Flash card
AWS Systems Manager Automation: documented, parameterised runbooks that execute operational tasks against AWS resources.
- Automation documents are multi-step runbooks with parameters, branching, and approval steps, executed by the service rather than by an operator.
- AWS publishes a large library of
AWS-prefixed runbooks for common tasks, so a lot of remediation needs configuration rather than authoring. - Can be triggered on a schedule, from an EventBridge rule, or as the remediation action attached to an AWS Config rule.
- Runs under an IAM role you specify, and every execution is recorded, so an operational change has an audit trail by construction.
- Rate control and error thresholds let a runbook roll across a fleet in batches and stop when failures exceed a limit.
Pick it when
Pick it over a Lambda function when the task is operating AWS resources and the sequence is known: you get approvals, rate control and an execution history without writing them. Pick it over Run Command when the work is a multi-step orchestration rather than a single command on instances.
It's the wrong answer when
It is the wrong answer for application logic, for anything needing sub-second reaction, and for work not shaped like operating infrastructure. A scenario about transforming an event payload is Lambda; a scenario about one shell command across a fleet is Run Command.