aws.ssm-document

Filters

• config-compliance

• content

• cross-account

• event

• finding

• json-diff

• list-item

• marked-for-op

• ops-item

• reduce

• value

content

Applies value type filter on the content of an SSM Document. :example:

policies:
  - name: document-content
    resource: ssm-document
    filters:
      - type: content
        key: cloudWatchEncryptionEnabled
        op: eq
        value: false

properties:
  default:
    type: object
  key:
    type: string
  op:
    enum:
    - eq
    - equal
    - ne
    - not-equal
    - gt
    - greater-than
    - ge
    - gte
    - le
    - lte
    - lt
    - less-than
    - glob
    - regex
    - regex-case
    - in
    - ni
    - not-in
    - contains
    - difference
    - intersect
    - mod
  type:
    enum:
    - content
  value:
    oneOf:
    - type: array
    - type: string
    - type: boolean
    - type: number
    - type: 'null'
  value_from:
    additionalProperties: 'False'
    properties:
      expr:
        oneOf:
        - type: integer
        - type: string
      format:
        enum:
        - csv
        - json
        - txt
        - csv2dict
      headers:
        patternProperties:
          ? ''
          : type: string
        type: object
      query:
        type: string
      url:
        type: string
    required:
    - url
    type: object
  value_path:
    type: string
  value_regex:
    type: string
  value_type:
    enum:
    - age
    - integer
    - expiration
    - normalize
    - size
    - cidr
    - cidr_size
    - swap
    - resource_count
    - expr
    - unique_size
    - date
    - version
    - float
required:
- type

Permissions - ssm:GetDocument

cross-account

Filter SSM documents which have cross account permissions

example:

policies:
  - name: ssm-cross-account
    resource: ssm-document
    filters:
      - type: cross-account
        whitelist: [xxxxxxxxxxxx]

properties:
  actions:
    items:
      type: string
    type: array
  everyone_only:
    type: boolean
  type:
    enum:
    - cross-account
  whitelist:
    items:
      type: string
    type: array
  whitelist_conditions:
    items:
      type: string
    type: array
  whitelist_from:
    additionalProperties: 'False'
    properties:
      expr:
        oneOf:
        - type: integer
        - type: string
      format:
        enum:
        - csv
        - json
        - txt
        - csv2dict
      headers:
        patternProperties:
          ? ''
          : type: string
        type: object
      query:
        type: string
      url:
        type: string
    required:
    - url
    type: object
  whitelist_orgids:
    items:
      type: string
    type: array
  whitelist_orgids_from:
    additionalProperties: 'False'
    properties:
      expr:
        oneOf:
        - type: integer
        - type: string
      format:
        enum:
        - csv
        - json
        - txt
        - csv2dict
      headers:
        patternProperties:
          ? ''
          : type: string
        type: object
      query:
        type: string
      url:
        type: string
    required:
    - url
    type: object
  whitelist_vpc:
    items:
      type: string
    type: array
  whitelist_vpc_from:
    additionalProperties: 'False'
    properties:
      expr:
        oneOf:
        - type: integer
        - type: string
      format:
        enum:
        - csv
        - json
        - txt
        - csv2dict
      headers:
        patternProperties:
          ? ''
          : type: string
        type: object
      query:
        type: string
      url:
        type: string
    required:
    - url
    type: object
  whitelist_vpce:
    items:
      type: string
    type: array
  whitelist_vpce_from:
    additionalProperties: 'False'
    properties:
      expr:
        oneOf:
        - type: integer
        - type: string
      format:
        enum:
        - csv
        - json
        - txt
        - csv2dict
      headers:
        patternProperties:
          ? ''
          : type: string
        type: object
      query:
        type: string
      url:
        type: string
    required:
    - url
    type: object
required:
- type

Permissions - ssm:DescribeDocumentPermission

json-diff

Compute the diff from the current resource to a previous version.

A resource matches the filter if a diff exists between the current resource and the selected revision.

Utilizes config as a resource revision database.

Revisions can be selected by date, against the previous version, and against a locked version (requires use of is-locked filter).

properties:
  selector:
    enum:
    - previous
    - date
    - locked
  selector_value:
    type: string
  type:
    enum:
    - json-diff
required:
- type

Permissions - config:GetResourceConfigHistory

Actions

• auto-tag-user

• copy-related-tag

• delete

• invoke-lambda

• invoke-sfn

• mark-for-op

• notify

• post-finding

• post-item

• put-metric

• remove-tag

• rename-tag

• set-sharing

• tag

• webhook

delete

Delete SSM documents. Set force flag to True to force delete on documents that are shared across accounts. This will remove those shared accounts, and then delete the document. Otherwise, delete will fail and raise InvalidDocumentOperation exception if a document is shared with other accounts. Default value for force is False.

example:

policies:
  - name: ssm-delete-documents
    resource: ssm-document
    filters:
      - type: cross-account
        whitelist: [xxxxxxxxxxxx]
    actions:
      - type: delete
        force: True

properties:
  force:
    type: boolean
  type:
    enum:
    - delete
required:
- type

Permissions - ssm:DeleteDocument, ssm:ModifyDocumentPermission

rename-tag

Rename an existing tag key to a new value.

example:

rename Application, and Bap to App, if a resource has both of the old keys then we’ll use the value specified by Application, which is based on the order of values of old_keys.

policies:
- name: rename-tags-example
  resource: aws.log-group
  filters:
    - or:
      - "tag:Bap": present
      - "tag:Application": present
  actions:
    - type: rename-tag
      old_keys: [Application, Bap]
      new_key: App

properties:
  new_key:
    type: string
  old_key:
    type: string
  old_keys:
    items:
      type: string
    type: array
  type:
    enum:
    - rename-tag
required:
- type

Permissions - tag:TagResources, tag:UntagResources

set-sharing

Edit list of accounts that share permissions on an SSM document. Pass in a list of account IDs to the ‘add’ or ‘remove’ fields to edit document sharing permissions. Set ‘remove’ to ‘matched’ to automatically remove any external accounts on a document (use in conjunction with the cross-account filter).

example:

policies:
  - name: ssm-set-sharing
    resource: ssm-document
    filters:
      - type: cross-account
        whitelist: [xxxxxxxxxxxx]
    actions:
      - type: set-sharing
        add: [yyyyyyyyyy]
        remove: matched

properties:
  add:
    items:
      type: string
    type: array
  remove:
    oneOf:
    - enum:
      - matched
    - items:
        type: string
      type: array
  type:
    enum:
    - set-sharing
required:
- type

Permissions - ssm:ModifyDocumentPermission