Configuring resource data sync for Inventory

Open the Amazon S3 console at https://console.amazonaws.cn/s3/.

Create a bucket to store your aggregated Inventory data. For more information, see Create a Bucket in the Amazon Simple Storage Service User Guide. Make a note of the bucket name and the Amazon Web Services Region where you created it.

Choose the Permissions tab, and then choose Bucket Policy.

Copy and paste the following bucket policy into the policy editor. Replace DOC-EXAMPLE-BUCKET and account-id with the name of the S3 bucket you created and a valid Amazon Web Services account ID.

To allow multiple Amazon Web Services accounts to send inventory data to the central Amazon S3 bucket, specify each account in the policy as shown in the following Resource sample:

"Resource": [
    "arn:aws-cn:s3:::DOC-EXAMPLE-BUCKET/*/accountid=123456789012/*", 
    "arn:aws-cn:s3:::DOC-EXAMPLE-BUCKET/*/accountid=444455556666/*",
    "arn:aws-cn:s3:::DOC-EXAMPLE-BUCKET/*/accountid=777788889999/*"
],
"Condition": {
    "StringEquals": {
         "s3:x-amz-acl": "bucket-owner-full-control",
         "aws:SourceAccount": [
                  "123456789012",
                  "444455556666",
                  "777788889999"
         ]
     },
      "ArnLike": {
          "aws:SourceArn": [
            "arn:aws-cn:ssm:*:123456789012:resource-data-sync/*",
            "arn:aws-cn:ssm:*:444455556666:resource-data-sync/*",
            "arn:aws-cn:ssm:*:777788889999:resource-data-sync/*"
          ]
     }
}

{
    "Version": "2012-10-17",
    "Statement": [
        {
        "Sid": "SSMBucketPermissionsCheck",
        "Effect": "Allow",
        "Principal": {
            "Service": "ssm.amazonaws.com.cn"
        },
        "Action": "s3:GetBucketAcl",
        "Resource": "arn:aws-cn:s3:::DOC-EXAMPLE-BUCKET"
        },
        {
        "Sid": " SSMBucketDelivery",
        "Effect": "Allow",
        "Principal": {
            "Service": "ssm.amazonaws.com.cn"
        },
        "Action": "s3:PutObject",
        "Resource": [
            "arn:aws-cn:s3:::DOC-EXAMPLE-BUCKET/*/accountid=ID_number/*",
            "arn:aws-cn:s3:::DOC-EXAMPLE-BUCKET/*/accountid=ID_number/*",
            "arn:aws-cn:s3:::DOC-EXAMPLE-BUCKET/*/accountid=ID_number/*",
            "arn:aws-cn:s3:::DOC-EXAMPLE-BUCKET/*/accountid=ID_number/*"
        ],
        "Condition": {
            "StringEquals": {
                "s3:x-amz-acl": "bucket-owner-full-control",
                "aws:SourceAccount": "ID_number"
            },
            "ArnLike": {
                "aws:SourceArn": "arn:aws-cn:ssm:*:ID_number:resource-data-sync/*"
            }
        }
      }
    ]
}

Open the Amazon Systems Manager console at https://console.amazonaws.cn/systems-manager/.

In the navigation pane, choose Fleet Manager.

-or-

If the Amazon Systems Manager home page opens first, choose the menu icon ( ) to open the navigation pane, and then choose Fleet Manager in the navigation pane.

In the Account management menu, choose Resource data sync.

Choose Create resource data sync.

In the Sync name field, enter a name for the sync configuration.

In the Bucket name field, enter the name of the Amazon S3 bucket you created using the To create and configure an Amazon S3 bucket for resource data sync procedure.

(Optional) In the Bucket prefix field, enter the name of an Amazon S3 bucket prefix (subdirectory).

In the Bucket region field, choose This region if the Amazon S3 bucket you created is located in the current Amazon Web Services Region. If the bucket is located in a different Amazon Web Services Region, choose Another region, and enter the name of the Region.

(Optional) In the KMS Key ARN field, type or paste a KMS Key ARN to encrypt inventory data in Amazon S3.

Choose Create.

Open the Amazon S3 console at https://console.amazonaws.cn/s3/.

Create a bucket to store your aggregated inventory data. For more information, see Create a Bucket in the Amazon Simple Storage Service User Guide. Make a note of the bucket name and the Amazon Web Services Region where you created it.

Choose the Permissions tab, and then choose Bucket Policy.

Copy and paste the following bucket policy into the policy editor. Replace DOC-EXAMPLE-BUCKET and organization-id with the name of the Amazon S3 bucket you created and a valid Amazon Organizations account ID.

Optionally, replace bucket-prefix with the name of an Amazon S3 prefix (subdirectory). If you didn't create a prefix, remove bucket-prefix/ from the ARN in the following policy.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "SSMBucketPermissionsCheck",
      "Effect": "Allow",
      "Principal": {
        "Service": "ssm.amazonaws.com.cn"
      },
      "Action": "s3:GetBucketAcl",
      "Resource": "arn:aws-cn:s3:::S3_bucket_name"
    },
    {
      "Sid": " SSMBucketDelivery",
      "Effect": "Allow",
      "Principal": {
        "Service": "ssm.amazonaws.com.cn"
      },
      "Action": "s3:PutObject",
      "Resource": [
        "arn:aws-cn:s3:::DOC-EXAMPLE-BUCKET/bucket-prefix/*/accountid=*/*"
      ],
      "Condition": {
        "StringEquals": {
          "s3:x-amz-acl": "bucket-owner-full-control",
          "aws:SourceOrgID": "organization-id"
                  }
      }
    },
    {
      "Sid": " SSMBucketDeliveryTagging",
      "Effect": "Allow",
      "Principal": {
        "Service": "ssm.amazonaws.com.cn"
      },
      "Action": "s3:PutObjectTagging",
      "Resource": [
        "arn:aws-cn:s3:::DOC-EXAMPLE-BUCKET/bucket-prefix/*/accountid=*/*"
      ]
    }
  ]
}

Install and configure the Amazon Command Line Interface (Amazon CLI), if you haven't already.

For information, see Installing or updating the latest version of the Amazon CLI.

Run the following command to verify that you don't have any other resource data syncs. You can only have one organization-based resource data sync.

aws ssm list-resource-data-sync

If the command returns another resource data sync, you must delete it or choose not to create a new one.

Run the following command to create a resource data sync for an account defined in Amazon Organizations. For DOC-EXAMPLE-BUCKET, specify the name of the Amazon S3 bucket you created earlier in this topic. If you created a prefix (subdirectory) for your bucket, then specify this information for prefix-name.

aws ssm create-resource-data-sync --sync-name name --s3-destination "BucketName=DOC-EXAMPLE-BUCKET,Prefix=prefix-name,SyncFormat=JsonSerDe,Region=Amazon Web Services Region, for example us-east-2,DestinationDataSharing={DestinationDataSharingType=Organization}"

Repeat Steps 2 and 3 for every Amazon Web Services Region and Amazon Web Services account where you want to synchronize data to the central Amazon S3 bucket.

Open the Amazon Systems Manager console at https://console.amazonaws.cn/systems-manager/.

In the navigation pane, choose Fleet Manager.

-or-

If the Amazon Systems Manager home page opens first, choose the menu icon ( ) to open the navigation pane, and then choose Fleet Manager in the navigation pane.

In the Account management dropdown, choose Resource data syncs.

Select a resource data sync from the table, and then choose View details to view information about your resource data sync.

Open the Amazon Systems Manager console at https://console.amazonaws.cn/systems-manager/.

In the navigation pane, choose Fleet Manager.

-or-

If the Amazon Systems Manager home page opens first, choose the menu icon ( ) to open the navigation pane, and then choose Fleet Manager in the navigation pane.

In the Account management dropdown, choose Resource data syncs.

Select a resource data sync from the table, and then choose Delete.