# Make an SSM Automation approval step expire with a defined failure path

> A manual approval is an execution step with approvers, a threshold and a bounded wait.

- Canonical URL: https://update.dsesecurity.com/updates/aws-ssm-automation-manual-approval-timeout/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-20T18:14:06+00:00
- Modified: 2026-10-20T18:34:30+00:00
- Last reviewed by DSE: 2026-10-20
- Resource type: Guide
- DSE priority: Information
- Topics: Business Continuity, Cybersecurity, IT
- Reading time: 2 minutes

## What you need to know

A manual approval is an execution step with approvers, a threshold and a bounded wait.

## Potentially affected

This applies to the aws:approve runbook action. It does not establish an organization’s change policy or imply that notification delivery constitutes an approval.

## DSE recommendation

DSE recommends placing the approval immediately before the consequential operation and supplying a readable description of its target and impact.

## Article

A manual approval is an execution step with approvers, a threshold and a bounded wait.

## Source facts

The aws:approve Automation action pauses a runbook until designated principals approve or reject the action. Execution resumes after the required approval count is met. AWS documents a seven-day default timeout and a thirty-day maximum, adjustable with timeoutSeconds. The action does not support multi-account and Region automations. MinRequiredApprovals cannot exceed the number of configured approvers.

Source: [AWS — aws:approve – Pause an automation for manual approval](https://docs.aws.amazon.com/systems-manager/latest/userguide/automation-action-approve.html).

## Applicability

This applies to the aws:approve runbook action. It does not establish an organization’s change policy or imply that notification delivery constitutes an approval.

## DSE recommendation

DSE recommends placing the approval immediately before the consequential operation and supplying a readable description of its target and impact. Select principals who can assess that change and decide how rejection, expiry and approver absence should be handled. Set an explicit timeout that fits the maintenance window. Keep execution permissions and the authority to approve distinct in the documented runbook ownership model. Write an explicit operational response for a missed approval window, including whether the target and change description must be reviewed again. Ask approvers to verify the actual execution target rather than accepting an approval message solely because its runbook name is familiar.

## Verification

Proposed verification: run a harmless approval workflow in a test account. Exercise approval, rejection and timeout paths, and inspect the resulting step states. Verify the configured threshold with multiple approvers where applicable. Retain the execution ID, reviewed message and decision history before applying the runbook to production targets.

## Official reference

[AWS — aws:approve – Pause an automation for manual approval](https://docs.aws.amazon.com/systems-manager/latest/userguide/automation-action-approve.html). Reviewed October 20, 2026.

## Primary reference

- Name: AWS — aws:approve – Pause an automation for manual approval
- Authority: docs.aws.amazon.com
- URL: https://docs.aws.amazon.com/systems-manager/latest/userguide/automation-action-approve.html
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Make an SSM Automation approval step expire with a defined failure path,” DSE Security, https://update.dsesecurity.com/updates/aws-ssm-automation-manual-approval-timeout/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.