Make an SSM Automation approval step expire with a defined failure path

A manual approval is an execution step with approvers, a threshold and a bounded wait.

Source facts

The aws:approve Automation action pauses a runbook until designated principals approve or reject the action. Execution resumes after the required approval count is met. AWS documents a seven-day default timeout and a thirty-day maximum, adjustable with timeoutSeconds. The action does not support multi-account and Region automations. MinRequiredApprovals cannot exceed the number of configured approvers.

Source: AWS — aws:approve – Pause an automation for manual approval.

Applicability

This applies to the aws:approve runbook action. It does not establish an organization’s change policy or imply that notification delivery constitutes an approval.

DSE recommendation

DSE recommends placing the approval immediately before the consequential operation and supplying a readable description of its target and impact. Select principals who can assess that change and decide how rejection, expiry and approver absence should be handled. Set an explicit timeout that fits the maintenance window. Keep execution permissions and the authority to approve distinct in the documented runbook ownership model. Write an explicit operational response for a missed approval window, including whether the target and change description must be reviewed again. Ask approvers to verify the actual execution target rather than accepting an approval message solely because its runbook name is familiar.

Verification

Proposed verification: run a harmless approval workflow in a test account. Exercise approval, rejection and timeout paths, and inspect the resulting step states. Verify the configured threshold with multiple approvers where applicable. Retain the execution ID, reviewed message and decision history before applying the runbook to production targets.

Official reference

AWS — aws:approve – Pause an automation for manual approval. Reviewed October 20, 2026.