SOA-C03 EventBridge, Remediation and Systems Manager Runbooks Guide

This lesson is about turning signals into action safely. SOA-C03 does not reward automation for its own sake. It rewards automation that reacts to the right condition, routes the event correctly, and performs a remediating action with controlled blast radius.

Runbook: Step-by-step operational procedure that can be followed manually or automated for consistent remediation.

Event enrichment: Adding useful context to an event before another workflow or target consumes it.

Operational flow AWS expects you to recognize

    flowchart LR
	  A["Metric or alarm fires"] --> B["EventBridge rule evaluates event"]
	  B --> C["Route to Lambda or Systems Manager Automation"]
	  C --> D["Run remediation or diagnostic action"]
	  D --> E["Notify operators and verify recovery"]

What AWS is really testing here

AWS wants you to know:

• when EventBridge should route and enrich events
• when Systems Manager Automation runbooks are the safer remediation path
• when custom or predefined remediation should be used
• why automation without trustworthy triggers can be dangerous

Common traps

• automating a destructive fix from a weak or noisy signal
• forgetting to notify people after automation acts
• treating EventBridge as the fix itself instead of the routing layer
• confusing diagnosis steps with remediation steps

Decision order that usually wins

1. Separate the problem into signal, routing, action, and verification.
2. If the question is about how the event gets to the action, think EventBridge.
3. If the question is about the repeatable remediation workflow itself, think Systems Manager Automation.
4. If the question is about small custom event-driven logic, think Lambda as the target, not as the router.
5. Before choosing full automation, ask whether the trigger is strong enough to avoid making the outage worse.

Quiz