Amazon Systems Manager Compliance - Amazon Systems Manager
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Amazon Systems Manager Compliance

You can use Compliance, a capability of Amazon Systems Manager, to scan your fleet of managed nodes for patch compliance and configuration inconsistencies. You can collect and aggregate data from multiple Amazon Web Services accounts and Regions, and then drill down into specific resources that aren’t compliant. By default, Compliance displays current compliance data about patching in Patch Manager and associations in State Manager. (Patch Manager and State Manager are also both capabilities of Amazon Systems Manager.) To get started with Compliance, open the Systems Manager console. In the navigation pane, choose Compliance.

Patch compliance data from Patch Manager can be sent to Amazon Security Hub. Security Hub gives you a comprehensive view of your high-priority security alerts and compliance status. It also monitors the patching status of your fleet. For more information, see Integrating Patch Manager with Amazon Security Hub.

Compliance offers the following additional benefits and features:

  • View compliance history and change tracking for Patch Manager patching data and State Manager associations by using Amazon Config.

  • Customize Compliance to create your own compliance types based on your IT or business requirements.

  • Remediate issues by using Run Command, another capability of Amazon Systems Manager, State Manager, or Amazon EventBridge.

  • Port data to Amazon Athena and Amazon QuickSight to generate fleet-wide reports.

EventBridge support

This Systems Manager capability is supported as an event type in Amazon EventBridge rules. For information, see Monitoring Systems Manager events with Amazon EventBridge and Reference: Amazon EventBridge event patterns and types for Systems Manager.

Chef InSpec integration

Systems Manager integrates with Chef InSpec. InSpec is an open-source, runtime framework that allows you to create human-readable profiles on GitHub or Amazon Simple Storage Service (Amazon S3). You can then use Systems Manager to run compliance scans and view compliant and noncompliant managed nodes. For more information, see Using Chef InSpec profiles with Systems Manager Compliance.


Compliance is offered at no additional charge. You only pay for the Amazon resources that you use.