Creating associations

Open the Amazon Systems Manager console at https://console.amazonaws.cn/systems-manager/.

In the navigation pane, choose State Manager.

-or-

If the Amazon Systems Manager home page opens first, choose the menu icon ( ) to open the navigation pane, and then choose State Manager.

Choose Create association.

In the Name field, specify a name.

In the Document list, choose the option next to a document name. Note the document type. This procedure applies to Command and Policy documents. For information about creating an association that uses an Automation runbook, see Scheduling automations with State Manager associations.

For Parameters, specify the required input parameters.

(Optional) Choose a CloudWatch alarm to apply to your association for monitoring.

For Targets, choose an option. For information about using targets, see About targets and rate controls in State Manager associations.

In the Specify schedule section, choose either On Schedule or No schedule. If you choose On Schedule, use the buttons provided to create a cron or rate schedule for the association.

If you don't want the association to run immediately after you create it, choose Apply association only at the next specified Cron interval.

(Optional) In the Schedule offset field, specify a number between 1 and 6.

In the Advanced options section use Compliance severity to choose a severity level for the association and use Change Calendars to choose a change calendar for the association.

Compliance reporting indicates whether the association state is compliant or noncompliant, along with the severity level you indicate here. For more information, see About State Manager association compliance.

The change calendar determines when the association runs. If the calendar is closed, the association isn't applied. If the calendar is open, the association runs accordingly. For more information, see Amazon Systems Manager Change Calendar.

In the Rate control section, choose options to control how the association runs on multiple nodes. For more information about using rate controls, see About targets and rate controls in State Manager associations.

In the Concurrency section, choose an option:

In the Error threshold section, choose an option:

(Optional) For Output options, to save the command output to a file, select the Enable writing output to S3 box. Enter the bucket and prefix (folder) names in the boxes.

Following are the minimal permissions required to turn on Amazon S3 output for an association. You can further restrict access by attaching IAM policies to users or roles within an account. At minimum, an Amazon EC2 instance profile should have an IAM role with the AmazonSSMManagedInstanceCore managed policy and the following inline policy.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:PutObject",
                "s3:GetObject",
                "s3:PutObjectAcl"
            ],
            "Resource": "arn:aws-cn:s3:::DOC-EXAMPLE-BUCKET/*"
        }
    ]
}

For minimal permissions, the Amazon S3 bucket you export to must have the default settings defined by the Amazon S3 console. For more information about creating Amazon S3 buckets, see Creating a bucket in the Amazon S3 User Guide.

Choose Create Association.

Install and configure the Amazon CLI or the Amazon Tools for PowerShell, if you haven't already.

For information, see Installing or updating the latest version of the Amazon CLI and Installing the Amazon Tools for PowerShell.

Use the following format to create a command that creates a State Manager association. Replace each example resource placeholder with your own information.

The following example creates an association on nodes tagged with "Environment,Linux". The association uses the AWS-UpdateSSMAgent document to update the SSM Agent on the targeted nodes at 2:00 UTC every Sunday morning. This association runs simultaneously on 10 nodes maximum at any given time. Also, this association stops running on more nodes for a particular execution interval if the error count exceeds 5. For compliance reporting, this association is assigned a severity level of Medium.

The following example targets node IDs by specifying a wildcard value (*). This allows Systems Manager to create an association on all nodes in the current Amazon Web Services account and Amazon Web Services Region. This association runs simultaneously on 10 nodes maximum at any given time. Also, this association stops running on more nodes for a particular execution interval if the error count exceeds 5. For compliance reporting, this association is assigned a severity level of Medium. This association uses a schedule offset, which means it runs two days after the specified cron schedule. It also includes the ApplyOnlyAtCronInterval parameter, which is required to use the schedule offset and which means the association won't run immediately after it is created.

The following example creates an association on nodes in Resource Groups. The group is named "HR-Department". The association uses the AWS-UpdateSSMAgent document to update SSM Agent on the targeted nodes at 2:00 UTC every Sunday morning. This association runs simultaneously on 10 nodes maximum at any given time. Also, this association stops running on more nodes for a particular execution interval if the error count exceeds 5. For compliance reporting, this association is assigned a severity level of Medium. This association runs at the specified cron schedule. It doesn't run immediately after the association is created.

The following example creates an association that runs on nodes tagged with a specific node ID. The association uses the SSM Agent document to update SSM Agent on the targeted nodes once when the change calendar is open. The association checks the calendar state when it runs. If the calendar is closed at launch time and the association is only run once, it won't run again because the association run window has passed. If the calendar is open, the association runs accordingly.

The following example creates an association that runs on nodes tagged with a specific node ID. The association uses the SSM Agent document to update SSM Agent on the targeted nodes on the targeted nodes at 2:00 AM every Sunday. This association runs only at the specified cron schedule when the change calendar is open. When the association is created, it checks the calendar state. If the calendar is closed, the association isn't applied. When the interval to apply the association starts at 2:00 AM on Sunday, the association checks to see if the calendar is open. If the calendar is open, the association runs accordingly.