A retailer with 800 EC2 instances suffers inconsistent patching and slow 2 a.m. incident triage that requires log collection, instance isolation, and scaling actions. Operations wants standardized automated responses with approvals and audit trails. Which automated runbook design standardizes patching and incident response with governance?
Select an answer to reveal the explanation.
Short Explanation
You'll sleep better when your 2 a.m. triage runs like a trusty recipe instead of guesswork. Automation runbooks fire off from EventBridge triggers to handle patching, isolation, and scaling, with approvals and Incident Manager keeping you governed and audit-ready.
Full Explanation
Systems Manager Automation documents define versioned runbooks for patch baselines, log gathering, isolation via security groups, and scaling actions, EventBridge rules trigger them on schedules or events, Patch Manager handles fleet compliance windows, and integration with Incident Manager adds engagement, approvals, and full audit history. Lambda cron jobs with emailed logs can execute commands but lack standardized approvals, fleet patch orchestration, idempotent remediation branching, and centralized audit, missing governance at 800-instance scale. Config rules with CloudWatch alarms provide detection and notification but still require manual remediation and do not orchestrate multi-step isolation or scaling workflows. CloudFormation drift redeploys enforce desired stack state but are disruptive for in-place OS patching, do not handle incident triage logic, and risk replacing data or interrupting traffic nightly. Exam caveat is to link Automation to Patch Manager and Incident Manager for closed-loop operations. Practical check is to run the runbook in audit mode on a canary fleet and review execution history before fleet-wide enforcement.