AWS Systems Manager
User Guide



The AWSSupport-SendLogBundleToS3Bucket Automation document uploads a log bundle generated by the EC2Rescue tool from the target instance to the specified S3 bucket. The automation execution installs the platform specific version of EC2Rescue based on the platform of the target instance. EC2Rescue is then used to collect all the available operating system (OS) logs.

Document Type





Windows, Linux


  • InstanceId

    Type: String

    Description: (Required) The ID of the Windows or Linux managed instance you want to collect logs from.

  • S3BucketName

    Type: String

    Description: (Required) S3 bucket to upload the logs to.

  • S3Path

    Type: String

    Default: AWSSupport-SendLogBundleToS3Bucket/

    Description: (Optional) S3 path for the collected logs.

  • AutomationAssumeRole

    Type: String

    Description: (Optional) The IAM role for this execution. If no role is specified, AWS Systems Manager Automation will use the permissions of the user that runs this document.


Collect logs from INSTANCEID and upload them to S3 Bucket mybucket

aws ssm start-automation-execution --document-name AWSSupport-SendLogBundleToS3Bucket --parameters "InstanceId=INSTANCEID, S3BucketName=mybucket"

Retrieve the execution output

aws ssm get-automation-execution --automation-execution-id EXECUTIONID --output text --query 'AutomationExecution.Output'

Required IAM Permissions

It is recommended that the EC2 instance receiving the command has an IAM role with the AmazonSSMManagedInstanceCore Amazon managed policy attached. The user must have at least ssm:ExecuteAutomation and ssm:SendCommand to run the automation and send the command to the instance, plus ssm:GetAutomationExecution to be able to read the automation output.

Document Steps

  1. aws:runCommand - Install EC2Rescue via AWS-ConfigureAWSPackage.

  2. aws:runCommand - Run the PowerShell script to collect Windows troubleshooting logs with EC2Rescue.

  3. aws:runCommand - Run the bash script to collect Linux troubleshooting logs with EC2Rescue.