AWS SSM OpsCenter Diagnostics
When to use
Any SSM OpsCenter investigation — OpsItem creation, automation runbook execution, related resource management, deduplication configuration, EventBridge integration, or notification delivery.
Investigation workflow
Step 1 — Collect and triage
aws ssm describe-ops-items --ops-item-filters "Key=Status,Values=Open,Operator=Equal" --query 'OpsItemSummaries[*].{Id:OpsItemId,Title:Title,Status:Status,Severity:Severity,Source:Source}'
aws ssm get-service-setting --setting-id /ssm/opsCenter
aws events list-rules --name-prefix "SSM"
Step 2 — Domain deep dive
aws ssm get-ops-item --ops-item-id <id>
aws ssm describe-automation-executions --filters "Key=ExecutionId,Values=<id>"
aws ssm list-ops-item-related-items --ops-item-id <id>
Step 3 — Detailed investigation
aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventSource,AttributeValue=ssm.amazonaws.com --max-results 20
aws sns list-topics
aws events describe-rule --name <rule-name>
Read references/guardrails.md before concluding on any OpsCenter issue.
Tool quick reference
| Tool / API |
When to use |
ssm describe-ops-items |
List OpsItems with filters |
ssm get-ops-item |
Get OpsItem details |
ssm create-ops-item |
Create new OpsItem |
ssm update-ops-item |
Update OpsItem status/details |
ssm describe-automation-executions |
Check runbook execution |
ssm list-ops-item-related-items |
List related resources |
Gotchas: AWS SSM OpsCenter
- OpsCenter is for operational issues, NOT incident management. It tracks and resolves operational issues using OpsItems.
- OpsItems can be created manually, by EventBridge rules, or by AWS services (Config, CloudWatch, etc.). Each source has different deduplication behavior.
- Automation runbooks associated with OpsItems require an IAM role with permissions for the actions in the runbook.
- Related resources are references (ARNs) attached to OpsItems. They are NOT live links — resource state changes don't auto-update the OpsItem.
- Deduplication uses an operational data hash. Duplicate OpsItems with the same hash are merged, not created as separate items.
- OpsCenter is regional. OpsItems in us-east-1 are not visible in eu-west-1. Use Explorer for cross-region aggregation.
Anti-hallucination rules
- Always cite specific OpsItem IDs, statuses, or API responses as evidence.
- OpsCenter is NOT incident management. Never conflate with Incident Manager.
- Related resources are static references. Never claim they auto-update.
- Deduplication uses hash-based matching. Never assume content-based dedup.
- Spend no more than 2 minutes on any single hypothesis. Pivot if inconclusive.
12 runbooks
| Category |
IDs |
Covers |
| A — OpsItems |
A1-A2 |
Creation, management |
| B — Automation |
B1-B2 |
Runbooks, execution |
| C — Resources |
C1-C2 |
Related resources, association |
| D — Deduplication |
D1-D2 |
Dedup behavior, configuration |
| E — EventBridge |
E1-E2 |
Integration, event rules |
| F — Notifications |
F1 |
Notification delivery |
| Z — Catch-All |
Z1 |
General troubleshooting |
1---2name: opscenter-diagnostics3description: Use this skill to investigate and troubleshoot AWS Systems Manager OpsCenter problems by analyzing OpsItem creation, automation runbooks, related resources, deduplication, EventBridge integration, notifications, and following structured runbooks. Activate when: OpsItem creation failures, automation runbook errors, resource association issues, deduplication problems, EventBridge rule failures, notification delivery issues, or the user says something is wrong with OpsCenter.4---56# AWS SSM OpsCenter Diagnostics78## When to use910Any SSM OpsCenter investigation — OpsItem creation, automation runbook execution, related resource management, deduplication configuration, EventBridge integration, or notification delivery.1112## Investigation workflow1314### Step 1 — Collect and triage1516```17aws ssm describe-ops-items --ops-item-filters "Key=Status,Values=Open,Operator=Equal" --query 'OpsItemSummaries[*].{Id:OpsItemId,Title:Title,Status:Status,Severity:Severity,Source:Source}'18aws ssm get-service-setting --setting-id /ssm/opsCenter19aws events list-rules --name-prefix "SSM"20```2122### Step 2 — Domain deep dive2324```25aws ssm get-ops-item --ops-item-id <id>26aws ssm describe-automation-executions --filters "Key=ExecutionId,Values=<id>"27aws ssm list-ops-item-related-items --ops-item-id <id>28```2930### Step 3 — Detailed investigation3132```33aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventSource,AttributeValue=ssm.amazonaws.com --max-results 2034aws sns list-topics35aws events describe-rule --name <rule-name>36```3738Read `references/guardrails.md` before concluding on any OpsCenter issue.3940## Tool quick reference4142| Tool / API | When to use |43|------------|-------------|44| `ssm describe-ops-items` | List OpsItems with filters |45| `ssm get-ops-item` | Get OpsItem details |46| `ssm create-ops-item` | Create new OpsItem |47| `ssm update-ops-item` | Update OpsItem status/details |48| `ssm describe-automation-executions` | Check runbook execution |49| `ssm list-ops-item-related-items` | List related resources |5051## Gotchas: AWS SSM OpsCenter5253- OpsCenter is for operational issues, NOT incident management. It tracks and resolves operational issues using OpsItems.54- OpsItems can be created manually, by EventBridge rules, or by AWS services (Config, CloudWatch, etc.). Each source has different deduplication behavior.55- Automation runbooks associated with OpsItems require an IAM role with permissions for the actions in the runbook.56- Related resources are references (ARNs) attached to OpsItems. They are NOT live links — resource state changes don't auto-update the OpsItem.57- Deduplication uses an operational data hash. Duplicate OpsItems with the same hash are merged, not created as separate items.58- OpsCenter is regional. OpsItems in us-east-1 are not visible in eu-west-1. Use Explorer for cross-region aggregation.5960## Anti-hallucination rules61621. Always cite specific OpsItem IDs, statuses, or API responses as evidence.632. OpsCenter is NOT incident management. Never conflate with Incident Manager.643. Related resources are static references. Never claim they auto-update.654. Deduplication uses hash-based matching. Never assume content-based dedup.665. Spend no more than 2 minutes on any single hypothesis. Pivot if inconclusive.6768## 12 runbooks6970| Category | IDs | Covers |71|----------|-----|--------|72| A — OpsItems | A1-A2 | Creation, management |73| B — Automation | B1-B2 | Runbooks, execution |74| C — Resources | C1-C2 | Related resources, association |75| D — Deduplication | D1-D2 | Dedup behavior, configuration |76| E — EventBridge | E1-E2 | Integration, event rules |77| F — Notifications | F1 | Notification delivery |78| Z — Catch-All | Z1 | General troubleshooting |
aws-samples