An operations team wants on-call engineers to run approved diagnostic and remediation commands, such as restarting a service through an AWS Systems Manager Automation runbook, directly from their Slack channel during an incident, without leaving chat or opening the console. The actions must run under a controlled, least-privilege role rather than an engineer's personal credentials. Which approach delivers this chat-based operations capability with the LEAST custom code?
- AConfigure AWS Chatbot for the Slack workspace and channel, assign it a channel IAM role scoped to the permitted Automation actions, and apply channel guardrail policies so engineers invoke the runbook through approved chat commands. Correct
- BBuild a Slack application backed by an AWS Lambda function behind Amazon API Gateway that parses slash commands, assumes a role, and calls the Systems Manager Automation API on the engineer's behalf.
- CCreate an Amazon SNS topic that posts incident alerts into Slack through an email-to-channel forwarder so engineers can read the alert and then run the Automation runbook from the AWS console themselves.
- DGrant each on-call engineer a long-lived IAM access key stored in Slack and a shared script that reads the key from a pinned message to call the Systems Manager Automation runbook during incidents.
Why A is correct: AWS Chatbot natively runs supported AWS commands from Slack under a configured channel IAM role bounded by guardrail policies, so engineers trigger the Automation runbook from chat with least-privilege control and no custom integration code.
Why B is wrong: A custom Slack app and Lambda parser can run the commands, but it is bespoke plumbing the team must build, secure, and maintain, whereas AWS Chatbot delivers the same chat-driven actions as managed configuration.
Why C is wrong: An SNS-to-Slack forwarder only delivers notifications and still sends engineers to the console to act, so it provides no in-chat command execution and fails the requirement to run remediation from Slack.
Why D is wrong: Embedding long-lived keys in chat is a serious security failure and is the opposite of least privilege, so although it technically runs commands it breaks the controlled-role requirement entirely.