Back to Checks
aws

SSM Incidents replication set is ACTIVE and has at least one response plan

ssmincidents_enabled_with_plans
Service: ssmincidentsSeverity: medium
OfficialBuilt-inVerified
Categories:resilience
Resource Type:Other

Incident Manager uses a replication set and response plans. This evaluates whether a replication set exists and is ACTIVE, and that at least one response plan is configured for coordinated incident handling.

Prowler logoProwlerprowler-provider-aws

Risk

Without an ACTIVE replication set or response plans, incidents lack coordinated engagement and automation, raising MTTR and impacting availability and integrity.

Threats include prolonged outages, lateral movement, and data exfiltration from delayed containment and misrouted escalation.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks ssmincidents_enabled_with_plans

Recommendation

Establish an ACTIVE replication set and create response plans that define engagement, escalation, runbooks, severity, and communication.

Apply least privilege to automation roles, test plans regularly, integrate with monitoring to trigger them, and use defense in depth with redundant contacts and Regions.

Remediation

Terraform

# Ensure replication set exists and becomes ACTIVE
resource "aws_ssmincidents_replication_set" "example" {
  regions {                      # Critical: creates the replication set so it can be ACTIVE
    region_name = "us-east-1"
  }
}

# Create a minimal response plan
resource "aws_ssmincidents_response_plan" "example" {
  name = "<example_resource_name>"  # Critical: ensures at least one response plan exists

  incident_template {                # Critical: required template for the plan
    title  = "<example_title>"
    impact = 5
  }
}

NativeIaC

# CloudFormation: create a minimal Incident Manager response plan
Resources:
  ResponsePlan:
    Type: AWS::SSMIncidents::ResponsePlan
    Properties:
      Name: <example_resource_name>  # Critical: ensures at least one response plan exists
      IncidentTemplate:              # Critical: required template for the response plan
        Title: <example_title>       # Critical: required
        Impact: 5                    # Critical: required (1=highest, 5=lowest)

Other

1In the AWS Console, go to Systems Manager > Incident Manager
2Replication sets > Create replication set > add at least one Region > Create; wait until Status is ACTIVE
3Response plans > Create response plan > set Name, Title, and Impact > Create
4Verify: Replication set shows ACTIVE and at least one response plan exists

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.ssmincidents.ssmincidents_client import (
    ssmincidents_client,
)


class ssmincidents_enabled_with_plans(Check):
    def execute(self):
        findings = []
        if ssmincidents_client.replication_set is not None:
            report = Check_Report_AWS(
                metadata=self.metadata(),
                resource={},
            )
            report.status = "FAIL"
            report.status_extended = "No SSM Incidents replication set exists."
            report.resource_arn = ssmincidents_client.replication_set_arn_template
            report.resource_id = ssmincidents_client.audited_account
            report.region = ssmincidents_client.region
            if ssmincidents_client.replication_set:
                report = Check_Report_AWS(
                    metadata=self.metadata(),
                    resource=ssmincidents_client.replication_set[0],
                )
                report.resource_id = ssmincidents_client.audited_account
                report.region = ssmincidents_client.region
                report.resource_arn = ssmincidents_client.replication_set[0].arn
                report.resource_tags = []  # Not supported for replication sets
                report.status = "FAIL"
                report.status_extended = f"SSM Incidents replication set {ssmincidents_client.replication_set[0].arn} exists but not ACTIVE."
                if ssmincidents_client.replication_set[0].status == "ACTIVE":
                    report.status_extended = f"SSM Incidents replication set {ssmincidents_client.replication_set[0].arn} is ACTIVE but no response plans exist."
                    if ssmincidents_client.response_plans:
                        report.status = "PASS"
                        report.status_extended = f"SSM Incidents replication set {ssmincidents_client.replication_set[0].arn} is ACTIVE and has response plans."

            findings.append(report)

        return findings

References