Check ID: ssmincidents_enabled_with_plans
Provider: AWS
Service: ssmincidents
Severity: MEDIUM
Categories: resilience
Resource type: Other

​
What this check verifies

Incident Manager uses a replication set and response plans. This evaluates whether a replication set exists and is ACTIVE, and that at least one response plan is configured for coordinated incident handling.

​
Risk

Without an ACTIVE replication set or response plans, incidents lack coordinated engagement and automation, raising MTTR and impacting availability and integrity. Threats include prolonged outages, lateral movement, and data exfiltration from delayed containment and misrouted escalation.

​
Recommendation

Establish an ACTIVE replication set and create response plans that define engagement, escalation, runbooks, severity, and communication. Apply least privilege to automation roles, test plans regularly, integrate with monitoring to trigger them, and use defense in depth with redundant contacts and Regions.

​
Remediation

# Ensure replication set exists and becomes ACTIVE
resource "aws_ssmincidents_replication_set" "example" {
  regions {                      # Critical: creates the replication set so it can be ACTIVE
    region_name = "us-east-1"
  }
}

# Create a minimal response plan
resource "aws_ssmincidents_response_plan" "example" {
  name = "<example_resource_name>"  # Critical: ensures at least one response plan exists

  incident_template {                # Critical: required template for the plan
    title  = "<example_title>"
    impact = 5
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = ssmincidents_enabled_with_plans. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks