# ssm-automation

Manages SSM automation documents, maintenance windows, patch baselines, and scheduled tasks.

Provisions custom SSM Automation and Run Command documents (YAML or JSON), maintenance windows with instance targets and RUN_COMMAND tasks, and patch baselines with approval rules and product filters. Supports multi-account document sharing.

## Usage

```hcl
module "ssm_automation" {
  source  = "hcassc.jfrog.io/iac-terraform-modules-virtual/observability/ssm-automation/aws"
  version = "0.1.0"

  maintenance_windows = {
    patching = {
      name     = "monthly-patching"
      schedule = "cron(0 2 ? * SUN#1 *)"
      duration = 4
    }
  }

  patch_baselines = {
    linux = {
      name             = "amazon-linux-2-baseline"
      operating_system = "AMAZON_LINUX_2"
    }
  }
}
```

<!-- BEGIN_TF_DOCS — DO NOT EDIT BELOW THIS LINE -->
## Requirements

| Name | Version |
| ---- | ------- |
| <a name="requirement_terraform"></a> [terraform](#requirement_terraform) | ~> 1.5 |
| <a name="requirement_aws"></a> [aws](#requirement_aws) | ~> 6.50 |

## Providers

| Name | Version |
| ---- | ------- |
| <a name="provider_aws"></a> [aws](#provider_aws) | 6.50.0 |

## Resources

| Name | Type |
| ---- | ---- |
| [aws_ssm_document.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssm_document) | resource |
| [aws_ssm_maintenance_window.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssm_maintenance_window) | resource |
| [aws_ssm_maintenance_window_target.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssm_maintenance_window_target) | resource |
| [aws_ssm_maintenance_window_task.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssm_maintenance_window_task) | resource |
| [aws_ssm_patch_baseline.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssm_patch_baseline) | resource |

## Inputs

| Name | Description | Type | Default | Required |
| ---- | ----------- | ---- | ------- | :------: |
| <a name="input_documents"></a> [documents](#input_documents) | Map of SSM automation documents to create | <pre>map(object({<br/>    name            = string<br/>    document_type   = optional(string, "Automation")<br/>    document_format = optional(string, "YAML")<br/>    content         = string<br/>    target_type     = optional(string, null)<br/>    version_name    = optional(string, null)<br/>    permissions     = optional(object({ account_ids = list(string) }), null)<br/>  }))</pre> | `{}` | no |
| <a name="input_maintenance_window_targets"></a> [maintenance_window_targets](#input_maintenance_window_targets) | Map of maintenance window targets | <pre>map(object({<br/>    window_key        = string<br/>    resource_type     = optional(string, "INSTANCE")<br/>    target_key        = optional(string, "tag:Patch")<br/>    target_values     = optional(list(string), ["true"])<br/>    owner_information = optional(string, null)<br/>  }))</pre> | `{}` | no |
| <a name="input_maintenance_window_tasks"></a> [maintenance_window_tasks](#input_maintenance_window_tasks) | Map of maintenance window tasks | <pre>map(object({<br/>    window_key       = string<br/>    target_key       = string<br/>    task_type        = optional(string, "RUN_COMMAND")<br/>    task_arn         = string<br/>    service_role_arn = optional(string, null)<br/>    priority         = optional(number, 1)<br/>    max_concurrency  = optional(string, "1")<br/>    max_errors       = optional(string, "1")<br/>    run_command_parameters = optional(object({<br/>      document_version = optional(string, "$LATEST")<br/>      output_s3_bucket = optional(string, null)<br/>      parameters       = optional(map(list(string)), {})<br/>    }), null)<br/>  }))</pre> | `{}` | no |
| <a name="input_maintenance_windows"></a> [maintenance_windows](#input_maintenance_windows) | Map of SSM maintenance windows | <pre>map(object({<br/>    name                       = string<br/>    description                = optional(string, "")<br/>    schedule                   = string<br/>    duration                   = optional(number, 2)<br/>    cutoff                     = optional(number, 1)<br/>    allow_unassociated_targets = optional(bool, false)<br/>    schedule_timezone          = optional(string, "UTC")<br/>  }))</pre> | `{}` | no |
| <a name="input_patch_baselines"></a> [patch_baselines](#input_patch_baselines) | Map of patch baselines to create | <pre>map(object({<br/>    name             = string<br/>    description      = optional(string, "")<br/>    operating_system = optional(string, "AMAZON_LINUX_2")<br/>    approved_patches = optional(list(string), [])<br/>    rejected_patches = optional(list(string), [])<br/>    approval_rules = optional(list(object({<br/>      approve_after_days  = optional(number, 7)<br/>      compliance_level    = optional(string, "CRITICAL")<br/>      patch_filter_groups = list(map(list(string)))<br/>    })), [])<br/>  }))</pre> | `{}` | no |
| <a name="input_tags"></a> [tags](#input_tags) | Resource tags to apply to all resources | `map(string)` | `{}` | no |

## Outputs

| Name | Description |
| ---- | ----------- |
| <a name="output_document_arns"></a> [document_arns](#output_document_arns) | Map of logical key to SSM document ARN |
| <a name="output_document_names"></a> [document_names](#output_document_names) | Map of logical key to SSM document name |
| <a name="output_maintenance_window_ids"></a> [maintenance_window_ids](#output_maintenance_window_ids) | Map of logical key to maintenance window ID |
| <a name="output_patch_baseline_ids"></a> [patch_baseline_ids](#output_patch_baseline_ids) | Map of logical key to patch baseline ID |
<!-- END_TF_DOCS — DO NOT EDIT ABOVE THIS LINE -->