Study SOA-C03 EventBridge, Remediation and Systems Manager Runbooks: key concepts, common traps, and exam decision cues.
This lesson covers SOA-C03 Task 1.2: identifying and remediating issues by using monitoring and availability metrics. AWS is testing whether you can move from signal to action safely. The best answer is rarely “automate everything.” It is usually “route the right event, enrich it if needed, run the smallest trustworthy action, and then verify the result.”
Runbook: Step-by-step operational procedure that can be executed manually or automatically for consistent diagnosis or remediation.
Event routing: Matching an event pattern and sending it to the correct target or workflow.
Blast radius: The scope of damage an incorrect action could cause.
AWS wants you to know:
flowchart LR
A["Metric, alarm, or health event"] --> B["EventBridge rule"]
B --> C["Target chosen by intent"]
C --> D["Lambda or Systems Manager Automation"]
D --> E["Notification and verification"]
Strong SOA-C03 answers can explain each stage instead of jumping from alarm directly to “fix the problem.”
| Need | Strongest first service or pattern | Why |
|---|---|---|
| Match and route a specific AWS event to a target | EventBridge rule | EventBridge is the routing and event-matching layer. |
| Run a repeatable, auditable operational procedure | Systems Manager Automation | Runbooks are better than ad hoc scripts for standardized remediation. |
| Perform a small custom action when an event fires | Lambda target | Lambda is often the action, not the event router. |
| Notify humans after or alongside automation | SNS or the chosen notification path | Operators still need visibility and confirmation. |
| Enrich or fan out operational events | EventBridge with multiple targets or transformation logic | The requirement is orchestration, not just a single repair step. |
This distinction shows up constantly on the exam.
| If the question is mainly about… | Think first about… |
|---|---|
| matching an event pattern | EventBridge |
| sending one event to the right target | EventBridge |
| passing context into a repeatable workflow | EventBridge plus a runbook target |
| executing a known operational repair procedure | Systems Manager Automation |
| approvals, parameters, or a standard runbook | Systems Manager Automation |
If the stem says “route,” “match,” “deliver,” or “fan out,” the center of gravity is usually EventBridge. If it says “run a remediation workflow,” “execute a documented operational procedure,” or “perform a parameterized fix,” the center of gravity is usually Systems Manager Automation.
AWS does not reward aggressive automation that can make the outage worse.
If a rule is not firing or a runbook is not executing, debug in order:
This order is stronger than investigating permissions first or editing scripts before verifying that the rule even matched the event.
| Scenario | Stronger answer | Weaker answer |
|---|---|---|
| Alarm should open a standard recovery workflow with auditability | Systems Manager Automation runbook | custom one-off script first |
| AWS service event must be matched and forwarded to several targets | EventBridge | direct Lambda invocation from everywhere |
| Small context-specific repair step must happen when an event occurs | Lambda target behind EventBridge | full runbook when the action is tiny and self-contained |
| Team wants automatic containment but the signal is noisy | add guardrails or require stronger trigger | automate the destructive action anyway |
An alarm indicates that an application fleet is repeatedly failing a health check. The operations team wants to route the event, run a standard remediation workflow that restarts a dependent service on the affected instances, and keep an auditable history of the action.
Which approach is strongest?
Correct answer: 1
Why: EventBridge handles event routing, while Systems Manager Automation provides the standardized, auditable runbook execution path. SNS alone notifies but does not remediate. CloudTrail is not the primary solution for runtime recovery.
| Trap | Better thinking |
|---|---|
| “EventBridge fixes the problem.” | EventBridge usually routes the problem to the real action target. |
| “Any alarm should trigger auto-remediation.” | Only strong, trustworthy signals should trigger meaningful automated changes. |
| “Lambda is always better than a runbook.” | If the operation should be repeatable, parameterized, and auditable, a runbook is often stronger. |
| “Notification is optional if remediation ran.” | Operators still need to know the event occurred and what the automation did. |