Response Syntax
{ "AssociationId": "string"
}
Response Elements
If the action is successful, the service sends back an HTTP 200 response.
The following data is returned in JSON format by the service.
AssociationId (p. 11) The association ID.
Type: String
Errors
For information about the errors that are common to all actions, see Common Errors (p. 841).
InternalServerError
An error occurred on the server side.
HTTP Status Code: 500
OpsItemInvalidParameterException
A specified parameter argument isn't valid. Verify the available arguments and try again.
HTTP Status Code: 400 OpsItemLimitExceededException
The request caused OpsItems to exceed one or more quotas. For information about OpsItem quotas, see What are the resource limits for OpsCenter?.
HTTP Status Code: 400 OpsItemNotFoundException
The specified OpsItem ID doesn't exist. Verify the ID and try again.
HTTP Status Code: 400
OpsItemRelatedItemAlreadyExistsException
The Amazon Resource Name (ARN) is already associated with the OpsItem.
HTTP Status Code: 400
Examples
Example
This example illustrates one usage of AssociateOpsItemRelatedItem.
See Also
Sample Request
POST / HTTP/1.1
Host: ssm.us-east-1.amazonaws.com Accept-Encoding: identity
X-Amz-Target: AmazonSSM.AssociateOpsItemRelatedItem Content-Type: application/x-amz-json-1.1
User-Agent: aws-cli/2.2.4 Python/3.8.8 Linux/5.4.129-72.229.amzn2int.x86_64 exe/
x86_64.amzn.2 prompt/off command/ssm.associate-ops-item-related-item X-Amz-Date: 20210804T181929Z
Authorization: AWS4-HMAC-SHA256 Credential=AKIAIOSFODNN7EXAMPLE/20210804/us-east-1/ssm/
aws4_request,
SignedHeaders=content-type;host;x-amz-date;x-amz-target, Signature=39c3b3042cd2aEXAMPLE Content-Length: 229
{ "OpsItemId": "oi-649fExample", "AssociationType": "RelatesTo",
"ResourceType": "AWS::SSMIncidents::IncidentRecord",
"ResourceUri": "arn:aws:ssm-incidents::111122223333:incident-record/Test/c6bd8931-efae-a4ff-7f98-4490Example"
}
Sample Response
{
"AssociationId": "61d7178d-a30d-4bc5-9b4e-a9e74EXAMPLE"
}
See Also
For more information about using this API in one of the language-specific AWS SDKs, see the following:
• AWS Command Line Interface
• AWS SDK for .NET
• AWS SDK for C++
• AWS SDK for Go
• AWS SDK for Java V2
• AWS SDK for JavaScript
• AWS SDK for PHP V3
• AWS SDK for Python
• AWS SDK for Ruby V3
CancelCommand
CancelCommand
Attempts to cancel the command specified by the Command ID. There is no guarantee that the command will be terminated and the underlying process stopped.
Request Syntax
{ "CommandId": "string", "InstanceIds": [ "string" ] }
Request Parameters
For information about the parameters that are common to all actions, see Common Parameters (p. 839).
The request accepts the following data in JSON format.
CommandId (p. 13)
The ID of the command you want to cancel.
Type: String
Length Constraints: Fixed length of 36.
Required: Yes InstanceIds (p. 13)
(Optional) A list of managed node IDs on which you want to cancel the command. If not provided, the command is canceled on every node on which it was requested.
Type: Array of strings
Array Members: Minimum number of 0 items. Maximum number of 50 items.
Pattern: (^i-(\w{8}|\w{17})$)|(^mi-\w{17}$) Required: No
Response Elements
If the action is successful, the service sends back an HTTP 200 response with an empty HTTP body.
Errors
For information about the errors that are common to all actions, see Common Errors (p. 841).
DuplicateInstanceId
You can't specify a managed node ID in more than one association.
HTTP Status Code: 400
Examples
InternalServerError
An error occurred on the server side.
HTTP Status Code: 500 InvalidCommandId
The specified command ID isn't valid. Verify the ID and try again.
HTTP Status Code: 400 InvalidInstanceId
The following problems can cause this exception:
• You don't have permission to access the managed node.
• AWS Systems Manager Agent(SSM Agent) isn't running. Verify that SSM Agent is running.
• SSM Agent isn't registered with the SSM endpoint. Try reinstalling SSM Agent.
• The managed node isn't in valid state. Valid states are: Running, Pending, Stopped, and Stopping. Invalid states are: Shutting-down and Terminated.
HTTP Status Code: 400
Examples
Example
This example illustrates one usage of CancelCommand.
Sample Request
POST / HTTP/1.1
Host: ssm.us-east-2.amazonaws.com Accept-Encoding: identity
X-Amz-Target: AmazonSSM.CancelCommand Content-Type: application/x-amz-json-1.1
User-Agent: aws-cli/2.0.0 Python/3.7.5 Windows/10 botocore/2.0.0dev4 X-Amz-Date: 20200220T233525Z
Authorization: AWS4-HMAC-SHA256 Credential=AKIAIOSFODNN7EXAMPLE/20200220/us-east-2/ssm/
aws4_request,
SignedHeaders=content-type;host;x-amz-date;x-amz-target, Signature=39c3b3042cd2aEXAMPLE Content-Length: 53
{ "CommandId": "25173b39-c88d-4459-ba3d-8704aEXAMPLE"
}
Sample Response
{}
See Also
For more information about using this API in one of the language-specific AWS SDKs, see the following:
• AWS Command Line Interface
See Also
• AWS SDK for .NET
• AWS SDK for C++
• AWS SDK for Go
• AWS SDK for Java V2
• AWS SDK for JavaScript
• AWS SDK for PHP V3
• AWS SDK for Python
• AWS SDK for Ruby V3
CancelMaintenanceWindowExecution
CancelMaintenanceWindowExecution
Stops a maintenance window execution that is already in progress and cancels any tasks in the window that haven't already starting running. Tasks already in progress will continue to completion.
Request Syntax
{ "WindowExecutionId": "string"
}
Request Parameters
For information about the parameters that are common to all actions, see Common Parameters (p. 839).
The request accepts the following data in JSON format.
WindowExecutionId (p. 16)
The ID of the maintenance window execution to stop.
Type: String
Length Constraints: Fixed length of 36.
Pattern: ^[0-9a-fA-F]{8}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{12}$
Required: Yes
Response Syntax
{ "WindowExecutionId": "string"
}
Response Elements
If the action is successful, the service sends back an HTTP 200 response.
The following data is returned in JSON format by the service.
WindowExecutionId (p. 16)
The ID of the maintenance window execution that has been stopped.
Type: String
Length Constraints: Fixed length of 36.
Pattern: ^[0-9a-fA-F]{8}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{4}\-[0-9a-fA-F]{12}$
Errors
Errors
For information about the errors that are common to all actions, see Common Errors (p. 841).
DoesNotExistException
Error returned when the ID specified for a resource, such as a maintenance window or patch baseline, doesn't exist.
For information about resource quotas in AWS Systems Manager, see Systems Manager service quotas in the Amazon Web Services General Reference.
HTTP Status Code: 400 InternalServerError
An error occurred on the server side.
HTTP Status Code: 500
Examples
Example
This example illustrates one usage of CancelMaintenanceWindowExecution.
Sample Request
POST / HTTP/1.1
Host: ssm.us-east-2.amazonaws.com Accept-Encoding: identity
X-Amz-Target: AmazonSSM.CancelMaintenanceWindowExecution Content-Type: application/x-amz-json-1.1
User-Agent: aws-cli/2.0.0 Python/3.7.5 Windows/10 botocore/2.0.0dev4 X-Amz-Date: 20200225T010054Z
Authorization: AWS4-HMAC-SHA256 Credential=AKIAIOSFODNN7EXAMPLE/20200225/us-east-2/ssm/
aws4_request,
SignedHeaders=content-type;host;x-amz-date;x-amz-target, Signature=39c3b3042cd2aEXAMPLE Content-Length: 61
{ "WindowExecutionId": "02f05632-d0bc-470d-b1e5-c59a8EXAMPLE"
}
Sample Response
{ "WindowExecutionId": "02f05632-d0bc-470d-b1e5-c59a8EXAMPLE"
}
See Also
For more information about using this API in one of the language-specific AWS SDKs, see the following:
• AWS Command Line Interface
• AWS SDK for .NET
See Also
• AWS SDK for C++
• AWS SDK for Go
• AWS SDK for Java V2
• AWS SDK for JavaScript
• AWS SDK for PHP V3
• AWS SDK for Python
• AWS SDK for Ruby V3
CreateActivation
CreateActivation
Generates an activation code and activation ID you can use to register your on-premises servers, edge devices, or virtual machine (VM) with AWS Systems Manager. Registering these machines with Systems Manager makes it possible to manage them using Systems Manager capabilities. You use the activation code and ID when installing SSM Agent on machines in your hybrid environment. For more information about requirements for managing on-premises machines using Systems Manager, see Setting up AWS Systems Manager for hybrid environments in the AWS Systems Manager User Guide.
NoteAmazon Elastic Compute Cloud (Amazon EC2) instances, edge devices, and on-premises servers and VMs that are configured for Systems Manager are all called managed nodes.
Request Syntax
{
"DefaultInstanceName": "string", "Description": "string",
"ExpirationDate": number, "IamRole": "string",
"RegistrationLimit": number, "RegistrationMetadata": [ {
"Key": "string", "Value": "string"
} ],
"Tags": [ {
"Key": "string", "Value": "string"
} ]}
Request Parameters
For information about the parameters that are common to all actions, see Common Parameters (p. 839).
The request accepts the following data in JSON format.
DefaultInstanceName (p. 19)
The name of the registered, managed node as it will appear in the AWS Systems Manager console or when you use the AWS command line tools to list Systems Manager resources.
Important
Don't enter personally identifiable information in this field.
Type: String
Length Constraints: Minimum length of 0. Maximum length of 256.
Pattern: ^([\p{L}\p{Z}\p{N}_.:/=+\-@]*)$
Required: No Description (p. 19)
A user-defined description of the resource that you want to register with Systems Manager.
Request Parameters
Important
Don't enter personally identifiable information in this field.
Type: String
Length Constraints: Minimum length of 0. Maximum length of 256.
Required: No ExpirationDate (p. 19)
The date by which this activation request should expire, in timestamp format, such as
"2021-07-07T00:00:00". You can specify a date up to 30 days in advance. If you don't provide an expiration date, the activation code expires in 24 hours.
Type: Timestamp Required: No IamRole (p. 19)
The name of the AWS Identity and Access Management (IAM) role that you want to assign to the managed node. This IAM role must provide AssumeRole permissions for the AWS Systems Manager service principal ssm.amazonaws.com. For more information, see Create an IAM service role for a hybrid environment in the AWS Systems Manager User Guide.
Type: String
Length Constraints: Maximum length of 64.
Required: Yes RegistrationLimit (p. 19)
Specify the maximum number of managed nodes you want to register. The default value is 1.
Type: Integer
Valid Range: Minimum value of 1. Maximum value of 1000.
Required: No
RegistrationMetadata (p. 19) Reserved for internal use.
Type: Array of RegistrationMetadataItem (p. 798) objects Required: No
Tags (p. 19)
Optional metadata that you assign to a resource. Tags enable you to categorize a resource in different ways, such as by purpose, owner, or environment. For example, you might want to tag an activation to identify which servers or virtual machines (VMs) in your on-premises environment you intend to activate. In this case, you could specify the following key-value pairs:
• Key=OS,Value=Windows
• Key=Environment,Value=Production Important
When you install SSM Agent on your on-premises servers and VMs, you specify an activation ID and code. When you specify the activation ID and code, tags assigned to the activation are automatically applied to the on-premises servers or VMs.
Response Syntax
You can't add tags to or delete tags from an existing activation. You can tag your on-premises servers, edge devices, and VMs after they connect to Systems Manager for the first time and are assigned a managed node ID. This means they are listed in the AWS Systems Manager console with an ID that is prefixed with "mi-". For information about how to add tags to your managed nodes, see AddTagsToResource (p. 6). For information about how to remove tags from your managed nodes, see RemoveTagsFromResource (p. 456).
Type: Array of Tag (p. 834) objects
Array Members: Maximum number of 1000 items.
Required: No
Response Syntax
{ "ActivationCode": "string", "ActivationId": "string"
}
Response Elements
If the action is successful, the service sends back an HTTP 200 response.
The following data is returned in JSON format by the service.
ActivationCode (p. 21)
The code the system generates when it processes the activation. The activation code functions like a password to validate the activation ID.
Type: String
Length Constraints: Minimum length of 20. Maximum length of 250.
ActivationId (p. 21)
The ID number generated by the system when it processed the activation. The activation ID functions like a user name.
Type: String
Pattern: ^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$
Errors
For information about the errors that are common to all actions, see Common Errors (p. 841).
InternalServerError
An error occurred on the server side.
HTTP Status Code: 500 InvalidParameters
You must specify values for all required parameters in the AWS Systems Manager document (SSM document). You can only supply values to parameters defined in the SSM document.
Examples
HTTP Status Code: 400
Examples
Example
This example illustrates one usage of CreateActivation.
Sample Request
POST / HTTP/1.1
Host: ssm.us-east-2.amazonaws.com Accept-Encoding: identity
X-Amz-Target: AmazonSSM.CreateActivation Content-Type: application/x-amz-json-1.1
User-Agent: aws-cli/1.17.12 Python/3.6.8 Darwin/18.7.0 botocore/1.14.12 X-Amz-Date: 20200324T135329Z
Authorization: AWS4-HMAC-SHA256 Credential=AKIAIOSFODNN7EXAMPLE/20200324/us-east-2/ssm/
aws4_request,
SignedHeaders=content-type;host;x-amz-date;x-amz-target, Signature=39c3b3042cd2aEXAMPLE Content-Length: 70
{ "IamRole": "service-role/role_name"
}
Sample Response
{ "ActivationCode": "Fjz3/sZfSvv78EXAMPLE",
"ActivationId": "e488f2f6-e686-4afb-8a04-ef6dfEXAMPLE"
}
See Also
For more information about using this API in one of the language-specific AWS SDKs, see the following:
• AWS Command Line Interface
• AWS SDK for .NET
• AWS SDK for C++
• AWS SDK for Go
• AWS SDK for Java V2
• AWS SDK for JavaScript
• AWS SDK for PHP V3
• AWS SDK for Python
• AWS SDK for Ruby V3
CreateAssociation
CreateAssociation
A State Manager association defines the state that you want to maintain on your managed nodes.
For example, an association can specify that anti-virus software must be installed and running on your managed nodes, or that certain ports must be closed. For static targets, the association specifies a schedule for when the configuration is reapplied. For dynamic targets, such as an AWS resource group or an AWS autoscaling group, State Manager, a capability of AWS Systems Manager applies the configuration when new managed nodes are added to the group. The association also specifies actions to take when applying the configuration. For example, an association for anti-virus software might run once a day. If the software isn't installed, then State Manager installs it. If the software is installed, but the service isn't running, then the association might instruct State Manager to start the service.
Request Syntax
{
"ApplyOnlyAtCronInterval": boolean, "AssociationName": "string",
"AutomationTargetParameterName": "string", "CalendarNames": [ "string" ],
"ComplianceSeverity": "string", "DocumentVersion": "string", "InstanceId": "string", "MaxConcurrency": "string", "MaxErrors": "string", "Name": "string", "OutputLocation": { "S3Location": {
"ScheduleExpression": "string", "SyncCompliance": "string", "TargetLocations": [ {
"Accounts": [ "string" ], "ExecutionRoleName": "string", "Regions": [ "string" ],
"TargetLocationMaxConcurrency": "string", "TargetLocationMaxErrors": "string"
}
For information about the parameters that are common to all actions, see Common Parameters (p. 839).
The request accepts the following data in JSON format.
Request Parameters
ApplyOnlyAtCronInterval (p. 23)
By default, when you create a new association, the system runs it immediately after it is created and then according to the schedule you specified. Specify this option if you don't want an association to run immediately after you create it. This parameter isn't supported for rate expressions.
Type: Boolean Required: No AssociationName (p. 23)
Specify a descriptive name for the association.
Type: String
Pattern: ^[a-zA-Z0-9_\-.]{3,128}$
Required: No
AutomationTargetParameterName (p. 23)
Choose the parameter that will define how your automation will branch out. This target is required for associations that use an Automation runbook and target resources by using rate controls.
Automation is a capability of AWS Systems Manager.
Type: String
Length Constraints: Minimum length of 1. Maximum length of 50.
Required: No CalendarNames (p. 23)
The names or Amazon Resource Names (ARNs) of the Change Calendar type documents you want to gate your associations under. The associations only run when that change calendar is open. For more information, see AWS Systems Manager Change Calendar.
Type: Array of strings Required: No
ComplianceSeverity (p. 23)
The severity level to assign to the association.
Type: String
Valid Values: CRITICAL | HIGH | MEDIUM | LOW | UNSPECIFIED Required: No
DocumentVersion (p. 23)
The document version you want to associate with the target(s). Can be a specific version or the default version.
Important
State Manager doesn't support running associations that use a new version of a document if that document is shared from another account. State Manager always runs the default version of a document if shared from another account, even though the Systems Manager console shows that a new version was processed. If you want to run an association using a new version of a document shared form another account, you must set the document version to default.
Type: String
Request Parameters
Pattern: ([$]LATEST|[$]DEFAULT|^[1-9][0-9]*$) Required: No
InstanceId (p. 23)
The managed node ID.
Note
InstanceId has been deprecated. To specify a managed node ID for an association, use the Targets parameter. Requests that include the parameter InstanceID with Systems Manager documents (SSM documents) that use schema version 2.0 or later will fail. In addition, if you use the parameter InstanceId, you can't use the parameters AssociationName, DocumentVersion, MaxErrors, MaxConcurrency, OutputLocation, or ScheduleExpression. To use these parameters, you must use the Targets parameter.
Type: String
Pattern: (^i-(\w{8}|\w{17})$)|(^mi-\w{17}$) Required: No
MaxConcurrency (p. 23)
The maximum number of targets allowed to run the association at the same time. You can specify a number, for example 10, or a percentage of the target set, for example 10%. The default value is 100%, which means all targets run the association at the same time.
If a new managed node starts and attempts to run an association while Systems Manager is running MaxConcurrency associations, the association is allowed to run. During the next
association interval, the new managed node will process its association within the limit specified for MaxConcurrency.
Type: String
Length Constraints: Minimum length of 1. Maximum length of 7.
Pattern: ^([1-9][0-9]*|[1-9][0-9]%|[1-9]%|100%)$
Required: No MaxErrors (p. 23)
The number of errors that are allowed before the system stops sending requests to run the association on additional targets. You can specify either an absolute number of errors, for example 10, or a percentage of the target set, for example 10%. If you specify 3, for example, the system stops sending requests when the fourth error is received. If you specify 0, then the system stops sending requests after the first error is returned. If you run an association on 50 managed nodes and set MaxError to 10%, then the system stops sending the request when the sixth error is received.
Executions that are already running an association when MaxErrors is reached are allowed to complete, but some of these executions may fail as well. If you need to ensure that there won't be more than max-errors failed executions, set MaxConcurrency to 1 so that executions proceed one at a time.
Type: String
Length Constraints: Minimum length of 1. Maximum length of 7.
Pattern: ^([1-9][0-9]*|[0]|[1-9][0-9]%|[0-9]%|100%)$
Required: No
Request Parameters
Name (p. 23)
The name of the SSM Command document or Automation runbook that contains the configuration information for the managed node.
You can specify AWS-predefined documents, documents you created, or a document that is shared with you from another account.
For Systems Manager documents (SSM documents) that are shared with you from other AWS accounts, you must specify the complete SSM document ARN, in the following format:
arn:partition:ssm:region:account-id:document/document-name For example:
arn:aws:ssm:us-east-2:12345678912:document/My-Shared-Document
For AWS-predefined documents and SSM documents you created in your account, you only need to specify the document name. For example, AWS-ApplyPatchBaseline or My-Document.
Type: String
Pattern: ^[a-zA-Z0-9_\-.:/]{3,128}$
Required: Yes OutputLocation (p. 23)
An Amazon Simple Storage Service (Amazon S3) bucket where you want to store the output details of the request.
Type: InstanceAssociationOutputLocation (p. 675) object Required: No
Parameters (p. 23)
The parameters for the runtime configuration of the document.
Type: String to array of strings map Required: No
ScheduleExpression (p. 23)
A cron expression when the association will be applied to the target(s).
Type: String
Length Constraints: Minimum length of 1. Maximum length of 256.
Required: No SyncCompliance (p. 23)
The mode for generating association compliance. You can specify AUTO or MANUAL. In AUTO mode, the system uses the status of the association execution to determine the compliance status. If the association execution runs successfully, then the association is COMPLIANT. If the association execution doesn't run successfully, the association is NON-COMPLIANT.
In MANUAL mode, you must specify the AssociationId as a parameter for the
PutComplianceItems (p. 420) API operation. In this case, compliance data isn't managed by State Manager. It is managed by your direct call to the PutComplianceItems (p. 420) API operation.
By default, all associations use AUTO mode.
Response Syntax
Type: String
Valid Values: AUTO | MANUAL Required: No
TargetLocations (p. 23)
A location is a combination of AWS Regions and AWS accounts where you want to run the association. Use this action to create an association in multiple Regions and multiple accounts.
Type: Array of TargetLocation (p. 837) objects
Type: Array of TargetLocation (p. 837) objects