SSM Incidents replication set is ACTIVE and has at least one response plan
ssmincidents_enabled_with_plans
Incident Manager uses a replication set and response plans. This evaluates whether a replication set exists and is ACTIVE, and that at least one response plan is configured for coordinated incident handling.
Risk
Without an ACTIVE replication set or response plans, incidents lack coordinated engagement and automation, raising MTTR and impacting availability and integrity.
Threats include prolonged outages, lateral movement, and data exfiltration from delayed containment and misrouted escalation.
prowler aws --checks ssmincidents_enabled_with_plans
Recommendation
Establish an ACTIVE replication set and create response plans that define engagement, escalation, runbooks, severity, and communication.
Apply least privilege to automation roles, test plans regularly, integrate with monitoring to trigger them, and use defense in depth with redundant contacts and Regions.
Remediation
- In the AWS Console, go to Systems Manager > Incident Manager
- Replication sets > Create replication set > add at least one Region > Create; wait until Status is ACTIVE
- Response plans > Create response plan > set Name, Title, and Impact > Create
- Verify: Replication set shows ACTIVE and at least one response plan exists
Source Code
Resource Type
Other