About Run Command Response to Failure Notification, In a multi-account environment

Question

Hi,

In a multi-account environment with about 100 accounts, various processes are automatically executed by Run Command in each account.

When an error occurs, we are notified via EventBridge and take appropriate action, but this requires logging in to each account and checking the target resource. This has become a significant burden as the number of accounts increases, and we are wondering if there is a better way to handle this issue.

In addition, we are also considering notifications for things that do not have to succeed every time, such as patching by Run Command. Is there any room for a way to do this, such as notifying if the process fails a certain number of times?

Best Regards,

Answer

You should consider setting up [AWS Organizations](https://docs.aws.amazon.com/organizations/latest/userguide/orgs_introduction.html) for centralized management, using [Amazon EventBridge for cross-account event routing](https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-cross-account.html), and implementing [AWS Systems Manager Automation for automated remediation](https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-automation.html). Additionally, for processes like patching that don't need to succeed every time, you can create custom metric filters in [CloudWatch Logs](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/Cross-Account-Cross-Region.html) to track errors and set alarms to notify you only when the error count exceeds a certain threshold. This approach reduces the need to manually log into each account and allows for more targeted notifications.

About Run Command Response to Failure Notification, In a multi-account environment

Relevant content