documents

Creates, updates, deletes or gets a document resource or lists documents in a region

Overview

Name	documents
Type	Resource
Description	The AWS::SSM::Document resource is an SSM document in AWS Systems Manager that defines the actions that Systems Manager performs, which can be used to set up and run commands on your instances.
Id	aws.ssm.documents

Fields

Name	Datatype	Description
content	object	The content for the Systems Manager document in JSON, YAML or String format.
attachments	array	A list of key and value pairs that describe attachments to a version of a document.
name	string	A name for the Systems Manager document.
version_name	string	An optional field specifying the version of the artifact you are creating with the document. This value is unique across all versions of a document, and cannot be changed.
document_type	string	The type of document to create.
document_format	string	Specify the document format for the request. The document format can be either JSON or YAML. JSON is the default format.
target_type	string	Specify a target type to define the kinds of resources the document can run on.
tags	array	Optional metadata that you assign to a resource. Tags enable you to categorize a resource in different ways, such as by purpose, owner, or environment.
requires	array	A list of SSM documents required by a document. For example, an ApplicationConfiguration document requires an ApplicationConfigurationSchema document.
update_method	string	Update method - when set to 'Replace', the update will replace the existing document; when set to 'NewVersion', the update will create a new version.
region	string	AWS region.

For more information, see AWS::SSM::Document.

Methods

Name	Accessible by	Required Params
create_resource	INSERT	Content, region
delete_resource	DELETE	data__Identifier, region
update_resource	UPDATE	data__Identifier, data__PatchDocument, region
list_resources	SELECT	region
get_resource	SELECT	data__Identifier, region

SELECT examples

Gets all documents in a region.

SELECT
region,
content,
attachments,
name,
version_name,
document_type,
document_format,
target_type,
tags,
requires,
update_method
FROM aws.ssm.documents
WHERE region = 'us-east-1';

Gets all properties from an individual document.

SELECT
region,
content,
attachments,
name,
version_name,
document_type,
document_format,
target_type,
tags,
requires,
update_method
FROM aws.ssm.documents
WHERE region = 'us-east-1' AND data__Identifier = '<Name>';

INSERT example

Use the following StackQL query and manifest file to create a new document resource, using stack-deploy.

Required Properties

/*+ create */
INSERT INTO aws.ssm.documents (
 Content,
 region
)
SELECT 
'{{ Content }}',
'{{ region }}';

All Properties

/*+ create */
INSERT INTO aws.ssm.documents (
 Content,
 Attachments,
 Name,
 VersionName,
 DocumentType,
 DocumentFormat,
 TargetType,
 Tags,
 Requires,
 UpdateMethod,
 region
)
SELECT 
 '{{ Content }}',
 '{{ Attachments }}',
 '{{ Name }}',
 '{{ VersionName }}',
 '{{ DocumentType }}',
 '{{ DocumentFormat }}',
 '{{ TargetType }}',
 '{{ Tags }}',
 '{{ Requires }}',
 '{{ UpdateMethod }}',
 '{{ region }}';

Manifest

version: 1
name: stack name
description: stack description
providers:
  - aws
globals:
  - name: region
    value: '{{ vars.AWS_REGION }}'
resources:
  - name: document
    props:
      - name: Content
        value: {}
      - name: Attachments
        value:
          - Key: '{{ Key }}'
            Values:
              - '{{ Values[0] }}'
            Name: '{{ Name }}'
      - name: Name
        value: '{{ Name }}'
      - name: VersionName
        value: '{{ VersionName }}'
      - name: DocumentType
        value: '{{ DocumentType }}'
      - name: DocumentFormat
        value: '{{ DocumentFormat }}'
      - name: TargetType
        value: '{{ TargetType }}'
      - name: Tags
        value:
          - Key: '{{ Key }}'
            Value: '{{ Value }}'
      - name: Requires
        value:
          - Name: '{{ Name }}'
            Version: '{{ Version }}'
      - name: UpdateMethod
        value: '{{ UpdateMethod }}'

DELETE example

/*+ delete */
DELETE FROM aws.ssm.documents
WHERE data__Identifier = '<Name>'
AND region = 'us-east-1';

Permissions

To operate on the documents resource, the following permissions are required:

Create

ssm:CreateDocument,
ssm:GetDocument,
ssm:AddTagsToResource,
ssm:ListTagsForResource,
s3:GetObject,
iam:PassRole

Read

ssm:GetDocument,
ssm:ListTagsForResource

Update

ssm:UpdateDocument,
s3:GetObject,
ssm:AddTagsToResource,
ssm:RemoveTagsFromResource,
ssm:ListTagsForResource,
iam:PassRole,
ssm:UpdateDocumentDefaultVersion,
ssm:DescribeDocument

Delete

ssm:DeleteDocument,
ssm:GetDocument

List

ssm:ListDocuments