All checks
Medium
SSM Automation should have CloudWatch logging enabled
Checks that Systems Manager Automation in this Region sends the output of aws:executeScript actions to CloudWatch Logs, so there is a record of the scripts runbooks run for audits and troubleshooting. Only aws:executeScript output is logged, and the setting is per Region.
- service
- SSM
- severity
- Medium
- scope
- evaluated in every region
How to fix it
In the console
Systems Manager → Automation → Preferences
- Send output to CloudWatch Logs
- Selected
- Encrypt log data
- Selected, unless the log group does not allow encryption
- CloudWatch Logs log group
- Send output to the default log group, or an existing group you keep for runbook output
With the AWS CLI
aws ssm update-service-setting --setting-id /ssm/automation/customer-script-log-destination --setting-value CloudWatch --region <region>With Terraform
resource "aws_ssm_service_setting" "this" {
setting_id = "/ssm/automation/customer-script-log-destination"
setting_value = "CloudWatch"
}See which of your accounts this check is failing on.
Book a live scan