When a new configuration object is written to a specific S3 bucket, a reviewed Systems Manager Automation runbook should run against a tagged fleet. Operators currently reboot every instance in the Region. What should start the runbook?
Select an answer to reveal the explanation.
Short Explanation
A new note in the inbox should start the checklist, not a fire drill for the whole building. An EventBridge rule on the object-created event can start your Systems Manager Automation runbook against the tagged fleet when that config object lands. Rebooting every instance in the Region does not apply the runbook and hits machines the change was never aimed at.
Full Explanation
The config object landing in S3 is the event that should start work. With the bucket sending events to EventBridge, a rule that matches that object-created event can start the reviewed Systems Manager Automation runbook and limit it to the tagged fleet. The runbook is what applies the config. A scheduled reboot of every instance in the Region runs whether or not the object changed, and a reboot is not the runbook. An S3 Inventory report is a later catalog of the bucket. It does not fire when the object is created, and rebooting the Region from that report has the same wrong blast radius. A State Manager association that reboots every instance on each apply also ignores the new object and touches the whole Region instead of the tagged fleet. Caveat: the bucket has to be set to send events to EventBridge, and the rule's pattern should name this bucket so other objects do not start the runbook. Operational check: upload a test config object and confirm one Automation execution starts against the tagged instances only.