{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/aws-ssm-automation-manual-approval-timeout/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/aws-ssm-automation-manual-approval-timeout/",
        "slug": "aws-ssm-automation-manual-approval-timeout",
        "url": "https://update.dsesecurity.com/updates/aws-ssm-automation-manual-approval-timeout/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/aws-ssm-automation-manual-approval-timeout.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/aws-ssm-automation-manual-approval-timeout/"
        },
        "title": "Make an SSM Automation approval step expire with a defined failure path",
        "summary": "A manual approval is an execution step with approvers, a threshold and a bounded wait.",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "continuity-recovery",
            "label": "Continuity & recovery",
            "alt": "Paired infrastructure paths converging on a stable recovered service.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "business-continuity",
                "name": "Business Continuity",
                "url": "https://update.dsesecurity.com/topic/business-continuity/"
            },
            {
                "slug": "cybersecurity",
                "name": "Cybersecurity",
                "url": "https://update.dsesecurity.com/topic/cybersecurity/"
            },
            {
                "slug": "it",
                "name": "IT",
                "url": "https://update.dsesecurity.com/topic/it/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-10-20T18:14:06+00:00",
        "modified_at": "2026-10-20T18:34:30+00:00",
        "reviewed_on": "2026-10-20",
        "reading_minutes": 2,
        "word_count": 276,
        "potentially_affected": "This applies to the aws:approve runbook action. It does not establish an organization’s change policy or imply that notification delivery constitutes an approval.",
        "dse_recommendation": "DSE recommends placing the approval immediately before the consequential operation and supplying a readable description of its target and impact.",
        "primary_source": {
            "name": "AWS — aws:approve – Pause an automation for manual approval",
            "url": "https://docs.aws.amazon.com/systems-manager/latest/userguide/automation-action-approve.html",
            "published_on": null,
            "authority": "docs.aws.amazon.com"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<p>A manual approval is an execution step with approvers, a threshold and a bounded wait.</p>\n<h2>Source facts</h2>\n<p>The aws:approve Automation action pauses a runbook until designated principals approve or reject the action. Execution resumes after the required approval count is met. AWS documents a seven-day default timeout and a thirty-day maximum, adjustable with timeoutSeconds. The action does not support multi-account and Region automations. MinRequiredApprovals cannot exceed the number of configured approvers.</p>\n<p>Source: <a href=\"https://docs.aws.amazon.com/systems-manager/latest/userguide/automation-action-approve.html\">AWS — aws:approve – Pause an automation for manual approval</a>.</p>\n<h2>Applicability</h2>\n<p>This applies to the aws:approve runbook action. It does not establish an organization’s change policy or imply that notification delivery constitutes an approval.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends placing the approval immediately before the consequential operation and supplying a readable description of its target and impact. Select principals who can assess that change and decide how rejection, expiry and approver absence should be handled. Set an explicit timeout that fits the maintenance window. Keep execution permissions and the authority to approve distinct in the documented runbook ownership model. Write an explicit operational response for a missed approval window, including whether the target and change description must be reviewed again. Ask approvers to verify the actual execution target rather than accepting an approval message solely because its runbook name is familiar.</p>\n<h2>Verification</h2>\n<p>Proposed verification: run a harmless approval workflow in a test account. Exercise approval, rejection and timeout paths, and inspect the resulting step states. Verify the configured threshold with multiple approvers where applicable. Retain the execution ID, reviewed message and decision history before applying the runbook to production targets.</p>\n<h2>Official reference</h2>\n<p><a href=\"https://docs.aws.amazon.com/systems-manager/latest/userguide/automation-action-approve.html\">AWS — aws:approve – Pause an automation for manual approval</a>. Reviewed October 20, 2026.</p>",
        "content_text": "A manual approval is an execution step with approvers, a threshold and a bounded wait.\nSource facts\nThe aws:approve Automation action pauses a runbook until designated principals approve or reject the action. Execution resumes after the required approval count is met. AWS documents a seven-day default timeout and a thirty-day maximum, adjustable with timeoutSeconds. The action does not support multi-account and Region automations. MinRequiredApprovals cannot exceed the number of configured approvers.\nSource: AWS — aws:approve – Pause an automation for manual approval.\nApplicability\nThis applies to the aws:approve runbook action. It does not establish an organization’s change policy or imply that notification delivery constitutes an approval.\nDSE recommendation\nDSE recommends placing the approval immediately before the consequential operation and supplying a readable description of its target and impact. Select principals who can assess that change and decide how rejection, expiry and approver absence should be handled. Set an explicit timeout that fits the maintenance window. Keep execution permissions and the authority to approve distinct in the documented runbook ownership model. Write an explicit operational response for a missed approval window, including whether the target and change description must be reviewed again. Ask approvers to verify the actual execution target rather than accepting an approval message solely because its runbook name is familiar.\nVerification\nProposed verification: run a harmless approval workflow in a test account. Exercise approval, rejection and timeout paths, and inspect the resulting step states. Verify the configured threshold with multiple approvers where applicable. Retain the execution ID, reviewed message and decision history before applying the runbook to production targets.\nOfficial reference\nAWS — aws:approve – Pause an automation for manual approval. Reviewed October 20, 2026.",
        "content_markdown": "A manual approval is an execution step with approvers, a threshold and a bounded wait.\n\n## Source facts\n\nThe aws:approve Automation action pauses a runbook until designated principals approve or reject the action. Execution resumes after the required approval count is met. AWS documents a seven-day default timeout and a thirty-day maximum, adjustable with timeoutSeconds. The action does not support multi-account and Region automations. MinRequiredApprovals cannot exceed the number of configured approvers.\n\nSource: [AWS — aws:approve – Pause an automation for manual approval](https://docs.aws.amazon.com/systems-manager/latest/userguide/automation-action-approve.html).\n\n## Applicability\n\nThis applies to the aws:approve runbook action. It does not establish an organization’s change policy or imply that notification delivery constitutes an approval.\n\n## DSE recommendation\n\nDSE recommends placing the approval immediately before the consequential operation and supplying a readable description of its target and impact. Select principals who can assess that change and decide how rejection, expiry and approver absence should be handled. Set an explicit timeout that fits the maintenance window. Keep execution permissions and the authority to approve distinct in the documented runbook ownership model. Write an explicit operational response for a missed approval window, including whether the target and change description must be reviewed again. Ask approvers to verify the actual execution target rather than accepting an approval message solely because its runbook name is familiar.\n\n## Verification\n\nProposed verification: run a harmless approval workflow in a test account. Exercise approval, rejection and timeout paths, and inspect the resulting step states. Verify the configured threshold with multiple approvers where applicable. Retain the execution ID, reviewed message and decision history before applying the runbook to production targets.\n\n## Official reference\n\n[AWS — aws:approve – Pause an automation for manual approval](https://docs.aws.amazon.com/systems-manager/latest/userguide/automation-action-approve.html). Reviewed October 20, 2026."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/aws-ssm-automation-manual-approval-timeout/",
                "url": "https://update.dsesecurity.com/updates/aws-ssm-automation-manual-approval-timeout/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-10-20"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/aws-ssm-automation-manual-approval-timeout/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Business Continuity",
                        "item": "https://update.dsesecurity.com/topic/business-continuity/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 3,
                        "name": "Make an SSM Automation approval step expire with a defined failure path",
                        "item": "https://update.dsesecurity.com/updates/aws-ssm-automation-manual-approval-timeout/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/aws-ssm-automation-manual-approval-timeout/#article",
                "identifier": "https://update.dsesecurity.com/updates/aws-ssm-automation-manual-approval-timeout/",
                "url": "https://update.dsesecurity.com/updates/aws-ssm-automation-manual-approval-timeout/",
                "headline": "Make an SSM Automation approval step expire with a defined failure path",
                "description": "A manual approval is an execution step with approvers, a threshold and a bounded wait.",
                "abstract": "A manual approval is an execution step with approvers, a threshold and a bounded wait.",
                "articleBody": "A manual approval is an execution step with approvers, a threshold and a bounded wait.\nSource facts\nThe aws:approve Automation action pauses a runbook until designated principals approve or reject the action. Execution resumes after the required approval count is met. AWS documents a seven-day default timeout and a thirty-day maximum, adjustable with timeoutSeconds. The action does not support multi-account and Region automations. MinRequiredApprovals cannot exceed the number of configured approvers.\nSource: AWS — aws:approve – Pause an automation for manual approval.\nApplicability\nThis applies to the aws:approve runbook action. It does not establish an organization’s change policy or imply that notification delivery constitutes an approval.\nDSE recommendation\nDSE recommends placing the approval immediately before the consequential operation and supplying a readable description of its target and impact. Select principals who can assess that change and decide how rejection, expiry and approver absence should be handled. Set an explicit timeout that fits the maintenance window. Keep execution permissions and the authority to approve distinct in the documented runbook ownership model. Write an explicit operational response for a missed approval window, including whether the target and change description must be reviewed again. Ask approvers to verify the actual execution target rather than accepting an approval message solely because its runbook name is familiar.\nVerification\nProposed verification: run a harmless approval workflow in a test account. Exercise approval, rejection and timeout paths, and inspect the resulting step states. Verify the configured threshold with multiple approvers where applicable. Retain the execution ID, reviewed message and decision history before applying the runbook to production targets.\nOfficial reference\nAWS — aws:approve – Pause an automation for manual approval. Reviewed October 20, 2026.",
                "datePublished": "2026-10-20T18:14:06+00:00",
                "dateModified": "2026-10-20T18:34:30+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/aws-ssm-automation-manual-approval-timeout/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/aws-ssm-automation-manual-approval-timeout/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/continuity-recovery-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Make an SSM Automation approval step expire with a defined failure path"
                },
                "articleSection": [
                    "Business Continuity",
                    "Cybersecurity",
                    "IT"
                ],
                "keywords": [
                    "Business Continuity",
                    "Cybersecurity",
                    "IT",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Business Continuity",
                        "url": "https://update.dsesecurity.com/topic/business-continuity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "Cybersecurity",
                        "url": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "IT",
                        "url": "https://update.dsesecurity.com/topic/it/"
                    }
                ],
                "wordCount": 276,
                "timeRequired": "PT2M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "AWS — aws:approve – Pause an automation for manual approval",
                    "url": "https://docs.aws.amazon.com/systems-manager/latest/userguide/automation-action-approve.html"
                }
            }
        ]
    }
}