Question

A SysOps administrator is building an AWS Systems Manager Automation runbook that stops production EC2 instances, resizes them to a larger instance type, and restarts them during a scheduled change window. Company policy requires that a change manager explicitly authorize the resize before it proceeds, but all other steps must run without human interaction. How should the administrator implement this requirement within the Automation runbook?

Accepted Answer

Add an aws:approve action step before the resize step, specifying the IAM principals allowed to approve, so the runbook pauses until authorization is granted.

Answer

Split the runbook into two separate documents and rely on the change manager to manually start the second document.

Answer

Add an aws:pause action step and instruct the change manager to resume execution from the CloudWatch console.

Answer

Configure a Run Command step with an SNS notification and wait for the change manager to reply to the email before continuing.