ssm-automation

Manages SSM automation documents, maintenance windows, patch baselines, and scheduled tasks.

Provisions custom SSM Automation and Run Command documents (YAML or JSON), maintenance windows with instance targets and RUN_COMMAND tasks, and patch baselines with approval rules and product filters. Supports multi-account document sharing.

Usage

module "ssm_automation" {
  source  = "hcassc.jfrog.io/iac-terraform-modules-virtual/observability/ssm-automation/aws"
  version = "0.1.0"

  maintenance_windows = {
    patching = {
      name     = "monthly-patching"
      schedule = "cron(0 2 ? * SUN#1 *)"
      duration = 4
    }
  }

  patch_baselines = {
    linux = {
      name             = "amazon-linux-2-baseline"
      operating_system = "AMAZON_LINUX_2"
    }
  }
}

Requirements

Name	Version
terraform	~> 1.5
aws	~> 6.50

Providers

Name	Version
aws	6.50.0

Resources

Name	Type
aws_ssm_document.this	resource
aws_ssm_maintenance_window.this	resource
aws_ssm_maintenance_window_target.this	resource
aws_ssm_maintenance_window_task.this	resource
aws_ssm_patch_baseline.this	resource

Inputs

Name	Description	Type	Default	Required
documents	Map of SSM automation documents to create	map(object({ name = string document_type = optional(string, "Automation") document_format = optional(string, "YAML") content = string target_type = optional(string, null) version_name = optional(string, null) permissions = optional(object({ account_ids = list(string) }), null) }))	{}	no
maintenance_window_targets	Map of maintenance window targets	map(object({ window_key = string resource_type = optional(string, "INSTANCE") target_key = optional(string, "tag:Patch") target_values = optional(list(string), ["true"]) owner_information = optional(string, null) }))	{}	no
maintenance_window_tasks	Map of maintenance window tasks	map(object({ window_key = string target_key = string task_type = optional(string, "RUN_COMMAND") task_arn = string service_role_arn = optional(string, null) priority = optional(number, 1) max_concurrency = optional(string, "1") max_errors = optional(string, "1") run_command_parameters = optional(object({ document_version = optional(string, "$LATEST") output_s3_bucket = optional(string, null) parameters = optional(map(list(string)), {}) }), null) }))	{}	no
maintenance_windows	Map of SSM maintenance windows	map(object({ name = string description = optional(string, "") schedule = string duration = optional(number, 2) cutoff = optional(number, 1) allow_unassociated_targets = optional(bool, false) schedule_timezone = optional(string, "UTC") }))	{}	no
patch_baselines	Map of patch baselines to create	map(object({ name = string description = optional(string, "") operating_system = optional(string, "AMAZON_LINUX_2") approved_patches = optional(list(string), []) rejected_patches = optional(list(string), []) approval_rules = optional(list(object({ approve_after_days = optional(number, 7) compliance_level = optional(string, "CRITICAL") patch_filter_groups = list(map(list(string))) })), []) }))	{}	no
tags	Resource tags to apply to all resources	map(string)	{}	no

Outputs

Name	Description
document_arns	Map of logical key to SSM document ARN
document_names	Map of logical key to SSM document name
maintenance_window_ids	Map of logical key to maintenance window ID
patch_baseline_ids	Map of logical key to patch baseline ID