diff --git a/roles/aws_common/defaults/main.yml b/roles/aws_common/defaults/main.yml
index 08808bc..8d5cef2 100644
--- a/roles/aws_common/defaults/main.yml
+++ b/roles/aws_common/defaults/main.yml
@@ -3,3 +3,6 @@
 # See https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/download-cloudwatch-agent-commandline.html
 aws_download_region: "{{ ansible_ec2_placement_region | default('us-west-2') }}"
 aws_cloudwatch_agent_rpm: "https://s3.{{ aws_download_region }}.amazonaws.com/amazoncloudwatch-agent-{{ aws_download_region }}/amazon_linux/amd64/latest/amazon-cloudwatch-agent.rpm"
+
+# Mostly for molecule testing, as skip-tags doesn't work with handlers.
+atl_aws_agent_restart: true
diff --git a/roles/aws_common/handlers/main.yml b/roles/aws_common/handlers/main.yml
new file mode 100644
index 0000000..768f8cf
--- /dev/null
+++ b/roles/aws_common/handlers/main.yml
@@ -0,0 +1,15 @@
+---
+
+- name: Enable CloudWatch Agent
+  systemd:
+    name: "amazon-cloudwatch-agent.service"
+    daemon_reload: true
+    enabled: true
+  when: atl_aws_agent_restart
+
+- name: Restart CloudWatch Agent
+  systemd:
+    name: "amazon-cloudwatch-agent.service"
+    enabled: true
+    status: restarted
+  when: atl_aws_agent_restart
diff --git a/roles/aws_common/molecule/default/playbook.yml b/roles/aws_common/molecule/default/playbook.yml
index 6ccfba2..e44015d 100644
--- a/roles/aws_common/molecule/default/playbook.yml
+++ b/roles/aws_common/molecule/default/playbook.yml
@@ -6,5 +6,6 @@
     ansible_default_ipv4:
       address: "9.9.9.9"
     ansible_ec2_instance_id: "NONE"
+    atl_aws_agent_restart: false
   roles:
     - role: aws_common
diff --git a/roles/aws_common/tasks/amazon.yml b/roles/aws_common/tasks/amazon.yml
index 2f0ba7f..dce19fe 100644
--- a/roles/aws_common/tasks/amazon.yml
+++ b/roles/aws_common/tasks/amazon.yml
@@ -6,4 +6,10 @@
       - ec2-utils
       - amazon-ssm-agent
       - amazon-efs-utils
+
+- name: Install CloudWatch Agent
+  yum:
+    name:
       - "{{ aws_cloudwatch_agent_rpm }}"
+  notify:
+    - Enable CloudWatch Agent