Automating the full AWS DRS agent lifecycle: Install, heal, and offboard

This article presents an automated solution for managing the full lifecycle of AWS Elastic Disaster Recovery agents—installation, health maintenance, and offboarding—using AWS Systems Manager and EventBridge.

• Three SSM Automation documents handle onboarding (install/repair), healing (restart/reinstall on stall), and offboarding (teardown on descope)
• Single EC2 tag (DR=yes/pause/no) controls the entire lifecycle without Lambda functions
• State Manager runs onboarding every 30 minutes; EventBridge triggers healing on replication stalls and offboarding on tag changes
• Three-layer RPO protection: OS auto-restart (seconds), EventBridge healing (minutes), State Manager backstop (30 minutes)
• Offboarding records honest billing status showing whether replication actually stopped or needs manual follow-up
• Cross-Region architecture with source Region automation and DR Region replication; private connectivity via Transit Gateway and VPC endpoints
• Least-privilege IAM roles with explicit permissions; safety guards prevent unintended actions during failover/failback
• Observability via SNS alerts, S3 audit reports, and CloudWatch metrics; deployment scripts and templates in GitHub repository

The solution automates agent lifecycle management at scale, eliminating manual console checks and reducing operational overhead for large EC2 fleets in disaster recovery scope.