Product logo
DocsBlogPricing

Permissions for @turbot/aws-ssm

Taking a look at permissions and associated grant levels for each permission for SSM:

PermissionGrant LevelHelp
ec2messages:AcknowledgeMessageAdmin
ec2messages:DeleteMessageAdmin
ec2messages:FailMessageAdmin
ec2messages:GetEndpointAdmin
ec2messages:GetMessagesAdmin
ec2messages:SendReplyAdmin
iam:ListRolesMetadata
iam:PassRoleAdminAllows to use existing role in SSM.
ssm-guiconnect:CancelConnectionOperator
ssm-guiconnect:GetConnectionMetadata
ssm-guiconnect:StartConnectionOperator
ssm:AddTagsToResourceOperatorConsidered to be low risk operation. Tags are metadata that you assign to your managed instances. Tags enable you to categorize your managed instances in different ways. E.g. by purpose/ owner/ or environment.
ssm:AssociateOpsItemRelatedItemAdmin
ssm:CancelCommandOperatorAttempts to cancel the command specified by the Command ID
ssm:CancelMaintenanceWindowExecutionOperator
ssm:CreateActivationAdminOperator can manage to registers on-premises server or virtual machine with Amazon EC2 so that you can manage these resources using Run Command
ssm:CreateAssociationOperatorOperator can associates the specified Systems Manager document with the specified instances or targets.
ssm:CreateAssociationBatchOperator
ssm:CreateDocumentAdmin
ssm:CreateMaintenanceWindowAdmin
ssm:CreateOpsItemAdmin
ssm:CreateOpsMetadataAdmin
ssm:CreatePatchBaselineAdminAdmin can creates a patch baseline. This is a admin definition for the patch base line. Verify that the AWS-DefaultPatchBaseline meets the need. Or create a patch baseline that defines a standard set of patches for the instances.
ssm:CreateResourceDataSyncAdminAdmin can create a resource data sync configuration to a single bucket in Amazon S3.
ssm:DeleteActivationAdmin
ssm:DeleteAssociationOperator
ssm:DeleteDocumentAdminBefore deleting the document. It is recommend that you use DeleteAssociation to disassociate all instances that are associated with the document.
ssm:DeleteInventoryAdmin
ssm:DeleteMaintenanceWindowAdmin
ssm:DeleteOpsMetadataAdmin
ssm:DeleteParameterOperatorDelete a parameter from the system.
ssm:DeleteParametersOperatorDelete a list of parameters.
ssm:DeletePatchBaselineAdmin
ssm:DeleteResourceDataSyncAdmin
ssm:DeregisterManagedInstanceOperatorRemoves the server or virtual machine from the list of registered servers. You can reregister the instance again at any time. If you don’t plan to use Run Command on the server. We suggest uninstalling the SSM Agent first.
ssm:DeregisterPatchBaselineForPatchGroupAdmin
ssm:DeregisterTargetFromMaintenanceWindowOperator
ssm:DeregisterTaskFromMaintenanceWindowOperator
ssm:DescribeActivationsMetadataDescribes the associations for the specified Systems Manager document or instance
ssm:DescribeAssociationReadOnly
ssm:DescribeAssociationExecutionTargetsReadOnly
ssm:DescribeAssociationExecutionsReadOnly
ssm:DescribeAutomationExecutionsMetadataProvides details about all active and terminated Automation executions.
ssm:DescribeAutomationStepExecutionsMetadataProvides details about all active and terminated step executions in an Automation workflow.
ssm:DescribeAvailablePatchesMetadata
ssm:DescribeDocumentMetadataDescribes the specified SSM document.
ssm:DescribeDocumentParametersMetadataDisplays the Documents node in the left navigation for EC2 and SSM. https://docs.aws.amazon.com/IAM/latest/UserGuide/list\_amazonsimplesystemsmanager.html
ssm:DescribeDocumentPermissionMetadataOnly account ID is displayed
ssm:DescribeEffectiveInstanceAssociationsMetadataAll associations for the instance(s).
ssm:DescribeEffectivePatchesForPatchBaselineMetadataThe EffectivePatch structure defines metadata about a patch along with the approval state of the patch in a particular patch baseline
ssm:DescribeInstanceAssociationsStatusMetadataOnly status information about the instance association
ssm:DescribeInstanceInformationMetadataAs it provides detailed information like the operating system platform the SSM Agent version (Linux) status etc.
ssm:DescribeInstancePatchStatesMetadataVery high-level information of the patch state.
ssm:DescribeInstancePatchStatesForPatchGroupMetadataDefines the high-level patch compliance state for a managed instance. providing information about the number of installed. missing. not applicable. and failed patches along with metadata about the operation when this information was gathered for the instance
ssm:DescribeInstancePatchesMetadataRetrieves the high-level patch state of one or more instances
ssm:DescribeInstancePropertiesMetadataDisplays the Managed Instances node in the left navigation for EC2 and SSM. https://docs.aws.amazon.com/IAM/latest/UserGuide/list\_amazonsimplesystemsmanager.html
ssm:DescribeInventoryDeletionsMetadata
ssm:DescribeMaintenanceWindowExecutionTaskInvocationsMetadataRetrieves the individual task executions (one per target) for a particular task executed as part of a Maintenance Window execution.
ssm:DescribeMaintenanceWindowExecutionTasksMetadata
ssm:DescribeMaintenanceWindowExecutionsMetadata
ssm:DescribeMaintenanceWindowScheduleMetadata
ssm:DescribeMaintenanceWindowTargetsMetadata
ssm:DescribeMaintenanceWindowTasksMetadata
ssm:DescribeMaintenanceWindowsMetadata
ssm:DescribeMaintenanceWindowsForTargetMetadata
ssm:DescribeOpsItemsMetadata
ssm:DescribeParametersMetadata
ssm:DescribePatchBaselinesMetadata
ssm:DescribePatchGroupStateMetadata
ssm:DescribePatchGroupsMetadata
ssm:DescribePatchPropertiesMetadata
ssm:DescribeSessionsMetadata
ssm:DisassociateOpsItemRelatedItemAdmin
ssm:GetAutomationExecutionMetadata
ssm:GetCalendarStateMetadata
ssm:GetCommandInvocationMetadataReturns detailed information about command execution
ssm:GetConnectionStatusMetadata
ssm:GetDefaultPatchBaselineMetadata
ssm:GetDeployablePatchSnapshotForInstanceReadOnlyContains A pre-signed Amazon S3 URL that can be used to download the patch snapshot.http://docs.aws.amazon.com/systems-manager/latest/APIReference/API\_GetDeployablePatchSnapshotForInstance.html#EC2-GetDeployablePatchSnapshotForInstance-response-SnapshotDownloadUrl
ssm:GetDocumentMetadata
ssm:GetInventoryMetadata
ssm:GetInventorySchemaMetadata
ssm:GetMaintenanceWindowMetadata
ssm:GetMaintenanceWindowExecutionMetadata
ssm:GetMaintenanceWindowExecutionTaskMetadata
ssm:GetMaintenanceWindowExecutionTaskInvocationMetadata
ssm:GetMaintenanceWindowTaskMetadata
ssm:GetManifestMetadataFetches the installation description for a package. https://docs.aws.amazon.com/IAM/latest/UserGuide/list\_amazonsimplesystemsmanager.html
ssm:GetOpsItemMetadata
ssm:GetOpsMetadataMetadata
ssm:GetOpsSummaryMetadata
ssm:GetParameterMetadataGet information about a parameter by using the parameter name.
ssm:GetParameterHistoryMetadata
ssm:GetParametersMetadataGet details of a parameter.
ssm:GetParametersByPathMetadataRetrieve parameters in a specific hierarchy.
ssm:GetPatchBaselineMetadata
ssm:GetPatchBaselineForPatchGroupMetadata
ssm:GetServiceSettingMetadata
ssm:LabelParameterVersionOperator
ssm:ListAssociationVersionsMetadataRetrieves all versions of an association for a specific association ID.
ssm:ListAssociationsMetadataLists the associations for the specified Systems Manager document or instance
ssm:ListCommandInvocationsMetadata
ssm:ListCommandsMetadataNo direct access to the S3 data
ssm:ListComplianceItemsMetadata
ssm:ListComplianceSummariesMetadata
ssm:ListDocumentMetadataHistoryMetadata
ssm:ListDocumentVersionsMetadata
ssm:ListDocumentsMetadata
ssm:ListInstanceAssociationsMetadataThis is shown only part of the AWS managed service part. not part of the API list
ssm:ListInventoryEntriesMetadata
ssm:ListOpsItemEventsMetadata
ssm:ListOpsItemRelatedItemsMetadata
ssm:ListOpsMetadataMetadata
ssm:ListResourceComplianceSummariesMetadata
ssm:ListResourceDataSyncMetadata
ssm:ListTagsForResourceMetadata
ssm:ModifyDocumentPermissionAdmin
ssm:PutComplianceItemsAdmin
ssm:PutConfigurePackageResultMetadataReports installation result for a package. https://docs.aws.amazon.com/IAM/latest/UserGuide/list\_amazonsimplesystemsmanager.html
ssm:PutInventoryOperator
ssm:PutParameterAdmin
ssm:RegisterDefaultPatchBaselineAdminAs creation is associated to Admin above
ssm:RegisterManagedInstanceAdmin
ssm:RegisterPatchBaselineForPatchGroupAdmin
ssm:RegisterTargetWithMaintenanceWindowOperatorUses the Maintenance created by Admin
ssm:RegisterTaskWithMaintenanceWindowOperatorUses the Maintenance created by Admin
ssm:RemoveTagsFromResourceOperator
ssm:ResetServiceSettingAdmin
ssm:ResumeSessionAdmin
ssm:SendAutomationSignalOperator
ssm:SendCommandOperator
ssm:StartAssociationsOnceOperator
ssm:StartAutomationExecutionOperator
ssm:StartChangeRequestExecutionAdmin
ssm:StartSessionAdmin
ssm:StopAutomationExecutionOperator
ssm:TerminateSessionAdmin
ssm:UnlabelParameterVersionAdmin
ssm:UpdateAssociationOperatorAs create/delete is part of the Operation function
ssm:UpdateAssociationStatusOperator
ssm:UpdateDocumentAdmin
ssm:UpdateDocumentDefaultVersionAdmin
ssm:UpdateDocumentMetadataAdmin
ssm:UpdateInstanceAssociationStatusOperator
ssm:UpdateInstanceInformationOperator
ssm:UpdateMaintenanceWindowAdmin
ssm:UpdateMaintenanceWindowTargetOperatorOperator can change the target of an existing Maintenance Window.
ssm:UpdateMaintenanceWindowTaskOperatorOperator can modify a task assigned to a Maintenance Window.
ssm:UpdateManagedInstanceRoleAdminAssigns or changes an Amazon Identity and Access Management (IAM) role to the managed instance.
ssm:UpdateOpsItemAdmin
ssm:UpdateOpsMetadataAdmin
ssm:UpdatePatchBaselineAdmin
ssm:UpdateResourceDataSyncAdmin
ssm:UpdateServiceSettingAdmin
ssmmessages:CreateControlChannelAdmin
ssmmessages:CreateDataChannelAdmin
ssmmessages:OpenControlChannelAdmin
ssmmessages:OpenDataChannelAdmin