Overview
This article answers a question we still get from time to time: is it safe to delete old CloudFix SSM document templates from your AWS account, and what happens afterward? It's particularly relevant if you have templates left over from an older CloudFix version, or from before your tenant moved off AWS Change Manager, that you no longer use and want to clean up.
Heads up: AWS Change Manager itself is retired — every CloudFix tenant now executes fixers through Direct SSM Automation instead (see the Direct SSM Automation Migration Guide). Some of the SSM documents you'll find in your account predate that move. The guidance below applies to leftover CloudFix templates and runbooks generally, whichever execution path created them.
Information
Every template CloudFix creates starts with the prefix "Cloudfix-", and you can remove any of these SSM documents from your AWS account at any time.
This includes templates from both old and current versions of CloudFix. CloudFix does not rely on AWS CloudFormation or other resource-management systems to track these templates, so it's safe to delete any unused Cloudfix-prefixed SSM document from your account. See How to Delete CloudFix Runbooks from Your AWS Account or Organization for the step-by-step CLI commands, including how to do this across an entire AWS Organization.
If you delete a "Cloudfix-Runbook-…" document that an active fixer still needs — as opposed to a legacy "Cloudfix-Template-…" one, which no active fixer reads at all — CloudFix detects that it's missing and recreates it automatically, either the next time you click Generate Runbook(s) for that finder, or automatically the next time CloudFix tries to execute it. Until it's back in place, that finder's recommendations will show status "Pending Approval" on the Available to Execute tab; that label just means the runbook isn't deployed yet, not that anything is waiting on a human approval — there is no approval step to complete. Execution picks back up on its own as soon as CloudFix redeploys the runbook.
Legacy templates from older CloudFix versions, identifiable by the prefix "Cloudfix-CT", can also be safely deleted if you no longer need them — this prefix predates the current "Cloudfix-Template-" naming convention and is purely historical, it doesn't indicate anything special about how the template behaves.
In short: CloudFix gives you full control over the SSM document templates it creates in your account, so you can streamline and declutter as needed without worrying about breaking anything CloudFix still relies on.
Related Articles
- How to Delete CloudFix Runbooks from Your AWS Account or Organization — the CLI commands for deleting these templates, for a single account or Org-wide.
- CloudFix Direct SSM Automation Migration Guide — how CloudFix executes fixers today, now that Change Manager is retired.
Priyanka Bhotika
Comments