What's changed: Deepened SOA-C02 Chapter 1 to Associate depth (tables, scenarios, FAQ, traps; localized figures)
1.3Automated Remediation (EventBridge and Systems Manager)
Understand event routing with EventBridge, automated remediation with Systems Manager Automation (runbooks), and Systems Manager ops features (patch management, Run Command, Parameter Store).
When you detect an issue, automating the response reduces toil—an ops best practice. EventBridge + Systems Manager Automation is the classic combo.
1.3.1The remediation flow
- EventBridge: routes events by rules (e.g., from CloudWatch alarms or AWS Config) to remediation.
- Systems Manager Automation: runs runbooks to auto-restart, patch, fix config, etc.
- Systems Manager ops: Patch Manager (patching), Run Command (run commands at scale), Parameter Store (config/secrets).
Common on SOA: auto-remediate on detection = EventBridge → SSM Automation (runbooks), run commands across many instances = Run Command, standardize patching = Patch Manager. Prefer operating via SSM rather than SSH.
Ops automation follows "detect → route → execute." EventBridge matches CloudWatch alarms, AWS Config non-compliance, service events, and schedules (cron) via event rules and routes to targets (SSM Automation, Lambda, SNS, Step Functions, etc.). The actual fix is performed by an Systems Manager Automation runbook (predefined or custom procedures) that reboots, patches, or fixes config unattended. SSM ops features are also frequently tested: Run Command (run commands across many instances without SSH), Patch Manager (standardize patching via patch baselines and maintenance windows), State Manager (maintain desired state), Session Manager (auditable shell access without opening ports), and Parameter Store (config and SecureString secrets). These run via the SSM agent plus a proper IAM role (instance profile), so you operate without opening SSH/RDP—preferred for security. Calling a runbook directly from AWS Config remediation is a common exam setup too.
| Goal | Use |
|---|---|
| Auto-remediate on detection | EventBridge → SSM Automation |
| Run commands at scale | Run Command |
| Standardize patching | Patch Manager |
| Shell access without open ports | Session Manager |
Scenario: auto-fix when an unencrypted EBS volume appears. An AWS Config rule flags non-compliance → EventBridge (or Config remediation) launches an SSM Automation runbook to remediate, tag, and notify unattended. Operate instances via Session Manager / Run Command without opening SSH.
Q. Auto-remediate on detection? EventBridge → SSM Automation (runbooks). Q. Operate without SSH? Session Manager / Run Command (SSM agent + IAM role). Q. Standardize patching? Patch Manager. Q. Store config/secrets? Parameter Store.
Watch the mix-ups: (1) When SSM "can’t see" an instance, the usual cause is a missing SSM agent or missing IAM role (instance profile). (2) EventBridge routes; runbooks execute—don’t swap roles. (3) Session Manager needs no inbound ports and can log actions to CloudTrail/logs.
Using SSM requires the SSM agent and a proper IAM role on instances, enabling secure operations without opening SSH.
1.3.2Section summary
- Auto-remediation = EventBridge → SSM Automation (runbooks)
- Operate with Run Command / Patch Manager / Parameter Store
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. You want to auto-run remediation (e.g., restart) triggered by an event. Which combo fits best?
Q2. You want to run a command across many EC2 instances without opening SSH. What do you use?
Q3. You want to standardize and automate OS patching. Which Systems Manager feature?