(Optional) Set up Amazon SNS to receive notifications about OpsItems

1. Sign in to the Amazon Web Services Management Console and open the Amazon SNS console at https://console.amazonaws.cn/sns/v3/home.

2. In the navigation pane, choose Topics.

3. Choose the topic that you created in Step 1, and then choose Edit.

4. Expand Access policy.

5. Add the following Sid block to the existing policy. Replace each example resource placeholder with your own information.

   {
         "Sid": "Allow OpsCenter to publish to this topic",
         "Effect": "Allow",
         "Principal": {
           "Service": "ssm.amazonaws.com.cn"
         },
         "Action": "SNS:Publish",
         "Resource": "arn:aws-cn:sns:region:account ID:topic name", // Account ID of the SNS topic owner
         "Condition": {
         "StringEquals": {
           "AWS:SourceAccount": "account ID" //  Account ID of the OpsItem owner
         }
      }
   }

   Note

   The aws:SourceAccount global condition key protects against the confused deputy scenario. To use this condition key, set the value to the account ID of the OpsItem owner. For more information, see Confused Deputy in the IAM User Guide.

6. Choose Save changes.

1. Open the Amazon KMS console at https://console.amazonaws.cn/kms.

2. To change the Amazon Web Services Region, use the Region selector in the upper-right corner of the page.

3. In the navigation pane, choose Customer managed keys.

4. Choose the ID of the KMS key that you chose when you created the topic.

5. In the Key policy section, choose Switch to policy view.

6. Choose Edit.

7. Add the following Sid block to the existing policy. Replace each example resource placeholder with your own information.

   {
         "Sid": "Allow OpsItems to decrypt the key",
         "Effect": "Allow",
         "Principal": {
           "Service": "ssm.amazonaws.com.cn"
         },
         "Action": ["kms:Decrypt", "kms:GenerateDataKey*"],
          "Resource": "arn:aws-cn:kms:region:account ID:key/key ID"
       }

   In the following example, the new block is entered at line 14.

   

8. Choose Save changes.

To add a notifications block to a default OpsItem rule

1. Open the Amazon Systems Manager console at https://console.amazonaws.cn/systems-manager/.

2. In the navigation pane, choose OpsCenter.

3. Choose the OpsItems tab, and then choose Configure sources.

4. Choose the name of the source rule that you want to configure with a notifications block, as shown in the following example.

   

   The rule opens in Amazon EventBridge.

5. On the rule details page, on the Targets tab, choose Edit.

6. In the Additional settings section, choose Configure input transformer.

7. In the Template box, add a notifications block in the following format.

   "notifications":[{"arn":"arn:aws-cn:sns:region:account ID:topic name"}],

   Here's an example.

   "notifications":[{"arn":"arn:aws:sns:us-west-2:1234567890:MySNSTopic"}],

   Enter the notifications block before the resources block, as shown in the following example for the US West (Oregon) (us-west-2) Region.

   {
       "title": "EBS snapshot copy failed",
       "description": "CloudWatch Event Rule SSMOpsItems-EBS-snapshot-copy-failed was triggered. Your EBS snapshot copy has failed. See below for more details.",
       "category": "Availability",
       "severity": "2",
       "source": "EC2",
       "notifications": [{
           "arn": "arn:aws:sns:us-west-2:1234567890:MySNSTopic"
       }],
       "resources": <resources>,
       "operationalData": {
           "/aws/dedup": {
               "type": "SearchableString",
               "value": "{\"dedupString\":\"SSMOpsItems-EBS-snapshot-copy-failed\"}"
           },
           "/aws/automations": {
               "value": "[ { \"automationType\": \"AWS:SSM:Automation\", \"automationId\": \"AWS-CopySnapshot\" } ]"
           },
           "failure-cause": {
               "value": <failure - cause>
           },
           "source": {
               "value": <source>
           },
           "start-time": {
               "value": <start - time>
           },
           "end-time": {
               "value": <end - time>
           }
       }
   }

8. Choose Confirm.

9. Choose Next.

10. Choose Next.

11. Choose Update rule.