Problem
A finder has Always Execute Fixer turned on, but its recommendations sit in the "Suggested" state and never move to Scheduled or In Progress on their own.
Note on older versions of this article: this issue used to be described as CloudFix failing to assume cloudfix-fixer-approver-role (AccessDenied) while trying to auto-approve an AWS Change Manager change template. CloudFix no longer uses Change Manager or change templates for any tenant — every tenant executes fixers through Direct SSM Automation — so a stuck "Suggested" recommendation is no longer caused by that role failing to assume. cloudfix-fixer-approver-role still exists in your CloudFix stack (it's stack-managed — leave it in place), but it is not part of fixer execution today. If you're here because of the old title, see Cause below for what actually stops automatic execution now.
Symptoms
-
Recommendations for the finder stay in "Suggested" status instead of progressing to Scheduled, In Progress, or Completed.
-
Always Execute Fixer is checked for the finder in Settings > Finders & Fixers, but no automatic execution happens.
-
Manually selecting the same resources on the Available to Execute tab and clicking EXECUTE may or may not work, depending on the cause (see below).
Cause
One or more of the following is true:
-
Your onboarding stack is below version 4.74. Direct SSM Automation requires stack version 4.74 or later. On an older stack, CloudFix skips automatic execution for every affected recommendation rather than running it. Settings > Finders & Fixers shows your current Template Version and, when you're behind, an "Upgrade to latest" link.
-
The finder has hit its concurrency limit. Each finder can run a limited number of fixer executions in parallel (10, by default). Recommendations queued past that limit stay in Suggested and are retried automatically by CloudFix's scheduled job — this usually clears on its own, but a finder that is consistently backed up may need its limit raised by CloudFix support.
-
The account is on the fixer exclusion list. Accounts excluded in Settings > Resource Tagging cannot execute fixers at all — automatically or manually — until they're removed from that list.
-
The tenant has no management account recorded. CloudFix deploys the runbooks (SSM Automation documents) that fixers run from into your management account. If that account isn't recorded on your tenant, no runbook can be created or executed. This is a setup issue — contact CloudFix support.
-
Always Execute Fixer isn't actually on for this finder. Double-check the checkbox in Settings > Finders & Fixers — recommendations for a finder without it stay in Suggested/Manual Approval until someone selects them on Available to Execute and clicks EXECUTE.
Resolution
Step 1: Confirm Always Execute Fixer is on
Go to Settings > Finders & Fixers and check the ALWAYS EXECUTE FIXER column for the finder in question. If it's off, either turn it on (to auto-execute future recommendations) or open the finder from the dashboard and execute the current recommendations manually from Available to Execute.
Step 2: Check your stack's Template Version
Still on Settings > Finders & Fixers, check Template Version. If it shows an "Upgrade to latest" link, your stack is below the 4.74 floor Direct SSM Automation requires. Click it and follow the instructions to update your onboarding stack.
Step 3: Confirm the account isn't excluded from fixer execution
Check Settings > Resource Tagging for the account the recommendation belongs to. If it's on the excluded-accounts list and shouldn't be, remove it.
Step 4: Contact CloudFix support
If Steps 1–3 don't resolve it, contact CloudFix support with the finder name and one of the stuck recommendation IDs. Support can check whether the finder's concurrency limit needs raising and confirm your tenant's management account is correctly configured.
A note on the "Auto Approve Templates" setting
Settings > Finders & Fixers also has a checkbox called AUTO APPROVE TEMPLATES. Despite the name, it does not control whether fixers auto-execute today — that's Always Execute Fixer, covered above. Auto Approve Templates is a holdover from Change Manager: turning it on only affects whether your stack's cloudfix-fixer-approver-role trusts CloudFix to assume it. It has no effect on whether recommendations execute. Leave it as-is unless CloudFix support asks you to change it.
After Fixing
Once Always Execute Fixer is on for the finder, your stack is at version 4.74 or later, and the account isn't excluded, CloudFix will run the fixer automatically the next time the scheduled job picks up a Suggested recommendation — no manual click needed. You can follow progress in the finder's Finished tab, or directly in the resource account's AWS Systems Manager > Automation > Executions.
Bill Gleeson
Comments