ssm:UpdateAssociationStatus is a Write access-level action in the ssm service. Grants permission to update the status of the SSM document associated with a specified instance
ARNs that ssm:UpdateAssociationStatus can be scoped to in an IAM policy.
Keys you can use in the Condition block of a policy that grants ssm:UpdateAssociationStatus.
Filters access by based on a tag key-value pair assigned to the AWS resource
Filters access by the ARN of the instance from which the request originated
Filters access by verifying the Amazon Resource Name (ARN) of the AWS Systems Manager's managed instance from which the request is made. This key is not present when the request comes from the managed instance authenticated with an IAM role associated with EC2 instance profile
Filters access by verifying that a user has permission to access a document belonging to a specific category enum
Filters access by verifying that a user has permission to access a document belonging to a specific document type. Only available in "aws", "aws-cn", and "aws-us-gov" partitions
Filters access by a tag key-value pair assigned to the Systems Manager resource
Filters access by based on a tag key-value pair assigned to the Systems Manager resource
A minimal policy that allows ssm:UpdateAssociationStatus. Replace "Resource": "*" with a specific ARN to follow least privilege.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowSsmUpdateAssociationStatus",
"Effect": "Allow",
"Action": "ssm:UpdateAssociationStatus",
"Resource": "*"
}
]
}