Question

A SysOps administrator manages resources across 12 AWS accounts organized under an AWS Organizations OU, spanning three Regions. They have built an AWS Systems Manager Automation runbook that stops non-production EC2 instances outside business hours. The administrator wants to execute this single runbook from a central management account so it runs against all target accounts and Regions in one operation, without manually assuming a role in each account. What is the MOST operationally efficient way to achieve this?

Accepted Answer

Use Systems Manager Automation with a multi-account and multi-Region execution, specifying the target accounts (or OU) and Regions along with an execution role and administrator role configured for cross-account access.

Answer

Copy the Automation runbook into each account and Region, then use EventBridge in each account to trigger it independently on a schedule.

Answer

Create a CloudFormation StackSet that provisions a Lambda function in every account to invoke the runbook locally through the SSM API.

Answer

Enable Systems Manager Run Command from the management account and target instances by tag across all accounts using resource groups.