Run an automation that requires approvals
The following procedures describe how to use the AWS Systems Manager console and AWS Command Line Interface
(AWS CLI) to run an automation with approvals using simple execution. The automation uses
the automation action aws:approve, which temporarily pauses the automation
until the designated principals either approve or deny the action. The automation runs
in the context of the current user. This means that you don't need to configure
additional IAM permissions as long as you have permission to use the runbook, and any
actions called by the runbook. If you have administrator permissions in IAM, then you
already have permission to use this runbook.
Before you begin
In addition to the standard inputs required by the runbook, the
aws:approve action requires the following two parameters:
-
A list of approvers. The list of approvers must contain at least one approver in the form of a user name or a user ARN. If multiple approvers are provided, a corresponding minimum approval count must also be specified within the runbook.
-
An Amazon Simple Notification Service (Amazon SNS) topic ARN. The Amazon SNS topic name must start with
Automation.
This procedure assumes that you have already created an Amazon SNS topic, which is required to deliver the approval request. For information, see Create a Topic in the Amazon Simple Notification Service Developer Guide.
Running an automation with approvers (console)
To run an automation with approvers
The following procedure describes how to use the Systems Manager console to run an automation with approvers.
Open the AWS Systems Manager console at https://console.aws.amazon.com/systems-manager/
. -
In the navigation pane, choose Automation, and then choose Execute automation.
-
In the Automation document list, choose a runbook. Choose one or more options in the Document categories pane to filter SSM documents according to their purpose. To view a runbook that you own, choose the Owned by me tab. To view a runbook that is shared with your account, choose the Shared with me tab. To view all runbooks, choose the All documents tab.
Note
You can view information about a runbook by choosing the runbook name.
-
In the Document details section, verify that Document version is set to the version that you want to run. The system includes the following version options:
-
Default version at runtime – Choose this option if the Automation runbook is updated periodically and a new default version is assigned.
-
Latest version at runtime – Choose this option if the Automation runbook is updated periodically, and you want to run the version that was most recently updated.
-
1 (Default) – Choose this option to run the first version of the document, which is the default.
-
-
Choose Next.
-
On the Execute automation document page, choose Simple execution.
-
In the Input parameters section, specify the required input parameters.
For example, if you chose the
AWS-StartEC2InstanceWithApprovalrunbook, then you must specify or choose instance IDs for the InstanceId parameter. -
In the Approvers section, specify the user names or user ARNs of approvers for the automation action.
-
In the SNSTopicARN section, specify the SNS topic ARN to use for sending approval notification. The SNS topic name must start with Automation.
-
Optionally, you can choose an IAM service role from the AutomationAssumeRole list. If you're targeting more than 100 accounts and Regions, you must specify the
AWS-SystemsManager-AutomationAdministrationRole. -
Choose Execute automation.
The specified approver receives an Amazon SNS notification with details to approve or reject the automation. This approval action is valid for 7 days from the date of issue and can be issued using the Systems Manager console or the AWS Command Line Interface (AWS CLI).
If you chose to approve the automation, the automation continues to run the steps included in the specified runbook. The console displays the status of the automation. If the automation fails to run, see Troubleshooting Systems Manager Automation.
To approve or deny an automation
Open the AWS Systems Manager console at https://console.aws.amazon.com/systems-manager/
. -
In the navigation pane, choose Automation, and then select the automation that was run in the previous procedure.
-
Choose Actions and then choose Approve/Deny.
-
Choose to Approve or Deny and optionally provide a comment.
-
Choose Submit.
Running an automation with approvers (command line)
The following procedure describes how to use the AWS CLI (on Linux or Windows) or AWS Tools for PowerShell to run an automation with approvers.
To run an automation with approvers
Install and configure the AWS CLI or the AWS Tools for PowerShell, if you haven't already.
For information, see Installing or updating the latest version of the AWS CLI and Installing the AWS Tools for PowerShell.
-
Run the following command to run an automation with approvers. Replace each
example resource placeholderwith your own information. In the document name section, specify a runbook that includes the automation action,aws:approve.For
Approvers, specify the user names or user ARNs of approvers for the action. ForSNSTopic, specify the SNS topic ARN to use to send approval notification. The Amazon SNS topic name must start withAutomation.Note
The specific names of the parameter values for approvers and the SNS topic depend on the values specified within the runbook you choose.
The system returns information like the following.
To approve an automation
-
Run the following command to approve an automation. Replace each
example resource placeholderwith your own information.There is no output if the command succeeds.
To deny an automation
-
Run the following command to deny an automation. Replace each
example resource placeholderwith your own information.There is no output if the command succeeds.
