Docs Home Pulumi IaC Pulumi ESC Pulumi Insights Pulumi Cloud Packages Tutorials
  1. Packages
  2. AWS Cloud Control
  3. API Docs
  4. ssm
  5. Association

We recommend new projects start with resources from the AWS provider.

AWS Cloud Control v1.26.0 published on Wednesday, Mar 12, 2025 by Pulumi
pulumi/pulumi-aws-native

aws-native.ssm.Association

Explore with Pulumi AI

We recommend new projects start with resources from the AWS provider.

AWS Cloud Control v1.26.0 published on Wednesday, Mar 12, 2025 by Pulumi
pulumi/pulumi-aws-native

The AWS::SSM::Association resource associates an SSM document in AWS Systems Manager with EC2 instances that contain a configuration agent to process the document.

Example Usage

Example

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using AwsNative = Pulumi.AwsNative;

return await Deployment.RunAsync(() => 
{
    var specificInstanceIdAssociation = new AwsNative.Ssm.Association("specificInstanceIdAssociation", new()
    {
        Name = "AWS-RunShellScript",
        Targets = new[]
        {
            new AwsNative.Ssm.Inputs.AssociationTargetArgs
            {
                Key = "InstanceIds",
                Values = new[]
                {
                    "i-1234567890abcdef0",
                },
            },
        },
        Parameters = 
        {
            { "commands", new[]
            {
                "ls",
            } },
            { "workingDirectory", new[]
            {
                "/",
            } },
        },
    });

});
Copy
package main

import (
	"github.com/pulumi/pulumi-aws-native/sdk/go/aws/ssm"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := ssm.NewAssociation(ctx, "specificInstanceIdAssociation", &ssm.AssociationArgs{
			Name: pulumi.String("AWS-RunShellScript"),
			Targets: ssm.AssociationTargetArray{
				&ssm.AssociationTargetArgs{
					Key: pulumi.String("InstanceIds"),
					Values: pulumi.StringArray{
						pulumi.String("i-1234567890abcdef0"),
					},
				},
			},
			Parameters: pulumi.StringArrayMap{
				"commands": pulumi.StringArray{
					pulumi.String("ls"),
				},
				"workingDirectory": pulumi.StringArray{
					pulumi.String("/"),
				},
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}
Copy

Coming soon!

import * as pulumi from "@pulumi/pulumi";
import * as aws_native from "@pulumi/aws-native";

const specificInstanceIdAssociation = new aws_native.ssm.Association("specificInstanceIdAssociation", {
    name: "AWS-RunShellScript",
    targets: [{
        key: "InstanceIds",
        values: ["i-1234567890abcdef0"],
    }],
    parameters: {
        commands: ["ls"],
        workingDirectory: ["/"],
    },
});
Copy
import pulumi
import pulumi_aws_native as aws_native

specific_instance_id_association = aws_native.ssm.Association("specificInstanceIdAssociation",
    name="AWS-RunShellScript",
    targets=[{
        "key": "InstanceIds",
        "values": ["i-1234567890abcdef0"],
    }],
    parameters={
        "commands": ["ls"],
        "workingDirectory": ["/"],
    })
Copy

Coming soon!

Example

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using AwsNative = Pulumi.AwsNative;

return await Deployment.RunAsync(() => 
{
    var specificInstanceIdAssociation = new AwsNative.Ssm.Association("specificInstanceIdAssociation", new()
    {
        Name = "AWS-RunShellScript",
        Targets = new[]
        {
            new AwsNative.Ssm.Inputs.AssociationTargetArgs
            {
                Key = "InstanceIds",
                Values = new[]
                {
                    "i-1234567890abcdef0",
                },
            },
        },
        Parameters = 
        {
            { "commands", new[]
            {
                "ls",
            } },
            { "workingDirectory", new[]
            {
                "/",
            } },
        },
    });

});
Copy
package main

import (
	"github.com/pulumi/pulumi-aws-native/sdk/go/aws/ssm"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := ssm.NewAssociation(ctx, "specificInstanceIdAssociation", &ssm.AssociationArgs{
			Name: pulumi.String("AWS-RunShellScript"),
			Targets: ssm.AssociationTargetArray{
				&ssm.AssociationTargetArgs{
					Key: pulumi.String("InstanceIds"),
					Values: pulumi.StringArray{
						pulumi.String("i-1234567890abcdef0"),
					},
				},
			},
			Parameters: pulumi.StringArrayMap{
				"commands": pulumi.StringArray{
					pulumi.String("ls"),
				},
				"workingDirectory": pulumi.StringArray{
					pulumi.String("/"),
				},
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}
Copy

Coming soon!

import * as pulumi from "@pulumi/pulumi";
import * as aws_native from "@pulumi/aws-native";

const specificInstanceIdAssociation = new aws_native.ssm.Association("specificInstanceIdAssociation", {
    name: "AWS-RunShellScript",
    targets: [{
        key: "InstanceIds",
        values: ["i-1234567890abcdef0"],
    }],
    parameters: {
        commands: ["ls"],
        workingDirectory: ["/"],
    },
});
Copy
import pulumi
import pulumi_aws_native as aws_native

specific_instance_id_association = aws_native.ssm.Association("specificInstanceIdAssociation",
    name="AWS-RunShellScript",
    targets=[{
        "key": "InstanceIds",
        "values": ["i-1234567890abcdef0"],
    }],
    parameters={
        "commands": ["ls"],
        "workingDirectory": ["/"],
    })
Copy

Coming soon!

Example

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using AwsNative = Pulumi.AwsNative;

return await Deployment.RunAsync(() => 
{
    var allInstanceIdsAssociation = new AwsNative.Ssm.Association("allInstanceIdsAssociation", new()
    {
        AssociationName = "UpdateSSMAgent",
        Name = "AWS-UpdateSSMAgent",
        ScheduleExpression = "cron(0 2 ? * SUN *)",
        Targets = new[]
        {
            new AwsNative.Ssm.Inputs.AssociationTargetArgs
            {
                Key = "InstanceIds",
                Values = new[]
                {
                    "*",
                },
            },
        },
    });

});
Copy
package main

import (
	"github.com/pulumi/pulumi-aws-native/sdk/go/aws/ssm"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := ssm.NewAssociation(ctx, "allInstanceIdsAssociation", &ssm.AssociationArgs{
			AssociationName:    pulumi.String("UpdateSSMAgent"),
			Name:               pulumi.String("AWS-UpdateSSMAgent"),
			ScheduleExpression: pulumi.String("cron(0 2 ? * SUN *)"),
			Targets: ssm.AssociationTargetArray{
				&ssm.AssociationTargetArgs{
					Key: pulumi.String("InstanceIds"),
					Values: pulumi.StringArray{
						pulumi.String("*"),
					},
				},
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}
Copy

Coming soon!

import * as pulumi from "@pulumi/pulumi";
import * as aws_native from "@pulumi/aws-native";

const allInstanceIdsAssociation = new aws_native.ssm.Association("allInstanceIdsAssociation", {
    associationName: "UpdateSSMAgent",
    name: "AWS-UpdateSSMAgent",
    scheduleExpression: "cron(0 2 ? * SUN *)",
    targets: [{
        key: "InstanceIds",
        values: ["*"],
    }],
});
Copy
import pulumi
import pulumi_aws_native as aws_native

all_instance_ids_association = aws_native.ssm.Association("allInstanceIdsAssociation",
    association_name="UpdateSSMAgent",
    name="AWS-UpdateSSMAgent",
    schedule_expression="cron(0 2 ? * SUN *)",
    targets=[{
        "key": "InstanceIds",
        "values": ["*"],
    }])
Copy

Coming soon!

Example

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using AwsNative = Pulumi.AwsNative;

return await Deployment.RunAsync(() => 
{
    var allInstanceIdsAssociation = new AwsNative.Ssm.Association("allInstanceIdsAssociation", new()
    {
        AssociationName = "UpdateSSMAgent",
        Name = "AWS-UpdateSSMAgent",
        ScheduleExpression = "cron(0 2 ? * SUN *)",
        Targets = new[]
        {
            new AwsNative.Ssm.Inputs.AssociationTargetArgs
            {
                Key = "InstanceIds",
                Values = new[]
                {
                    "*",
                },
            },
        },
    });

});
Copy
package main

import (
	"github.com/pulumi/pulumi-aws-native/sdk/go/aws/ssm"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := ssm.NewAssociation(ctx, "allInstanceIdsAssociation", &ssm.AssociationArgs{
			AssociationName:    pulumi.String("UpdateSSMAgent"),
			Name:               pulumi.String("AWS-UpdateSSMAgent"),
			ScheduleExpression: pulumi.String("cron(0 2 ? * SUN *)"),
			Targets: ssm.AssociationTargetArray{
				&ssm.AssociationTargetArgs{
					Key: pulumi.String("InstanceIds"),
					Values: pulumi.StringArray{
						pulumi.String("*"),
					},
				},
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}
Copy

Coming soon!

import * as pulumi from "@pulumi/pulumi";
import * as aws_native from "@pulumi/aws-native";

const allInstanceIdsAssociation = new aws_native.ssm.Association("allInstanceIdsAssociation", {
    associationName: "UpdateSSMAgent",
    name: "AWS-UpdateSSMAgent",
    scheduleExpression: "cron(0 2 ? * SUN *)",
    targets: [{
        key: "InstanceIds",
        values: ["*"],
    }],
});
Copy
import pulumi
import pulumi_aws_native as aws_native

all_instance_ids_association = aws_native.ssm.Association("allInstanceIdsAssociation",
    association_name="UpdateSSMAgent",
    name="AWS-UpdateSSMAgent",
    schedule_expression="cron(0 2 ? * SUN *)",
    targets=[{
        "key": "InstanceIds",
        "values": ["*"],
    }])
Copy

Coming soon!

Example

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using AwsNative = Pulumi.AwsNative;

return await Deployment.RunAsync(() => 
{
    var taggedInstancesAssociation = new AwsNative.Ssm.Association("taggedInstancesAssociation", new()
    {
        AssociationName = "UpdateSSMAgent",
        Name = "AWS-UpdateSSMAgent",
        ScheduleExpression = "rate(7 days)",
        Targets = new[]
        {
            new AwsNative.Ssm.Inputs.AssociationTargetArgs
            {
                Key = "tag:Environment",
                Values = new[]
                {
                    "Production",
                },
            },
        },
    });

});
Copy
package main

import (
	"github.com/pulumi/pulumi-aws-native/sdk/go/aws/ssm"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := ssm.NewAssociation(ctx, "taggedInstancesAssociation", &ssm.AssociationArgs{
			AssociationName:    pulumi.String("UpdateSSMAgent"),
			Name:               pulumi.String("AWS-UpdateSSMAgent"),
			ScheduleExpression: pulumi.String("rate(7 days)"),
			Targets: ssm.AssociationTargetArray{
				&ssm.AssociationTargetArgs{
					Key: pulumi.String("tag:Environment"),
					Values: pulumi.StringArray{
						pulumi.String("Production"),
					},
				},
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}
Copy

Coming soon!

import * as pulumi from "@pulumi/pulumi";
import * as aws_native from "@pulumi/aws-native";

const taggedInstancesAssociation = new aws_native.ssm.Association("taggedInstancesAssociation", {
    associationName: "UpdateSSMAgent",
    name: "AWS-UpdateSSMAgent",
    scheduleExpression: "rate(7 days)",
    targets: [{
        key: "tag:Environment",
        values: ["Production"],
    }],
});
Copy
import pulumi
import pulumi_aws_native as aws_native

tagged_instances_association = aws_native.ssm.Association("taggedInstancesAssociation",
    association_name="UpdateSSMAgent",
    name="AWS-UpdateSSMAgent",
    schedule_expression="rate(7 days)",
    targets=[{
        "key": "tag:Environment",
        "values": ["Production"],
    }])
Copy

Coming soon!

Example

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using AwsNative = Pulumi.AwsNative;

return await Deployment.RunAsync(() => 
{
    var taggedInstancesAssociation = new AwsNative.Ssm.Association("taggedInstancesAssociation", new()
    {
        AssociationName = "UpdateSSMAgent",
        Name = "AWS-UpdateSSMAgent",
        ScheduleExpression = "rate(7 days)",
        Targets = new[]
        {
            new AwsNative.Ssm.Inputs.AssociationTargetArgs
            {
                Key = "tag:Environment",
                Values = new[]
                {
                    "Production",
                },
            },
        },
    });

});
Copy
package main

import (
	"github.com/pulumi/pulumi-aws-native/sdk/go/aws/ssm"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		_, err := ssm.NewAssociation(ctx, "taggedInstancesAssociation", &ssm.AssociationArgs{
			AssociationName:    pulumi.String("UpdateSSMAgent"),
			Name:               pulumi.String("AWS-UpdateSSMAgent"),
			ScheduleExpression: pulumi.String("rate(7 days)"),
			Targets: ssm.AssociationTargetArray{
				&ssm.AssociationTargetArgs{
					Key: pulumi.String("tag:Environment"),
					Values: pulumi.StringArray{
						pulumi.String("Production"),
					},
				},
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}
Copy

Coming soon!

import * as pulumi from "@pulumi/pulumi";
import * as aws_native from "@pulumi/aws-native";

const taggedInstancesAssociation = new aws_native.ssm.Association("taggedInstancesAssociation", {
    associationName: "UpdateSSMAgent",
    name: "AWS-UpdateSSMAgent",
    scheduleExpression: "rate(7 days)",
    targets: [{
        key: "tag:Environment",
        values: ["Production"],
    }],
});
Copy
import pulumi
import pulumi_aws_native as aws_native

tagged_instances_association = aws_native.ssm.Association("taggedInstancesAssociation",
    association_name="UpdateSSMAgent",
    name="AWS-UpdateSSMAgent",
    schedule_expression="rate(7 days)",
    targets=[{
        "key": "tag:Environment",
        "values": ["Production"],
    }])
Copy

Coming soon!

Create Association Resource

Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.

Constructor syntax

new Association(name: string, args?: AssociationArgs, opts?: CustomResourceOptions);
@overload
def Association(resource_name: str,
                args: Optional[AssociationArgs] = None,
                opts: Optional[ResourceOptions] = None)

@overload
def Association(resource_name: str,
                opts: Optional[ResourceOptions] = None,
                apply_only_at_cron_interval: Optional[bool] = None,
                association_name: Optional[str] = None,
                automation_target_parameter_name: Optional[str] = None,
                calendar_names: Optional[Sequence[str]] = None,
                compliance_severity: Optional[AssociationComplianceSeverity] = None,
                document_version: Optional[str] = None,
                instance_id: Optional[str] = None,
                max_concurrency: Optional[str] = None,
                max_errors: Optional[str] = None,
                name: Optional[str] = None,
                output_location: Optional[AssociationInstanceAssociationOutputLocationArgs] = None,
                parameters: Optional[Mapping[str, Sequence[str]]] = None,
                schedule_expression: Optional[str] = None,
                schedule_offset: Optional[int] = None,
                sync_compliance: Optional[AssociationSyncCompliance] = None,
                targets: Optional[Sequence[AssociationTargetArgs]] = None,
                wait_for_success_timeout_seconds: Optional[int] = None)
func NewAssociation(ctx *Context, name string, args *AssociationArgs, opts ...ResourceOption) (*Association, error)
public Association(string name, AssociationArgs? args = null, CustomResourceOptions? opts = null)
public Association(String name, AssociationArgs args)
public Association(String name, AssociationArgs args, CustomResourceOptions options)

type: aws-native:ssm:Association
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.

Parameters

name This property is required. string
The unique name of the resource.
args AssociationArgs
The arguments to resource properties.
opts CustomResourceOptions
Bag of options to control resource's behavior.
resource_name This property is required. str
The unique name of the resource.
args AssociationArgs
The arguments to resource properties.
opts ResourceOptions
Bag of options to control resource's behavior.
ctx Context
Context object for the current deployment.
name This property is required. string
The unique name of the resource.
args AssociationArgs
The arguments to resource properties.
opts ResourceOption
Bag of options to control resource's behavior.
name This property is required. string
The unique name of the resource.
args AssociationArgs
The arguments to resource properties.
opts CustomResourceOptions
Bag of options to control resource's behavior.
name This property is required. String
The unique name of the resource.
args This property is required. AssociationArgs
The arguments to resource properties.
options CustomResourceOptions
Bag of options to control resource's behavior.

Association Resource Properties

To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.

Inputs

In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.

The Association resource accepts the following input properties:

ApplyOnlyAtCronInterval bool
By default, when you create a new association, the system runs it immediately after it is created and then according to the schedule you specified. Specify this option if you don't want an association to run immediately after you create it. This parameter is not supported for rate expressions.
AssociationName string
The name of the association.
AutomationTargetParameterName string
Choose the parameter that will define how your automation will branch out. This target is required for associations that use an Automation runbook and target resources by using rate controls. Automation is a tool in AWS Systems Manager .
CalendarNames List<string>
The names or Amazon Resource Names (ARNs) of the Change Calendar type documents your associations are gated under. The associations only run when that Change Calendar is open. For more information, see AWS Systems Manager Change Calendar in the AWS Systems Manager User Guide .
ComplianceSeverity Pulumi.AwsNative.Ssm.AssociationComplianceSeverity
The severity level that is assigned to the association.
DocumentVersion string
The version of the SSM document to associate with the target.
InstanceId string
The ID of the instance that the SSM document is associated with.
MaxConcurrency string

The maximum number of targets allowed to run the association at the same time. You can specify a number, for example 10, or a percentage of the target set, for example 10%. The default value is 100%, which means all targets run the association at the same time.

If a new managed node starts and attempts to run an association while Systems Manager is running MaxConcurrency associations, the association is allowed to run. During the next association interval, the new managed node will process its association within the limit specified for MaxConcurrency .

MaxErrors string

The number of errors that are allowed before the system stops sending requests to run the association on additional targets. You can specify either an absolute number of errors, for example 10, or a percentage of the target set, for example 10%. If you specify 3, for example, the system stops sending requests when the fourth error is received. If you specify 0, then the system stops sending requests after the first error is returned. If you run an association on 50 managed nodes and set MaxError to 10%, then the system stops sending the request when the sixth error is received.

Executions that are already running an association when MaxErrors is reached are allowed to complete, but some of these executions may fail as well. If you need to ensure that there won't be more than max-errors failed executions, set MaxConcurrency to 1 so that executions proceed one at a time.

Name string
The name of the SSM document.
OutputLocation Pulumi.AwsNative.Ssm.Inputs.AssociationInstanceAssociationOutputLocation
An Amazon Simple Storage Service (Amazon S3) bucket where you want to store the output details of the request.
Parameters Dictionary<string, ImmutableArray<string>>
Parameter values that the SSM document uses at runtime.
ScheduleExpression string
A Cron or Rate expression that specifies when the association is applied to the target.
ScheduleOffset int
Number of days to wait after the scheduled day to run an association.
SyncCompliance Pulumi.AwsNative.Ssm.AssociationSyncCompliance

The mode for generating association compliance. You can specify AUTO or MANUAL . In AUTO mode, the system uses the status of the association execution to determine the compliance status. If the association execution runs successfully, then the association is COMPLIANT . If the association execution doesn't run successfully, the association is NON-COMPLIANT .

In MANUAL mode, you must specify the AssociationId as a parameter for the PutComplianceItems API action. In this case, compliance data is not managed by State Manager. It is managed by your direct call to the PutComplianceItems API action.

By default, all associations use AUTO mode.

Targets List<Pulumi.AwsNative.Ssm.Inputs.AssociationTarget>
The targets that the SSM document sends commands to.
WaitForSuccessTimeoutSeconds int

The number of seconds the service should wait for the association status to show "Success" before proceeding with the stack execution. If the association status doesn't show "Success" after the specified number of seconds, then stack creation fails.

When you specify a value for the WaitForSuccessTimeoutSeconds , drift detection for your AWS CloudFormation stack’s configuration might yield inaccurate results. If drift detection is important in your scenario, we recommend that you don’t include WaitForSuccessTimeoutSeconds in your template.

ApplyOnlyAtCronInterval bool
By default, when you create a new association, the system runs it immediately after it is created and then according to the schedule you specified. Specify this option if you don't want an association to run immediately after you create it. This parameter is not supported for rate expressions.
AssociationName string
The name of the association.
AutomationTargetParameterName string
Choose the parameter that will define how your automation will branch out. This target is required for associations that use an Automation runbook and target resources by using rate controls. Automation is a tool in AWS Systems Manager .
CalendarNames []string
The names or Amazon Resource Names (ARNs) of the Change Calendar type documents your associations are gated under. The associations only run when that Change Calendar is open. For more information, see AWS Systems Manager Change Calendar in the AWS Systems Manager User Guide .
ComplianceSeverity AssociationComplianceSeverity
The severity level that is assigned to the association.
DocumentVersion string
The version of the SSM document to associate with the target.
InstanceId string
The ID of the instance that the SSM document is associated with.
MaxConcurrency string

The maximum number of targets allowed to run the association at the same time. You can specify a number, for example 10, or a percentage of the target set, for example 10%. The default value is 100%, which means all targets run the association at the same time.

If a new managed node starts and attempts to run an association while Systems Manager is running MaxConcurrency associations, the association is allowed to run. During the next association interval, the new managed node will process its association within the limit specified for MaxConcurrency .

MaxErrors string

The number of errors that are allowed before the system stops sending requests to run the association on additional targets. You can specify either an absolute number of errors, for example 10, or a percentage of the target set, for example 10%. If you specify 3, for example, the system stops sending requests when the fourth error is received. If you specify 0, then the system stops sending requests after the first error is returned. If you run an association on 50 managed nodes and set MaxError to 10%, then the system stops sending the request when the sixth error is received.

Executions that are already running an association when MaxErrors is reached are allowed to complete, but some of these executions may fail as well. If you need to ensure that there won't be more than max-errors failed executions, set MaxConcurrency to 1 so that executions proceed one at a time.

Name string
The name of the SSM document.
OutputLocation AssociationInstanceAssociationOutputLocationArgs
An Amazon Simple Storage Service (Amazon S3) bucket where you want to store the output details of the request.
Parameters map[string][]string
Parameter values that the SSM document uses at runtime.
ScheduleExpression string
A Cron or Rate expression that specifies when the association is applied to the target.
ScheduleOffset int
Number of days to wait after the scheduled day to run an association.
SyncCompliance AssociationSyncCompliance

The mode for generating association compliance. You can specify AUTO or MANUAL . In AUTO mode, the system uses the status of the association execution to determine the compliance status. If the association execution runs successfully, then the association is COMPLIANT . If the association execution doesn't run successfully, the association is NON-COMPLIANT .

In MANUAL mode, you must specify the AssociationId as a parameter for the PutComplianceItems API action. In this case, compliance data is not managed by State Manager. It is managed by your direct call to the PutComplianceItems API action.

By default, all associations use AUTO mode.

Targets []AssociationTargetArgs
The targets that the SSM document sends commands to.
WaitForSuccessTimeoutSeconds int

The number of seconds the service should wait for the association status to show "Success" before proceeding with the stack execution. If the association status doesn't show "Success" after the specified number of seconds, then stack creation fails.

When you specify a value for the WaitForSuccessTimeoutSeconds , drift detection for your AWS CloudFormation stack’s configuration might yield inaccurate results. If drift detection is important in your scenario, we recommend that you don’t include WaitForSuccessTimeoutSeconds in your template.

applyOnlyAtCronInterval Boolean
By default, when you create a new association, the system runs it immediately after it is created and then according to the schedule you specified. Specify this option if you don't want an association to run immediately after you create it. This parameter is not supported for rate expressions.
associationName String
The name of the association.
automationTargetParameterName String
Choose the parameter that will define how your automation will branch out. This target is required for associations that use an Automation runbook and target resources by using rate controls. Automation is a tool in AWS Systems Manager .
calendarNames List<String>
The names or Amazon Resource Names (ARNs) of the Change Calendar type documents your associations are gated under. The associations only run when that Change Calendar is open. For more information, see AWS Systems Manager Change Calendar in the AWS Systems Manager User Guide .
complianceSeverity AssociationComplianceSeverity
The severity level that is assigned to the association.
documentVersion String
The version of the SSM document to associate with the target.
instanceId String
The ID of the instance that the SSM document is associated with.
maxConcurrency String

The maximum number of targets allowed to run the association at the same time. You can specify a number, for example 10, or a percentage of the target set, for example 10%. The default value is 100%, which means all targets run the association at the same time.

If a new managed node starts and attempts to run an association while Systems Manager is running MaxConcurrency associations, the association is allowed to run. During the next association interval, the new managed node will process its association within the limit specified for MaxConcurrency .

maxErrors String

The number of errors that are allowed before the system stops sending requests to run the association on additional targets. You can specify either an absolute number of errors, for example 10, or a percentage of the target set, for example 10%. If you specify 3, for example, the system stops sending requests when the fourth error is received. If you specify 0, then the system stops sending requests after the first error is returned. If you run an association on 50 managed nodes and set MaxError to 10%, then the system stops sending the request when the sixth error is received.

Executions that are already running an association when MaxErrors is reached are allowed to complete, but some of these executions may fail as well. If you need to ensure that there won't be more than max-errors failed executions, set MaxConcurrency to 1 so that executions proceed one at a time.

name String
The name of the SSM document.
outputLocation AssociationInstanceAssociationOutputLocation
An Amazon Simple Storage Service (Amazon S3) bucket where you want to store the output details of the request.
parameters Map<String,List<String>>
Parameter values that the SSM document uses at runtime.
scheduleExpression String
A Cron or Rate expression that specifies when the association is applied to the target.
scheduleOffset Integer
Number of days to wait after the scheduled day to run an association.
syncCompliance AssociationSyncCompliance

The mode for generating association compliance. You can specify AUTO or MANUAL . In AUTO mode, the system uses the status of the association execution to determine the compliance status. If the association execution runs successfully, then the association is COMPLIANT . If the association execution doesn't run successfully, the association is NON-COMPLIANT .

In MANUAL mode, you must specify the AssociationId as a parameter for the PutComplianceItems API action. In this case, compliance data is not managed by State Manager. It is managed by your direct call to the PutComplianceItems API action.

By default, all associations use AUTO mode.

targets List<AssociationTarget>
The targets that the SSM document sends commands to.
waitForSuccessTimeoutSeconds Integer

The number of seconds the service should wait for the association status to show "Success" before proceeding with the stack execution. If the association status doesn't show "Success" after the specified number of seconds, then stack creation fails.

When you specify a value for the WaitForSuccessTimeoutSeconds , drift detection for your AWS CloudFormation stack’s configuration might yield inaccurate results. If drift detection is important in your scenario, we recommend that you don’t include WaitForSuccessTimeoutSeconds in your template.

applyOnlyAtCronInterval boolean
By default, when you create a new association, the system runs it immediately after it is created and then according to the schedule you specified. Specify this option if you don't want an association to run immediately after you create it. This parameter is not supported for rate expressions.
associationName string
The name of the association.
automationTargetParameterName string
Choose the parameter that will define how your automation will branch out. This target is required for associations that use an Automation runbook and target resources by using rate controls. Automation is a tool in AWS Systems Manager .
calendarNames string[]
The names or Amazon Resource Names (ARNs) of the Change Calendar type documents your associations are gated under. The associations only run when that Change Calendar is open. For more information, see AWS Systems Manager Change Calendar in the AWS Systems Manager User Guide .
complianceSeverity AssociationComplianceSeverity
The severity level that is assigned to the association.
documentVersion string
The version of the SSM document to associate with the target.
instanceId string
The ID of the instance that the SSM document is associated with.
maxConcurrency string

The maximum number of targets allowed to run the association at the same time. You can specify a number, for example 10, or a percentage of the target set, for example 10%. The default value is 100%, which means all targets run the association at the same time.

If a new managed node starts and attempts to run an association while Systems Manager is running MaxConcurrency associations, the association is allowed to run. During the next association interval, the new managed node will process its association within the limit specified for MaxConcurrency .

maxErrors string

The number of errors that are allowed before the system stops sending requests to run the association on additional targets. You can specify either an absolute number of errors, for example 10, or a percentage of the target set, for example 10%. If you specify 3, for example, the system stops sending requests when the fourth error is received. If you specify 0, then the system stops sending requests after the first error is returned. If you run an association on 50 managed nodes and set MaxError to 10%, then the system stops sending the request when the sixth error is received.

Executions that are already running an association when MaxErrors is reached are allowed to complete, but some of these executions may fail as well. If you need to ensure that there won't be more than max-errors failed executions, set MaxConcurrency to 1 so that executions proceed one at a time.

name string
The name of the SSM document.
outputLocation AssociationInstanceAssociationOutputLocation
An Amazon Simple Storage Service (Amazon S3) bucket where you want to store the output details of the request.
parameters {[key: string]: string[]}
Parameter values that the SSM document uses at runtime.
scheduleExpression string
A Cron or Rate expression that specifies when the association is applied to the target.
scheduleOffset number
Number of days to wait after the scheduled day to run an association.
syncCompliance AssociationSyncCompliance

The mode for generating association compliance. You can specify AUTO or MANUAL . In AUTO mode, the system uses the status of the association execution to determine the compliance status. If the association execution runs successfully, then the association is COMPLIANT . If the association execution doesn't run successfully, the association is NON-COMPLIANT .

In MANUAL mode, you must specify the AssociationId as a parameter for the PutComplianceItems API action. In this case, compliance data is not managed by State Manager. It is managed by your direct call to the PutComplianceItems API action.

By default, all associations use AUTO mode.

targets AssociationTarget[]
The targets that the SSM document sends commands to.
waitForSuccessTimeoutSeconds number

The number of seconds the service should wait for the association status to show "Success" before proceeding with the stack execution. If the association status doesn't show "Success" after the specified number of seconds, then stack creation fails.

When you specify a value for the WaitForSuccessTimeoutSeconds , drift detection for your AWS CloudFormation stack’s configuration might yield inaccurate results. If drift detection is important in your scenario, we recommend that you don’t include WaitForSuccessTimeoutSeconds in your template.

apply_only_at_cron_interval bool
By default, when you create a new association, the system runs it immediately after it is created and then according to the schedule you specified. Specify this option if you don't want an association to run immediately after you create it. This parameter is not supported for rate expressions.
association_name str
The name of the association.
automation_target_parameter_name str
Choose the parameter that will define how your automation will branch out. This target is required for associations that use an Automation runbook and target resources by using rate controls. Automation is a tool in AWS Systems Manager .
calendar_names Sequence[str]
The names or Amazon Resource Names (ARNs) of the Change Calendar type documents your associations are gated under. The associations only run when that Change Calendar is open. For more information, see AWS Systems Manager Change Calendar in the AWS Systems Manager User Guide .
compliance_severity AssociationComplianceSeverity
The severity level that is assigned to the association.
document_version str
The version of the SSM document to associate with the target.
instance_id str
The ID of the instance that the SSM document is associated with.
max_concurrency str

The maximum number of targets allowed to run the association at the same time. You can specify a number, for example 10, or a percentage of the target set, for example 10%. The default value is 100%, which means all targets run the association at the same time.

If a new managed node starts and attempts to run an association while Systems Manager is running MaxConcurrency associations, the association is allowed to run. During the next association interval, the new managed node will process its association within the limit specified for MaxConcurrency .

max_errors str

The number of errors that are allowed before the system stops sending requests to run the association on additional targets. You can specify either an absolute number of errors, for example 10, or a percentage of the target set, for example 10%. If you specify 3, for example, the system stops sending requests when the fourth error is received. If you specify 0, then the system stops sending requests after the first error is returned. If you run an association on 50 managed nodes and set MaxError to 10%, then the system stops sending the request when the sixth error is received.

Executions that are already running an association when MaxErrors is reached are allowed to complete, but some of these executions may fail as well. If you need to ensure that there won't be more than max-errors failed executions, set MaxConcurrency to 1 so that executions proceed one at a time.

name str
The name of the SSM document.
output_location AssociationInstanceAssociationOutputLocationArgs
An Amazon Simple Storage Service (Amazon S3) bucket where you want to store the output details of the request.
parameters Mapping[str, Sequence[str]]
Parameter values that the SSM document uses at runtime.
schedule_expression str
A Cron or Rate expression that specifies when the association is applied to the target.
schedule_offset int
Number of days to wait after the scheduled day to run an association.
sync_compliance AssociationSyncCompliance

The mode for generating association compliance. You can specify AUTO or MANUAL . In AUTO mode, the system uses the status of the association execution to determine the compliance status. If the association execution runs successfully, then the association is COMPLIANT . If the association execution doesn't run successfully, the association is NON-COMPLIANT .

In MANUAL mode, you must specify the AssociationId as a parameter for the PutComplianceItems API action. In this case, compliance data is not managed by State Manager. It is managed by your direct call to the PutComplianceItems API action.

By default, all associations use AUTO mode.

targets Sequence[AssociationTargetArgs]
The targets that the SSM document sends commands to.
wait_for_success_timeout_seconds int

The number of seconds the service should wait for the association status to show "Success" before proceeding with the stack execution. If the association status doesn't show "Success" after the specified number of seconds, then stack creation fails.

When you specify a value for the WaitForSuccessTimeoutSeconds , drift detection for your AWS CloudFormation stack’s configuration might yield inaccurate results. If drift detection is important in your scenario, we recommend that you don’t include WaitForSuccessTimeoutSeconds in your template.

applyOnlyAtCronInterval Boolean
By default, when you create a new association, the system runs it immediately after it is created and then according to the schedule you specified. Specify this option if you don't want an association to run immediately after you create it. This parameter is not supported for rate expressions.
associationName String
The name of the association.
automationTargetParameterName String
Choose the parameter that will define how your automation will branch out. This target is required for associations that use an Automation runbook and target resources by using rate controls. Automation is a tool in AWS Systems Manager .
calendarNames List<String>
The names or Amazon Resource Names (ARNs) of the Change Calendar type documents your associations are gated under. The associations only run when that Change Calendar is open. For more information, see AWS Systems Manager Change Calendar in the AWS Systems Manager User Guide .
complianceSeverity "CRITICAL" | "HIGH" | "MEDIUM" | "LOW" | "UNSPECIFIED"
The severity level that is assigned to the association.
documentVersion String
The version of the SSM document to associate with the target.
instanceId String
The ID of the instance that the SSM document is associated with.
maxConcurrency String

The maximum number of targets allowed to run the association at the same time. You can specify a number, for example 10, or a percentage of the target set, for example 10%. The default value is 100%, which means all targets run the association at the same time.

If a new managed node starts and attempts to run an association while Systems Manager is running MaxConcurrency associations, the association is allowed to run. During the next association interval, the new managed node will process its association within the limit specified for MaxConcurrency .

maxErrors String

The number of errors that are allowed before the system stops sending requests to run the association on additional targets. You can specify either an absolute number of errors, for example 10, or a percentage of the target set, for example 10%. If you specify 3, for example, the system stops sending requests when the fourth error is received. If you specify 0, then the system stops sending requests after the first error is returned. If you run an association on 50 managed nodes and set MaxError to 10%, then the system stops sending the request when the sixth error is received.

Executions that are already running an association when MaxErrors is reached are allowed to complete, but some of these executions may fail as well. If you need to ensure that there won't be more than max-errors failed executions, set MaxConcurrency to 1 so that executions proceed one at a time.

name String
The name of the SSM document.
outputLocation Property Map
An Amazon Simple Storage Service (Amazon S3) bucket where you want to store the output details of the request.
parameters Map<List<String>>
Parameter values that the SSM document uses at runtime.
scheduleExpression String
A Cron or Rate expression that specifies when the association is applied to the target.
scheduleOffset Number
Number of days to wait after the scheduled day to run an association.
syncCompliance "AUTO" | "MANUAL"

The mode for generating association compliance. You can specify AUTO or MANUAL . In AUTO mode, the system uses the status of the association execution to determine the compliance status. If the association execution runs successfully, then the association is COMPLIANT . If the association execution doesn't run successfully, the association is NON-COMPLIANT .

In MANUAL mode, you must specify the AssociationId as a parameter for the PutComplianceItems API action. In this case, compliance data is not managed by State Manager. It is managed by your direct call to the PutComplianceItems API action.

By default, all associations use AUTO mode.

targets List<Property Map>
The targets that the SSM document sends commands to.
waitForSuccessTimeoutSeconds Number

The number of seconds the service should wait for the association status to show "Success" before proceeding with the stack execution. If the association status doesn't show "Success" after the specified number of seconds, then stack creation fails.

When you specify a value for the WaitForSuccessTimeoutSeconds , drift detection for your AWS CloudFormation stack’s configuration might yield inaccurate results. If drift detection is important in your scenario, we recommend that you don’t include WaitForSuccessTimeoutSeconds in your template.

Outputs

All input properties are implicitly available as output properties. Additionally, the Association resource produces the following output properties:

AssociationId string
Unique identifier of the association.
Id string
The provider-assigned unique ID for this managed resource.
AssociationId string
Unique identifier of the association.
Id string
The provider-assigned unique ID for this managed resource.
associationId String
Unique identifier of the association.
id String
The provider-assigned unique ID for this managed resource.
associationId string
Unique identifier of the association.
id string
The provider-assigned unique ID for this managed resource.
association_id str
Unique identifier of the association.
id str
The provider-assigned unique ID for this managed resource.
associationId String
Unique identifier of the association.
id String
The provider-assigned unique ID for this managed resource.

Supporting Types

AssociationComplianceSeverity
, AssociationComplianceSeverityArgs

Critical
CRITICAL
High
HIGH
Medium
MEDIUM
Low
LOW
Unspecified
UNSPECIFIED
AssociationComplianceSeverityCritical
CRITICAL
AssociationComplianceSeverityHigh
HIGH
AssociationComplianceSeverityMedium
MEDIUM
AssociationComplianceSeverityLow
LOW
AssociationComplianceSeverityUnspecified
UNSPECIFIED
Critical
CRITICAL
High
HIGH
Medium
MEDIUM
Low
LOW
Unspecified
UNSPECIFIED
Critical
CRITICAL
High
HIGH
Medium
MEDIUM
Low
LOW
Unspecified
UNSPECIFIED
CRITICAL
CRITICAL
HIGH
HIGH
MEDIUM
MEDIUM
LOW
LOW
UNSPECIFIED
UNSPECIFIED
"CRITICAL"
CRITICAL
"HIGH"
HIGH
"MEDIUM"
MEDIUM
"LOW"
LOW
"UNSPECIFIED"
UNSPECIFIED

AssociationInstanceAssociationOutputLocation
, AssociationInstanceAssociationOutputLocationArgs

S3Location Pulumi.AwsNative.Ssm.Inputs.AssociationS3OutputLocation
S3OutputLocation is a property of the InstanceAssociationOutputLocation property that specifies an Amazon S3 bucket where you want to store the results of this request.
S3Location AssociationS3OutputLocation
S3OutputLocation is a property of the InstanceAssociationOutputLocation property that specifies an Amazon S3 bucket where you want to store the results of this request.
s3Location AssociationS3OutputLocation
S3OutputLocation is a property of the InstanceAssociationOutputLocation property that specifies an Amazon S3 bucket where you want to store the results of this request.
s3Location AssociationS3OutputLocation
S3OutputLocation is a property of the InstanceAssociationOutputLocation property that specifies an Amazon S3 bucket where you want to store the results of this request.
s3_location AssociationS3OutputLocation
S3OutputLocation is a property of the InstanceAssociationOutputLocation property that specifies an Amazon S3 bucket where you want to store the results of this request.
s3Location Property Map
S3OutputLocation is a property of the InstanceAssociationOutputLocation property that specifies an Amazon S3 bucket where you want to store the results of this request.

AssociationS3OutputLocation
, AssociationS3OutputLocationArgs

OutputS3BucketName string
The name of the S3 bucket.
OutputS3KeyPrefix string
The S3 bucket subfolder.
OutputS3Region string
The AWS Region of the S3 bucket.
OutputS3BucketName string
The name of the S3 bucket.
OutputS3KeyPrefix string
The S3 bucket subfolder.
OutputS3Region string
The AWS Region of the S3 bucket.
outputS3BucketName String
The name of the S3 bucket.
outputS3KeyPrefix String
The S3 bucket subfolder.
outputS3Region String
The AWS Region of the S3 bucket.
outputS3BucketName string
The name of the S3 bucket.
outputS3KeyPrefix string
The S3 bucket subfolder.
outputS3Region string
The AWS Region of the S3 bucket.
output_s3_bucket_name str
The name of the S3 bucket.
output_s3_key_prefix str
The S3 bucket subfolder.
output_s3_region str
The AWS Region of the S3 bucket.
outputS3BucketName String
The name of the S3 bucket.
outputS3KeyPrefix String
The S3 bucket subfolder.
outputS3Region String
The AWS Region of the S3 bucket.

AssociationSyncCompliance
, AssociationSyncComplianceArgs

Auto
AUTO
Manual
MANUAL
AssociationSyncComplianceAuto
AUTO
AssociationSyncComplianceManual
MANUAL
Auto
AUTO
Manual
MANUAL
Auto
AUTO
Manual
MANUAL
AUTO
AUTO
MANUAL
MANUAL
"AUTO"
AUTO
"MANUAL"
MANUAL

AssociationTarget
, AssociationTargetArgs

Key This property is required. string
User-defined criteria for sending commands that target managed nodes that meet the criteria.
Values This property is required. List<string>

User-defined criteria that maps to Key . For example, if you specified tag:ServerRole , you could specify value:WebServer to run a command on instances that include EC2 tags of ServerRole,WebServer .

Depending on the type of target, the maximum number of values for a key might be lower than the global maximum of 50.

Key This property is required. string
User-defined criteria for sending commands that target managed nodes that meet the criteria.
Values This property is required. []string

User-defined criteria that maps to Key . For example, if you specified tag:ServerRole , you could specify value:WebServer to run a command on instances that include EC2 tags of ServerRole,WebServer .

Depending on the type of target, the maximum number of values for a key might be lower than the global maximum of 50.

key This property is required. String
User-defined criteria for sending commands that target managed nodes that meet the criteria.
values This property is required. List<String>

User-defined criteria that maps to Key . For example, if you specified tag:ServerRole , you could specify value:WebServer to run a command on instances that include EC2 tags of ServerRole,WebServer .

Depending on the type of target, the maximum number of values for a key might be lower than the global maximum of 50.

key This property is required. string
User-defined criteria for sending commands that target managed nodes that meet the criteria.
values This property is required. string[]

User-defined criteria that maps to Key . For example, if you specified tag:ServerRole , you could specify value:WebServer to run a command on instances that include EC2 tags of ServerRole,WebServer .

Depending on the type of target, the maximum number of values for a key might be lower than the global maximum of 50.

key This property is required. str
User-defined criteria for sending commands that target managed nodes that meet the criteria.
values This property is required. Sequence[str]

User-defined criteria that maps to Key . For example, if you specified tag:ServerRole , you could specify value:WebServer to run a command on instances that include EC2 tags of ServerRole,WebServer .

Depending on the type of target, the maximum number of values for a key might be lower than the global maximum of 50.

key This property is required. String
User-defined criteria for sending commands that target managed nodes that meet the criteria.
values This property is required. List<String>

User-defined criteria that maps to Key . For example, if you specified tag:ServerRole , you could specify value:WebServer to run a command on instances that include EC2 tags of ServerRole,WebServer .

Depending on the type of target, the maximum number of values for a key might be lower than the global maximum of 50.

Package Details

Repository
AWS Native pulumi/pulumi-aws-native
License
Apache-2.0

We recommend new projects start with resources from the AWS provider.

AWS Cloud Control v1.26.0 published on Wednesday, Mar 12, 2025 by Pulumi
pulumi/pulumi-aws-native