162 actions in the ssm service. Select an action to see its access level, resource ARNs, condition keys, and a copy-paste IAM policy.
Grants permission to add or overwrite one or more tags for a specified AWS resource
Grants permission to associate RelatedItem to an OpsItem
Grants permission to cancel a specified Run Command command
Grants permission to cancel an in-progress maintenance window execution
Grants permission to create an activation that is used to register on-premises servers and virtual machines (VMs) with Systems Manager
Grants permission to associate a specified Systems Manager document with specified instances or other targets
Grants permission to combine entries for multiple CreateAssociation operations in a single command
Grants permission to create a cloud connector for managing instances in other cloud environments
Grants permission to create a Systems Manager SSM document
Grants permission to create a maintenance window
Grants permission to create an OpsItem in OpsCenter
Grants permission to create an OpsMetadata object for an AWS resource
Grants permission to create a patch baseline
Grants permission to create a resource data sync configuration, which regularly collects inventory data from managed instances and updates the data in an Amazon S3 bucket
Grants permission to delete a specified activation for managed instances
Grants permission to disassociate a specified SSM document from a specified instance
Grants permission to delete a specified cloud connector
Grants permission to delete a specified SSM document and its instance associations
Grants permission to delete a specified custom inventory type, or the data associated with a custom inventory type
Grants permission to delete a specified maintenance window
Grants permission to delete an OpsItem
Grants permission to delete an OpsMetadata object
Grants permission to delete a specified SSM parameter
Grants permission to delete multiple specified SSM parameters
Grants permission to delete a specified patch baseline
Grants permission to delete a specified resource data sync
Grants permission to delete a Systems Manager resource policy
Grants permission to deregister a specified on-premises server or virtual machine (VM) from Systems Manager
Grants permission to deregister a specified patch baseline from being the default patch baseline for a specified patch group
Grants permission to deregister a specified target from a maintenance window
Grants permission to deregister a specified task from a maintenance window
Grants permission to view details about a specified managed instance activation, such as when it was created and the number of instances registered using the activation
Grants permission to view details about the specified association for a specified instance or target
Grants permission to view all executions for a specified association
Grants permission to view information about a specified association execution
Grants permission to view details about all active and terminated Automation executions
Grants permission to view information about all active and terminated step executions in an Automation workflow
Grants permission to view all patches eligible to include in a patch baseline
Grants permission to view details about a specified SSM document
Grants permission to display information about SSM document parameters in the Systems Manager console (internal Systems Manager action)
Grants permission to view the permissions for a specified SSM document
Grants permission to view all current associations for a specified instance
Grants permission to view details about the patches currently associated with the specified patch baseline (Windows only)
Grants permission to view the status of the associations for a specified instance
Grants permission to view details about a specified instance
Grants permission to view general details about the patches on a specified instance
Grants permission to view status details about patches on a specified instance
Grants permission to describe the high-level patch state for the instances in the specified patch group
Grants permission to user's Amazon EC2 console to render managed instances' nodes
Grants permission to view details about a specified inventory deletion
Grants permission to view the executions of a specified maintenance window
Grants permission to view details of a specified task execution for a maintenance window
Grants permission to view details about the tasks that ran during a specified maintenance window execution
Grants permission to view information about all or specified maintenance windows
Grants permission to view details about upcoming executions of a specified maintenance window
Grants permission to view information about the maintenance window targets and tasks associated with a specified instance
Grants permission to view a list of the targets associated with a specified maintenance window
Grants permission to view a list of the tasks associated with a specified maintenance window
Grants permission to view details about specified OpsItems
Grants permission to view details about a specified SSM parameter
Grants permission to view information about patch baselines that meet the specified criteria
Grants permission to view information about the patch baseline for a specified patch group
Grants permission to view aggregated status details for patches for a specified patch group
Grants permission to view details of available patches for a specified operating system and patch property
Grants permission to view a list of recent Session Manager sessions that meet the specified search criteria
Grants permission to disassociate RelatedItem from an OpsItem
Grants permission to a Systems Manager delegated administrator to view related resource details about OpsItems across multiple AWS accounts in the AWS Management Console
Grants permission to return a credentials set to be used with just-in-time node access
Grants permission to view details of a specified Automation execution
Grants permission to view details of a specific calendar
Grants permission to view the calendar state for a change calendar or a list of change calendars
Grants permission to view details about a specified cloud connector
Grants permission to view details about the command execution of a specified invocation or plugin
Grants permission to view the Session Manager connection status for a specified managed instance
Grants permission to view the current default patch baseline for a specified operating system type
Grants permission to retrieve the current patch baseline snapshot for a specified instance
Grants permission to view the contents of a specified SSM document
Grants permission to retrieve an existing preview that shows the effects that running a specified Automation runbook would have on the targeted resources
Grants permission to view instance inventory details per the specified criteria
Grants permission to view a list of inventory types or attribute names for a specified inventory item type
Grants permission to view details about a specified maintenance window
Grants permission to view details about a specified maintenance window execution
Grants permission to view details about a specified maintenance window execution task
Grants permission to view details about a specific maintenance window task running on a specific target
Grants permission to view details about tasks registered with a specified maintenance window
Grants permission to Systems Manager and SSM Agent to determine package installation requirements for an instance (internal Systems Manager call)
Grants permission to view information about a specified OpsItem
Grants permission to retrieve an OpsMetadata object
Grants permission to view summary information about OpsItems based on specified filters and aggregators
Grants permission to view information about a specified parameter
Grants permission to view details and changes for a specified parameter
Grants permission to view information about multiple specified parameters
Grants permission to view information about parameters in a specified hierarchy
Grants permission to view information about a specified patch baseline
Grants permission to view the ID of the current patch baseline for a specified patch group
Grants permission to retrieve lists of Systems Manager resource policies
Grants permission to view the account-level setting for an AWS service
Grants permission to apply an identifying label to a specified version of a parameter
Grants permission to list the associations for a specified SSM document or managed instance
Grants permission to list versions of the specified association
Grants permission to list cloud connectors in your account
Grants permission to list information about command invocations sent to a specified instance
Grants permission to list the commands sent to a specified instance
Grants permission to list compliance status for specified resource types on a specified resource
Grants permission to list a summary count of compliant and noncompliant resources for a specified compliance type
Grants permission to view metadata history about a specified SSM document
Grants permission to view information about a specified SSM document
Grants permission to list all versions of a specified document
Grants permission to SSM Agent to check for new State Manager associations (internal Systems Manager call)
Grants permission to view a list of specified inventory types for a specified instance
Grants permission to view details about managed nodes based on specified filters
Grants permission to view summary information about managed nodes based on specified filters and aggregators
Grants permission to view details about OpsItemEvents
Grants permission to view details about OpsItem RelatedItems
Grants permission to view a list of OpsMetadata objects
Grants permission to list resource-level summary count
Grants permission to list information about resource data sync configurations in an account
Grants permission to view a list of resource tags for a specified resource
Grants permission to share a custom SSM document publicly or privately with specified AWS accounts
Grants permission to create/edit a specific calendar
Grants permission to register a compliance type and other compliance details on a specified resource
Grants permission to SSM Agent to generate a report of the results of specific agent requests (internal Systems Manager call)
Grants permission to add or update inventory items on multiple specified managed instances
Grants permission to create an SSM parameter
Grants permission to create or update a Systems Manager resource policy
Grants permission to specify the default patch baseline for an operating system type
Grants permission to register a Systems Manager Agent
Grants permission to specify the default patch baseline for a specified patch group
Grants permission to register a target with a specified maintenance window
Grants permission to register a task with a specified maintenance window
Grants permission to remove a specified tag key from a specified resource
Grants permission to reset the service setting for an AWS account to the default value
Grants permission to reconnect a Session Manager session to a managed instance
Grants permission to send a signal to change the current behavior or status of a specified Automation execution
Grants permission to run commands on one or more specified managed instances
Grants permission to start the workflow for just-in-time node access sessions
Grants permission to run a specified association manually
Grants permission to initiate the execution of an Automation document
Grants permission to initiate the execution of an Automation Change Template document
Grants permission to create a preview showing the effects that running a specified Automation runbook would have on the targeted resources
Grants permission to initiate a connection to a specified target for a Session Manager session
Grants permission to stop a specified Automation execution that is already in progress
Grants permission to permanently end a Session Manager connection to an instance
Grants permission to remove an identifying label from a specified version of a parameter
Grants permission to update an association and immediately run the association on the specified targets
Grants permission to update the status of the SSM document associated with a specified instance
Grants permission to update a specified cloud connector
Grants permission to update one or more values for an SSM document
Grants permission to change the default version of an SSM document
Grants permission to update the metadata of an SSM document
Grants permission to SSM Agent to update the status of the association that it is currently running (internal Systems Manager call)
Grants permission to SSM Agent to send a heartbeat signal to the Systems Manager service in the cloud
Grants permission to update a specified maintenance window
Grants permission to update a specified maintenance window target
Grants permission to update a specified maintenance window task
Grants permission to assign or change the IAM role assigned to a specified managed instance
Grants permission to edit or change an OpsItem
Grants permission to update an OpsMetadata object
Grants permission to update a specified patch baseline
Grants permission to update a resource data sync
Grants permission to update the service setting for an AWS account
Grants permission to verify that a specified cloud connector is functioning properly and to retrieve any validation findings or issues detected