compliance_items
Creates, updates, deletes, gets or lists a compliance_items resource.
Overview
| Name | compliance_items |
| Type | Resource |
| Id | aws.ssm.compliance_items |
Fields
The following fields are returned by SELECT queries:
- list_compliance_items
| Name | Datatype | Description |
|---|---|---|
compliance_type | string | The compliance type. For example, Association (for a State Manager association), Patch, or Custom:string are all valid compliance types. (pattern: <code>[A-Za-z0-9_-]\w+|Custom:[a-zA-Z0-9_-]\w+</code>) |
details | object | A "Key": "Value" tag combination for the compliance item. |
execution_summary | object | A summary for the compliance item. The summary includes an execution ID, the execution type (for example, command), and the execution time. For State Manager associations, the ExecutionTime value represents when the compliance status was captured and aggregated by the Systems Manager service, not necessarily when the underlying association was executed on the managed node. State Manager updates compliance status for all associations on an instance whenever any association executes, which means multiple associations may show the same execution time even if they were executed at different times. |
id | string | An ID for the compliance item. For example, if the compliance item is a Windows patch, the ID could be the number of the KB article; for example: KB4010320. |
resource_id | string | An ID for the resource. For a managed node, this is the node ID. |
resource_type | string | The type of resource. ManagedInstance is currently the only supported resource type. |
severity | string | The severity of the compliance status. Severity can be one of the following: Critical, High, Medium, Low, Informational, Unspecified. (CRITICAL, HIGH, MEDIUM, LOW, INFORMATIONAL, UNSPECIFIED) |
status | string | The status of the compliance item. An item is either COMPLIANT, NON_COMPLIANT, or an empty string (for Windows patches that aren't applicable). (COMPLIANT, NON_COMPLIANT) |
title | string | A title for the compliance item. For example, if the compliance item is a Windows patch, the title could be the title of the KB article for the patch; for example: Security Update for Active Directory Federation Services. |
Methods
The following methods are available for this resource:
| Name | Accessible by | Required Params | Optional Params | Description |
|---|---|---|---|---|
list_compliance_items | select | region | For a specified resource ID, this API operation returns a list of compliance statuses for different resource types. Currently, you can only specify one resource ID per call. List results depend on the criteria specified in the filter. | |
put_compliance_items | replace | region, ResourceId, ResourceType, ComplianceType, ExecutionSummary, Items | Registers a compliance type and other compliance details on a designated resource. This operation lets you register custom compliance details with a resource. This call overwrites existing compliance information on the resource, so you must provide a full list of compliance items each time that you send the request. ComplianceType can be one of the following: ExecutionId: The execution ID when the patch, association, or custom compliance item was applied. ExecutionType: Specify patch, association, or Custom:string. ExecutionTime. The time the patch, association, or custom compliance item was applied to the managed node. For State Manager associations, this represents the time when compliance status was captured by the Systems Manager service during its internal compliance aggregation workflow, not necessarily when the association was executed on the managed node. State Manager updates compliance information for all associations on an instance whenever any association executes, which may result in multiple associations showing the same execution time. Id: The patch, association, or custom compliance ID. Title: A title. Status: The status of the compliance item. For example, approved for patches, or Failed for associations. Severity: A patch severity. For example, Critical. DocumentName: An SSM document name. For example, AWS-RunPatchBaseline. DocumentVersion: An SSM document version number. For example, 4. Classification: A patch classification. For example, security updates. PatchBaselineId: A patch baseline ID. PatchSeverity: A patch severity. For example, Critical. PatchState: A patch state. For example, InstancesWithFailedPatches. PatchGroup: The name of a patch group. InstalledTime: The time the association, patch, or custom compliance item was applied to the resource. Specify the time by using the following format: yyyy-MM-dd'T'HH:mm:ss'Z' |
Parameters
Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.
| Name | Datatype | Description |
|---|---|---|
region | string | AWS region (default: us-east-1) |
SELECT examples
- list_compliance_items
For a specified resource ID, this API operation returns a list of compliance statuses for different resource types. Currently, you can only specify one resource ID per call. List results depend on the criteria specified in the filter.
SELECT
compliance_type,
details,
execution_summary,
id,
resource_id,
resource_type,
severity,
status,
title
FROM aws.ssm.compliance_items
WHERE region = '{{ region }}' -- required
;
REPLACE examples
- put_compliance_items
Registers a compliance type and other compliance details on a designated resource. This operation lets you register custom compliance details with a resource. This call overwrites existing compliance information on the resource, so you must provide a full list of compliance items each time that you send the request. ComplianceType can be one of the following: ExecutionId: The execution ID when the patch, association, or custom compliance item was applied. ExecutionType: Specify patch, association, or Custom:string. ExecutionTime. The time the patch, association, or custom compliance item was applied to the managed node. For State Manager associations, this represents the time when compliance status was captured by the Systems Manager service during its internal compliance aggregation workflow, not necessarily when the association was executed on the managed node. State Manager updates compliance information for all associations on an instance whenever any association executes, which may result in multiple associations showing the same execution time. Id: The patch, association, or custom compliance ID. Title: A title. Status: The status of the compliance item. For example, approved for patches, or Failed for associations. Severity: A patch severity. For example, Critical. DocumentName: An SSM document name. For example, AWS-RunPatchBaseline. DocumentVersion: An SSM document version number. For example, 4. Classification: A patch classification. For example, security updates. PatchBaselineId: A patch baseline ID. PatchSeverity: A patch severity. For example, Critical. PatchState: A patch state. For example, InstancesWithFailedPatches. PatchGroup: The name of a patch group. InstalledTime: The time the association, patch, or custom compliance item was applied to the resource. Specify the time by using the following format: yyyy-MM-dd'T'HH:mm:ss'Z'
REPLACE aws.ssm.compliance_items
SET
ResourceId = '{{ ResourceId }}',
ResourceType = '{{ ResourceType }}',
ComplianceType = '{{ ComplianceType }}',
ExecutionSummary = '{{ ExecutionSummary }}',
Items = '{{ Items }}',
ItemContentHash = '{{ ItemContentHash }}',
UploadType = '{{ UploadType }}'
WHERE
region = '{{ region }}' --required
AND ResourceId = '{{ ResourceId }}' --required
AND ResourceType = '{{ ResourceType }}' --required
AND ComplianceType = '{{ ComplianceType }}' --required
AND ExecutionSummary = '{{ ExecutionSummary }}' --required
AND Items = '{{ Items }}' --required;