An existing 311 stack pages operators for every noisy metric spike and lacks automatic healing. Which operational improvement best raises excellence?

Operational excellence on an existing 311 stack improves when alarms express actionable health—not every noisy spike—and known remediations run automatically. CloudWatch composite alarms combine related signals into conditions operators can trust, while Systems Manager Automation runbooks execute approved fixes for disk-full, process-restart, and similar well-understood failures. That pairing raises excellence because it reduces toil, shortens MTTR, and keeps humans for novel incidents instead of repetitive wrench-turning. Removing all alarms so on-call never hears about production fails conceptually: silence is not excellence—it merely delays detection of citizen-impacting outages. Keeping only raw per-datapoint emails with no correlation and no automated response documents fails by flooding operators without a remediation path. Requiring manual SSH as the sole remediation path with no SSM Automation fails as chronic toil and expands privileged interactive access during incidents. Exam caveat: automate only approved, idempotent remediations; composite alarms that mask real Sev-1s or runbooks that mutate state unsafely create new risk—review automation blast radius. Operational check: convert the top three noisy 311 alarms into composite conditions, attach an SSM Automation document with a dry-run or nonprod test, measure pages-per-week and MTTR before/after, and document ownership of each runbook.