What Is a Runbook?
Last verified on Nov 8, 2026.
A runbook is a documented procedure for a specific task: a series of steps someone follows to reach a defined outcome. AWS Well-Architected says the minimum is a step-by-step text document. Teams write them for routine work such as deploys and credential rotation, and for fixing known failures at 3 a.m. when nobody wants to improvise.
Runbook vs Playbook
The terms are used loosely, so confirm what your team means. AWS draws a line: a playbook is a step-by-step guide to investigate an incident, scope its impact, and find the root cause. When the cause is known, the playbook points to a runbook that fixes it.
Google's SRE material uses "playbook" for the guide attached to an alert. Per the SRE workbook, it explains the alert's severity and impact, gives debugging suggestions, and lists mitigations. A playbook entry is usually created whenever an alert is created. Under AWS's terms, that guide combines a playbook and a runbook.
What a Good Runbook Contains
AWS lists these elements:
- Desired outcome: what done looks like, so the reader can tell.
- Tools and permissions: anything special, named up front, so nobody finds out mid-incident that they lack access.
- Ordered steps: short, one action per step.
- Error handling and escalation: what to do when a step fails, and who to contact.
- Owner and location: a named owner, published in a central place, ideally under version control.
Validate it by having someone else on the team run it. Anti-patterns AWS names: relying on memory, deploying without a checklist, different people doing the same task differently, and letting the runbook drift away from the system.
Example
An example for an alert that fires when a queue stops being processed. Everything here is illustrative.
Runbook: orders-queue backlog above 10,000 for 10 minutes
Owner: payments platform team
Outcome: backlog under 500 and falling
1. Check consumer health: kubectl get pods -l app=orders-consumer
2. If pods keep restarting, read the last run: kubectl logs --previous <pod>
3. If the cause is a bad release, roll back: kubectl rollout undo deployment/orders-consumer
4. If pods are healthy but slow, scale up: kubectl scale deployment/orders-consumer --replicas=8
5. Confirm the backlog is falling for 5 minutes.
Escalate to the payments on-call if the backlog is still rising after step 4.The commands use kubectl, and the Kubernetes docs cover kubectl logs --previous for reading the last run of a restarting container.
Keep It Alive
A stale runbook is worse than none because people trust it. Treat an update as part of the change: when the system changes, the runbook changes in the same pull request. Google adds that on-call engineers should update the playbook with fresh information when the corresponding page fires. Run exercises so people know the documents exist. The Google incident management guide says playbooks help only if on-callers are aware of them, and recommends practice such as Wheel of Misfortune exercises.
AWS says text runbooks should be automated as your organization matures. AWS Systems Manager Automation, for example, models a runbook as steps that run in sequence, each built around one action, written in YAML or JSON. Automate the safe, repeatable steps and leave judgment calls to a person.
Where Runbooks Fit
A runbook is the response end of the loop that begins with an alert and an on-call engineer. Missing or wrong steps surface in the postmortem, which is where you fix them. Google asks that every alert have a playbook entry, and an alert the person paged cannot act on feeds alert fatigue. For the kind of failure a runbook often covers, see the guide to detecting crash loops.
Frequently Asked Questions
What is a runbook in IT operations?
A documented process for achieving a specific outcome, written as ordered steps anyone on the team can follow. At its simplest it is a checklist for a task such as restarting a service, rotating a credential, or failing over a database.
What is the difference between a runbook and a playbook?
In AWS guidance, a playbook investigates: it guides discovery to find the root cause of an incident. A runbook performs: it carries out the procedure that fixes a known cause. Google uses the word playbook for alert-response guides that cover both. Check which meaning your team uses.
What should a runbook contain?
The desired outcome, the tools and permissions needed, the steps in order, how to handle errors, who owns it, and when and how to escalate.
Should runbooks be automated?
Over time, yes. AWS says text runbooks should be automated as an organization matures, for example with Systems Manager Automation. Start with the safe, repeatable steps and keep a human in charge of judgment calls.
Sources
- A runbook is a documented process to achieve a specific outcome; at a minimum a step-by-step text document with the desired outcome, tools and permissions, error handling, escalations, and an owner, published centrally, validated by a second person, and automated as the organization matures (accessed Nov 8, 2026)
- Playbooks are step-by-step guides to investigate an incident and find the root cause; the playbook points to a runbook that resolves a known cause (accessed Nov 8, 2026)
- Google calls them playbooks: high-level instructions for responding to an alert, with severity, impact, debugging suggestions, and mitigations; a playbook entry is usually created with each alert (accessed Nov 8, 2026)
- In AWS Systems Manager, an Automation runbook defines actions run in sequential steps, each built around a single action, written in YAML or JSON (accessed Nov 8, 2026)
- kubectl logs --previous prints the logs of the previous instance of a container in a pod (accessed Nov 8, 2026)
- kubectl scale sets a new size for a deployment (accessed Nov 8, 2026)
- A Deployment can be rolled back to an earlier revision with kubectl rollout undo, for example when it is crash looping (accessed Nov 8, 2026)
- Up-to-date playbooks speed up incident response, and on-callers need to know they exist; practice exercises keep that knowledge current (accessed Nov 8, 2026)