Anything changed to Incident Manager's API at 2025-05-20?

Question

From 2025-05-20, the incident created from API does not start engagement, even the escalation plan contains one.

The incidents created with exactly the same code logic and exactly the same configuration on everything in Incident Manager works normally at 2025-05-19.

The incidents created manually at the console within the same response plan can still work normally.

User-5429203 · Accepted Answer

I found a workaround for this issue. I was facing the same problem with my Lambda function, whose main tasks are to:

* Start an SSM Automation runbook that deactivates, deletes, and rotates a compromised IAM key.
* Start an Incident Manager incident.

While the incident was being created successfully, the engagement wasn't being triggered—so I wasn’t receiving any email notifications.

To fix this, I added the following permission to my Lambda execution role. This allows the function to initiate an engagement via AWS Systems Manager Contacts and Incident Manager, specifically for the contact named bernardo_josee:

json
Copy
Edit
{
  "Effect": "Allow",
  "Action": "ssm-contacts:StartEngagement",
  "Resource": "arn:aws:ssm-contacts:eu-west-2:YOUR_ACCOUNT_ID:contact/bernardo_josee"
}
In my Lambda python code, the engagement and email notification were successfully triggered by the start_incident() call, shown below:

incident_response = incidents.start_incident(
    clientToken=client_token,
    responsePlanArn=RESPONSE_PLAN_ARN,
    title=f'IAM Key Compromise detected for user {user_name}',
    impact=1,
    triggerDetails={
        'source': 'AWS Lambda',
        'timestamp': event_time,
        'rawData': json.dumps(detail)
    }
)
Let me know if this helps!

James · Answer

Same here. The escalation plan was not engaged when manually triggered via API since 2025-05-20. I've been debugging it for quite some time. Recreated response plan, escalation plan, contacts, but no help. The issue still exists after 2 days.

James

answered a year ago

re:Post Agent · Answer

AWS Systems Manager Incident Manager is designed to help manage and respond to incidents in AWS environments. It allows you to create response plans, engage responders, and automate certain actions during an incident.

When an incident is created through the API, it typically should trigger the associated response plan, including any configured escalation plans. If you're experiencing a situation where API-created incidents are not starting engagements as expected, while manually created incidents are working normally, this could potentially indicate an issue with the API integration or configuration.

To troubleshoot this kind of situation, you might want to:

1. Review your API calls to ensure all necessary parameters are correctly set.
2. Check your IAM permissions to make sure the API has the necessary access to create and manage incidents.
3. Verify that your response plans and escalation plans are correctly configured.
4. Look for any error messages or unexpected responses from the API calls.
5. Review CloudTrail logs for any changes or issues related to Incident Manager API calls.

If the problem persists, it would be advisable to contact AWS Support for further assistance, as they would have the most up-to-date information about any potential changes or issues with the service.  
**Sources**  
[AWS Systems Manager Incident Manager - Amazon Web Services](https://aws.amazon.com/systems-manager/features/incident-manager/)  
[Logging AWS Systems Manager Incident Manager API calls using AWS CloudTrail - Incident Manager](https://docs.aws.amazon.com/incident-manager/latest/userguide/logging-using-cloudtrail.html)

Anything changed to Incident Manager's API at 2025-05-20?

Add your answer

Relevant content