AWS Systems Manager Incident Manager is no longer open to new customers. Existing customers can continue to use the service as normal. For more information, see AWS Systems Manager Incident Manager availability change.

Using migration runbooks for OpsCenter

This guide provides step-by-step instructions for migrating your Amazon CloudWatch alarms and Amazon EventBridge rules from AWS Systems Manager Incident Manager to AWS Systems Manager OpsCenter using automated migration runbooks.

For an overview of OpsCenter capabilities and to understand the differences between Incident Manager and OpsCenter, see Migrating to AWS Systems Manager OpsCenter.

Migration overview

The migration process uses Systems Manager Automation runbooks to integrate your existing CloudWatch alarms and EventBridge rules with OpsCenter. The process includes the following steps:

Step 1: Deploy the CloudFormation template

Deploy the CloudFormation template to create the IAM role, Amazon S3 bucket, and Amazon SNS topic required by the migration runbooks.

Required IAM permissions

To deploy this CloudFormation template, you need IAM permissions for CloudFormation stack operations (cloudformation:CreateStack, cloudformation:DescribeStacks), IAM role management (iam:CreateRole, iam:PutRolePolicy, iam:AttachRolePolicy, iam:PassRole), Amazon S3 bucket creation and configuration (s3:CreateBucket, s3:PutBucket*), and Amazon SNS topic operations (sns:CreateTopic, sns:Subscribe, sns:SetTopicAttributes).

For complete details on CloudFormation permissions, see CloudFormation permissions reference in the CloudFormation User Guide.

To deploy the CloudFormation template using the console

CloudFormation displays the CREATE_IN_PROGRESS status. The status changes to CREATE_COMPLETE when the stack is ready.

To deploy the CloudFormation template using the AWS CLI

For the first region in your account, use the following command:

aws cloudformation create-stack \
    --stack-name im-migration-infrastructure \
    --template-body file://AWS-IncidentManager-MigrationResources.yaml \
    --parameters ParameterKey=ApprovalEmail,ParameterValue=your-email@example.com \
    ParameterKey=IsPrimaryMigrationRegion,ParameterValue=true \
    --capabilities CAPABILITY_NAMED_IAM \
    --region us-east-1
      

For additional regions in the same account, set IsPrimaryMigrationRegion to false:

aws cloudformation create-stack \
    --stack-name im-migration-infrastructure \
    --template-body file://AWS-IncidentManager-MigrationResources.yaml \
    --parameters ParameterKey=ApprovalEmail,ParameterValue=your-email@example.com \
    ParameterKey=IsPrimaryMigrationRegion,ParameterValue=false \
    --capabilities CAPABILITY_NAMED_IAM \
    --region us-west-2
      

To verify the stack status:

aws cloudformation describe-stacks \
    --stack-name im-migration-infrastructure \
    --query 'Stacks[0].StackStatus' \
    --output text
      

Wait until the command returns CREATE_COMPLETE before proceeding to the next step.

Step 2: Migrate CloudWatch alarms and EventBridge rules

Use the Systems Manager Automation runbooks to migrate your CloudWatch alarms and EventBridge rules from Incident Manager to OpsCenter.

Migration runbooks

For more information about what these runbooks do, including detailed step descriptions, input parameters, and outputs, see the runbook documentation.

How the runbooks work

Both migration runbooks follow the same workflow:

Input parameters

Both runbooks require the following parameters:

To migrate using the console

To migrate using the AWS CLI

For CloudWatch alarms:

aws ssm start-automation-execution \
    --document-name "AWS-MigrateIncidentManagerCloudWatchAlarms" \
    --parameters '{
        "AutomationAssumeRole": ["arn:aws:iam::123456789012:role/IM-Migration-Automation-Role"],
        "ApproverArn": ["arn:aws:iam::123456789012:role/Admin"],
        "S3BucketName": ["im-migration-logs-123456789012-us-east-1"],
        "SNSTopicArn": ["arn:aws:sns:us-east-1:123456789012:Automation-IM-Migration-Approvals"],
        "RequireManualApproval": ["false"]
    }' \
    --region us-east-1
      

For EventBridge rules:

aws ssm start-automation-execution \
    --document-name "AWS-MigrateIncidentManagerEventBridgeRules" \
    --parameters '{
        "AutomationAssumeRole": ["arn:aws:iam::123456789012:role/IM-Migration-Automation-Role"],
        "ApproverArn": ["arn:aws:iam::123456789012:role/Admin"],
        "S3BucketName": ["im-migration-logs-123456789012-us-east-1"],
        "SNSTopicArn": ["arn:aws:sns:us-east-1:123456789012:Automation-IM-Migration-Approvals"],
        "RequireManualApproval": ["false"]
    }' \
    --region us-east-1
      

To review the resource list in Amazon S3:

# For CloudWatch alarms
aws s3 cp s3://im-migration-logs-123456789012-us-east-1/review/CloudWatch/review_CW_alarms_to_migrate_123456789012_us-east-1.json ./

# For EventBridge rules
aws s3 cp s3://im-migration-logs-123456789012-us-east-1/review/EventBridge/review_EB_rules_to_migrate_123456789012_us-east-1.json ./
      

If RequireManualApproval is set to true, review the resource list and approve the migration by clicking the approval link in the email notification or from the automation execution console page. If set to false, the migration proceeds automatically after backup.

Step 3: Verify your migration

After completing the migration, verify that your resources are functioning correctly:

Step 4: Clean up Incident Manager resources

After successfully migrating your CloudWatch alarms and EventBridge rules, you can optionally clean up Incident Manager resources to fully off-board from the service.

For detailed instructions on deleting the Replication Set, response plans, contacts, runbooks, and other Incident Manager resources, see Cleaning up Incident Manager Resources.

Delete CloudFormation stacks (optional)

You can delete the CloudFormation stacks to remove the IAM role, Amazon SNS topic, and Amazon S3 bucket created for the migration.

To delete the CloudFormation stack

aws cloudformation delete-stack --stack-name <your-stack-name>
      

Monitoring and troubleshooting

CloudWatch Logs - Migration activities are logged to CloudWatch Logs:

Amazon S3 backup structure - All configurations are backed up to Amazon S3 before migration:

migration-logs-{AccountId}-{Region}/
├── backups/
│   ├── CloudWatch/
│   │   └── {AccountId}/
│   │       └── {Region}/
│   │           └── {AlarmName}_backup.json
│   └── EventBridge/
│       └── {AccountId}/
│           └── {Region}/
│               └── {RuleName}_backup.json
└── review/
    ├── CloudWatch/
    │   └── review_CW_alarms_to_migrate_{AccountId}_{Region}.json
    └── EventBridge/
        └── review_EB_rules_to_migrate_{AccountId}_{Region}.json
    

Common issues:

Rollback procedure:

If you need to roll back the migration:

Frequently asked questions

Related resources