associations

Creates, updates, deletes or gets an association resource or lists associations in a region

Overview

Name	associations
Type	Resource
Description	The AWS::SSM::Association resource associates an SSM document in AWS Systems Manager with EC2 instances that contain a configuration agent to process the document.
Id	awscc.ssm.associations

Fields

get (all properties)

Name	Datatype	Description
association_name	string	The name of the association.
calendar_names	array
schedule_expression	string	A Cron or Rate expression that specifies when the association is applied to the target.
max_errors	string
parameters	object	Parameter values that the SSM document uses at runtime.
instance_id	string	The ID of the instance that the SSM document is associated with.
wait_for_success_timeout_seconds	integer
max_concurrency	string
compliance_severity	string
▶targets	array	The targets that the SSM document sends commands to.
sync_compliance	string
▶output_location	object
schedule_offset	integer
name	string	The name of the SSM document.
apply_only_at_cron_interval	boolean
document_version	string	The version of the SSM document to associate with the target.
association_id	string	Unique identifier of the association.
automation_target_parameter_name	string
region	string	AWS region.

list (identifiers only)

Name	Datatype	Description
association_id	string	Unique identifier of the association.
region	string	AWS region.

For more information, see AWS::SSM::Association.

Methods

Name	Resource	Accessible by	Required Params
create_resource	associations	INSERT	Name, region
delete_resource	associations	DELETE	Identifier, region
update_resource	associations	UPDATE	Identifier, PatchDocument, region
list_resources	associations_list_only	SELECT	region
get_resource	associations	SELECT	Identifier, region

SELECT examples

get (all properties)

Gets all properties from an individual association.

SELECT
  region,
  association_name,
  calendar_names,
  schedule_expression,
  max_errors,
  parameters,
  instance_id,
  wait_for_success_timeout_seconds,
  max_concurrency,
  compliance_severity,
  targets,
  sync_compliance,
  output_location,
  schedule_offset,
  name,
  apply_only_at_cron_interval,
  document_version,
  association_id,
  automation_target_parameter_name
FROM awscc.ssm.associations
WHERE
  region = 'us-east-1' AND
  Identifier = '{{ association_id }}';

list (identifiers only)

Lists all associations in a region.

SELECT
  region,
  association_id
FROM awscc.ssm.associations_list_only
WHERE
  region = 'us-east-1';

INSERT example

Use the following StackQL query and manifest file to create a new association resource, using stack-deploy.

Required Properties

/*+ create */
INSERT INTO awscc.ssm.associations (
  Name,
  region
)
SELECT
  '{{ name }}',
  '{{ region }}';

All Properties

/*+ create */
INSERT INTO awscc.ssm.associations (
  AssociationName,
  CalendarNames,
  ScheduleExpression,
  MaxErrors,
  Parameters,
  InstanceId,
  WaitForSuccessTimeoutSeconds,
  MaxConcurrency,
  ComplianceSeverity,
  Targets,
  SyncCompliance,
  OutputLocation,
  ScheduleOffset,
  Name,
  ApplyOnlyAtCronInterval,
  DocumentVersion,
  AutomationTargetParameterName,
  region
)
SELECT
  '{{ association_name }}',
  '{{ calendar_names }}',
  '{{ schedule_expression }}',
  '{{ max_errors }}',
  '{{ parameters }}',
  '{{ instance_id }}',
  '{{ wait_for_success_timeout_seconds }}',
  '{{ max_concurrency }}',
  '{{ compliance_severity }}',
  '{{ targets }}',
  '{{ sync_compliance }}',
  '{{ output_location }}',
  '{{ schedule_offset }}',
  '{{ name }}',
  '{{ apply_only_at_cron_interval }}',
  '{{ document_version }}',
  '{{ automation_target_parameter_name }}',
  '{{ region }}';

Manifest

version: 1
name: stack name
description: stack description
providers:
  - aws
globals:
  - name: region
    value: '{{ vars.AWS_REGION }}'
resources:
  - name: association
    props:
      - name: association_name
        value: '{{ association_name }}'
      - name: calendar_names
        value:
          - '{{ calendar_names[0] }}'
      - name: schedule_expression
        value: '{{ schedule_expression }}'
      - name: max_errors
        value: '{{ max_errors }}'
      - name: parameters
        value: {}
      - name: instance_id
        value: '{{ instance_id }}'
      - name: wait_for_success_timeout_seconds
        value: '{{ wait_for_success_timeout_seconds }}'
      - name: max_concurrency
        value: '{{ max_concurrency }}'
      - name: compliance_severity
        value: '{{ compliance_severity }}'
      - name: targets
        value:
          - values:
              - '{{ values[0] }}'
            key: '{{ key }}'
      - name: sync_compliance
        value: '{{ sync_compliance }}'
      - name: output_location
        value:
          s3_location:
            output_s3_key_prefix: '{{ output_s3_key_prefix }}'
            output_s3_region: '{{ output_s3_region }}'
            output_s3_bucket_name: '{{ output_s3_bucket_name }}'
      - name: schedule_offset
        value: '{{ schedule_offset }}'
      - name: name
        value: '{{ name }}'
      - name: apply_only_at_cron_interval
        value: '{{ apply_only_at_cron_interval }}'
      - name: document_version
        value: '{{ document_version }}'
      - name: automation_target_parameter_name
        value: '{{ automation_target_parameter_name }}'

UPDATE example

Use the following StackQL query and manifest file to update a association resource, using stack-deploy.

/*+ update */
UPDATE awscc.ssm.associations
SET PatchDocument = string('{{ {
    "AssociationName": association_name,
    "CalendarNames": calendar_names,
    "ScheduleExpression": schedule_expression,
    "MaxErrors": max_errors,
    "Parameters": parameters,
    "InstanceId": instance_id,
    "WaitForSuccessTimeoutSeconds": wait_for_success_timeout_seconds,
    "MaxConcurrency": max_concurrency,
    "ComplianceSeverity": compliance_severity,
    "Targets": targets,
    "SyncCompliance": sync_compliance,
    "OutputLocation": output_location,
    "ScheduleOffset": schedule_offset,
    "Name": name,
    "ApplyOnlyAtCronInterval": apply_only_at_cron_interval,
    "DocumentVersion": document_version,
    "AutomationTargetParameterName": automation_target_parameter_name
} | generate_patch_document }}')
WHERE
  region = '{{ region }}' AND
  Identifier = '{{ association_id }}';

DELETE example

/*+ delete */
DELETE FROM awscc.ssm.associations
WHERE
  Identifier = '{{ association_id }}' AND
  region = 'us-east-1';

Permissions

To operate on the associations resource, the following permissions are required:

Read

ssm:DescribeAssociation,
resource-groups:GetGroupQuery,
resource-groups:ListGroups,
resource-groups:ListGroupResources

Create

ec2:DescribeInstanceStatus,
iam:PassRole,
iam:CreateServiceLinkedRole,
ssm:CreateAssociation,
ssm:DescribeAssociation,
ssm:GetCalendarState

Update

iam:PassRole,
ssm:UpdateAssociation,
ssm:GetCalendarState

List

ssm:ListAssociations

Delete

ssm:DeleteAssociation