My SSM document is running regularly and incurring unexpected costs — how can I identify what or who is triggering it?

To identify the source of recurring SSM Document executions, you can leverage a combination of CloudTrail, CloudWatch, and SSM execution history to trace who or what is triggering the document. Here’s a structured approach:

1. Check SSM Execution History.
   Navigate to Systems Manager -> Automation -> Executions.
   Look at recent executions of the document, noting the Execution ID, Status, Start Time, and Initiated By field. The “Initiated By” field often shows whether the execution was started by a user, role, or service.

2. Use AWS CloudTrail.
   CloudTrail records all API calls made in your account. You can filter for the StartAutomationExecution API, which is used when an SSM document is invoked.
   In the CloudTrail console:
   Open Event History.
   Filter by Event Name -> StartAutomationExecution.
   Look at the Event Source, User Identity, Event Time, and Resources fields.
   This will tell you whether the execution was triggered by:
   An IAM user or role.
   Another AWS service (like EventBridge, Lambda, or CodePipeline).
   Cross-account principals if applicable

3. Inspect CloudWatch Logs (if enabled).
   If your document writes logs, check CloudWatch Logs for the SSM automation execution logs. The logs may contain additional metadata, such as instance IDs or parameters passed, which can help correlate the invocation with specific resources or scripts.

4. Check EventBridge Rules and Schedules.
   Sometimes SSM documents are triggered automatically via EventBridge rules or SSM Maintenance Windows. Review EventBridge -> Rules and Systems Manager -> Maintenance Windows to see if the document is scheduled. If found, the rule or maintenance window will list the target SSM document and its execution schedule.

If the “Initiated By” is an IAM role or Lambda function, check CloudTrail for what assumed the role or triggered the Lambda around the same timestamp. For cross-account invocations, ensure CloudTrail logging is enabled in all relevant accounts. By combining SSM execution history, CloudTrail event queries, CloudWatch logs, and EventBridge/maintenance window checks, you can reliably trace the origin of automated SSM document executions and stop unnecessary cost accrual.