• The Amazon Systems Manager CloudWatch Dashboard will no longer be available after April 30, 2026. Customers can continue to use Amazon CloudWatch console to view, create, and manage their Amazon CloudWatch dashboards, just as they do today. For more information, see [Amazon CloudWatch Dashboard documentation](https://docs.amazonaws.cn/AmazonCloudWatch/latest/monitoring/CloudWatch_Dashboards.html).
# Working with Change Manager
**Change Manager availability change**
Amazon Systems Manager Change Manager will no longer be open to new customers starting November 7, 2025. If you would like to use Change Manager, sign up prior to that date. Existing customers can continue to use the service as normal. For more information, see [Amazon Systems Manager Change Manager availability change](https://docs.amazonaws.cn/systems-manager/latest/userguide/change-manager-availability-change.html).
With Change Manager, a tool in Amazon Systems Manager, users across your organization or in a single Amazon Web Services account can perform change-related tasks for which they have been granted the necessary permissions. Change Manager tasks include the following:
+ Create, review, and approve or reject change templates.
A change template is a collection of configuration settings in Change Manager that define such things as required approvals, available runbooks, and notification options for change requests.
+ Create, review, and approve or reject change requests.
A change request is a request in Change Manager to run an Automation runbook that updates one or more resources in your Amazon or on-premises environments. A change request is created using a change template.
+ Specify which users in your organization or account can be made reviewers for change templates and change requests.
+ Edit configuration settings, such as how user identities are managed in Change Manager and which of the available *best practice* options are enforced in your Change Manager operations. For information about configuring these settings, see [Configuring Change Manager options and best practices](change-manager-account-setup.md).
**Topics**
+ [
# Working with change templates
](change-templates.md)
+ [
# Working with change requests
](change-requests.md)
+ [
# Reviewing change request details, tasks, and timelines (console)
](reviewing-changes.md)
+ [
# Viewing aggregated counts of change requests (command line)
](change-requests-review-aggregate-command-line.md)
# Working with change templates
**Change Manager availability change**
Amazon Systems Manager Change Manager will no longer be open to new customers starting November 7, 2025. If you would like to use Change Manager, sign up prior to that date. Existing customers can continue to use the service as normal. For more information, see [Amazon Systems Manager Change Manager availability change](https://docs.amazonaws.cn/systems-manager/latest/userguide/change-manager-availability-change.html).
A change template is a collection of configuration settings in Change Manager that define such things as required approvals, available runbooks, and notification options for change requests.
**Note**
Amazon provides a sample [Hello World](change-templates-aws-managed.md) change template you can use to try out Change Manager, a tool in Amazon Systems Manager. However, you create your own change templates to define the changes you want to allow to the resources in your organization or account.
The changes that are made when a runbook workflow runs are based on the contents an Automation runbook. In each change template you create, you can include one or more Automation runbooks that the user making a change request can choose from to run during the update. You can also create change templates that allow requesters to choose any available Automation runbook for the change request.
To create a change template, you can use the **Builder** option in the **Create template** console page to build a change template. Alternatively, using the **Editor** option, you can manually author JSON or YAML content with the configuration you want for your runbook workflow. You can also use a command line tool to create a change template, with JSON content for the change template stored in an external file.
**Topics**
+ [
# Try out the Amazon managed `Hello World` change template
](change-templates-aws-managed.md)
+ [
# Creating change templates
](change-templates-create.md)
+ [
# Reviewing and approving or rejecting change templates
](change-templates-review.md)
+ [
# Deleting change templates
](change-templates-delete.md)
# Try out the Amazon managed `Hello World` change template
**Change Manager availability change**
Amazon Systems Manager Change Manager will no longer be open to new customers starting November 7, 2025. If you would like to use Change Manager, sign up prior to that date. Existing customers can continue to use the service as normal. For more information, see [Amazon Systems Manager Change Manager availability change](https://docs.amazonaws.cn/systems-manager/latest/userguide/change-manager-availability-change.html).
You can use the sample change template `AWS-HelloWorldChangeTemplate`, which uses the sample Automation runbook `AWS-HelloWorld`, to test the review and approval process after you have finished setting up Change Manager, a tool in Amazon Systems Manager. This template is designed for testing or verifying your configured permissions, approver assignments, and approval process. Approval to use this change template in your organization or account has already been provided by Amazon. Any change request based on this change template, however, must still be approved by reviewers in your organization or account.
Rather than make changes to a resource, the result of the runbook workflow associated with this template is to print a message in the output of an Automation step.
**Before you begin**
Before you begin, ensure you have completed the following tasks:
+ If you're using Amazon Organizations to manage change across an organization, complete the organization setup tasks described in [Setting up Change Manager for an organization (management account)](change-manager-organization-setup.md).
+ Configure Change Manager for your delegated administrator account or single account, as described in [Configuring Change Manager options and best practices](change-manager-account-setup.md).
**Note**
If you turned on the best practice option **Require monitors for all templates** in your Change Manager settings, turn it off temporarily while you test the Hello World change template.
**To try out the Amazon managed Hello World change template**
1. Open the Amazon Systems Manager console at [https://console.amazonaws.cn/systems-manager/](https://console.amazonaws.cn/systems-manager/).
1. In the navigation pane, choose **Change Manager**.
1. Choose **Create request**.
1. Choose the change template named `AWS-HelloWorldChangeTemplate`, and then choose **Next**.
1. For **Name**, enter a name for the change request that makes its purpose easy to identify, such as **MyChangeRequestTest**.
1. For the remainder of the steps to create your change request, see [Creating change requestsCreating change requests (console)](change-requests-create.md).
**Next steps**
For information about approving change requests, see [Reviewing and approving or rejecting change requests](change-requests-review.md).
To view the status and results of your change request, choose the name of your change request on the **Requests** tab in Change Manager.
# Creating change templates
**Change Manager availability change**
Amazon Systems Manager Change Manager will no longer be open to new customers starting November 7, 2025. If you would like to use Change Manager, sign up prior to that date. Existing customers can continue to use the service as normal. For more information, see [Amazon Systems Manager Change Manager availability change](https://docs.amazonaws.cn/systems-manager/latest/userguide/change-manager-availability-change.html).
A change template is a collection of configuration settings in Change Manager that define such things as required approvals, available runbooks, and notification options for change requests.
You can create change templates for your operations in Change Manager, a tool in Amazon Systems Manager, using the console, which includes Builder and Editor options, or command line tools.
**Topics**
+ [
# About approvals in your change templates
](cm-approvals-templates.md)
+ [
# Creating change templates using Builder
](change-templates-custom-builder.md)
+ [
# Creating change templates using Editor
](change-templates-custom-editor.md)
+ [
# Creating change templates using command line tools
](change-templates-tools.md)
# About approvals in your change templates
**Change Manager availability change**
Amazon Systems Manager Change Manager will no longer be open to new customers starting November 7, 2025. If you would like to use Change Manager, sign up prior to that date. Existing customers can continue to use the service as normal. For more information, see [Amazon Systems Manager Change Manager availability change](https://docs.amazonaws.cn/systems-manager/latest/userguide/change-manager-availability-change.html).
For each change template that you create, you can specify up to five approval *levels* for change requests created from it. For each of those levels, you can designate up to five potential *approvers*. An approver isn't limited to a single user. You can also specify an IAM group or IAM role as an individual approver. For IAM groups and IAM roles, one or more users belonging to the group or role can provide approvals toward receiving the total number of approvals required for a change request. You can also specify more approvers than your change template requires.
Change Manager supports two main approaches to approvals: *per-level approvals* and *per-line approvals*. A combination of the two types is also possible in some situations. We recommend using only per-level approvals in your Change Manager operations.
------
#### [ Per-level approvals ]
*Recommended*. As of January 23, 2023, Change Manager supports per-level approvals. In this model, for each approval level in your change template, you first specify how many approvals are required for that level. Then you specify at least that many approvers for the level and can specify more approvers. However, only the number of per-level approvers that you specify need to approve the change request. For example, you could specify five approvers but require three approvals.
For console-view and JSON samples of this approval type, see [Sample per-level approval configuration](approval-type-samples.md#per-level-approvals).
------
#### [ Per-line approvals ]
*Supported for backward compatibility*. The original release of Change Manager supported only per-line approvals. In this model, every approver specified for an approval level is represented as an approval line. Each approver had to approve a change request for it to be approved at that level. Prior to January 23, 2023, this was the only supported model for approvals. Change templates created before this date continue to support per-line approvals, but we recommend using per-level approvals instead.
For console-view and JSON samples of this approval type, see [Sample per-line approval configuration](approval-type-samples.md#per-line-approvals).
------
#### [ Combined per-line and per-level approvals ]
*Not recommended*. In the console, the **Builder** tab no longer supports adding per-line approvals. However, in some cases you might end up with both per-line and per-level approvals in a change template. This can occur if you update a change template that was created before January 23, 2023, or if you create or update a change template by editing its YAML content manually,
For console-view and JSON samples of this approval type, see [Sample combined per-level and per-line approval configuration](approval-type-samples.md#combined-approval-levels).
------
**Important**
Although it's possible to create a change template that combines per-line and per-level approvals, this configuration isn't recommended or necessary. Whichever approval type requires more approvals (per-line or per-level approvals) takes precedence. For example:
If a change template specifies three per-level approvals but five per-line approvals, then five approvals are required.
If a change template specifies four per-level approvals but two per-line approvals, then four approvals are required.
You can create a level that includes both per-line and per-level approvals by editing the YAML or JSON content manually. Then, the **Builder** tab displays controls for specifying the required number of approvals for both the level and for individual lines. However, new levels that you add using the console still support only per-level approval configurations.
## Change request notifications and rejections
Amazon SNS notifications
When a change request is created using your change template, notifications are sent to subscribers of the Amazon Simple Notification Service (Amazon SNS) topic that has been designated for approval notifications at that level. You can specify the notification topic in the change template or allow the user creating the change request to specify one.
After the minimum number of required approvals is received at one level, notifications are sent to approvers subscribed to the Amazon SNS topic for the next level, and so on.
Ensure that the IAM roles, groups, and users you designate together provide enough approvers to meet the required number of approvals you specify. For example, if you designate only a single IAM group as an approver that contains three users, you can't specify that five approvals are mandatory at that level, only three or less.
Change request rejections
No matter how many approval levels and approvers you specify, only one rejection to a change request is required to prevent the runbook workflow for that request from occurring.
# Change Manager approval type examples
**Change Manager availability change**
Amazon Systems Manager Change Manager will no longer be open to new customers starting November 7, 2025. If you would like to use Change Manager, sign up prior to that date. Existing customers can continue to use the service as normal. For more information, see [Amazon Systems Manager Change Manager availability change](https://docs.amazonaws.cn/systems-manager/latest/userguide/change-manager-availability-change.html).
The following samples demonstrate the console view and JSON content for the three types of approval types in Change Manager.
**Topics**
+ [
## Sample per-level approval configuration
](#per-level-approvals)
+ [
## Sample per-line approval configuration
](#per-line-approvals)
+ [
## Sample combined per-level and per-line approval configuration
](#combined-approval-levels)
## Sample per-level approval configuration
In the per-level approval level setup shown in the following image, three approvals are required. Those approvals can come from any combination of IAM users, groups, and roles that are specified as approvers. Specified approvers include two IAM users (John Stiles and Ana Carolina Silva), a user group that contains three members (`GroupOfThree`), and a user role that represents ten users (`RoleOfTen`).
If all three users in the `GroupOfThree` group approve the change request, it is approved for that level. It's not necessary to receive an approval from each user, group, or role. The minimum number of approvals can come from any combination of specified approvers. We recommend per-level approvals for your Change Manager operations.
![\[Approval level showing three approvals are required and four specified approvers.\]](http://docs.amazonaws.cn/en_us/systems-manager/latest/userguide/images/Add-approval-2.png)
The following sample illustrates part of the YAML code for this configuration.
**Note**
This version of the YAML code include an additional input, `MinRequiredApprovals` (with an initial capital `M`). The value for this input indicates how many approvals are required from among all available reviewers. Note also that the `minRequiredApprovals` (lowercase initial `m`) value for each approver in the `Approvers` list is `0` (zero). This indicates that the approver can contribute to the overall approvals but is not required to do so.
```
schemaVersion: "0.3"
emergencyChange: false
autoApprovable: false
mainSteps:
- name: ApproveAction1
action: aws:approve
timeoutSeconds: 604800
inputs:
Message: Please approve this change request
MinRequiredApprovals: 3
EnhancedApprovals:
Approvers:
- approver: John Stiles
type: IamUser
minRequiredApprovals: 0
- approver: Ana Carolina Silva
type: IamUser
minRequiredApprovals: 0
- approver: GroupOfThree
type: IamGroup
minRequiredApprovals: 0
- approver: RoleOfTen
type: IamRole
minRequiredApprovals: 0
templateInformation: >
#### What is the purpose of this change?
//truncated
```
## Sample per-line approval configuration
In the approval level setup shown in the following image, four approvers are specified. These include two IAM users (John Stiles and Ana Carolina Silva), a user group that contains three members (`GroupOfThree`), and a user role that represents ten users (`RoleOfTen`). Per-line approvals are supported for backwards compatibility but not recommended.
![\[Approval level showing four required per-line approvers.\]](http://docs.amazonaws.cn/en_us/systems-manager/latest/userguide/images/Add-approval-1.png)
For the change request to be approved in this per-line approval configuration, it must be approved by all approver lines: John Stiles, Ana Carolina Silva, one member of the `GroupOfThree` group, and one member of the `RoleOfTen` role.
The following sample illustrates part of the YAML code for this configuration.
**Note**
Observe that the value for each `minRequiredApprovals` approver is `1`. This indicates that one approval is required from each approver.
```
schemaVersion: "0.3"
emergencyChange: false
autoApprovable: false
mainSteps:
- name: ApproveAction1
action: aws:approve
timeoutSeconds: 10000
inputs:
Message: Please approve this change request
EnhancedApprovals:
Approvers:
- approver: John Stiles
type: IamUser
minRequiredApprovals: 1
- approver: Ana Carolina Silva
type: IamUser
minRequiredApprovals: 1
- approver: GroupOfThree
type: IamGroup
minRequiredApprovals: 1
- approver: RoleOfTen
type: IamRole
minRequiredApprovals: 1
executableRunBooks:
- name: AWS-HelloWorld
version: $DEFAULT
templateInformation: >
#### What is the purpose of this change?
//truncated
```
## Sample combined per-level and per-line approval configuration
In the combined per-level and per-line approval setup shown in the following image, three approvals are specified for the level, but four approvals are specified for the line-item approvals. Whichever approval type requires more approvals takes precedence over the other, so four approvals are required by this configuration. Combined per-level and per-line approval are not recommended.
![\[Approval level showing three approvals required for the level but four required at the line level.\]](http://docs.amazonaws.cn/en_us/systems-manager/latest/userguide/images/Add-approval-3.png)
```
schemaVersion: "0.3"
emergencyChange: false
autoApprovable: false
mainSteps:
- name: ApproveAction1
action: aws:approve
timeoutSeconds: 604800
inputs:
Message: Please approve this change request
MinRequiredApprovals: 3
EnhancedApprovals:
Approvers:
- approver: John Stiles
type: IamUser
minRequiredApprovals: 1
- approver: Ana Carolina Silva
type: IamUser
minRequiredApprovals: 1
- approver: GroupOfThree
type: IamGroup
minRequiredApprovals: 1
- approver: RoleOfTen
type: IamRole
minRequiredApprovals: 1
templateInformation: >
#### What is the purpose of this change?
//truncated
```
**Topics**
+ [
# About approvals in your change templates
](cm-approvals-templates.md)
+ [
# Creating change templates using Builder
](change-templates-custom-builder.md)
+ [
# Creating change templates using Editor
](change-templates-custom-editor.md)
+ [
# Creating change templates using command line tools
](change-templates-tools.md)
# Creating change templates using Builder
**Change Manager availability change**
Amazon Systems Manager Change Manager will no longer be open to new customers starting November 7, 2025. If you would like to use Change Manager, sign up prior to that date. Existing customers can continue to use the service as normal. For more information, see [Amazon Systems Manager Change Manager availability change](https://docs.amazonaws.cn/systems-manager/latest/userguide/change-manager-availability-change.html).
Using the Builder for change templates in Change Manager, a tool in Amazon Systems Manager, you can configure the runbook workflow defined in your change template without having to use JSON or YAML syntax. After you specify your options, the system converts your input into the YAML format that Systems Manager can use to run runbook workflows.
**To create a change template using Builder**
1. Open the Amazon Systems Manager console at [https://console.amazonaws.cn/systems-manager/](https://console.amazonaws.cn/systems-manager/).
1. In the navigation pane, choose **Change Manager**.
1. Choose **Create template**.
1. For **Name**, enter a name for the template that makes its purpose easy to identify, such as **UpdateEC2LinuxAMI**.
1. In the **Change template details** section, do the following:
+ For **Description**, provide a brief explanation of how and when the change template you're creating is to be used.
This description helps users who create change requests determine whether they're using the correct change template. It helps those who review change requests understand whether the request should be approved.
+ For **Change template type**, specify whether you're creating a standard change template or an emergency change template.
An emergency change template is used for situations when a change must be made even if changes are otherwise blocked by an event in the calendar in use by Amazon Systems Manager Change Calendar. Change requests created from an emergency change template must still be approved by its designated approvers, but the requested changes can still run even when the calendar is blocked.
+ For **Runbook options**, specify the runbooks that users can choose from when creating a change request. You can add a single runbook or multiple runbooks. Alternatively, you can allow requesters to specify which runbook to use. In any of these cases, only one runbook can be included in the change request.
+ For **Runbook**, select the names of the runbooks and the versions of those runbooks that users can choose from for their change requests. No matter how many runbooks you add to the change template, only one can be selected per change request.
You don't specify a runbook if you chose **Any runbook can be used** earlier.
**Tip**
Select a runbook and runbook version, and then choose **View** to examine the contents of the runbook in the Systems Manager Documents interface.
1. In the **Template information** section, use Markdown to enter information for users who create change requests from this change template. We have provided a set of questions that you can include for users who create change requests, or you can add other information and questions instead.
**Note**
Markdown is a markup language that allows you to add wiki-style descriptions to documents and individual steps within the document. For more information about using Markdown, see [Using Markdown in Amazon](https://docs.amazonaws.cn/general/latest/gr/aws-markdown.html).
We recommend providing questions for users to answer about their change requests to help approvers decide whether or not to grant each change request, such as listing any manual steps required to run as part of the change and a rollback plan.
**Tip**
Toggle between **Hide preview** and **Show preview** to see what your content looks like as you compose.
1. In the **Change request approvals** section, do the following:
+ (Optional) If you want to allow change requests that are created from this change template to run automatically, without review by any approvers (with the exception of change freeze events), select **Enable auto-approval**.
**Note**
Enabling auto-approvals in a change template provides users with the *option* of bypassing reviewers. They can still choose to specify reviewers when creating a change request. Therefore, you must still specify reviewer options in the change template.
**Important**
If you enable auto-approval for a change template, users can submit change requests using that template that do not require review by reviewers before they run (with the exception of change freeze event approvers). If you want to restrict a particular user, group, or IAM role from submitting auto-approval requests, you can use a condition in an IAM policy for this purpose. For more information, see [Controlling access to auto-approval runbook workflows](change-manager-auto-approval-access.md).
+ For **Number of approvals required at this level**, choose the number of approvals that change requests created from this change template must receive for this level.
+ To add mandatory first-level approvers, choose **Add approver**, and then choose from the following:
+ **Template specified approvers** – Choose one or more users, groups, or Amazon Identity and Access Management (IAM) roles from your account to approve change requests created from this change template. Any change requests that are created using this template must be reviewed and approved by each approver you specify.
+ **Request specified approvers** – The user who makes the change request specifies reviewers at the time they make the request and can choose from a list of users in your account.
The number you enter in the **Required** column determines how many reviewers must be specified by a change request that uses this change template.
**Important**
Prior to January 23, 2023, the **Builder** tab supported specifying per-line approvals only. New change templates and new levels you add to existing change templates using the **Builder** tab support per-level approvals only. We recommend using only per-level approvals in your Change Manager operations.
For more information, see [About approvals in your change templates](cm-approvals-templates.md).
+ For **SNS topic to notify approvers**, do the following:
1. Choose one of the following to specify the Amazon Simple Notification Service (Amazon SNS) topic in your account to use for sending notifications to approvers that a change request is ready for their review:
+ **Enter an SNS Amazon Resource Name (ARN)** – For **Topic ARN**, enter the ARN of an existing Amazon SNS topic. This topic can be in any of your organization's accounts.
+ **Select an existing SNS topic** – For **Target notification topic**, select the ARN of an existing Amazon SNS topic in your current Amazon Web Services account. (This option isn't available if you haven't yet created any Amazon SNS topics in your current Amazon Web Services account and Amazon Web Services Region.)
+ **Specify SNS topic when the change request is created **– The user who creates a change request can specify the Amazon SNS topic to use for notifications.
**Note**
The Amazon SNS topic you select must be configured to specify the notifications it sends and the subscribers they're sent to. Its access policy must also grant permissions to Systems Manager so Change Manager can send notifications. For information, see [Configuring Amazon SNS topics for Change Manager notifications](change-manager-sns-setup.md).
1. Choose **Add notification**.
1. (Optional) To add an additional level of approvers, choose **Add approval level** and choose between template-specified approvers and request-specified approvers for this level. Then choose an SNS topic to notify this level of approvers.
After all approvals have been received by first-level approvers, second-level approvers are notified, and so on.
You can add a maximum of five levels of approvers in each template. You might, for example, require approvals from users in technical roles for the first level, then managerial approval for the second level.
1. In the **Monitoring** section, for **CloudWatch alarm to monitor**, enter the name of an Amazon CloudWatch alarm in the current account to monitor the progress of runbook workflows that are based on this template.
**Tip**
To create a new alarm, or to review the settings of an alarm you want to specify, choose **Open the Amazon CloudWatch console**. For information about working with CloudWatch alarms, see [Using CloudWatch Alarms](https://docs.amazonaws.cn/AmazonCloudWatch/latest/monitoring/AlarmThatSendsEmail.html) in the *Amazon CloudWatch User Guide*.
1. In the **Notifications** section, do the following:
1. Choose one of the following to specify the Amazon SNS topic in your account to use for sending notifications about change requests that are created using this change template:
+ **Enter an SNS Amazon Resource Name (ARN)** – For **Topic ARN**, enter the ARN of an existing Amazon SNS topic. This topic can be in any of your organization's accounts.
+ **Select an existing SNS topic** – For **Target notification topic**, select the ARN of an existing Amazon SNS topic in your current Amazon Web Services account. (This option isn't available if you haven't yet created any Amazon SNS topics in your current Amazon Web Services account and Amazon Web Services Region.)
**Note**
The Amazon SNS topic you select must be configured to specify the notifications it sends and the subscribers they're sent to. Its access policy must also grant permissions to Systems Manager so Change Manager can send notifications. For information, see [Configuring Amazon SNS topics for Change Manager notifications](change-manager-sns-setup.md).
1. Choose **Add notification**.
1. (Optional) In the **Tags** section, apply one or more tag key name/value pairs to the change template.
Tags are optional metadata that you assign to a resource. By using tags, you can categorize a resource in different ways, such as by purpose, owner, or environment. For example, you might want to tag a change template to identify the type of change it makes and the environment it runs in. In this case, you could specify the following key name/value pairs:
+ `Key=TaskType,Value=InstanceRepair`
+ `Key=Environment,Value=Production`
1. Choose **Save and preview**.
1. Review the details of the change template you're creating.
If you want to make change to the change template before submitting it for review, choose **Actions, Edit**.
If you're satisfied with the contents of the change template, choose **Submit for review**. The users in your organization or account who have been specified as template reviewers on the **Settings** tab in Change Manager are notified that a new change template is pending their review.
If an Amazon SNS topic has been specified for change templates, notifications are sent when the change template is rejected or approved. If you don't receive notifications related to this change template, you can return to Change Manager later to check on its status.
# Creating change templates using Editor
**Change Manager availability change**
Amazon Systems Manager Change Manager will no longer be open to new customers starting November 7, 2025. If you would like to use Change Manager, sign up prior to that date. Existing customers can continue to use the service as normal. For more information, see [Amazon Systems Manager Change Manager availability change](https://docs.amazonaws.cn/systems-manager/latest/userguide/change-manager-availability-change.html).
Use the steps in this topic to configure a change template in Change Manager, a tool in Amazon Systems Manager, by entering JSON or YAML instead of using the console controls.
**To create a change template using Editor**
1. In the navigation pane, choose **Change Manager**.
1. Choose **Create template**.
1. For **Name**, enter a name for the template that makes its purpose easy to identify, such as **RestartEC2LinuxInstance**.
1. Above **Change template details**, choose **Editor**.
1. In the **Document editor** section, choose **Edit**, and then enter the JSON or YAML content for your change template.
The following is an example.
**Note**
The parameter `minRequiredApprovals` is used to specify how many reviewers at a specified level must approve a change request that is created using this template.
This example demonstrates two levels of approvals. You can specify up to five levels of approvals, but only one level is required.
In the first level, the specific user "John-Doe" must approve each change request. After that, any three members of the IAM role `Admin` must approve the change request.
For more information about approvals for change templates, see [About approvals in your change templates](cm-approvals-templates.md).
------
#### [ YAML ]
```
description: >-
This change template demonstrates the feature set available for creating
change templates for Change Manager. This template starts a Runbook workflow
for the Automation runbook called AWS-HelloWorld.
templateInformation: >
### Document Name: HelloWorldChangeTemplate
## What does this document do?
This change template demonstrates the feature set available for creating
change templates for Change Manager. This template starts a Runbook workflow
for the Automation runbook called AWS-HelloWorld.
## Input Parameters
* ApproverSnsTopicArn: (Required) Amazon Simple Notification Service ARN for
approvers.
* Approver: (Required) The name of the approver to send this request to.
* ApproverType: (Required) The type of reviewer.
* Allowed Values: IamUser, IamGroup, IamRole, SSOGroup, SSOUser
## Output Parameters
This document has no outputs
schemaVersion: '0.3'
parameters:
ApproverSnsTopicArn:
type: String
description: Amazon Simple Notification Service ARN for approvers.
Approver:
type: String
description: IAM approver
ApproverType:
type: String
description: >-
Approver types for the request. Allowed values include IamUser, IamGroup,
IamRole, SSOGroup, and SSOUser.
executableRunBooks:
- name: AWS-HelloWorld
version: '1'
emergencyChange: false
autoApprovable: false
mainSteps:
- name: ApproveAction1
action: 'aws:approve'
timeoutSeconds: 3600
inputs:
Message: >-
A sample change request has been submitted for your review in Change
Manager. You can approve or reject this request.
EnhancedApprovals:
NotificationArn: '{{ ApproverSnsTopicArn }}'
Approvers:
- approver: John-Doe
type: IamUser
minRequiredApprovals: 1
- name: ApproveAction2
action: 'aws:approve'
timeoutSeconds: 3600
inputs:
Message: >-
A sample change request has been submitted for your review in Change
Manager. You can approve or reject this request.
EnhancedApprovals:
NotificationArn: '{{ ApproverSnsTopicArn }}'
Approvers:
- approver: Admin
type: IamRole
minRequiredApprovals: 3
```
------
#### [ JSON ]
```
{
"description": "This change template demonstrates the feature set available for creating
change templates for Change Manager. This template starts a Runbook workflow
for the Automation runbook called AWS-HelloWorld",
"templateInformation": "### Document Name: HelloWorldChangeTemplate\n\n
## What does this document do?\n
This change template demonstrates the feature set available for creating change templates for Change Manager.
This template starts a Runbook workflow for the Automation runbook called AWS-HelloWorld.\n\n
## Input Parameters\n* ApproverSnsTopicArn: (Required) Amazon Simple Notification Service ARN for approvers.\n
* Approver: (Required) The name of the approver to send this request to.\n
* ApproverType: (Required) The type of reviewer. * Allowed Values: IamUser, IamGroup, IamRole, SSOGroup, SSOUser\n\n
## Output Parameters\nThis document has no outputs\n",
"schemaVersion": "0.3",
"parameters": {
"ApproverSnsTopicArn": {
"type": "String",
"description": "Amazon Simple Notification Service ARN for approvers."
},
"Approver": {
"type": "String",
"description": "IAM approver"
},
"ApproverType": {
"type": "String",
"description": "Approver types for the request. Allowed values include IamUser, IamGroup, IamRole, SSOGroup, and SSOUser."
}
},
"executableRunBooks": [
{
"name": "AWS-HelloWorld",
"version": "1"
}
],
"emergencyChange": false,
"autoApprovable": false,
"mainSteps": [
{
"name": "ApproveAction1",
"action": "aws:approve",
"timeoutSeconds": 3600,
"inputs": {
"Message": "A sample change request has been submitted for your review in Change Manager. You can approve or reject this request.",
"EnhancedApprovals": {
"NotificationArn": "{{ ApproverSnsTopicArn }}",
"Approvers": [
{
"approver": "John-Doe",
"type": "IamUser",
"minRequiredApprovals": 1
}
]
}
}
},
{
"name": "ApproveAction2",
"action": "aws:approve",
"timeoutSeconds": 3600,
"inputs": {
"Message": "A sample change request has been submitted for your review in Change Manager. You can approve or reject this request.",
"EnhancedApprovals": {
"NotificationArn": "{{ ApproverSnsTopicArn }}",
"Approvers": [
{
"approver": "Admin",
"type": "IamRole",
"minRequiredApprovals": 3
}
]
}
}
}
]
}
```
------
1. Choose **Save and preview**.
1. Review the details of the change template you're creating.
If you want to make change to the change template before submitting it for review, choose **Actions, Edit**.
If you're satisfied with the contents of the change template, choose **Submit for review**. The users in your organization or account who have been specified as template reviewers on the **Settings** tab in Change Manager are notified that a new change template is pending their review.
If an Amazon Simple Notification Service (Amazon SNS) topic has been specified for change templates, notifications are sent when the change template is rejected or approved. If you don't receive notifications related to this change template, you can return to Change Manager later to check on its status.
# Creating change templates using command line tools
**Change Manager availability change**
Amazon Systems Manager Change Manager will no longer be open to new customers starting November 7, 2025. If you would like to use Change Manager, sign up prior to that date. Existing customers can continue to use the service as normal. For more information, see [Amazon Systems Manager Change Manager availability change](https://docs.amazonaws.cn/systems-manager/latest/userguide/change-manager-availability-change.html).
The following procedures describe how to use the Amazon Command Line Interface (Amazon CLI) (on Linux, macOS, or Windows Server) or Amazon Tools for Windows PowerShell to create a change request in Change Manager, a tool in Amazon Systems Manager.
**To create a change template**
1. Install and configure the Amazon CLI or the Amazon Tools for PowerShell, if you haven't already.
For information, see [Installing or updating the latest version of the Amazon CLI](https://docs.amazonaws.cn/cli/latest/userguide/getting-started-install.html) and [Installing the Amazon Tools for PowerShell](https://docs.amazonaws.cn/powershell/latest/userguide/pstools-getting-set-up.html).
1. Create a JSON file on your local machine with a name such as `MyChangeTemplate.json`, and then paste the content for your change template into it.
**Note**
Change templates use a version of schema 0.3 that doesn't include all the same support as for Automation runbooks.
The following is an example.
**Note**
The parameter `minRequiredApprovals` is used to specify how many reviewers at a specified level must approve a change request that is created using this template.
This example demonstrates two levels of approvals. You can specify up to five levels of approvals, but only one level is required.
In the first level, the specific user "John-Doe" must approve each change request. After that, any three members of the IAM role `Admin` must approve the change request.
For more information about approvals for change templates, see [About approvals in your change templates](cm-approvals-templates.md).
```
{
"description": "This change template demonstrates the feature set available for creating
change templates for Change Manager. This template starts a Runbook workflow
for the Automation runbook called AWS-HelloWorld",
"templateInformation": "### Document Name: HelloWorldChangeTemplate\n\n
## What does this document do?\n
This change template demonstrates the feature set available for creating change templates for Change Manager.
This template starts a Runbook workflow for the Automation runbook called AWS-HelloWorld.\n\n
## Input Parameters\n* ApproverSnsTopicArn: (Required) Amazon Simple Notification Service ARN for approvers.\n
* Approver: (Required) The name of the approver to send this request to.\n
* ApproverType: (Required) The type of reviewer. * Allowed Values: IamUser, IamGroup, IamRole, SSOGroup, SSOUser\n\n
## Output Parameters\nThis document has no outputs\n",
"schemaVersion": "0.3",
"parameters": {
"ApproverSnsTopicArn": {
"type": "String",
"description": "Amazon Simple Notification Service ARN for approvers."
},
"Approver": {
"type": "String",
"description": "IAM approver"
},
"ApproverType": {
"type": "String",
"description": "Approver types for the request. Allowed values include IamUser, IamGroup, IamRole, SSOGroup, and SSOUser."
}
},
"executableRunBooks": [
{
"name": "AWS-HelloWorld",
"version": "1"
}
],
"emergencyChange": false,
"autoApprovable": false,
"mainSteps": [
{
"name": "ApproveAction1",
"action": "aws:approve",
"timeoutSeconds": 3600,
"inputs": {
"Message": "A sample change request has been submitted for your review in Change Manager. You can approve or reject this request.",
"EnhancedApprovals": {
"NotificationArn": "{{ ApproverSnsTopicArn }}",
"Approvers": [
{
"approver": "John-Doe",
"type": "IamUser",
"minRequiredApprovals": 1
}
]
}
}
},
{
"name": "ApproveAction2",
"action": "aws:approve",
"timeoutSeconds": 3600,
"inputs": {
"Message": "A sample change request has been submitted for your review in Change Manager. You can approve or reject this request.",
"EnhancedApprovals": {
"NotificationArn": "{{ ApproverSnsTopicArn }}",
"Approvers": [
{
"approver": "Admin",
"type": "IamRole",
"minRequiredApprovals": 3
}
]
}
}
}
]
}
```
1. Run the following command to create the change template.
------
#### [ Linux & macOS ]
```
aws ssm create-document \
--name MyChangeTemplate \
--document-format JSON \
--document-type Automation.ChangeTemplate \
--content file://MyChangeTemplate.json \
--tags Key=tag-key,Value=tag-value
```
------
#### [ Windows ]
```
aws ssm create-document ^
--name MyChangeTemplate ^
--document-format JSON ^
--document-type Automation.ChangeTemplate ^
--content file://MyChangeTemplate.json ^
--tags Key=tag-key,Value=tag-value
```
------
#### [ PowerShell ]
```
$json = Get-Content -Path "C:\path\to\file\MyChangeTemplate.json" | Out-String
New-SSMDocument `
-Content $json `
-Name "MyChangeTemplate" `
-DocumentType "Automation.ChangeTemplate" `
-Tags "Key=tag-key,Value=tag-value"
```
------
For information about other options you can specify, see [https://docs.amazonaws.cn/cli/latest/reference/ssm/create-document.html](https://docs.amazonaws.cn/cli/latest/reference/ssm/create-document.html).
The system returns information like the following.
```
{
"DocumentDescription":{
"CreatedDate":1.585061751738E9,
"DefaultVersion":"1",
"Description":"Use this template to update an EC2 Linux AMI. Requires one
approver specified in the template and an approver specified in the request.",
"DocumentFormat":"JSON",
"DocumentType":"Automation",
"DocumentVersion":"1",
"Hash":"0d3d879b3ca072e03c12638d0255ebd004d2c65bd318f8354fcde820dEXAMPLE",
"HashType":"Sha256",
"LatestVersion":"1",
"Name":"MyChangeTemplate",
"Owner":"123456789012",
"Parameters":[
{
"DefaultValue":"",
"Description":"Level one approvers",
"Name":"LevelOneApprovers",
"Type":"String"
},
{
"DefaultValue":"",
"Description":"Level one approver type",
"Name":"LevelOneApproverType",
"Type":"String"
},
"cloudWatchMonitors": {
"monitors": [
"my-cloudwatch-alarm"
]
}
],
"PlatformTypes":[
"Windows",
"Linux"
],
"SchemaVersion":"0.3",
"Status":"Creating",
"Tags":[
]
}
}
```
The users in your organization or account who have been specified as template reviewers on the **Settings** tab in Change Manager are notified that a new change template is pending their review.
If an Amazon Simple Notification Service (Amazon SNS) topic has been specified for change templates, notifications are sent when the change template is rejected or approved. If you don't receive notifications related to this change template, you can return to Change Manager later to check on its status.
# Reviewing and approving or rejecting change templates
**Change Manager availability change**
Amazon Systems Manager Change Manager will no longer be open to new customers starting November 7, 2025. If you would like to use Change Manager, sign up prior to that date. Existing customers can continue to use the service as normal. For more information, see [Amazon Systems Manager Change Manager availability change](https://docs.amazonaws.cn/systems-manager/latest/userguide/change-manager-availability-change.html).
If you're specified as a reviewer for change templates in Change Manager, a tool in Amazon Systems Manager, you're notified when a new change template, or new version of a change template, is awaiting your review. An Amazon Simple Notification Service (Amazon SNS) topic sends the notifications.
**Note**
This functionality depends on whether your account has been configured to use an Amazon SNS topic to send change template review notifications. For information about specifying a template reviewer notification topic, see [Task 1: Configuring Change Manager user identity management and template reviewers](change-manager-account-setup.md#cm-configure-account-task-1).
To review the change template, follow the link in your notification, sign in to the Amazon Web Services Management Console, and follow the steps in this procedure.
**To review and approve or reject a change template**
1. Open the Amazon Systems Manager console at [https://console.amazonaws.cn/systems-manager/](https://console.amazonaws.cn/systems-manager/).
1. In the navigation pane, choose **Change Manager**.
1. In the **Change templates** section at the bottom of the **Overview** tab, choose the number in **Pending review**.
1. In the **Change templates** list, locate and choose the name of change template to review.
1. In the summary page, review the proposed content of the change template and do one of the following:
+ To approve the change template, which allows it to be used in change requests, choose **Approve**.
+ To reject the change template, which prevents it from being used in change requests, choose **Reject**.
# Deleting change templates
**Change Manager availability change**
Amazon Systems Manager Change Manager will no longer be open to new customers starting November 7, 2025. If you would like to use Change Manager, sign up prior to that date. Existing customers can continue to use the service as normal. For more information, see [Amazon Systems Manager Change Manager availability change](https://docs.amazonaws.cn/systems-manager/latest/userguide/change-manager-availability-change.html).
This topic describes how to delete templates that you have created in Change Manager, a tool in Systems Manager. If you are using Change Manager for an organization, this procedure is performed in your delegated administrator account.
1. Open the Amazon Systems Manager console at [https://console.amazonaws.cn/systems-manager/](https://console.amazonaws.cn/systems-manager/).
1. In the navigation pane, choose **Change Manager**.
1. Choose the **Templates** tab.
1. Choose the name of the template to delete.
1. Choose **Actions, Delete template**.
1. In the confirmation dialog, enter the word **DELETE**, and then choose **Delete**.
# Working with change requests
**Change Manager availability change**
Amazon Systems Manager Change Manager will no longer be open to new customers starting November 7, 2025. If you would like to use Change Manager, sign up prior to that date. Existing customers can continue to use the service as normal. For more information, see [Amazon Systems Manager Change Manager availability change](https://docs.amazonaws.cn/systems-manager/latest/userguide/change-manager-availability-change.html).
A change request is a request in Change Manager to run an Automation runbook that updates one or more resources in your Amazon or on-premises environments. A change request is created using a change template.
When you create a change request in Change Manager, a tool in Amazon Systems Manager, one or more approvers in your organization or account must review and approve the request. Without the required approvals, the runbook workflow, which makes the changes you request, isn't permitted to run.
**Topics**
+ [
# Creating change requests
](change-requests-create.md)
+ [
# Reviewing and approving or rejecting change requests
](change-requests-review.md)
# Creating change requests
**Change Manager availability change**
Amazon Systems Manager Change Manager will no longer be open to new customers starting November 7, 2025. If you would like to use Change Manager, sign up prior to that date. Existing customers can continue to use the service as normal. For more information, see [Amazon Systems Manager Change Manager availability change](https://docs.amazonaws.cn/systems-manager/latest/userguide/change-manager-availability-change.html).
When you create a change request in Change Manager, a tool in Amazon Systems Manager, the change template you select typically does the following:
+ Designates approvers for the change request or specifies how many approvals are required
+ Specifies the Amazon Simple Notification Service (Amazon SNS) topic to use to notify approvers about your change request
+ Specifies an Amazon CloudWatch alarm to monitor the runbook workflow for the change request
+ Identifies which Automation runbooks you can choose from to make the requested change
In some cases, a change template might be configured so you specify your own Automation runbook to use, and to specify who should review and approve the request.
**Important**
If you use Change Manager across an organization, we recommend always making changes from the delegated administrator account. Although you can make changes from other accounts in the organization, those changes won't be reported in or viewable from the delegated administrator account.
**Topics**
+ [
## About change request approvals
](#cm-approvals-requests)
+ [
## Creating change requests (console)
](#change-requests-create-console)
+ [
## Creating change requests (Amazon CLI)
](#change-requests-create-cli)
## About change request approvals
Depending on the requirements specified in a change template, change requests that you create from it can require approvals from up to five *levels* before the runbook workflow for the request can occur. For each of those levels, the template creator could specify up to five potential *approvers*. An approver isn't limited to a single user. An approver in this sense can also be an IAM group or IAM role. For IAM groups and IAM roles, one or more users belonging to the group or role can provide approvals toward receiving the total number of approvals required for a change request. Template creators can also specify more approvers than the change template requires.
**Original approval workflows and updated and/or approvals**
Using change templates created before January 23, 2023, an approval must be received from each specified approver for the change request to be approved at that level. For example, in the approval level setup shown in the following image, four approvers are specified. Specified approvers include two users (John Stiles and Ana Carolina Silva), a user group that contains three members (GroupOfThree), and a user role that represents ten users (RoleOfTen).
![\[Approval level showing four required per-line approvers.\]](http://docs.amazonaws.cn/en_us/systems-manager/latest/userguide/images/Add-approval-1.png)
For the change request to be approved at this level, it must be approved by John Stiles, Ana Carolina Silva, one member of the `GroupOfThree` group, and one member of the `RoleOfTen` role.
Using change templates created on or after January 23, 2023, for each approval level, template creators can specify an overall total number of required approvals. Those approvals can come from any combination of users, groups, and roles that have been specified as approvers. A change template could require only one approval for a level but specify, for example, two individual users, two groups, and one role as potential approvers.
For example, in the approval level area shown in the following image, three approvals are required. The template-specified approvers include two users (John Stiles and Ana Carolina Silva), a user group that contains three members (`GroupOfThree`), and a user role that represents ten users (`RoleOfTen`).
![\[Approval level showing three approvals are required and four specified approvers.\]](http://docs.amazonaws.cn/en_us/systems-manager/latest/userguide/images/Add-approval-2.png)
If all three users in the `GroupOfThree` group approve your change request, it is approved for that level. It's not necessary to receive an approval from each user, group, or role. The minimum number of approvals can come from any combination of potential approvers.
When your change request is created, notifications are sent to subscribers of the Amazon SNS topic that has been specified for approval notifications at that level. The change template creator might have specified the notification topic that must be used or allowed you to specify one.
After the minimum number of required approvals is received at one level, notifications are sent to approvers that are subscribed to the Amazon SNS topic for the next level, and so on.
No matter how many approval levels and approvers are specified, only one rejection to a change request is required to prevent the runbook workflow for that request from occurring.
## Creating change requests (console)
The following procedure describes how to create a change request by using the Systems Manager console.
**To create a change request (console)**
1. Open the Amazon Systems Manager console at [https://console.amazonaws.cn/systems-manager/](https://console.amazonaws.cn/systems-manager/).
1. In the navigation pane, choose **Change Manager**.
1. Choose **Create request**.
1. Search for and select a change template that you want to use for this change request.
1. Choose **Next**.
1. For **Name**, enter a name for the change request that makes its purpose easy to identify, such as **UpdateEC2LinuxAMI-us-east-2**.
1. For **Runbook**, select the runbook you want to use to make your requested change.
**Note**
If the option to select a runbook isn't available, the change template author has specified which runbook must be used.
1. For **Change request information**, use Markdown to provide additional information about the change request to help reviewers decide whether to approve or reject the change request. The author of the template you're using might have provided instructions or questions for you to answer.
**Note**
Markdown is a markup language that allows you to add wiki-style descriptions to documents and individual steps within the document. For more information about using Markdown, see [Using Markdown in Amazon](https://docs.amazonaws.cn/general/latest/gr/aws-markdown.html).
1. In the **Workflow start time** section, choose one of the following:
+ **Run the operation at a scheduled time** – For **Requested start time**, enter the date and time you propose for running the runbook workflow for this request. For **Estimated end time**, enter the date and time that you expect the runbook workflow to complete. (This time is an estimate only that you're providing for reviewers.)
**Tip**
Choose **View Change Calendar** to check for any blocking events for the time you specify.
+ **Run the operation as soon as possible after approval** – If the change request is approved, the runbook workflow runs as soon as there is a non-restricted period when changes can be made.
1. In the **Change request approvals** section, do the following:
1. If **Approval type** options are presented, choose one of the following:
+ **Automatic approval **– The change template you selected is configured to allow change requests to run automatically without review by any approvers. Continue to Step 11.
**Note**
The permissions specified in the IAM policies that govern your use of Systems Manager must not restrict you from submitting auto-approval change requests in order for them to run automatically.
+ **Specify approvers** – You must add one or more users, groups, or IAM roles to review and approve this change request.
**Note**
You can choose to specify reviewers even if the permissions specified in the IAM policies that govern your use of Systems Manager allow you to run auto-approval change requests.
1. Choose **Add approver**, and then select one or more users, groups, or Amazon Identity and Access Management (IAM) roles from the lists of available reviewers.
**Note**
One or more approvers might already be specified. This means that mandatory approvers are already specified in the change template you have selected. These approvers can't be removed from the request. If the **Add approver** button isn't available, the template you have chosen doesn't allow additional reviewers to be added to requests.
For more information about approvals for change requests, see [About change request approvals](#cm-approvals-requests).
1. Under **SNS topic to notify approvers**, choose one of the following to specify the Amazon SNS topic in your account to use for sending notifications to the approvers you are adding to this change request.
**Note**
If the option to specify an Amazon SNS topic isn't available, the change template you selected already specifies the Amazon SNS topic to use.
+ **Enter an SNS Amazon Resource Name (ARN)** – For **Topic ARN**, enter the ARN of an existing Amazon SNS topic. This topic can be in any of your organization's accounts.
+ **Select an existing SNS topic** – For **Target notification topic**, select the ARN of an existing Amazon SNS topic in your current account. (This option isn't available if you haven't yet created any Amazon SNS topics in your current Amazon Web Services account and Amazon Web Services Region.)
**Note**
The Amazon SNS topic you select must be configured to specify the notifications it sends and the subscribers they're sent to. Its access policy must also grant permissions to Systems Manager so Change Manager can send notifications. For information, see [Configuring Amazon SNS topics for Change Manager notifications](change-manager-sns-setup.md).
1. Choose **Add notification**.
1. Choose **Next**.
1. For **IAM role**, select an IAM role *in your current account * that has the permissions needed to run the runbooks that are specified for this change request.
This role is also referred to as the service role, or assume role, for Automation. For more information about this role, see [Setting up Automation](automation-setup.md).
1. In the **Deployment location** section, choose one of the following:
**Note**
If you're using Change Manager with a single Amazon Web Services account only and not with an organization set up in Amazon Organizations, you don't need to specify a deployment location.
+ **Apply change to this account** – The runbook workflow runs in the current account only. For an organization, this means the delegated administrator account.
+ **Apply change to multiple organizational units (OUs)** – Do the following:
1. For **Accounts and organizational units (OUs)**, enter the ID of a member account in your organization, in the format **123456789012**, or the ID of an organizational unit, in the format **o-o96EXAMPLE**.
1. (Optional) For **Execution role name**, enter the name of the IAM role *in the target account* or OU that has the permissions needed to run the runbooks that are specified for this change request. All accounts in any OU you specify should use the same name for this role.
1. (Optional) Choose **Add another target location** for each additional account or OU you want to specify and repeat steps a and b.
1. For **Target Amazon Web Services Region**, select the Region to make the change in, such as `Ohio (us-east-2)` for the US East (Ohio) Region.
1. Expand **Rate control**.
For **Concurrency**, enter a number, then from the list select whether this represents the number or percentage of accounts the runbook workflow can run in at the same time.
For **Error threshold**, enter a number, then from the list select whether this represents the number or percentage of accounts where runbook workflow can fail before the operation is stopped.
1. In the **Deployment targets** section, do the following:
1. Choose one of the following:
+ **Single resource** – The change is to be made for just one resource. For example, a single node or a single Amazon Machine Image (AMI), depending on the operation defined in the runbooks for this change request.
+ **Multiple resources** – For **Parameter**, select from the available parameters from the runbooks for this change request. This selection reflects the type of resource being updated.
For example, if the runbook for this change request is `AWS-RetartEC2Instance`, you might choose `InstanceId`, and then define which instances are updated by selecting from the following:
+ **Specify tags** – Enter a key-value pair that all resources to be updated are tagged with.
+ **Choose a resource group** – Choose the name of the resource group that all resources to be updated belong to.
+ **Specify parameter values** – Identify the resources to update in the **Runbook parameters** section.
+ **Target all instances** – Make the change on all managed nodes in the target locations.
1. If you chose **Multiple resources**, expand **Rate control**.
For **Concurrency**, enter a number, then from the list select whether this represents the number or percentage of targets the runbook workflow can update at the same time.
For **Error threshold**, enter a number, then from the list select whether this represents the number or percentage of targets where the update can fail before the operation is stopped.
1. If you chose **Specify parameter values** to update multiple resources in the previous step: In the **Runbook parameters** section, specify values for the required input parameters. The parameter values you must supply are based on the contents of the Automation runbooks associated with the change template you chose.
For example, if the change template uses the `AWS-RetartEC2Instance` runbook, then you must enter one or more instance IDs for the **InstanceId** parameter. Alternatively, choose **Show interactive instance picker** and select available instances one by one.
1. Choose **Next**.
1. In the **Review and submit** page, double-check the resources and options you have specified for this change request.
Choose the **Edit** button for any section you want to make changes to.
When you're satisfied with the change request details, choose **Submit for approval**.
If an Amazon SNS topic has been specified in the change template you chose for the request, notifications are sent when the request is rejected or approved. If you don't receive notifications for the request, you can return to Change Manager to check the status of your request.
## Creating change requests (Amazon CLI)
You can create a change request using the Amazon Command Line Interface (Amazon CLI) by specifying options and parameters for the change request in a JSON file and using the `--cli-input-json` option to include it in your command.
**To create a change request (Amazon CLI)**
1. Install and configure the Amazon CLI or the Amazon Tools for PowerShell, if you haven't already.
For information, see [Installing or updating the latest version of the Amazon CLI](https://docs.amazonaws.cn/cli/latest/userguide/getting-started-install.html) and [Installing the Amazon Tools for PowerShell](https://docs.amazonaws.cn/powershell/latest/userguide/pstools-getting-set-up.html).
1. Create a JSON file on your local machine with a name such as `MyChangeRequest.json` and paste the following content into it.
Replace *placeholders* with values for your change request.
**Note**
This sample JSON creates a change request using the `AWS-HelloWorldChangeTemplate` change template and `AWS-HelloWorld` runbook. To help you adapt this sample for your own change requests, see [https://docs.amazonaws.cn/systems-manager/latest/APIReference/API_StartChangeRequestExecution.html](https://docs.amazonaws.cn/systems-manager/latest/APIReference/API_StartChangeRequestExecution.html) in the *Amazon Systems Manager API Reference* for information about all available parameters
For more information about approvals for change requests, see [About change request approvals](#cm-approvals-requests).
```
{
"ChangeRequestName": "MyChangeRequest",
"DocumentName": "AWS-HelloWorldChangeTemplate",
"DocumentVersion": "$DEFAULT",
"ScheduledTime": "2021-12-30T03:00:00",
"ScheduledEndTime": "2021-12-30T03:05:00",
"Tags": [
{
"Key": "Purpose",
"Value": "Testing"
}
],
"Parameters": {
"Approver": [
"JohnDoe"
],
"ApproverType": [
"IamUser"
],
"ApproverSnsTopicArn": [
"arn:aws:sns:us-east-2:123456789012:MyNotificationTopic"
]
},
"Runbooks": [
{
"DocumentName": "AWS-HelloWorld",
"DocumentVersion": "1",
"MaxConcurrency": "1",
"MaxErrors": "1",
"Parameters": {
"AutomationAssumeRole": [
"arn:aws:iam::123456789012:role/MyChangeManagerAssumeRole"
]
}
}
],
"ChangeDetails": "### Document Name: HelloWorldChangeTemplate\n\n## What does this document do?\nThis change template demonstrates the feature set available for creating change templates for Change Manager. This template starts a Runbook workflow for the Automation document called AWS-HelloWorld.\n\n## Input Parameters\n* ApproverSnsTopicArn: (Required) Amazon Simple Notification Service ARN for approvers.\n* Approver: (Required) The name of the approver to send this request to.\n* ApproverType: (Required) The type of reviewer.\n * Allowed Values: IamUser, IamGroup, IamRole, SSOGroup, SSOUser\n\n## Output Parameters\nThis document has no outputs \n"
}
```
1. In the directory where you created the JSON file, run the following command.
```
aws ssm start-change-request-execution --cli-input-json file://MyChangeRequest.json
```
The system returns information like the following.
```
{
"AutomationExecutionId": "b3c1357a-5756-4839-8617-2d2a4EXAMPLE"
}
```
# Reviewing and approving or rejecting change requests
**Change Manager availability change**
Amazon Systems Manager Change Manager will no longer be open to new customers starting November 7, 2025. If you would like to use Change Manager, sign up prior to that date. Existing customers can continue to use the service as normal. For more information, see [Amazon Systems Manager Change Manager availability change](https://docs.amazonaws.cn/systems-manager/latest/userguide/change-manager-availability-change.html).
If you're specified as a reviewer for a change request in Change Manager, a tool in Amazon Systems Manager, you're notified through an Amazon Simple Notification Service (Amazon SNS) topic when a new change request is awaiting your review.
**Note**
This functionality depends on whether an Amazon SNS was specified in the change template for sending review notifications. For information, see [Configuring Amazon SNS topics for Change Manager notifications](change-manager-sns-setup.md).
To review the change request, you can follow the link in your notification, or sign in to the Amazon Web Services Management Console directly and follow the steps in this procedure.
**Note**
If an Amazon SNS topic is assigned for reviewers in a change template, notifications are sent to the topic's subscribers when the change request changes status.
For more information about approvals for change requests, see [About change request approvals](change-requests-create.md#cm-approvals-requests).
## Reviewing and approving or rejecting change requests (console)
The following procedures describe how to use the Systems Manager console to review and approve or reject change requests.
**To review and approve or reject a single change request**
1. Open the link in the email notification you received and sign in to the Amazon Web Services Management Console, which directs you to the change request for your review.
1. In the summary page, review the proposed content of the change request.
To approve the change request, choose **Approve**. In the dialog box, provide any comments you want to add for this approval, and then choose **Approve**. The runbook workflow represented by this request starts to run either when scheduled, or as soon as changes aren't blocked by any restrictions.
-or-
To reject the change request, choose **Reject**. In the dialog box, provide any comments you want to add for this rejection, and then choose **Reject**.
**To review and approve or reject change requests in bulk**
1. Open the Amazon Systems Manager console at [https://console.amazonaws.cn/systems-manager/](https://console.amazonaws.cn/systems-manager/).
1. In the navigation pane, choose **Change Manager**.
1. Choose the **Approvals** tab.
1. (Optional) Review the details of requests pending your approval by choosing the name of each request, and then return to the **Approvals** tab.
1. Select the check box of each change request that you want to approve.
-or-
Select the check box of each change request that you want to reject.
1. In the dialog box, provide any comments you want to add for this approval or rejection.
1. Depending on whether you're approving or rejecting the selected change requests, choose **Approve** or **Reject**.
## Reviewing and approving or rejecting a change request (command line)
The following procedure describes how to use the Amazon Command Line Interface (Amazon CLI) (on Linux, macOS, or Windows Server) to review and approve or reject a change request.
**To review and approve or reject a change request**
1. Install and configure the Amazon Command Line Interface (Amazon CLI), if you haven't already.
For information, see [Installing or updating the latest version of the Amazon CLI](https://docs.amazonaws.cn/cli/latest/userguide/getting-started-install.html).
1. Create a JSON file on your local machine that specifies the parameters for your Amazon CLI call.
```
{
"OpsItemFilters":
[
{
"Key": "OpsItemType",
"Values": ["/aws/changerequest"],
"Operator": "Equal"
}
],
"MaxResults": number
}
```
You can filter the results for a specific approver by specifying the approver's Amazon Resource Name (ARN) in the JSON file. Here is an example.
```
{
"OpsItemFilters":
[
{
"Key": "OpsItemType",
"Values": ["/aws/changerequest"],
"Operator": "Equal"
},
{
"Key": "ChangeRequestByApproverArn",
"Values": ["arn:aws-cn:iam::account-id:user/user-name"],
"Operator": "Equal"
}
],
"MaxResults": number
}
```
1. Run the following command to view the maximum number of change requests you specified in the JSON file.
------
#### [ Linux & macOS ]
```
aws ssm describe-ops-items \
--cli-input-json file://filename.json
```
------
#### [ Windows ]
```
aws ssm describe-ops-items ^
--cli-input-json file://filename.json
```
------
1. Run the following command to approve or reject a change request.
------
#### [ Linux & macOS ]
```
aws ssm send-automation-signal \
--automation-execution-id ID \
--signal-type Approve_or_Reject \
--payload Comment="message"
```
------
#### [ Windows ]
```
aws ssm send-automation-signal ^
--automation-execution-id ID ^
--signal-type Approve_or_Reject ^
--payload Comment="message"
```
------
If an Amazon SNS topic has been specified in the change template you chose for the request, notifications are sent when the request is rejected or approved. If you don't receive notifications for the request, you can return to Change Manager to check the status of your request. For information about other options when using this command, see [https://docs.amazonaws.cn/cli/latest/reference/ssm/send-automation-signal.html](https://docs.amazonaws.cn/cli/latest/reference/ssm/send-automation-signal.html) in the Amazon Systems Manager section of the *Amazon CLI Command Reference*.
# Reviewing change request details, tasks, and timelines (console)
**Change Manager availability change**
Amazon Systems Manager Change Manager will no longer be open to new customers starting November 7, 2025. If you would like to use Change Manager, sign up prior to that date. Existing customers can continue to use the service as normal. For more information, see [Amazon Systems Manager Change Manager availability change](https://docs.amazonaws.cn/systems-manager/latest/userguide/change-manager-availability-change.html).
You can view information about a change request, including requests for which changes have already been processed, in the dashboard of Change Manager, a tool in Amazon Systems Manager. These details include a link to the Automation operation that runs the runbooks that make the change. An Automation execution ID is generated when the request is created, but the process doesn't run until all approvals have been given and no restrictions are in place to block the change.
**To review change request details, tasks, and timelines**
1. In the navigation pane, choose **Change Manager**.
1. Choose the **Requests** tab.
1. In the **Change requests** section, search for the change request you want to review.
You can use the **Create date range** options to limit results to a specific time period.
You can filter requests by the following properties:
+ `Status`
+ `Request ID`
+ `Approver`
+ `Requester`
For example, to view details about all change requests that have completed successfully in the past 24 hours, do the following:
1. For **Create date range**, choose **1d**.
1. In the search box, select **Status, CompletedWithSuccess**.
1. In the results, choose the name of the successfully completed change request to review results for.
1. View information about the change request on the following tabs:
+ **Request details** – View basic details about the change request, including the requester, the change template, and the Automation runbooks selected for the change. You can also follow a link to the Automation operation details and view information about any runbook parameters specified in the request, Amazon CloudWatch alarms assigned to the change request, and approvals and comments provided for the request.
+ **Task** – View information about the task in the change, including task status for completed change requests, the targeted resources, the steps in the associated Automation runbooks, and concurrency and error threshold details.
+ **Timeline** – View a summary of all events associated with the change request, listed by date and time. The summary indicates when the change request was created, actions by assigned approvers, a note of when approved change requests are scheduled to run, runbook workflow details, and status changes for the overall change process and each step in the runbook.
+ **Associated events** – View auditable details about change requests that are recorded in [Amazon CloudTrail Lake](https://docs.amazonaws.cn/awscloudtrail/latest/userguide/cloudtrail-lake.html). Details include which API actions were run, the request parameters included for those actions, the user account that ran the action, the resources updated during the process, and more.
When you enable CloudTrail Lake event tracking, CloudTrail Lake creates an event data store for events related to your change requests. The event details are available for the account or organization where the change request ran. You can turn on CloudTrail Lake event tracking from any change request in your account or organization. For information about enabling CloudTrail Lake integration and creating an event data store, see [Monitoring your change request events](monitoring-change-request-events.md).
**Note**
There is a charge to use **CloudTrail Lake**. For details, see [Amazon CloudTrail pricing](https://www.amazonaws.cn/cloudtrail/pricing/).
# Viewing aggregated counts of change requests (command line)
**Change Manager availability change**
Amazon Systems Manager Change Manager will no longer be open to new customers starting November 7, 2025. If you would like to use Change Manager, sign up prior to that date. Existing customers can continue to use the service as normal. For more information, see [Amazon Systems Manager Change Manager availability change](https://docs.amazonaws.cn/systems-manager/latest/userguide/change-manager-availability-change.html).
You can view aggregated counts of change requests in Change Manager, a tool in Amazon Systems Manager, by using the [GetOpsSummary](https://docs.amazonaws.cn/systems-manager/latest/APIReference/API_GetOpsSummary.html) API operation. This API operation can return counts for a single Amazon Web Services account in a single Amazon Web Services Region or for multiple accounts and multiple Regions.
**Note**
If you want to view aggregated counts of change requests for multiple Amazon Web Services accounts and multiple Amazon Web Services Regions, you must set up and configure a resource data sync. For more information, see [Creating a resource data sync for Inventory](inventory-create-resource-data-sync.md).
The following procedure describes how to use the Amazon Command Line Interface (Amazon CLI) (on Linux, macOS, or Windows Server) to view aggregated counts of change requests.
**To view aggregated counts of change requests**
1. Install and configure the Amazon Command Line Interface (Amazon CLI), if you haven't already.
For information, see [Installing or updating the latest version of the Amazon CLI](https://docs.amazonaws.cn/cli/latest/userguide/getting-started-install.html).
1. Run one of the following commands.
**Single account and Region**
This command returns a count of all change requests for the Amazon Web Services account and Amazon Web Services Region for which your Amazon CLI session is configured.
------
#### [ Linux & macOS ]
```
aws ssm get-ops-summary \
--filters Key=AWS:OpsItem.OpsItemType,Values="/aws/changerequests",Type=Equal \
--aggregators AggregatorType=count,AttributeName=Status,TypeName=AWS:OpsItem
```
------
#### [ Windows ]
```
aws ssm get-ops-summary ^
--filters Key=AWS:OpsItem.OpsItemType,Values="/aws/changerequests",Type=Equal ^
--aggregators AggregatorType=count,AttributeName=Status,TypeName=AWS:OpsItem
```
------
The call returns information like the following.
```
{
"Entities": [
{
"Data": {
"AWS:OpsItem": {
"Content": [
{
"Count": "38",
"Status": "Open"
}
]
}
}
}
]
}
```
**Multiple accounts and/or Regions**
This command returns a count of all change requests for the Amazon Web Services accounts and Amazon Web Services Regions specified in the resource data sync.
------
#### [ Linux & macOS ]
```
aws ssm get-ops-summary \
--sync-name resource_data_sync_name \
--filters Key=AWS:OpsItem.OpsItemType,Values="/aws/changerequests",Type=Equal \
--aggregators AggregatorType=count,AttributeName=Status,TypeName=AWS:OpsItem
```
------
#### [ Windows ]
```
aws ssm get-ops-summary ^
--sync-name resource_data_sync_name ^
--filters Key=AWS:OpsItem.OpsItemType,Values="/aws/changerequests",Type=Equal ^
--aggregators AggregatorType=count,AttributeName=Status,TypeName=AWS:OpsItem
```
------
The call returns information like the following.
```
{
"Entities": [
{
"Data": {
"AWS:OpsItem": {
"Content": [
{
"Count": "43",
"Status": "Open"
},
{
"Count": "2",
"Status": "Resolved"
}
]
}
}
}
]
}
```
**Multiple accounts and a specific Region**
This command returns a count of all change requests for the Amazon Web Services accounts specified in the resource data sync. However, it only returns data from the Region specified in the command.
------
#### [ Linux & macOS ]
```
aws ssm get-ops-summary \
--sync-name resource_data_sync_name \
--filters Key=AWS:OpsItem.SourceRegion,Values='Region',Type=Equal Key=AWS:OpsItem.OpsItemType,Values="/aws/changerequests",Type=Equal \
--aggregators AggregatorType=count,AttributeName=Status,TypeName=AWS:OpsItem
```
------
#### [ Windows ]
```
aws ssm get-ops-summary ^
--sync-name resource_data_sync_name ^
--filters Key=AWS:OpsItem.SourceRegion,Values='Region',Type=Equal Key=AWS:OpsItem.OpsItemType,Values="/aws/changerequests",Type=Equal ^
--aggregators AggregatorType=count,AttributeName=Status,TypeName=AWS:OpsItem
```
------
**Multiple accounts and Regions with output grouped by Region**
This command returns a count of all change requests for the Amazon Web Services accounts and Amazon Web Services Regions specified in the resource data sync. The output displays count information per Region.
------
#### [ Linux & macOS ]
```
aws ssm get-ops-summary \
--sync-name resource_data_sync_name \
--filters Key=AWS:OpsItem.OpsItemType,Values="/aws/changerequests",Type=Equal \
--aggregators '[{"AggregatorType":"count","TypeName":"AWS:OpsItem","AttributeName":"Status","Aggregators":[{"AggregatorType":"count","TypeName":"AWS:OpsItem","AttributeName":"SourceRegion"}]}]'
```
------
#### [ Windows ]
```
aws ssm get-ops-summary ^
--sync-name resource_data_sync_name ^
--filters Key=AWS:OpsItem.OpsItemType,Values="/aws/changerequests",Type=Equal ^
--aggregators '[{"AggregatorType":"count","TypeName":"AWS:OpsItem","AttributeName":"Status","Aggregators":[{"AggregatorType":"count","TypeName":"AWS:OpsItem","AttributeName":"SourceRegion"}]}]'
```
------
The call returns information like the following.
```
{
"Entities": [
{
"Data": {
"AWS:OpsItem": {
"Content": [
{
"Count": "38",
"SourceRegion": "us-east-1",
"Status": "Open"
},
{
"Count": "4",
"SourceRegion": "us-east-2",
"Status": "Open"
},
{
"Count": "1",
"SourceRegion": "us-west-1",
"Status": "Open"
},
{
"Count": "2",
"SourceRegion": "us-east-2",
"Status": "Resolved"
}
]
}
}
}
]
}
```
**Multiple accounts and Regions with output grouped by accounts and Regions**
This command returns a count of all change requests for the Amazon Web Services accounts and Amazon Web Services Regions specified in the resource data sync. The output groups the count information by accounts and Regions.
------
#### [ Linux & macOS ]
```
aws ssm get-ops-summary \
--sync-name resource_data_sync_name \
--filters Key=AWS:OpsItem.OpsItemType,Values="/aws/changerequests",Type=Equal \
--aggregators '[{"AggregatorType":"count","TypeName":"AWS:OpsItem","AttributeName":"Status","Aggregators":[{"AggregatorType":"count","TypeName":"AWS:OpsItem","AttributeName":"SourceAccountId","Aggregators":[{"AggregatorType":"count","TypeName":"AWS:OpsItem","AttributeName":"SourceRegion"}]}]}]'
```
------
#### [ Windows ]
```
aws ssm get-ops-summary ^
--sync-name resource_data_sync_name ^
--filters Key=AWS:OpsItem.OpsItemType,Values="/aws/changerequests",Type=Equal ^
--aggregators '[{"AggregatorType":"count","TypeName":"AWS:OpsItem","AttributeName":"Status","Aggregators":[{"AggregatorType":"count","TypeName":"AWS:OpsItem","AttributeName":"SourceAccountId","Aggregators":[{"AggregatorType":"count","TypeName":"AWS:OpsItem","AttributeName":"SourceRegion"}]}]}]'
```
------
The call returns information like the following.
```
{
"Entities": [
{
"Data": {
"AWS:OpsItem": {
"Content": [
{
"Count": "38",
"SourceAccountId": "123456789012",
"SourceRegion": "us-east-1",
"Status": "Open"
},
{
"Count": "4",
"SourceAccountId": "111122223333",
"SourceRegion": "us-east-2",
"Status": "Open"
},
{
"Count": "1",
"SourceAccountId": "111122223333",
"SourceRegion": "us-west-1",
"Status": "Open"
},
{
"Count": "2",
"SourceAccountId": "444455556666",
"SourceRegion": "us-east-2",
"Status": "Resolved"
},
{
"Count": "1",
"SourceAccountId": "222222222222",
"SourceRegion": "us-east-1",
"Status": "Open"
}
]
}
}
}
]
}
```