ssm:UpdateInstanceAssociationStatus

Write

ssm:UpdateInstanceAssociationStatus is a Write access-level action in the ssm service. Grants permission to SSM Agent to update the status of the association that it is currently running (internal Systems Manager call)

Resource types

ARNs that ssm:UpdateInstanceAssociationStatus can be scoped to in an IAM policy.

arn:${Partition}:ssm:${Region}:${Account}:association/${AssociationId}

association

arn:${Partition}:ec2:${Region}:${Account}:instance/${InstanceId}

instance

arn:${Partition}:ssm:${Region}:${Account}:managed-instance/${InstanceId}

managed-instance

Condition keys

Keys you can use in the Condition block of a policy that grants ssm:UpdateInstanceAssociationStatus.

aws:ResourceTag/${TagKey} String

Filters access by based on a tag key-value pair assigned to the AWS resource

ssm:resourceTag/${TagKey} String

Filters access by a tag key-value pair assigned to the Systems Manager resource

ssm:resourceTag/tag-key String

Filters access by based on a tag key-value pair assigned to the Systems Manager resource

Example IAM policy

A minimal policy that allows ssm:UpdateInstanceAssociationStatus. Replace "Resource": "*" with a specific ARN to follow least privilege.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowSsmUpdateInstanceAssociationStatus",
      "Effect": "Allow",
      "Action": "ssm:UpdateInstanceAssociationStatus",
      "Resource": "*"
    }
  ]
}

Related actions in ssm

ssm:AddTagsToResource Tagging ssm:AssociateOpsItemRelatedItem Write ssm:CancelCommand Write ssm:CancelMaintenanceWindowExecution Write ssm:CreateActivation Write ssm:CreateAssociation Write ssm:CreateAssociationBatch Write ssm:CreateCloudConnector Write ssm:CreateDocument Write ssm:CreateMaintenanceWindow Write ssm:CreateOpsItem Write ssm:CreateOpsMetadata Write

View all ssm actions →