aws.ssm-patch-baseline

Custom (account-owned) ssm patch baselines.

AWS predefined baselines are owned by an aws account and can’t be tagged or modified, so only self-owned baselines are enumerated.

example:

policies:
  - name: ssm-patch-baseline-untagged
    resource: aws.ssm-patch-baseline
    filters:
      - "tag:Owner": absent
    actions:
      - type: tag
        key: Owner
        value: unknown

Filters

• config-compliance

• event

• finding

• list-item

• marked-for-op

• ops-item

• reduce

• value

Actions

• auto-tag-user

• copy-related-tag

• invoke-lambda

• invoke-sfn

• mark-for-op

• notify

• post-finding

• post-item

• put-metric

• remove-tag

• tag

• webhook