Overview
This article answers a question we still get from time to time: is it safe to delete old CloudFix SSM document templates from your AWS account, and what happens afterward? It's particularly relevant if you have templates left over from an older CloudFix version, or from before your tenant moved off AWS Change Manager, that you no longer use and want to clean up.
Heads up: AWS Change Manager itself is retired — every CloudFix tenant now executes fixers through Direct SSM Automation instead (see the Direct SSM Automation Migration Guide). This article's title reflects its history, but the guidance below applies to leftover CloudFix templates and runbooks generally, whichever execution path created them.
Information
Every template CloudFix creates starts with the prefix "Cloudfix-", and you can remove any of these SSM documents from your AWS account at any time.
This includes templates from both old and current versions of CloudFix. CloudFix does not rely on AWS CloudFormation or other resource-management systems to track these templates, so it's safe to delete any unused Cloudfix-prefixed SSM document from your account. See How to Delete CloudFix Runbooks from Your AWS Account or Organization for the step-by-step CLI commands, including how to do this across an entire AWS Organization.
In the event that a template still needed by an active fixer is deleted, CloudFix's built-in system will automatically recreate it during a later template refresh job — this doesn't happen immediately, but in due course. When that refreshed template arrives, it comes back in an unapproved state: you'll need to re-approve it before CloudFix can execute that fixer again. Deleting a template does not silently restore automatic execution.
Legacy templates from older CloudFix versions, identifiable by the prefix "Cloudfix-CT", can also be safely deleted if you no longer need them — this prefix predates the current "Cloudfix-Template-" naming convention and is purely historical, it doesn't indicate anything special about how the template behaves.
In short: CloudFix gives you full control over the SSM document templates it creates in your account, so you can streamline and declutter as needed without worrying about breaking anything CloudFix still relies on.
Related Articles
- How to Delete CloudFix Runbooks from Your AWS Account or Organization — the CLI commands for deleting these templates, for a single account or Org-wide.
- CloudFix Direct SSM Automation Migration Guide — how CloudFix executes fixers today, now that Change Manager is retired.
Priyanka Bhotika
Comments