• The AWS Systems Manager CloudWatch Dashboard will no longer be available after April 30, 2026. Customers can continue to use Amazon CloudWatch console to view, create, and manage their Amazon CloudWatch dashboards, just as they do today. For more information, see [Amazon CloudWatch Dashboard documentation](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch_Dashboards.html).
# Monitoring Systems Manager events with Amazon EventBridge
Amazon EventBridge is a serverless event bus service that allows you to connect your applications with data from a variety of sources. EventBridge delivers a stream of real-time data from your own applications, software-as-a-service (SaaS) applications, and AWS services and routes that data to targets such as AWS Lambda. You can set up routing rules to determine where to send your data to build application architectures that react in real time to all of your data sources. EventBridge allows you to build event driven architectures, which are loosely coupled and distributed.
EventBridge was formerly called Amazon CloudWatch Events. EventBridge includes new features that allow you to receive events from SaaS partners and your own applications. Existing CloudWatch Events users can access their existing default bus, rules, and events in the new EventBridge console and in the CloudWatch Events console. EventBridge uses the same CloudWatch Events API, so all of your existing CloudWatch Events API usage remains the same.
EventBridge can add events from dozens of AWS services to your rules, and targets from over 20 AWS services.
EventBridge provides support for both AWS Systems Manager events and Systems Manager targets.
**Supported Systems Manager event types**
Among the many types of Systems Manager events that EventBridge can detect are:
+ A just-in-time node access request status update for manual approvals.
+ A failed just-in-time node access request.
+ A maintenance window being turned off.
+ An Automation workflow completing successfully. Automation is a tool in AWS Systems Manager.
+ A managed node being out of patch compliance.
+ A parameter value being updated.
EventBridge supports events from the following AWS Systems Manager tools:
+ Just-in-time node access (Events are emitted on a best effort basis.)
+ Automation (Events are emitted on a best effort basis.)
+ Change Calendar (Events are emitted on a best effort basis.)
+ Compliance
+ Inventory (Events are emitted on a best effort basis.)
+ Maintenance Windows (Events are emitted on a best effort basis.)
+ Parameter Store (Events are emitted on a best effort basis.)
+ Run Command (Events are emitted on a best effort basis.)
+ State Manager (Events are emitted on a best effort basis.)
For complete details about supported Systems Manager event types, see [Reference: Amazon EventBridge event patterns and types for Systems Manager](reference-eventbridge-events.md) and [Amazon EventBridge event examples for Systems Manager](monitoring-systems-manager-event-examples.md).
**Supported Systems Manager target types**
EventBridge supports the following three Systems Manager tools as targets of an event rule:
+ Running an Automation workflow
+ Running a Run Command Command document (Events are emitted on a best effort basis.)
+ Creating an OpsCenter OpsItem
For suggested ways you might use these targets, see [Sample scenarios: Systems Manager targets in Amazon EventBridge rules](monitoring-systems-manager-targets.md).
For more information about how to get started with EventBridge and set up rules, see [Getting started with Amazon EventBridge](https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-get-started.html) in the *Amazon EventBridge User Guide*. For complete information about working with EventBridge, see the [https://docs.aws.amazon.com/eventbridge/latest/userguide/](https://docs.aws.amazon.com/eventbridge/latest/userguide/).
**Topics**
+ [Configuring EventBridge for Systems Manager events](monitoring-systems-manager-events.md)
+ [Amazon EventBridge event examples for Systems Manager](monitoring-systems-manager-event-examples.md)
+ [Sample scenarios: Systems Manager targets in Amazon EventBridge rules](monitoring-systems-manager-targets.md)
# Configuring EventBridge for Systems Manager events
You can use Amazon EventBridge to perform a target event when supported AWS Systems Manager status changes, state changes, or other conditions occur. You can create a rule that runs whenever there is a state or status transition, or when there is a transition to one or more states that are of interest.
The following procedure provides general steps for creating an EventBridge rule that engages when a specified event is emitted by Systems Manager. For a list of procedures in this user guide that address specific scenarios, see **More info** at the end of this topic.
**Note**
When a service in your AWS account emits an event, it always goes to your account’s default event bus. To write a rule that responds to events from AWS services in your account, associate it with the default event bus. You can create a rule on a custom event bus that looks for events from AWS services, but this rule only engages when you receive such an event from another account through cross-account event delivery. For more information, see [Sending and receiving Amazon EventBridge events between AWS accounts](https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-cross-account.html) in the *Amazon EventBridge User Guide*.
**To configure EventBridge for Systems Manager events**
1. Open the Amazon EventBridge console at [https://console.aws.amazon.com/events/](https://console.aws.amazon.com/events/).
1. In the navigation pane, choose **Rules**.
1. Choose **Create rule**.
1. Enter a name and description for the rule.
A rule can't have the same name as another rule in the same AWS Region and on the same event bus.
1. For **Event bus**, choose the event bus that you want to associate with this rule. If you want this rule to respond to matching events that come from your own AWS account, select **default**. When an AWS service in your account emits an event, it always goes to your account’s default event bus.
1. For **Rule type**, choose **Rule with an event pattern**.
1. Choose **Next**.
1. For **Event source**, choose **AWS events or EventBridge partner events**.
1. In the **Event pattern** section, choose **Event pattern form**.
1. For **Event source**, choose **AWS services**.
1. For **AWS service**, choose **Systems Manager**.
1. For **Event type**, do one of the following:
+ Choose **All Events**.
If you choose **All Events**, all events emitted by Systems Manager will match the rule. Be aware that this option can result in many event target actions.
+ Choose the type of Systems Manager event to use for this rule. EventBridge supports events from the following AWS Systems Manager tools:
+ Automation
+ Change Calendar
+ Compliance
+ Inventory
+ Maintenance Windows
+ Parameter Store
+ Run Command
+ State Manager
**Note**
For Systems Manager actions that aren't supported by EventBridge, you can choose an AWS API call through CloudTrail to create an event rule that is based on an API call, which are recorded by CloudTrail. For an example, see [Monitoring session activity using Amazon EventBridge (console)](session-manager-auditing.md#session-manager-auditing-eventbridge-events).
1. (Optional) To make the rule more specific, add filter values. For example, if you chose **State Manager** and want to limit the rule to the state of a single managed instance that is targeted by an Association, for **Specific type(s)**, choose **EC2 State Manager Instance Association State Change**.
For complete details about supported detail types, see [Reference: Amazon EventBridge event patterns and types for Systems Manager](reference-eventbridge-events.md).
Some detail types have other supported options such as status. The available options depend on the tool you selected.
1. Choose **Next**.
1. For **Target types**, choose **AWS service**.
1. For **Select a target**, choose a target such as an Amazon SNS topic or AWS Lambda function. The target is triggered when an event is received that matches the event pattern defined in the rule.
1. For many target types, EventBridge needs permissions to send events to the target. In these cases, EventBridge can create the AWS Identity and Access Management (IAM) role needed for your rule to run:
+ To create an IAM role automatically, choose **Create a new role for this specific resource**.
+ To use an IAM role that you created earlier, choose **Use existing role**.
1. (Optional) Choose **Add another target** to add another target for this rule.
1. Choose **Next**.
1. (Optional) Enter one or more tags for the rule. For more information, see [Amazon EventBridge tags](https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-tagging.html) in the *Amazon EventBridge User Guide*.
1. Choose **Next**.
1. Review the details of the rule and choose **Create rule**.
**More info**
+ [Creating an EventBridge event that uses a runbook (console)](running-automations-event-bridge.md#automation-cwe-target-console)
+ [Passing data to Automation using input transformers](automation-tutorial-eventbridge-input-transformers.md)
+ [Remediating compliance issues using EventBridge](compliance-fixing.md)
+ [Viewing inventory delete actions in EventBridge](inventory-custom.md#delete-custom-inventory-cwe)
+ [Configure EventBridge rules to create OpsItems](OpsCenter-automatically-create-OpsItems-2.md)
+ [Configuring EventBridge rules for parameters and parameter policies](sysman-paramstore-cwe.md#cwe-parameter-changes)
# Amazon EventBridge event examples for Systems Manager
The following are examples, in JSON format, of supported EventBridge events for AWS Systems Manager.
**Topics**
+ [AWS Systems Manager Automation Events](#SSM-Automation-event-types)
+ [AWS Systems Manager Change Calendar Events](#SSM-Change-Management-event-types)
+ [AWS Systems Manager Change Manager Events](#SSM-Change-Manager-event-types)
+ [AWS Systems Manager Compliance Events](#SSM-Configuration-Compliance-event-types)
+ [AWS Systems Manager Maintenance Windows Events](#EC2_maintenance_windows_event_types)
+ [AWS Systems Manager Parameter Store Events](#SSM-Parameter-Store-event-types)
+ [AWS Systems Manager OpsCenter Events](#SSM-OpsCenter-event-types)
+ [AWS Systems Manager Run Command Events](#SSM-Run-Command-event-types)
+ [AWS Systems Manager State Manager Events](#SSM-State-Manager-event-types)
## AWS Systems Manager Automation Events
**Automation Step Status-change Notification**
```
{
"version": "0",
"id": "eeca120b-a321-433e-9635-dab369006a6b",
"detail-type": "EC2 Automation Step Status-change Notification",
"source": "aws.ssm",
"account": "123456789012",
"time": "2024-11-29T19:43:35Z",
"region": "us-east-1",
"resources": ["arn:aws:ssm:us-east-2:123456789012:automation-execution/333ba70b-2333-48db-b17e-a5e69c6f4d1c",
"arn:aws:ssm:us-east-2:123456789012:automation-definition/runcommand1:1"],
"detail": {
"ExecutionId": "333ba70b-2333-48db-b17e-a5e69c6f4d1c",
"Definition": "runcommand1",
"DefinitionVersion": 1.0,
"Status": "Success",
"EndTime": "Nov 29, 2024 7:43:25 PM",
"StartTime": "Nov 29, 2024 7:43:23 PM",
"Time": 2630.0,
"StepName": "runFixedCmds",
"Action": "aws:runCommand"
}
}
```
**Automation Execution Status-change Notification**
```
{
"version": "0",
"id": "d290ece9-1088-4383-9df6-cd5b4ac42b99",
"detail-type": "EC2 Automation Execution Status-change Notification",
"source": "aws.ssm",
"account": "123456789012",
"time": "2024-11-29T19:43:35Z",
"region": "us-east-2",
"resources": ["arn:aws:ssm:us-east-2:123456789012:automation-execution/333ba70b-2333-48db-b17e-a5e69c6f4d1c",
"arn:aws:ssm:us-east-2:123456789012:automation-definition/runcommand1:1"],
"detail": {
"ExecutionId": "333ba70b-2333-48db-b17e-a5e69c6f4d1c",
"Definition": "runcommand1",
"DefinitionVersion": 1.0,
"Status": "Success",
"StartTime": "Nov 29, 2024 7:43:20 PM",
"EndTime": "Nov 29, 2024 7:43:26 PM",
"Time": 5753.0,
"ExecutedBy": "arn:aws:iam::123456789012:user/userName"
}
}
```
## AWS Systems Manager Change Calendar Events
Use the information in this topic to plan and understand the behavior of EventBridge events for AWS Systems Manager Change Calendar.
**Note**
State changes for calendars shared from other AWS accounts are not currently supported.
### Change Calendar integration with Amazon EventBridge
AWS Systems Manager Change Calendar integrates with Amazon EventBridge to notify you of calendar state changes. Be aware of the following behaviors related to the underlying scheduling architecture:
Event timing and reliability
+ EventBridge delivers notifications on a best-effort basis with up to a 15-minute scheduling tolerance.
+ State change events reflect overall calendar status transitions, not individual calendar events.
+ When multiple calendar events occur simultaneously, EventBridge generates only one event per actual calendar state change.
+ EventBridge triggers events only when the calendar's overall state transitions (for example, from CLOSED to OPEN), not for individual calendar events that don't result in a state change.
+ Advisory events that don't modify the calendar state don't trigger EventBridge notifications.
Event modifications and timing considerations
+ If you modify calendar events within 15 minutes of their scheduled start or end time, EventBridge might generate duplicate notifications or miss notifications.
+ This behavior occurs because the scheduling system might not have sufficient time to properly update or cancel previously scheduled notifications.
+ For recurring events, this behavior typically affects only the first occurrence after modification.
Adjacent and overlapping events
+ When calendar events are scheduled within 5 minutes of each other, state transition events might or might not occur, depending on the actual state change.
+ Creating overlapping events in certain orders might generate additional EventBridge events even when no actual state change occurs.
+ To ensure predictable behavior, avoid creating or modifying calendar events close to their execution times.
Best practices
+ Design your EventBridge rules and downstream automation to handle potential duplicate events.
+ Implement idempotency in your automation workflows to prevent issues from duplicate notifications.
+ Allow sufficient lead time (at least 15 minutes) when you create or modify calendar events.
+ Test your EventBridge integrations thoroughly with your specific calendar event patterns.
**Calendar OPEN**
```
{
"version": "0",
"id": "47a3f03a-f30d-1011-ac9a-du3bdEXAMPLE",
"detail-type": "Calendar State Change",
"source": "aws.ssm",
"account": "123456789012",
"time": "2024-09-19T18:00:07Z",
"region": "us-east-2",
"resources": [
"arn:aws:ssm:us-east-2:123456789012:document/MyCalendar"
],
"detail": {
"state": "OPEN",
"atTime": "2024-09-19T18:00:07Z",
"nextTransitionTime": "2024-10-11T18:00:07Z"
}
}
```
**Calendar CLOSED**
```
{
"version": "0",
"id": "f30df03a-1011-ac9a-47a3-f761eEXAMPLE",
"detail-type": "Calendar State Change",
"source": "aws.ssm",
"account": "123456789012",
"time": "2024-09-17T21:40:02Z",
"region": "us-east-2",
"resources": [
"arn:aws:ssm:us-east-2:123456789012:document/MyCalendar"
],
"detail": {
"state": "CLOSED",
"atTime": "2024-08-17T21:40:00Z",
"nextTransitionTime": "2024-09-19T18:00:07Z"
}
}
```
## AWS Systems Manager Change Manager Events
**Change request status update notification - example 1**
```
{
"version": "0",
"id": "feab80c1-a8ff-c721-b8b1-96ce70939696",
"detail-type": "Change Request Status Update",
"source": "aws.ssm",
"account": "123456789012",
"time": "2024-10-24T10:51:52Z",
"region": "us-east-1",
"resources": [
"arn:aws:ssm:us-west-2:123456789012:opsitem/oi-12345abcdef",
"arn:aws:ssm:us-west-2:123456789012:document/MyRunbook1"
],
"detail": {
"change-request-id": "d0585556-80f6-4522-8dad-dada6d45b67d",
"change-request-title": "A change request title",
"ops-item-id": "oi-12345abcdef",
"ops-item-created-by": "arn:aws:iam::123456789012:user/JohnDoe",
"ops-item-created-time": "2024-10-24T10:50:33.180334Z",
"ops-item-modified-by": "arn:aws:iam::123456789012:user/JohnDoe",
"ops-item-modified-time": "2024-10-24T10:50:33.180340Z",
"ops-item-status": "InProgress",
"change-template-document-name": "MyChangeTemplate",
"runbook-document-arn": "arn:aws:ssm:us-west-2:123456789012:document/MyRunbook1",
"runbook-document-version": "1",
"auto-approve": true,
"approvers": [
"arn:aws:iam::123456789012:user/JaneDoe"
]
}
}
```
**Change request status update notification - example 2**
```
{
"version": "0",
"id": "25ce6b03-2e4e-1a2b-2a8f-6c9de8d278d2",
"detail-type": "Change Request Status Update",
"source": "aws.ssm",
"account": "123456789012",
"time": "2024-10-24T10:51:52Z",
"region": "us-east-1",
"resources": [
"arn:aws:ssm:us-west-2:123456789012:opsitem/oi-abcdef12345",
"arn:aws:ssm:us-west-2:123456789012:document/MyRunbook1"
],
"detail": {
"change-request-id": "d0585556-80f6-4522-8dad-dada6d45b67d",
"change-request-title": "A change request title",
"ops-item-id": "oi-abcdef12345",
"ops-item-created-by": "arn:aws:iam::123456789012:user/JohnDoe",
"ops-item-created-time": "2024-10-24T10:50:33.180334Z",
"ops-item-modified-by": "arn:aws:iam::123456789012:user/JohnDoe",
"ops-item-modified-time": "2024-10-24T10:50:33.997163Z",
"ops-item-status": "Rejected",
"change-template-document-name": "MyChangeTemplate",
"runbook-document-arn": "arn:aws:ssm:us-west-2:123456789012:document/MyRunbook1",
"runbook-document-version": "1",
"auto-approve": true,
"approvers": [
"arn:aws:iam::123456789012:user/JaneDoe"
]
}
}
```
## AWS Systems Manager Compliance Events
The following are examples of the events for AWS Systems Manager Compliance.
**Association Compliant**
```
{
"version": "0",
"id": "01234567-0123-0123-0123-012345678901",
"detail-type": "Configuration Compliance State Change",
"source": "aws.ssm",
"account": "123456789012",
"time": "2024-07-17T19:03:26Z",
"region": "us-east-2",
"resources": [
"arn:aws:ssm:us-east-2:123456789012:managed-instance/i-01234567890abcdef"
],
"detail": {
"last-runtime": "2024-01-01T10:10:10Z",
"compliance-status": "compliant",
"resource-type": "managed-instance",
"resource-id": "i-01234567890abcdef",
"compliance-type": "Association"
}
}
```
**Association Non-Compliant**
```
{
"version": "0",
"id": "01234567-0123-0123-0123-012345678901",
"detail-type": "Configuration Compliance State Change",
"source": "aws.ssm",
"account": "123456789012",
"time": "2024-07-17T19:02:31Z",
"region": "us-east-2",
"resources": [
"arn:aws:ssm:us-east-2:123456789012:managed-instance/i-01234567890abcdef"
],
"detail": {
"last-runtime": "2024-01-01T10:10:10Z",
"compliance-status": "non_compliant",
"resource-type": "managed-instance",
"resource-id": "i-01234567890abcdef",
"compliance-type": "Association"
}
}
```
**Patch Compliant**
```
{
"version": "0",
"id": "01234567-0123-0123-0123-012345678901",
"detail-type": "Configuration Compliance State Change",
"source": "aws.123456789012",
"account": "123456789012",
"time": "2024-07-17T19:03:26Z",
"region": "us-east-2",
"resources": [
"arn:aws:ssm:us-east-2:123456789012:managed-instance/i-01234567890abcdef"
],
"detail": {
"resource-type": "managed-instance",
"resource-id": "i-01234567890abcdef",
"compliance-status": "compliant",
"compliance-type": "Patch",
"patch-baseline-id": "PB789",
"severity": "critical"
}
}
```
**Patch Non-Compliant**
```
{
"version": "0",
"id": "01234567-0123-0123-0123-012345678901",
"detail-type": "Configuration Compliance State Change",
"source": "aws.ssm",
"account": "123456789012",
"time": "2024-07-17T19:02:31Z",
"region": "us-east-2",
"resources": [
"arn:aws:ssm:us-east-2:123456789012:managed-instance/i-01234567890abcdef"
],
"detail": {
"resource-type": "managed-instance",
"resource-id": "i-01234567890abcdef",
"compliance-status": "non_compliant",
"compliance-type": "Patch",
"patch-baseline-id": "PB789",
"severity": "critical"
}
}
```
## AWS Systems Manager Maintenance Windows Events
The following are examples of the events for Systems Manager Maintenance Windows.
**Register a Target**
Valid status values include `REGISTERED` and `DEREGISTERED`.
```
{
"version":"0",
"id":"01234567-0123-0123-0123-0123456789ab",
"detail-type":"Maintenance Window Target Registration Notification",
"source":"aws.ssm",
"account":"123456789012",
"time":"2024-11-16T00:58:37Z",
"region":"us-east-2",
"resources":[
"arn:aws:ssm:us-east-2:123456789012:maintenancewindow/mw-0ed7251d3fcf6e0c2",
"arn:aws:ssm:us-east-2:123456789012:windowtarget/e7265f13-3cc5-4f2f-97a9-7d3ca86c32a6"
],
"detail":{
"window-target-id":"e7265f13-3cc5-4f2f-97a9-7d3ca86c32a6",
"window-id":"mw-0ed7251d3fcf6e0c2",
"status":"REGISTERED"
}
}
```
**Window Execution Type**
Valid status values include the following:
+ `CANCELLED`
+ `CANCELLING`
+ `FAILED`
+ `IN_PROGRESS`
+ `PENDING`
+ `SKIPPED_OVERLAPPING`
+ `SUCCESS TIMED_OUT`
```
{
"version":"0",
"id":"01234567-0123-0123-0123-0123456789ab",
"detail-type":"Maintenance Window Execution State-change Notification",
"source":"aws.ssm",
"account":"123456789012",
"time":"2025-06-02T14:52:18Z",
"region":"us-east-2",
"resources":[
"arn:aws:ssm:us-east-2:123456789012:maintenancewindow/mw-0c50858d01EXAMPLE"
],
"detail":{
"start-time":"2025-06-02T14:48:28.039273Z",
"end-time":"2025-06-02T14:52:18.083773Z",
"window-id":"mw-0ed7251d3fcf6e0c2",
"window-execution-id":"14bea65d-5ccc-462d-a2f3-e99c8EXAMPLE",
"status":"SUCCESS"
}
}
```
**Task Execution Type**
Valid status values include `IN_PROGRESS`, `SUCCESS`, `FAILED`, and `TIMED_OUT`.
```
{
"version":"0",
"id":"01234567-0123-0123-0123-0123456789ab",
"detail-type":"Maintenance Window Task Execution State-change Notification",
"source":"aws.ssm",
"account":"123456789012",
"time":"2025-06-02T14:52:18Z",
"region":"us-east-2",
"resources":[
"arn:aws:ssm:us-east-2:123456789012:maintenancewindow/mw-0c50858d01EXAMPLE"
],
"detail":{
"start-time":"2025-06-02T14:48:28.039273Z",
"task-execution-id":"6417e808-7f35-4d1a-843f-123456789012",
"end-time":"2025-06-02T14:52:18.083773Z",
"window-id":"mw-0ed7251d3fcf6e0c2",
"window-execution-id":"14bea65d-5ccc-462d-a2f3-e99c8EXAMPLE",
"status":"SUCCESS"
}
}
```
**Task Target Processed**
Valid status values include `IN_PROGRESS`, `SUCCESS`, `FAILED`, and `TIMED_OUT`.
```
{
"version":"0",
"id":"01234567-0123-0123-0123-0123456789ab",
"detail-type":"Maintenance Window Task Target Invocation State-change Notification",
"source":"aws.ssm",
"account":"123456789012",
"time":"2025-06-02T14:52:18Z",
"region":"us-east-2",
"resources":[
"arn:aws:ssm:us-east-2:123456789012:maintenancewindow/mw-123456789012345678"
],
"detail":{
"start-time":"2025-06-02T14:48:28.039273Z",
"end-time":"2025-06-02T14:52:18.083773Z",
"window-id":"mw-0ed7251d3fcf6e0c2",
"window-execution-id":"791b72e0-f0da-4021-8b35-f95dfEXAMPLE",
"task-execution-id":"c9b05aba-197f-4d8d-be34-e73fbEXAMPLE",
"window-target-id":"e32eecb2-646c-4f4b-8ed1-205fbEXAMPLE",
"status":"SUCCESS",
"owner-information":"Owner"
}
}
```
**Window State Change**
Valid status values include `ENABLED` and `DISABLED`.
```
{
"version":"0",
"id":"01234567-0123-0123-0123-0123456789ab",
"detail-type":"Maintenance Window State-change Notification",
"source":"aws.ssm",
"account":"123456789012",
"time":"2024-11-16T00:58:37Z",
"region":"us-east-2",
"resources":[
"arn:aws:ssm:us-east-2:123456789012:maintenancewindow/mw-0c50858d01EXAMPLE"
],
"detail":{
"window-id":"mw-0c50858d01EXAMPLE",
"status":"DISABLED"
}
}
```
## AWS Systems Manager Parameter Store Events
The following are examples of the events for Systems Manager Parameter Store.
**Create Parameter**
```
{
"version": "0",
"id": "6a7e4feb-b491-4cf7-a9f1-bf3703497718",
"detail-type": "Parameter Store Change",
"source": "aws.ssm",
"account": "123456789012",
"time": "2024-05-22T16:43:48Z",
"region": "us-east-2",
"resources": [
"arn:aws:ssm:us-east-2:123456789012:parameter/MyExampleParameter"
],
"detail": {
"operation": "Create",
"name": "MyExampleParameter",
"type": "String",
"description": "Sample Parameter"
}
}
```
**Update Parameter**
```
{
"version": "0",
"id": "9547ef2d-3b7e-4057-b6cb-5fdf09ee7c8f",
"detail-type": "Parameter Store Change",
"source": "aws.ssm",
"account": "123456789012",
"time": "2024-05-22T16:44:48Z",
"region": "us-east-2",
"resources": [
"arn:aws:ssm:us-east-2:123456789012:parameter/MyExampleParameter"
],
"detail": {
"operation": "Update",
"name": "MyExampleParameter",
"type": "String",
"description": "Sample Parameter"
}
}
```
**Delete Parameter**
```
{
"version": "0",
"id": "80e9b391-6a9b-413c-839a-453b528053af",
"detail-type": "Parameter Store Change",
"source": "aws.ssm",
"account": "123456789012",
"time": "2024-05-22T16:45:48Z",
"region": "us-east-2",
"resources": [
"arn:aws:ssm:us-east-2:123456789012:parameter/MyExampleParameter"
],
"detail": {
"operation": "Delete",
"name": "MyExampleParameter",
"type": "String",
"description": "Sample Parameter"
}
}
```
## AWS Systems Manager OpsCenter Events
**OpsCenter OpsItem create notification**
```
{
"version": "0",
"id": "aae66adc-7aac-f0c0-7854-7691e8c079b8",
"detail-type": "OpsItem Create",
"source": "aws.ssm",
"account": "123456789012",
"time": "2024-10-19T02:48:11Z",
"region": "us-east-1",
"resources": [
"arn:aws:ssm:us-west-2:123456789012:opsitem/oi-123456abcdef"
],
"detail": {
"created-by": "arn:aws:iam::123456789012:user/JohnDoe",
"created-time": "2024-10-19T02:46:53.629361Z",
"source": "aws.ssm",
"status": "Open",
"ops-item-id": "oi-123456abcdef",
"title": "An issue title",
"ops-item-type": "/aws/issue",
"description": "A long description may appear here"
}
}
```
**OpsCenter OpsItem update notification**
```
{
"version": "0",
"id": "2fb5b168-b725-41dd-a890-29311200089c",
"detail-type": "OpsItem Update",
"source": "aws.ssm",
"account": "123456789012",
"time": "2024-10-19T02:48:11Z",
"region": "us-east-1",
"resources": [
"arn:aws:ssm:us-west-2:123456789012:opsitem/oi-123456abcdef"
],
"detail": {
"created-by": "arn:aws:iam::123456789012:user/JohnDoe",
"created-time": "2024-10-19T02:46:54.049271Z",
"modified-by": "arn:aws:iam::123456789012:user/JohnDoe",
"modified-time": "2024-10-19T02:46:54.337354Z",
"source": "aws.ssm",
"status": "Open",
"ops-item-id": "oi-123456abcdef",
"title": "An issue title",
"ops-item-type": "/aws/issue",
"description": "A long description may appear here"
}
}
```
## AWS Systems Manager Run Command Events
**Run Command Status-change Notification**
```
{
"version": "0",
"id": "51c0891d-0e34-45b1-83d6-95db273d1602",
"detail-type": "EC2 Command Status-change Notification",
"source": "aws.ssm",
"account": "123456789012",
"time": "2024-07-10T21:51:32Z",
"region": "us-east-2",
"resources": ["arn:aws:ec2:us-east-2:123456789012:instance/i-02573cafcfEXAMPLE"],
"detail": {
"command-id": "e8d3c0e4-71f7-4491-898f-c9b35bee5f3b",
"document-name": "AWS-RunPowerShellScript",
"expire-after": "2024-07-14T22:01:30.049Z",
"parameters": {
"executionTimeout": ["3600"],
"commands": ["date"]
},
"requested-date-time": "2024-07-10T21:51:30.049Z",
"status": "Success"
}
}
```
**Run Command Invocation Status-change Notification**
```
{
"version": "0",
"id": "4780e1b8-f56b-4de5-95f2-95dbEXAMPLE",
"detail-type": "EC2 Command Invocation Status-change Notification",
"source": "aws.ssm",
"account": "123456789012",
"time": "2024-07-10T21:51:32Z",
"region": "us-east-2",
"resources": ["arn:aws:ec2:us-east-2:123456789012:instance/i-02573cafcfEXAMPLE"],
"detail": {
"command-id": "e8d3c0e4-71f7-4491-898f-c9b35bee5f3b",
"document-name": "AWS-RunPowerShellScript",
"instance-id": "i-02573cafcfEXAMPLE",
"requested-date-time": "2024-07-10T21:51:30.049Z",
"status": "Success"
}
}
```
## AWS Systems Manager State Manager Events
**State Manager Association State Change**
```
{
"version":"0",
"id":"db839caf-6f6c-40af-9a48-25b2ae2b7774",
"detail-type":"EC2 State Manager Association State Change",
"source":"aws.ssm",
"account":"123456789012",
"time":"2024-05-16T23:01:10Z",
"region":"us-east-2",
"resources":[
"arn:aws:ssm:us-east-2::document/AWS-RunPowerShellScript"
],
"detail":{
"association-id":"6e37940a-23ba-4ab0-9b96-5d0a1a05464f",
"document-name":"AWS-RunPowerShellScript",
"association-version":"1",
"document-version":"Optional.empty",
"targets":"[{\"key\":\"InstanceIds\",\"values\":[\"i-12345678\"]}]",
"creation-date":"2024-02-13T17:22:54.458Z",
"last-successful-execution-date":"2024-05-16T23:00:01Z",
"last-execution-date":"2024-05-16T23:00:01Z",
"last-updated-date":"2024-02-13T17:22:54.458Z",
"status":"Success",
"association-status-aggregated-count":"{\"Success\":1}",
"schedule-expression":"cron(0 */30 * * * ? *)",
"association-cwe-version":"1.0"
}
}
```
**State Manager Instance Association State Change**
```
{
"version":"0",
"id":"6a7e8feb-b491-4cf7-a9f1-bf3703467718",
"detail-type":"EC2 State Manager Instance Association State Change",
"source":"aws.ssm",
"account":"123456789012",
"time":"2024-02-23T15:23:48Z",
"region":"us-east-2",
"resources":[
"arn:aws:ec2:us-east-2:123456789012:instance/i-12345678",
"arn:aws:ssm:us-east-2:123456789012:document/my-custom-document"
],
"detail":{
"association-id":"34fcb7e0-9a14-4984-9989-0e04e3f60bd8",
"instance-id":"i-02573cafcfEXAMPLE",
"document-name":"my-custom-document",
"document-version":"1",
"targets":"[{\"key\":\"instanceids\",\"values\":[\"i-02573cafcfEXAMPLE\"]}]",
"creation-date":"2024-02-23T15:23:48Z",
"last-successful-execution-date":"2024-02-23T16:23:48Z",
"last-execution-date":"2024-02-23T16:23:48Z",
"status":"Success",
"detailed-status":"",
"error-code":"testErrorCode",
"execution-summary":"testExecutionSummary",
"output-url":"sampleurl",
"instance-association-cwe-version":"1"
}
}
```
# Sample scenarios: Systems Manager targets in Amazon EventBridge rules
When you specify the target to invoke in an Amazon EventBridge rule, you can choose from over 20 target types and add up to five targets to each rule.
Of the various targets, you can choose from Automation, OpsCenter, and Run Command, which are tools in AWS Systems Manager, as target actions when an EventBridge event occurs.
The following are several examples of ways you can use these tools as the target of an EventBridge rule.
**Automation examples**
You can configure an EventBridge rule to start Automation workflows when events such as the following occur:
+ When an Amazon CloudWatch alarm reports that a managed node has failed a status check (`StatusCheckFailed_Instance=1`), run the `AWSSupport-ExecuteEC2Rescue` Automation runbook on the node.
+ When an `EC2 Instance State-change Notification` event occurs because a new Amazon Elastic Compute Cloud (Amazon EC2) instance is running, run the `AWS-AttachEBSVolume` Automation runbook on the instance.
+ When an Amazon Elastic Block Store (Amazon EBS) volume is created and available, run the `AWS-CreateSnapshot` Automation runbook on the volume.
**OpsCenter examples**
You can configure an EventBridge rule to create a new OpsItem when incidents such as the following occur:
+ A throttling event for Amazon DynamoDB occurs, or Amazon EBS volume performance has degraded.
+ An Amazon EC2 Auto Scaling group fails to launch a node, or a Systems Manager Automation workflow fails.
+ An EC2 instance changes state from `Running` to `Stopped`.
**Run Command examples**
You can configure an EventBridge rule to run a Systems Manager Command document in Run Command when events such as the following occur:
+ When an Auto Scaling group is about to end, a Run Command script could capture the log files from the node before it is ended.
+ When a new node is created in an Auto Scaling group, a Run Command target action could turn on the web server role or install software on the node.
+ When a managed node is found to be out of compliance, a Run Command target action could update patches on the node by running the `AWS-RunPatchBaseline` document.