Operations Actions Permission-only actions Resource types Condition keys

Actions, resources, and condition keys for Amazon Systems Manager

Amazon Systems Manager (service prefix: ssm) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Amazon Systems Manager
Actions defined by Amazon Systems Manager
Permission-only actions for Amazon Systems Manager
Resource types defined by Amazon Systems Manager
Condition keys for Amazon Systems Manager

API operations defined by Amazon Systems Manager

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
AddTagsToResource	ssm:AddTagsToResource			Tagging, Write
AssociateOpsItemRelatedItem	ssm:AssociateOpsItemRelatedItem			Write
CancelCommand	ssm:CancelCommand			Write
CancelMaintenanceWindowExecution	ssm:CancelMaintenanceWindowExecution			Write
CreateActivation	ssm:AddTagsToResource			Tagging, Write
	ssm:CreateActivation			Write
	iam:PassRole	iam:PassedToService	ssm.amazonaws.com	Write
CreateAssociation	ssm:AddTagsToResource			Tagging, Write
	ssm:CreateAssociation			Write
	iam:PassRole	iam:PassedToService	ssm.amazonaws.com	Write
CreateAssociationBatch	ssm:CreateAssociation			Write
	ssm:CreateAssociationBatch			Write
	iam:PassRole	iam:PassedToService	ssm.amazonaws.com	Write
CreateCloudConnector	ssm:AddTagsToResource			Tagging, Write
	ssm:CreateCloudConnector			Write
	iam:PassRole	iam:PassedToService	ssm.amazonaws.com	Write
CreateDocument	ssm:AddTagsToResource			Tagging, Write
	ssm:CreateDocument			Write
	ssm:GetDocument			Read
	iam:PassRole	iam:PassedToService	justintimeaccess.ssm.amazonaws.com, ssm.amazonaws.com	Write
CreateMaintenanceWindow	ssm:AddTagsToResource			Tagging, Write
CreateMaintenanceWindow	ssm:CreateMaintenanceWindow			Write
CreateOpsItem	ssm:AddTagsToResource			Tagging, Write
CreateOpsItem	ssm:CreateOpsItem			Write
CreateOpsMetadata	ssm:AddTagsToResource			Tagging, Write
CreateOpsMetadata	ssm:CreateOpsMetadata			Write
CreatePatchBaseline	ssm:AddTagsToResource			Tagging, Write
CreatePatchBaseline	ssm:CreatePatchBaseline			Write
CreateResourceDataSync	ssm:CreateResourceDataSync			Write
DeleteActivation	ssm:DeleteActivation			Write
DeleteAssociation	ssm:DeleteAssociation			Write
DeleteCloudConnector	ssm:DeleteCloudConnector			Write
DeleteDocument	ssm:DeleteDocument			Write
DeleteInventory	ssm:DeleteInventory			Write
DeleteMaintenanceWindow	ssm:DeleteMaintenanceWindow			Write
DeleteOpsItem	ssm:DeleteOpsItem			Write
DeleteOpsMetadata	ssm:DeleteOpsMetadata			Write
DeleteParameter	ssm:DeleteParameter			Write
DeleteParameters	ssm:DeleteParameters			Write
DeletePatchBaseline	ssm:DeletePatchBaseline			Write
DeleteResourceDataSync	ssm:DeleteResourceDataSync			Write
DeleteResourcePolicy	ssm:DeleteResourcePolicy			Permissions management, Write
DeregisterManagedInstance	ssm:DeregisterManagedInstance			Write
DeregisterPatchBaselineForPatchGroup	ssm:DeregisterPatchBaselineForPatchGroup			Write
DeregisterTargetFromMaintenanceWindow	ssm:DeregisterTargetFromMaintenanceWindow			Write
DeregisterTaskFromMaintenanceWindow	ssm:DeregisterTaskFromMaintenanceWindow			Write
DescribeActivations	ssm:DescribeActivations			Read
DescribeAssociation	ssm:DescribeAssociation			Read
DescribeAssociationExecutionTargets	ssm:DescribeAssociationExecutionTargets			Read
DescribeAssociationExecutions	ssm:DescribeAssociationExecutions			Read
DescribeAutomationExecutions	ssm:DescribeAutomationExecutions			Read
DescribeAutomationStepExecutions	ssm:DescribeAutomationStepExecutions			Read
DescribeAutomationStepExecutions	iam:PassRole	iam:PassedToService	ssm.amazonaws.com	Write
DescribeAvailablePatches	ssm:DescribeAvailablePatches			Read
DescribeDocument	ssm:DescribeDocument			Read
DescribeDocumentPermission	ssm:DescribeDocumentPermission			Read
DescribeEffectiveInstanceAssociations	ssm:DescribeEffectiveInstanceAssociations			Read
DescribeEffectivePatchesForPatchBaseline	ssm:DescribeEffectivePatchesForPatchBaseline			Read
DescribeInstanceAssociationsStatus	ssm:DescribeInstanceAssociationsStatus			Read
DescribeInstanceInformation	ssm:DescribeInstanceInformation			Read
DescribeInstancePatchStates	ssm:DescribeInstancePatchStates			Read
DescribeInstancePatchStatesForPatchGroup	ssm:DescribeInstancePatchStatesForPatchGroup			Read
DescribeInstancePatches	ssm:DescribeInstancePatches			Read
DescribeInstanceProperties	ssm:DescribeInstanceProperties			Read
DescribeInventoryDeletions	ssm:DescribeInventoryDeletions			Read
DescribeMaintenanceWindowExecutionTaskInvocations	ssm:DescribeMaintenanceWindowExecutionTaskInvocations			List
DescribeMaintenanceWindowExecutionTasks	ssm:DescribeMaintenanceWindowExecutionTasks			List
DescribeMaintenanceWindowExecutions	ssm:DescribeMaintenanceWindowExecutions			List
DescribeMaintenanceWindowSchedule	ssm:DescribeMaintenanceWindowSchedule			List
DescribeMaintenanceWindowTargets	ssm:DescribeMaintenanceWindowTargets			List
DescribeMaintenanceWindowTasks	ssm:DescribeMaintenanceWindowTasks			List
DescribeMaintenanceWindows	ssm:DescribeMaintenanceWindows			List
DescribeMaintenanceWindowsForTarget	ssm:DescribeMaintenanceWindowsForTarget			List
DescribeOpsItems	ssm:DescribeOpsItems			Read
DescribeParameters	ssm:DescribeParameters			List
DescribePatchBaselines	ssm:DescribePatchBaselines			List
DescribePatchGroupState	ssm:DescribePatchGroupState			List
DescribePatchGroups	ssm:DescribePatchGroups			List
DescribePatchProperties	ssm:DescribePatchProperties			List
DescribeSessions	ssm:DescribeSessions			List
DisassociateOpsItemRelatedItem	ssm:DisassociateOpsItemRelatedItem			Write
GetAccessToken	ssm:GetAccessToken			Read
GetAutomationExecution	ssm:GetAutomationExecution			Read
GetAutomationExecution	iam:PassRole	iam:PassedToService	ssm.amazonaws.com	Write
GetCalendarState	ssm:GetCalendarState			Read
GetCloudConnector	ssm:GetCloudConnector			Read
GetCommandInvocation	ssm:GetCommandInvocation			Read
GetConnectionStatus	ssm:GetConnectionStatus			Read
GetDefaultPatchBaseline	ssm:GetDefaultPatchBaseline			Read
GetDeployablePatchSnapshotForInstance	ssm:GetDeployablePatchSnapshotForInstance			Read
GetDocument	ssm:GetDocument			Read
GetExecutionPreview	ssm:GetExecutionPreview			Read
GetInventory	ssm:GetInventory			Read
GetInventorySchema	ssm:GetInventorySchema			Read
GetMaintenanceWindow	ssm:GetMaintenanceWindow			Read
GetMaintenanceWindowExecution	ssm:GetMaintenanceWindowExecution			Read
GetMaintenanceWindowExecutionTask	ssm:GetMaintenanceWindowExecutionTask			Read
GetMaintenanceWindowExecutionTaskInvocation	ssm:GetMaintenanceWindowExecutionTaskInvocation			Read
GetMaintenanceWindowTask	ssm:GetMaintenanceWindowTask			Read
GetOpsItem	ssm:GetOpsItem			Read
GetOpsMetadata	ssm:GetOpsMetadata			Read
GetOpsSummary	ssm:GetOpsSummary			Read
GetParameter	ssm:GetParameter			Read
GetParameterHistory	ssm:GetParameterHistory			Read
GetParameters	ssm:GetParameters			Read
GetParametersByPath	ssm:GetParametersByPath			Read
GetPatchBaseline	ssm:GetPatchBaseline			Read
GetPatchBaselineForPatchGroup	ssm:GetPatchBaselineForPatchGroup			Read
GetResourcePolicies	ssm:GetResourcePolicies			List
GetServiceSetting	ssm:GetServiceSetting			Read
LabelParameterVersion	ssm:LabelParameterVersion			Write
ListAssociationVersions	ssm:ListAssociationVersions			List
ListAssociations	ssm:ListAssociations			List
ListCloudConnectors	ssm:ListCloudConnectors			List
ListCommandInvocations	ssm:ListCommandInvocations			List
ListCommands	ssm:ListCommands			List
ListComplianceItems	ssm:ListComplianceItems			List
ListComplianceSummaries	ssm:ListComplianceSummaries			List
ListDocumentMetadataHistory	ssm:ListDocumentMetadataHistory			List
ListDocumentVersions	ssm:ListDocumentVersions			List
ListDocuments	ssm:ListDocuments			List
ListInventoryEntries	ssm:ListInventoryEntries			List
ListNodes	ssm:ListNodes			List
ListNodesSummary	ssm:ListNodesSummary			List
ListOpsItemEvents	ssm:ListOpsItemEvents			List
ListOpsItemRelatedItems	ssm:ListOpsItemRelatedItems			List
ListOpsMetadata	ssm:ListOpsMetadata			List
ListResourceComplianceSummaries	ssm:ListResourceComplianceSummaries			List
ListResourceDataSync	ssm:ListResourceDataSync			List
ListTagsForResource	ssm:ListTagsForResource			List
ModifyDocumentPermission	ssm:ModifyDocumentPermission			Permissions management, Write
PutComplianceItems	ssm:PutComplianceItems			Write
PutInventory	ssm:PutInventory			Write
PutParameter	ssm:AddTagsToResource			Tagging, Write
PutParameter	ssm:PutParameter			Write
PutResourcePolicy	ssm:PutResourcePolicy			Permissions management, Write
RegisterDefaultPatchBaseline	ssm:RegisterDefaultPatchBaseline			Write
RegisterPatchBaselineForPatchGroup	ssm:RegisterPatchBaselineForPatchGroup			Write
RegisterTargetWithMaintenanceWindow	ssm:RegisterTargetWithMaintenanceWindow			Write
RegisterTaskWithMaintenanceWindow	ssm:RegisterTaskWithMaintenanceWindow			Write
RegisterTaskWithMaintenanceWindow	iam:PassRole	iam:PassedToService	ssm.amazonaws.com	Write
RemoveTagsFromResource	ssm:RemoveTagsFromResource			Tagging, Write
ResetServiceSetting	ssm:ResetServiceSetting			Write
ResumeSession	ssm:ResumeSession			Write
SendAutomationSignal	ssm:SendAutomationSignal			Write
SendCommand	ssm:SendCommand			Write
SendCommand	iam:PassRole	iam:PassedToService	ssm.amazonaws.com	Write
StartAccessRequest	ssm:AddTagsToResource			Tagging, Write
StartAccessRequest	ssm:StartAccessRequest			Write
StartAssociationsOnce	ssm:StartAssociationsOnce			Write
StartAutomationExecution	ssm:AddTagsToResource			Tagging, Write
	ssm:StartAutomationExecution			Write
	iam:PassRole	iam:PassedToService	ssm.amazonaws.com	Write
StartChangeRequestExecution	ssm:StartChangeRequestExecution			Write
StartChangeRequestExecution	iam:PassRole	iam:PassedToService	ssm.amazonaws.com	Write
StartExecutionPreview	ssm:StartExecutionPreview			Read
StartSession	ssm:StartSession			Write
StopAutomationExecution	ssm:StopAutomationExecution			Write
TerminateSession	ssm:TerminateSession			Write
UnlabelParameterVersion	ssm:UnlabelParameterVersion			Write
UpdateAssociation	ssm:UpdateAssociation			Write
UpdateAssociation	iam:PassRole	iam:PassedToService	ssm.amazonaws.com	Write
UpdateAssociationStatus	ssm:UpdateAssociationStatus			Write
UpdateCloudConnector	ssm:UpdateCloudConnector			Write
UpdateDocument	ssm:UpdateDocument			Write
UpdateDocument	iam:PassRole	iam:PassedToService	justintimeaccess.ssm.amazonaws.com, ssm.amazonaws.com	Write
UpdateDocumentDefaultVersion	ssm:UpdateDocumentDefaultVersion			Write
UpdateDocumentMetadata	ssm:UpdateDocumentMetadata			Write
UpdateMaintenanceWindow	ssm:UpdateMaintenanceWindow			Write
UpdateMaintenanceWindowTarget	ssm:UpdateMaintenanceWindowTarget			Write
UpdateMaintenanceWindowTask	ssm:UpdateMaintenanceWindowTask			Write
UpdateMaintenanceWindowTask	iam:PassRole	iam:PassedToService	ssm.amazonaws.com	Write
UpdateManagedInstanceRole	ssm:UpdateManagedInstanceRole			Write
UpdateManagedInstanceRole	iam:PassRole	iam:PassedToService	ssm.amazonaws.com	Write
UpdateOpsItem	ssm:UpdateOpsItem			Write
UpdateOpsMetadata	ssm:UpdateOpsMetadata			Write
UpdatePatchBaseline	ssm:UpdatePatchBaseline			Write
UpdateResourceDataSync	ssm:UpdateResourceDataSync			Write
UpdateServiceSetting	ssm:UpdateServiceSetting			Write
UpdateServiceSetting	iam:PassRole	iam:PassedToService	ssm.amazonaws.com	Write
ValidateCloudConnector	ssm:ValidateCloudConnector			Read

Actions defined by Amazon Systems Manager

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in Amazon. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AddTagsToResource	Grants permission to add or overwrite one or more tags for a specified Amazon resource	association	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		automation-execution	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ssm:resourceTag/tag-key
		cloud-connector	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		document	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ssm:DocumentCategories ssm:DocumentType ssm:resourceTag/${TagKey}
		instance	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ssm:resourceTag/${TagKey}
		maintenancewindow	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ssm:resourceTag/tag-key
		managed-instance	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ssm:resourceTag/tag-key
		opsitem	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		opsmetadata	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ssm:resourceTag/${TagKey}
		parameter	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ssm:resourceTag/tag-key
		patchbaseline	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ssm:resourceTag/tag-key
		task	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
AssociateOpsItemRelatedItem	Grants permission to associate RelatedItem to an OpsItem	opsitem*	aws:ResourceTag/${TagKey}	Write
CancelCommand	Grants permission to cancel a specified Run Command command			Write
CancelMaintenanceWindowExecution	Grants permission to cancel an in-progress maintenance window execution	maintenancewindow*	aws:ResourceTag/${TagKey} ssm:resourceTag/tag-key	Write
CreateActivation	Grants permission to create an activation that is used to register on-premises servers and virtual machines (VMs) with Systems Manager		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateAssociation	Grants permission to associate a specified Systems Manager document with specified instances or other targets	association*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
		document*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ssm:DocumentCategories ssm:DocumentType ssm:resourceTag/${TagKey}
		instance	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ssm:resourceTag/${TagKey}
		managed-instance	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ssm:resourceTag/tag-key
CreateAssociationBatch	Grants permission to combine entries for multiple CreateAssociation operations in a single command	document*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ssm:DocumentCategories ssm:DocumentType ssm:resourceTag/${TagKey}	Write
		instance	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ssm:resourceTag/${TagKey}
		managed-instance	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ssm:resourceTag/tag-key
CreateCloudConnector	Grants permission to create a cloud connector for managing instances in other cloud environments	cloud-connector*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateDocument	Grants permission to create a Systems Manager SSM document	document*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ssm:DocumentCategories ssm:DocumentType ssm:resourceTag/${TagKey}	Write
CreateMaintenanceWindow	Grants permission to create a maintenance window		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateOpsItem	Grants permission to create an OpsItem in OpsCenter		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateOpsMetadata	Grants permission to create an OpsMetadata object for an Amazon resource		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreatePatchBaseline	Grants permission to create a patch baseline		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateResourceDataSync	Grants permission to create a resource data sync configuration, which regularly collects inventory data from managed instances and updates the data in an Amazon S3 bucket	resourcedatasync*	ssm:SyncType	Write
DeleteActivation	Grants permission to delete a specified activation for managed instances			Write
DeleteAssociation	Grants permission to disassociate a specified SSM document from a specified instance	association	aws:ResourceTag/${TagKey}	Write
		document	aws:ResourceTag/${TagKey} ssm:DocumentCategories ssm:DocumentType ssm:resourceTag/${TagKey}
		instance	aws:ResourceTag/${TagKey} ssm:resourceTag/${TagKey}
		managed-instance	aws:ResourceTag/${TagKey} ssm:resourceTag/tag-key
DeleteCloudConnector	Grants permission to delete a specified cloud connector	cloud-connector*	aws:ResourceTag/${TagKey}	Write
DeleteDocument	Grants permission to delete a specified SSM document and its instance associations	document*	aws:ResourceTag/${TagKey} ssm:DocumentCategories ssm:DocumentType ssm:resourceTag/${TagKey}	Write
DeleteInventory	Grants permission to delete a specified custom inventory type, or the data associated with a custom inventory type			Write
DeleteMaintenanceWindow	Grants permission to delete a specified maintenance window	maintenancewindow*	aws:ResourceTag/${TagKey} ssm:resourceTag/tag-key	Write
DeleteOpsItem	Grants permission to delete an OpsItem	opsitem*	aws:ResourceTag/${TagKey}	Write
DeleteOpsMetadata	Grants permission to delete an OpsMetadata object	opsmetadata*	aws:ResourceTag/${TagKey} ssm:resourceTag/${TagKey}	Write
DeleteParameter	Grants permission to delete a specified SSM parameter	parameter*	aws:ResourceTag/${TagKey} ssm:resourceTag/tag-key	Write
DeleteParameters	Grants permission to delete multiple specified SSM parameters	parameter*	aws:ResourceTag/${TagKey} ssm:resourceTag/tag-key	Write
DeletePatchBaseline	Grants permission to delete a specified patch baseline	patchbaseline*	aws:ResourceTag/${TagKey} ssm:resourceTag/tag-key	Write
DeleteResourceDataSync	Grants permission to delete a specified resource data sync	resourcedatasync*	ssm:SyncType	Write
DeleteResourcePolicy	Grants permission to delete a Systems Manager resource policy	document	aws:ResourceTag/${TagKey} ssm:DocumentCategories ssm:DocumentType ssm:resourceTag/${TagKey}	Permissions management, Write
		opsitemgroup
		parameter	aws:ResourceTag/${TagKey} ssm:resourceTag/tag-key
DeregisterManagedInstance	Grants permission to deregister a specified on-premises server or virtual machine (VM) from Systems Manager	managed-instance*	aws:ResourceTag/${TagKey} ssm:resourceTag/tag-key	Write
DeregisterPatchBaselineForPatchGroup	Grants permission to deregister a specified patch baseline from being the default patch baseline for a specified patch group	patchbaseline*	aws:ResourceTag/${TagKey} ssm:resourceTag/tag-key	Write
DeregisterTargetFromMaintenanceWindow	Grants permission to deregister a specified target from a maintenance window	maintenancewindow*	aws:ResourceTag/${TagKey} ssm:resourceTag/tag-key	Write
DeregisterTargetFromMaintenanceWindow		windowtarget*	aws:ResourceTag/${TagKey} ssm:resourceTag/tag-key	Write
DeregisterTaskFromMaintenanceWindow	Grants permission to deregister a specified task from a maintenance window	maintenancewindow*	aws:ResourceTag/${TagKey} ssm:resourceTag/tag-key	Write
DeregisterTaskFromMaintenanceWindow		windowtask*	aws:ResourceTag/${TagKey} ssm:resourceTag/tag-key	Write
DescribeActivations	Grants permission to view details about a specified managed instance activation, such as when it was created and the number of instances registered using the activation			Read
DescribeAssociation	Grants permission to view details about the specified association for a specified instance or target	association	aws:ResourceTag/${TagKey}	Read
		document	aws:ResourceTag/${TagKey} ssm:DocumentCategories ssm:DocumentType ssm:resourceTag/${TagKey}
		instance	aws:ResourceTag/${TagKey} ssm:resourceTag/${TagKey}
		managed-instance	aws:ResourceTag/${TagKey} ssm:resourceTag/tag-key
DescribeAssociationExecutionTargets	Grants permission to view information about a specified association execution	association*	aws:ResourceTag/${TagKey}	Read
DescribeAssociationExecutions	Grants permission to view all executions for a specified association	association*	aws:ResourceTag/${TagKey}	Read
DescribeAutomationExecutions	Grants permission to view details about all active and terminated Automation executions			Read
DescribeAutomationStepExecutions	Grants permission to view information about all active and terminated step executions in an Automation workflow	automation-execution*	aws:ResourceTag/${TagKey} ssm:resourceTag/tag-key	Read
DescribeAvailablePatches	Grants permission to view all patches eligible to include in a patch baseline			Read
DescribeDocument	Grants permission to view details about a specified SSM document	document*	aws:ResourceTag/${TagKey} ssm:DocumentCategories ssm:DocumentType ssm:resourceTag/${TagKey}	Read
DescribeDocumentParameters	Grants permission to display information about SSM document parameters in the Systems Manager console (internal Systems Manager action)	document*	aws:ResourceTag/${TagKey} ssm:DocumentCategories ssm:DocumentType ssm:resourceTag/${TagKey}	Read
DescribeDocumentPermission	Grants permission to view the permissions for a specified SSM document	document*	aws:ResourceTag/${TagKey} ssm:DocumentCategories ssm:DocumentType ssm:resourceTag/${TagKey}	Read
DescribeEffectiveInstanceAssociations	Grants permission to view all current associations for a specified instance	instance*	aws:ResourceTag/${TagKey} ssm:resourceTag/${TagKey}	Read
DescribeEffectiveInstanceAssociations		managed-instance*	aws:ResourceTag/${TagKey} ssm:resourceTag/tag-key	Read
DescribeEffectivePatchesForPatchBaseline	Grants permission to view details about the patches currently associated with the specified patch baseline (Windows only)	patchbaseline*	aws:ResourceTag/${TagKey} ssm:resourceTag/tag-key	Read
DescribeInstanceAssociationsStatus	Grants permission to view the status of the associations for a specified instance	instance*	aws:ResourceTag/${TagKey} ssm:resourceTag/${TagKey}	Read
DescribeInstanceAssociationsStatus		managed-instance*	aws:ResourceTag/${TagKey} ssm:resourceTag/tag-key	Read
DescribeInstanceInformation	Grants permission to view details about a specified instance			Read
DescribeInstancePatchStates	Grants permission to view status details about patches on a specified instance	instance*	aws:ResourceTag/${TagKey} ssm:resourceTag/${TagKey}	Read
DescribeInstancePatchStates		managed-instance*	aws:ResourceTag/${TagKey} ssm:resourceTag/${TagKey} ssm:resourceTag/tag-key	Read
DescribeInstancePatchStatesForPatchGroup	Grants permission to describe the high-level patch state for the instances in the specified patch group			Read
DescribeInstancePatches	Grants permission to view general details about the patches on a specified instance	instance*	aws:ResourceTag/${TagKey} ssm:resourceTag/${TagKey}	Read
DescribeInstancePatches		managed-instance*	aws:ResourceTag/${TagKey} ssm:resourceTag/${TagKey} ssm:resourceTag/tag-key	Read
DescribeInstanceProperties	Grants permission to user's Amazon EC2 console to render managed instances' nodes			Read
DescribeInventoryDeletions	Grants permission to view details about a specified inventory deletion			Read
DescribeMaintenanceWindowExecutionTaskInvocations	Grants permission to view details of a specified task execution for a maintenance window			List
DescribeMaintenanceWindowExecutionTasks	Grants permission to view details about the tasks that ran during a specified maintenance window execution			List
DescribeMaintenanceWindowExecutions	Grants permission to view the executions of a specified maintenance window	maintenancewindow*	aws:ResourceTag/${TagKey} ssm:resourceTag/tag-key	List
DescribeMaintenanceWindowSchedule	Grants permission to view details about upcoming executions of a specified maintenance window			List
DescribeMaintenanceWindowTargets	Grants permission to view a list of the targets associated with a specified maintenance window	maintenancewindow*	aws:ResourceTag/${TagKey} ssm:resourceTag/tag-key	List
DescribeMaintenanceWindowTasks	Grants permission to view a list of the tasks associated with a specified maintenance window	maintenancewindow*	aws:ResourceTag/${TagKey} ssm:resourceTag/tag-key	List
DescribeMaintenanceWindows	Grants permission to view information about all or specified maintenance windows			List
DescribeMaintenanceWindowsForTarget	Grants permission to view information about the maintenance window targets and tasks associated with a specified instance			List
DescribeOpsItems	Grants permission to view details about specified OpsItems			Read
DescribeParameters	Grants permission to view details about a specified SSM parameter			List
DescribePatchBaselines	Grants permission to view information about patch baselines that meet the specified criteria			List
DescribePatchGroupState	Grants permission to view aggregated status details for patches for a specified patch group			List
DescribePatchGroups	Grants permission to view information about the patch baseline for a specified patch group			List
DescribePatchProperties	Grants permission to view details of available patches for a specified operating system and patch property			List
DescribeSessions	Grants permission to view a list of recent Session Manager sessions that meet the specified search criteria			List
DisassociateOpsItemRelatedItem	Grants permission to disassociate RelatedItem from an OpsItem	opsitem*	aws:ResourceTag/${TagKey}	Write
ExecuteAPI	Grants permission to a Systems Manager delegated administrator to view related resource details about OpsItems across multiple Amazon accounts in the Amazon Web Services Management Console			Read
GetAccessToken	Grants permission to return a credentials set to be used with just-in-time node access	opsitem*	aws:ResourceTag/${TagKey}	Read
GetAutomationExecution	Grants permission to view details of a specified Automation execution	automation-execution*	aws:ResourceTag/${TagKey} ssm:resourceTag/tag-key	Read
GetCalendarState	Grants permission to view the calendar state for a change calendar or a list of change calendars	document*	aws:ResourceTag/${TagKey} ssm:DocumentCategories ssm:DocumentType ssm:resourceTag/${TagKey}	Read
GetCloudConnector	Grants permission to view details about a specified cloud connector	cloud-connector*	aws:ResourceTag/${TagKey}	Read
GetCommandInvocation	Grants permission to view details about the command execution of a specified invocation or plugin			Read
GetConnectionStatus	Grants permission to view the Session Manager connection status for a specified managed instance	instance	aws:ResourceTag/${TagKey} ssm:resourceTag/${TagKey}	Read
		managed-instance	aws:ResourceTag/${TagKey} ssm:resourceTag/${TagKey} ssm:resourceTag/tag-key
		task	aws:ResourceTag/${TagKey} ssm:resourceTag/${TagKey}
GetDefaultPatchBaseline	Grants permission to view the current default patch baseline for a specified operating system type	patchbaseline*	aws:ResourceTag/${TagKey} ssm:resourceTag/tag-key	Read
GetDeployablePatchSnapshotForInstance	Grants permission to retrieve the current patch baseline snapshot for a specified instance			Read
GetDocument	Grants permission to view the contents of a specified SSM document	document*	aws:ResourceTag/${TagKey} ssm:DocumentCategories ssm:DocumentType ssm:resourceTag/${TagKey}	Read
GetExecutionPreview	Grants permission to retrieve an existing preview that shows the effects that running a specified Automation runbook would have on the targeted resources			Read
GetInventory	Grants permission to view instance inventory details per the specified criteria			Read
GetInventorySchema	Grants permission to view a list of inventory types or attribute names for a specified inventory item type			Read
GetMaintenanceWindow	Grants permission to view details about a specified maintenance window	maintenancewindow*	aws:ResourceTag/${TagKey} ssm:resourceTag/tag-key	Read
GetMaintenanceWindowExecution	Grants permission to view details about a specified maintenance window execution			Read
GetMaintenanceWindowExecutionTask	Grants permission to view details about a specified maintenance window execution task			Read
GetMaintenanceWindowExecutionTaskInvocation	Grants permission to view details about a specific maintenance window task running on a specific target			Read
GetMaintenanceWindowTask	Grants permission to view details about tasks registered with a specified maintenance window	maintenancewindow*	aws:ResourceTag/${TagKey} ssm:resourceTag/tag-key	Read
GetOpsItem	Grants permission to view information about a specified OpsItem	opsitem*	aws:ResourceTag/${TagKey}	Read
GetOpsMetadata	Grants permission to retrieve an OpsMetadata object	opsmetadata*	aws:ResourceTag/${TagKey} ssm:resourceTag/${TagKey}	Read
GetOpsSummary	Grants permission to view summary information about OpsItems based on specified filters and aggregators	resourcedatasync*		Read
GetParameter	Grants permission to view information about a specified parameter	parameter*	aws:ResourceTag/${TagKey} ssm:resourceTag/tag-key	Read
GetParameterHistory	Grants permission to view details and changes for a specified parameter	parameter*	aws:ResourceTag/${TagKey} ssm:resourceTag/tag-key	Read
GetParameters	Grants permission to view information about multiple specified parameters	parameter*	aws:ResourceTag/${TagKey} ssm:resourceTag/tag-key	Read
GetParametersByPath	Grants permission to view information about parameters in a specified hierarchy	parameter*	aws:ResourceTag/${TagKey} ssm:Recursive ssm:resourceTag/tag-key	Read
GetPatchBaseline	Grants permission to view information about a specified patch baseline	patchbaseline*	aws:ResourceTag/${TagKey} ssm:resourceTag/tag-key	Read
GetPatchBaselineForPatchGroup	Grants permission to view the ID of the current patch baseline for a specified patch group			Read
GetResourcePolicies	Grants permission to retrieve lists of Systems Manager resource policies	document	aws:ResourceTag/${TagKey} ssm:DocumentCategories ssm:DocumentType ssm:resourceTag/${TagKey}	List
		opsitemgroup
		parameter	aws:ResourceTag/${TagKey} ssm:resourceTag/tag-key
GetServiceSetting	Grants permission to view the account-level setting for an Amazon service	servicesetting*		Read
LabelParameterVersion	Grants permission to apply an identifying label to a specified version of a parameter	parameter*	aws:ResourceTag/${TagKey} ssm:resourceTag/tag-key	Write
ListAssociationVersions	Grants permission to list versions of the specified association	association*	aws:ResourceTag/${TagKey}	List
ListAssociations	Grants permission to list the associations for a specified SSM document or managed instance			List
ListCloudConnectors	Grants permission to list cloud connectors in your account			List
ListCommandInvocations	Grants permission to list information about command invocations sent to a specified instance			List
ListCommands	Grants permission to list the commands sent to a specified instance			List
ListComplianceItems	Grants permission to list compliance status for specified resource types on a specified resource			List
ListComplianceSummaries	Grants permission to list a summary count of compliant and noncompliant resources for a specified compliance type			List
ListDocumentMetadataHistory	Grants permission to view metadata history about a specified SSM document	document*	aws:ResourceTag/${TagKey} ssm:DocumentCategories ssm:DocumentType ssm:resourceTag/${TagKey}	List
ListDocumentVersions	Grants permission to list all versions of a specified document	document*	aws:ResourceTag/${TagKey} ssm:DocumentCategories ssm:DocumentType ssm:resourceTag/${TagKey}	List
ListDocuments	Grants permission to view information about a specified SSM document			List
ListInstanceAssociations	Grants permission to SSM Agent to check for new State Manager associations (internal Systems Manager call)	instance	aws:ResourceTag/${TagKey} ssm:resourceTag/${TagKey}	List
ListInstanceAssociations		managed-instance	aws:ResourceTag/${TagKey} ssm:resourceTag/tag-key	List
ListInventoryEntries	Grants permission to view a list of specified inventory types for a specified instance			List
ListNodes	Grants permission to view details about managed nodes based on specified filters	resourcedatasync*		List
ListNodesSummary	Grants permission to view summary information about managed nodes based on specified filters and aggregators	resourcedatasync*		List
ListOpsItemEvents	Grants permission to view details about OpsItemEvents			List
ListOpsItemRelatedItems	Grants permission to view details about OpsItem RelatedItems			List
ListOpsMetadata	Grants permission to view a list of OpsMetadata objects			List
ListResourceComplianceSummaries	Grants permission to list resource-level summary count			List
ListResourceDataSync	Grants permission to list information about resource data sync configurations in an account		ssm:SyncType	List
ListTagsForResource	Grants permission to view a list of resource tags for a specified resource	association	aws:ResourceTag/${TagKey}	List
		automation-execution	aws:ResourceTag/${TagKey} ssm:resourceTag/tag-key
		cloud-connector	aws:ResourceTag/${TagKey}
		document	aws:ResourceTag/${TagKey} ssm:DocumentCategories ssm:DocumentType ssm:resourceTag/${TagKey}
		maintenancewindow	aws:ResourceTag/${TagKey} ssm:resourceTag/tag-key
		managed-instance	aws:ResourceTag/${TagKey} ssm:resourceTag/tag-key
		opsitem	aws:ResourceTag/${TagKey}
		opsmetadata	aws:ResourceTag/${TagKey} ssm:resourceTag/${TagKey}
		parameter	aws:ResourceTag/${TagKey} ssm:resourceTag/tag-key
		patchbaseline	aws:ResourceTag/${TagKey} ssm:resourceTag/tag-key
ModifyDocumentPermission	Grants permission to share a custom SSM document publicly or privately with specified Amazon accounts	document*	aws:ResourceTag/${TagKey} ssm:DocumentCategories ssm:DocumentType ssm:resourceTag/${TagKey}	Permissions management, Write
PutComplianceItems	Grants permission to register a compliance type and other compliance details on a specified resource	instance	aws:ResourceTag/${TagKey} ec2:SourceInstanceARN ssm:resourceTag/${TagKey} ssm:SourceInstanceARN	Write
PutComplianceItems		managed-instance	aws:ResourceTag/${TagKey} ec2:SourceInstanceARN ssm:resourceTag/tag-key ssm:SourceInstanceARN	Write
PutInventory	Grants permission to add or update inventory items on multiple specified managed instances		ssm:InventoryTypeName	Write
PutParameter	Grants permission to create an SSM parameter	parameter*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ssm:Overwrite ssm:Policies ssm:resourceTag/tag-key	Write
PutResourcePolicy	Grants permission to create or update a Systems Manager resource policy	document	aws:ResourceTag/${TagKey} ssm:DocumentCategories ssm:DocumentType ssm:resourceTag/${TagKey}	Permissions management, Write
		opsitemgroup
		parameter	aws:ResourceTag/${TagKey} ssm:resourceTag/tag-key
RegisterDefaultPatchBaseline	Grants permission to specify the default patch baseline for an operating system type	patchbaseline*	aws:ResourceTag/${TagKey} ssm:resourceTag/tag-key	Write
RegisterManagedInstance	Grants permission to register a Systems Manager Agent		aws:RequestTag/${TagKey} aws:TagKeys	Write
RegisterPatchBaselineForPatchGroup	Grants permission to specify the default patch baseline for a specified patch group	patchbaseline*	aws:ResourceTag/${TagKey} ssm:resourceTag/tag-key	Write
RegisterTargetWithMaintenanceWindow	Grants permission to register a target with a specified maintenance window	maintenancewindow*	aws:ResourceTag/${TagKey} ssm:resourceTag/tag-key	Write
RegisterTaskWithMaintenanceWindow	Grants permission to register a task with a specified maintenance window	maintenancewindow*	aws:ResourceTag/${TagKey} ssm:resourceTag/tag-key	Write
RemoveTagsFromResource	Grants permission to remove a specified tag key from a specified resource	association	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		automation-execution	aws:ResourceTag/${TagKey} aws:TagKeys ssm:resourceTag/tag-key
		cloud-connector	aws:ResourceTag/${TagKey} aws:TagKeys
		document	aws:ResourceTag/${TagKey} aws:TagKeys ssm:DocumentCategories ssm:DocumentType ssm:resourceTag/${TagKey}
		instance	aws:ResourceTag/${TagKey} aws:TagKeys ssm:resourceTag/${TagKey}
		maintenancewindow	aws:ResourceTag/${TagKey} aws:TagKeys ssm:resourceTag/tag-key
		managed-instance	aws:ResourceTag/${TagKey} aws:TagKeys ssm:resourceTag/tag-key
		opsitem	aws:ResourceTag/${TagKey} aws:TagKeys
		opsmetadata	aws:ResourceTag/${TagKey} aws:TagKeys ssm:resourceTag/${TagKey}
		parameter	aws:ResourceTag/${TagKey} aws:TagKeys ssm:resourceTag/tag-key
		patchbaseline	aws:ResourceTag/${TagKey} aws:TagKeys ssm:resourceTag/tag-key
		task	aws:ResourceTag/${TagKey} aws:TagKeys
ResetServiceSetting	Grants permission to reset the service setting for an Amazon Web Services account to the default value	servicesetting*		Write
ResumeSession	Grants permission to reconnect a Session Manager session to a managed instance	session*	ssm:resourceTag/aws:ssmmessages:session-id ssm:resourceTag/aws:ssmmessages:target-id	Write
SendAutomationSignal	Grants permission to send a signal to change the current behavior or status of a specified Automation execution	automation-execution*	aws:ResourceTag/${TagKey} ssm:resourceTag/tag-key	Write
SendCommand	Grants permission to run commands on one or more specified managed instances	bucket	aws:ResourceTag/${TagKey} ssm:resourceTag/${TagKey}	Write
		document*	aws:ResourceTag/${TagKey} ssm:DocumentCategories ssm:DocumentType ssm:resourceTag/${TagKey}
		instance	aws:ResourceTag/${TagKey} ssm:resourceTag/${TagKey}
		managed-instance	aws:ResourceTag/${TagKey} ssm:resourceTag/${TagKey} ssm:resourceTag/tag-key
StartAccessRequest	Grants permission to start the workflow for just-in-time node access sessions	instance	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ssm:resourceTag/${TagKey}	Write
StartAccessRequest		managed-instance	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ssm:resourceTag/tag-key	Write
StartAssociationsOnce	Grants permission to run a specified association manually	association*	aws:ResourceTag/${TagKey}	Write
StartAutomationExecution	Grants permission to initiate the execution of an Automation document	automation-definition	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ssm:DocumentType ssm:DocumentVersion	Write
		automation-execution*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ssm:DocumentVersion ssm:resourceTag/tag-key
		document*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ssm:DocumentCategories ssm:DocumentType ssm:DocumentVersion ssm:resourceTag/${TagKey}
StartChangeRequestExecution	Grants permission to initiate the execution of an Automation Change Template document	automation-definition	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ssm:AutoApprove ssm:DocumentType ssm:DocumentVersion	Write
		automation-execution*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ssm:AutoApprove ssm:DocumentVersion ssm:resourceTag/tag-key
		document*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys ssm:AutoApprove ssm:DocumentCategories ssm:DocumentType ssm:DocumentVersion ssm:resourceTag/${TagKey}
StartExecutionPreview	Grants permission to create a preview showing the effects that running a specified Automation runbook would have on the targeted resources			Read
StartSession	Grants permission to initiate a connection to a specified target for a Session Manager session	document	aws:ResourceTag/${TagKey} ssm:AccessRequestId ssm:DocumentCategories ssm:DocumentType ssm:resourceTag/${TagKey} ssm:SessionDocumentAccessCheck	Write
		instance	aws:ResourceTag/${TagKey} ssm:AccessRequestId ssm:resourceTag/${TagKey} ssm:SessionDocumentAccessCheck
		managed-instance	aws:ResourceTag/${TagKey} ssm:AccessRequestId ssm:resourceTag/${TagKey} ssm:resourceTag/tag-key ssm:SessionDocumentAccessCheck
		task	aws:ResourceTag/${TagKey} ssm:AccessRequestId ssm:resourceTag/${TagKey} ssm:SessionDocumentAccessCheck
StopAutomationExecution	Grants permission to stop a specified Automation execution that is already in progress	automation-execution*	aws:ResourceTag/${TagKey} ssm:resourceTag/tag-key	Write
TerminateSession	Grants permission to permanently end a Session Manager connection to an instance	session*	ssm:resourceTag/aws:ssmmessages:session-id ssm:resourceTag/aws:ssmmessages:target-id	Write
UnlabelParameterVersion	Grants permission to remove an identifying label from a specified version of a parameter	parameter*	aws:ResourceTag/${TagKey} ssm:resourceTag/tag-key	Write
UpdateAssociation	Grants permission to update an association and immediately run the association on the specified targets	association*	aws:ResourceTag/${TagKey}	Write
		document	aws:ResourceTag/${TagKey} ssm:DocumentCategories ssm:DocumentType ssm:resourceTag/${TagKey}
		instance	aws:ResourceTag/${TagKey} ssm:resourceTag/${TagKey}
		managed-instance	aws:ResourceTag/${TagKey} ssm:resourceTag/tag-key
UpdateAssociationStatus	Grants permission to update the status of the SSM document associated with a specified instance	document*	aws:ResourceTag/${TagKey} ec2:SourceInstanceARN ssm:DocumentCategories ssm:DocumentType ssm:resourceTag/${TagKey} ssm:SourceInstanceARN	Write
		instance	aws:ResourceTag/${TagKey} ec2:SourceInstanceARN ssm:resourceTag/${TagKey} ssm:SourceInstanceARN
		managed-instance	aws:ResourceTag/${TagKey} ec2:SourceInstanceARN ssm:resourceTag/tag-key ssm:SourceInstanceARN
UpdateCloudConnector	Grants permission to update a specified cloud connector	cloud-connector*	aws:ResourceTag/${TagKey}	Write
UpdateDocument	Grants permission to update one or more values for an SSM document	document*	aws:ResourceTag/${TagKey} ssm:DocumentCategories ssm:DocumentType ssm:resourceTag/${TagKey}	Write
UpdateDocumentDefaultVersion	Grants permission to change the default version of an SSM document	document*	aws:ResourceTag/${TagKey} ssm:DocumentCategories ssm:DocumentType ssm:resourceTag/${TagKey}	Write
UpdateDocumentMetadata	Grants permission to update the metadata of an SSM document	document*	aws:ResourceTag/${TagKey} ssm:DocumentCategories ssm:DocumentType ssm:resourceTag/${TagKey}	Write
UpdateInstanceInformation	Grants permission to SSM Agent to send a heartbeat signal to the Systems Manager service in the cloud	instance	aws:ResourceTag/${TagKey} ec2:SourceInstanceARN ssm:resourceTag/${TagKey} ssm:SourceInstanceARN	Write
UpdateInstanceInformation		managed-instance	aws:ResourceTag/${TagKey} ec2:SourceInstanceARN ssm:resourceTag/tag-key ssm:SourceInstanceARN	Write
UpdateMaintenanceWindow	Grants permission to update a specified maintenance window	maintenancewindow*	aws:ResourceTag/${TagKey} ssm:resourceTag/tag-key	Write
UpdateMaintenanceWindowTarget	Grants permission to update a specified maintenance window target	maintenancewindow*	aws:ResourceTag/${TagKey} ssm:resourceTag/tag-key	Write
UpdateMaintenanceWindowTarget		windowtarget*	aws:ResourceTag/${TagKey} ssm:resourceTag/tag-key	Write
UpdateMaintenanceWindowTask	Grants permission to update a specified maintenance window task	maintenancewindow*	aws:ResourceTag/${TagKey} ssm:resourceTag/tag-key	Write
UpdateMaintenanceWindowTask		windowtask*	aws:ResourceTag/${TagKey} ssm:resourceTag/tag-key	Write
UpdateManagedInstanceRole	Grants permission to assign or change the IAM role assigned to a specified managed instance	iam-role*	ssm:resourceTag/tag-key	Write
UpdateManagedInstanceRole		managed-instance*	aws:ResourceTag/${TagKey} ssm:resourceTag/tag-key	Write
UpdateOpsItem	Grants permission to edit or change an OpsItem	opsitem*	aws:ResourceTag/${TagKey}	Write
UpdateOpsMetadata	Grants permission to update an OpsMetadata object	opsmetadata*	aws:ResourceTag/${TagKey} ssm:resourceTag/${TagKey}	Write
UpdatePatchBaseline	Grants permission to update a specified patch baseline	patchbaseline*	aws:ResourceTag/${TagKey} ssm:resourceTag/tag-key	Write
UpdateResourceDataSync	Grants permission to update a resource data sync	resourcedatasync*	ssm:SyncType	Write
UpdateServiceSetting	Grants permission to update the service setting for an Amazon Web Services account	servicesetting*		Write
ValidateCloudConnector	Grants permission to verify that a specified cloud connector is functioning properly and to retrieve any validation findings or issues detected	cloud-connector*	aws:ResourceTag/${TagKey}	Read

Permission-only actions for Amazon Systems Manager

The following actions are defined by Amazon Systems Manager but are not directly invocable through any API operation. They can only be used in IAM policy statements to grant or deny permissions.

Actions	Description	Resource types (*required)	Condition keys	Access level
GetCalendar	Grants permission to view details of a specific calendar	document*	aws:ResourceTag/${TagKey} ssm:DocumentCategories ssm:DocumentType ssm:resourceTag/${TagKey}	Read
GetManifest	Grants permission to Systems Manager and SSM Agent to determine package installation requirements for an instance (internal Systems Manager call)			Read
PutCalendar	Grants permission to create/edit a specific calendar	document*	aws:ResourceTag/${TagKey} ssm:DocumentCategories ssm:DocumentType ssm:resourceTag/${TagKey}	Write
PutConfigurePackageResult	Grants permission to SSM Agent to generate a report of the results of specific agent requests (internal Systems Manager call)			Read
UpdateInstanceAssociationStatus	Grants permission to SSM Agent to update the status of the association that it is currently running (internal Systems Manager call)	association*	aws:ResourceTag/${TagKey} ec2:SourceInstanceARN ssm:SourceInstanceARN	Write
		instance	aws:ResourceTag/${TagKey} ec2:SourceInstanceARN ssm:resourceTag/${TagKey} ssm:SourceInstanceARN
		managed-instance	aws:ResourceTag/${TagKey} ec2:SourceInstanceARN ssm:resourceTag/tag-key ssm:SourceInstanceARN

Resource types defined by Amazon Systems Manager

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
association	arn:${Partition}:ssm:${Region}:${Account}:association/${AssociationId}	aws:ResourceTag/${TagKey}
automation-definition	arn:${Partition}:ssm:${Region}:${Account}:automation-definition/${AutomationDefinitionName}:${VersionId}	ssm:DocumentType
automation-execution	arn:${Partition}:ssm:${Region}:${Account}:automation-execution/${AutomationExecutionId}	aws:ResourceTag/${TagKey} ssm:resourceTag/tag-key
bucket	arn:${Partition}:s3:::${BucketName}
cloud-connector	arn:${Partition}:ssm:${Region}:${Account}:cloud-connector/${CloudConnectorId}	aws:ResourceTag/${TagKey}
document	arn:${Partition}:ssm:${Region}:${Account}:document/${DocumentName}	aws:ResourceTag/${TagKey} ssm:DocumentCategories ssm:DocumentType ssm:resourceTag/${TagKey}
iam-role	arn:${Partition}:iam::${Account}:role/${RoleName}
instance	arn:${Partition}:ec2:${Region}:${Account}:instance/${InstanceId}	aws:ResourceTag/${TagKey} ssm:resourceTag/${TagKey}
maintenancewindow	arn:${Partition}:ssm:${Region}:${Account}:maintenancewindow/${ResourceId}	aws:ResourceTag/${TagKey} ssm:resourceTag/tag-key
managed-instance	arn:${Partition}:ssm:${Region}:${Account}:managed-instance/${InstanceId}	aws:ResourceTag/${TagKey} ssm:resourceTag/tag-key
managed-instance-inventory	arn:${Partition}:ssm:${Region}:${Account}:managed-instance-inventory/${InstanceId}
opsitem	arn:${Partition}:ssm:${Region}:${Account}:opsitem/${ResourceId}	aws:ResourceTag/${TagKey}
opsitemgroup	arn:${Partition}:ssm:${Region}:${Account}:opsitemgroup/default
opsmetadata	arn:${Partition}:ssm:${Region}:${Account}:opsmetadata/${ResourceId}	aws:ResourceTag/${TagKey} ssm:resourceTag/${TagKey}
parameter	arn:${Partition}:ssm:${Region}:${Account}:parameter/${ParameterNameWithoutLeadingSlash}	aws:ResourceTag/${TagKey} ssm:resourceTag/tag-key
patchbaseline	arn:${Partition}:ssm:${Region}:${Account}:patchbaseline/${PatchBaselineIdResourceId}	aws:ResourceTag/${TagKey} ssm:resourceTag/tag-key
resourcedatasync	arn:${Partition}:ssm:${Region}:${Account}:resource-data-sync/${SyncName}
servicesetting	arn:${Partition}:ssm:${Region}:${Account}:servicesetting/${ResourceId}
session	arn:${Partition}:ssm:${Region}:${Account}:session/${SessionId}	ssm:resourceTag/aws:ssmmessages:session-id ssm:resourceTag/aws:ssmmessages:target-id
task	arn:${Partition}:ecs:${Region}:${Account}:task/${TaskId}	aws:ResourceTag/${TagKey}
windowtarget	arn:${Partition}:ssm:${Region}:${Account}:windowtarget/${WindowTargetId}	aws:ResourceTag/${TagKey} ssm:resourceTag/tag-key
windowtask	arn:${Partition}:ssm:${Region}:${Account}:windowtask/${WindowTaskId}	aws:ResourceTag/${TagKey} ssm:resourceTag/tag-key

Condition keys for Amazon Systems Manager

Amazon Systems Manager defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by 'Create' requests based on the allowed set of values for a specified tags	String
aws:ResourceTag/${TagKey}	Filters access by based on a tag key-value pair assigned to the Amazon resource	String
aws:TagKeys	Filters access by 'Create' requests based on whether mandatory tags are included in the request	ArrayOfString
ec2:SourceInstanceARN	Filters access by the ARN of the instance from which the request originated	ARN
ssm:AccessRequestId	Filters access by verifying that a user has access to the access request ID specified in the request	String
ssm:AutoApprove	Filters access by verifying that a user has permission to start Change Manager workflows without a review step (with the exception of change freeze events)	Bool
ssm:DocumentCategories	Filters access by verifying that a user has permission to access a document belonging to a specific category enum	ArrayOfString
ssm:DocumentType	Filters access by verifying that a user has permission to access a document belonging to a specific document type. Only available in "aws", "aws-cn", and "aws-us-gov" partitions	String
ssm:DocumentVersion	Filters access by verifying that a user has permission to access a specific version of a document	ArrayOfString
ssm:InventoryTypeName	Filters access by verifying that a user also has access to the InventoryType specified in the request	ArrayOfString
ssm:Overwrite	Filters access by controling whether Systems Manager parameters can be overwritten	String
ssm:Policies	Filters access by controlling whether an IAM Entity (user or role) can create or update a parameter that includes a parameter policy	String
ssm:Recursive	Filters access by Systems Manager parameters created in a hierarchical structure	String
ssm:SessionDocumentAccessCheck	Filters access by verifying that a user has permission to access either the default Session Manager configuration document or the custom configuration document specified in a request	Bool
ssm:SourceInstanceARN	Filters access by verifying the Amazon Resource Name (ARN) of the Amazon Systems Manager's managed instance from which the request is made. This key is not present when the request comes from the managed instance authenticated with an IAM role associated with EC2 instance profile	ARN
ssm:SyncType	Filters access by verifying that a user also has access to the ResourceDataSync SyncType specified in the request	String
ssm:resourceTag/${TagKey}	Filters access by a tag key-value pair assigned to the Systems Manager resource	String
ssm:resourceTag/aws:ssmmessages:session-id	Filters access by based on a tag key-value pair assigned to the Systems Manager session resource	String
ssm:resourceTag/aws:ssmmessages:target-id	Filters access by based on a tag key-value pair assigned to the Systems Manager session resource	String
ssm:resourceTag/tag-key	Filters access by based on a tag key-value pair assigned to the Systems Manager resource	String

Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Amazon Storage Gateway (storagegateway)

Amazon Systems Manager GUI Connect (ssm-guiconnect)