documents

Creates, updates, deletes or gets a document resource or lists documents in a region

Overview

Name	documents
Type	Resource
Description	The AWS::SSM::Document resource is an SSM document in AWS Systems Manager that defines the actions that Systems Manager performs, which can be used to set up and run commands on your instances.
Id	awscc.ssm.documents

Fields

get (all properties)

Name	Datatype	Description
content	object	The content for the Systems Manager document in JSON, YAML or String format.
▶attachments	array	A list of key and value pairs that describe attachments to a version of a document.
name	string	A name for the Systems Manager document.
version_name	string	An optional field specifying the version of the artifact you are creating with the document. This value is unique across all versions of a document, and cannot be changed.
document_type	string	The type of document to create.
document_format	string	Specify the document format for the request. The document format can be either JSON or YAML. JSON is the default format.
target_type	string	Specify a target type to define the kinds of resources the document can run on.
▶tags	array	Optional metadata that you assign to a resource. Tags enable you to categorize a resource in different ways, such as by purpose, owner, or environment.
▶requires	array	A list of SSM documents required by a document. For example, an ApplicationConfiguration document requires an ApplicationConfigurationSchema document.
update_method	string	Update method - when set to 'Replace', the update will replace the existing document; when set to 'NewVersion', the update will create a new version.
region	string	AWS region.

list (identifiers only)

Name	Datatype	Description
name	string	A name for the Systems Manager document.
region	string	AWS region.

For more information, see AWS::SSM::Document.

Methods

Name	Resource	Accessible by	Required Params
create_resource	documents	INSERT	Content, region
delete_resource	documents	DELETE	Identifier, region
update_resource	documents	UPDATE	Identifier, PatchDocument, region
list_resources	documents_list_only	SELECT	region
get_resource	documents	SELECT	Identifier, region

SELECT examples

get (all properties)

Gets all properties from an individual document.

SELECT
  region,
  content,
  attachments,
  name,
  version_name,
  document_type,
  document_format,
  target_type,
  tags,
  requires,
  update_method
FROM awscc.ssm.documents
WHERE
  region = '{{ region }}' AND
  Identifier = '{{ name }}';

list (identifiers only)

Lists all documents in a region.

SELECT
  region,
  name
FROM awscc.ssm.documents_list_only
WHERE
  region = '{{ region }}';

INSERT example

Use the following StackQL query and manifest file to create a new document resource, using stack-deploy.

Required Properties

/*+ create */
INSERT INTO awscc.ssm.documents (
  Content,
  region
)
SELECT
  '{{ content }}',
  '{{ region }}'
RETURNING
  ErrorCode,
  EventTime,
  Identifier,
  Operation,
  OperationStatus,
  RequestToken,
  ResourceModel,
  RetryAfter,
  StatusMessage,
  TypeName
;

All Properties

/*+ create */
INSERT INTO awscc.ssm.documents (
  Content,
  Attachments,
  Name,
  VersionName,
  DocumentType,
  DocumentFormat,
  TargetType,
  Tags,
  Requires,
  UpdateMethod,
  region
)
SELECT
  '{{ content }}',
  '{{ attachments }}',
  '{{ name }}',
  '{{ version_name }}',
  '{{ document_type }}',
  '{{ document_format }}',
  '{{ target_type }}',
  '{{ tags }}',
  '{{ requires }}',
  '{{ update_method }}',
  '{{ region }}'
RETURNING
  ErrorCode,
  EventTime,
  Identifier,
  Operation,
  OperationStatus,
  RequestToken,
  ResourceModel,
  RetryAfter,
  StatusMessage,
  TypeName
;

Manifest

version: 1
name: stack name
description: stack description
providers:
- aws
globals:
- name: region
  value: '{{ vars.AWS_REGION }}'
resources:
- name: document
  props:
    - name: content
      value: {}
    - name: attachments
      value:
        - key: '{{ key }}'
          values:
            - '{{ values[0] }}'
          name: '{{ name }}'
    - name: name
      value: '{{ name }}'
    - name: version_name
      value: '{{ version_name }}'
    - name: document_type
      value: '{{ document_type }}'
    - name: document_format
      value: '{{ document_format }}'
    - name: target_type
      value: '{{ target_type }}'
    - name: tags
      value:
        - key: '{{ key }}'
          value: '{{ value }}'
    - name: requires
      value:
        - name: '{{ name }}'
          version: '{{ version }}'
    - name: update_method
      value: '{{ update_method }}'

UPDATE example

Use the following StackQL query and manifest file to update a document resource, using stack-deploy.

/*+ update */
UPDATE awscc.ssm.documents
SET PatchDocument = string('{{ {
    "Content": content,
    "Attachments": attachments,
    "VersionName": version_name,
    "DocumentFormat": document_format,
    "TargetType": target_type,
    "Tags": tags,
    "Requires": requires,
    "UpdateMethod": update_method
} | generate_patch_document }}')
WHERE
  region = '{{ region }}' AND
  Identifier = '{{ name }}'
RETURNING
  ErrorCode,
  EventTime,
  Identifier,
  Operation,
  OperationStatus,
  RequestToken,
  ResourceModel,
  RetryAfter,
  StatusMessage,
  TypeName
;

DELETE example

/*+ delete */
DELETE FROM awscc.ssm.documents
WHERE
  Identifier = '{{ name }}' AND
  region = '{{ region }}'
RETURNING
  ErrorCode,
  EventTime,
  Identifier,
  Operation,
  OperationStatus,
  RequestToken,
  ResourceModel,
  RetryAfter,
  StatusMessage,
  TypeName
;

Additional Parameters

Mutable resources in the Cloud Control provider support additional optional parameters which can be supplied with INSERT, UPDATE, or DELETE operations. These include:

Parameter	Description
ClientToken	A unique identifier to ensure the idempotency of the resource request. This allows the provider to accurately distinguish between retries and new requests. A client token is valid for 36 hours once used. After that, a resource request with the same client token is treated as a new request. If you do not specify a client token, one is generated for inclusion in the request.
RoleArn	The ARN of the IAM role used to perform this resource operation. The role specified must have the permissions required for this operation. If you do not specify a role, a temporary session is created using your AWS user credentials.
TypeVersionId	For private resource types, the type version to use in this resource operation. If you do not specify a resource version, the default version is used.

Permissions

To operate on the documents resource, the following permissions are required:

Create

ssm:CreateDocument,
ssm:GetDocument,
ssm:AddTagsToResource,
ssm:ListTagsForResource,
s3:GetObject,
iam:PassRole

Read

ssm:DescribeDocument,
ssm:GetDocument,
ssm:ListTagsForResource

Update

ssm:UpdateDocument,
s3:GetObject,
ssm:AddTagsToResource,
ssm:RemoveTagsFromResource,
ssm:ListTagsForResource,
iam:PassRole,
ssm:UpdateDocumentDefaultVersion,
ssm:DescribeDocument

Delete

ssm:DeleteDocument,
ssm:GetDocument

List

ssm:ListDocuments