Systems Manager
Prefix ssm, 166 actions · Domain Management & Governance
79 AWS managed policies. 4 have reviewed guidance; the rest have authoritative permission data pending editorial review. 21 are service-linked role policies, shown with permission data only.
User access (5)
Operator and limited (43)
- AIOpsOperatorAccessOperator
- AmazonEKSLocalOutpostClusterPolicyOperator
- AmazonElasticFileSystemsUtilsOperator
- AmazonRDSCustomInstanceProfileRolePolicyOperator
- AmazonSageMakerSpacesControllerPolicyOperator
- AmazonSSMAutomationApproverAccessOperator
- AmazonSSMManagedEC2InstanceDefaultPolicyOperator
- AmazonSSMManagedInstanceCoreOperator
- AWS-SSM-DiagnosisAutomation-AdministrationRolePolicyOperator
- AWS-SSM-DiagnosisAutomation-ExecutionRolePolicyOperator
- AWS-SSM-RemediationAutomation-AdministrationRolePolicyOperator
- AWS-SSM-RemediationAutomation-ExecutionRolePolicyOperator
- AWSApplicationMigrationSSMAccessOperator
- AWSBudgetsActions_RolePolicyForResourceAdministrationWithSSMOperator
- AWSCloud9EnvironmentMemberOperator
- AWSCloud9SSMInstanceProfileOperator
- AWSCloud9UserOperator
- AWSEC2VssRestorePolicyOperator
- AWSElasticDisasterRecoveryLaunchActionsPolicyOperator
- AWSMarketplaceImageBuildFullAccessOperator
- AWSQuickSetupCFGCPacksPermissionsBoundaryOperator
- AWSQuickSetupDeploymentRolePolicyOperator
- AWSQuickSetupDevOpsGuruPermissionsBoundaryOperator
- AWSQuickSetupDistributorPermissionsBoundaryOperator
- AWSQuickSetupEnableDHMCExecutionPolicyOperator
- AWSQuickSetupJITNADeploymentRolePolicyOperator
- AWSQuickSetupManagedInstanceProfileExecutionPolicyOperator
- AWSQuickSetupManageJITNAResourcesExecutionPolicyOperator
- AWSQuickSetupPatchPolicyLambdaExecutionPolicyOperator
- AWSQuickSetupPatchPolicyTagManagementExecutionPolicyOperator
- AWSQuickSetupSchedulerPermissionsBoundaryOperator
- AWSQuickSetupSSMDeploymentRolePolicyOperator
- AWSQuickSetupSSMHostMgmtPermissionsBoundaryOperator
- AWSQuickSetupSSMLifecycleManagementExecutionPolicyOperator
- AWSQuickSetupStartSSMAssociationsExecutionPolicyOperator
- AWSQuickSetupStartStopInstancesExecutionPolicyOperator
- AWSSystemsManagerEnableExplorerExecutionPolicyOperator
- AWSSystemsManagerJustInTimeAccessTokenPolicyOperator
- AWSSystemsManagerJustInTimeAccessTokenSessionPolicyOperator
- AWSSystemsManagerJustInTimeNodeAccessRolePropagationPolicyOperator
- AWSTransformInfrastructureExecutorAccessEC2Operator
- CloudWatchAgentAdminPolicyOperator
- EC2ImageBuilderExecutionPolicyOperator
Service roles (10)
- AmazonEC2RoleforSSMHigh privilegeOperator
- AmazonSSMAutomationRoleAdmin
- AmazonSSMMaintenanceWindowRoleOperator
- AmplifyBackendDeployFullAccessOperator
- AWSDataLifecycleManagerSSMFullAccessOperator
- AWSFaultInjectionSimulatorEC2AccessOperator
- AWSFaultInjectionSimulatorECSAccessOperator
- AWSFaultInjectionSimulatorSSMAccessOperator
- AWSMigrationHubRefactorSpaces-SSMAutomationPolicyOperator
- SageMakerStudioDomainServiceRolePolicyOperator
Service-linked roles (21)
- AmazonEKSConnectorServiceRolePolicyOperator
- AmazonGuardDutyServiceRolePolicyOperator
- AmazonInspector2ServiceRolePolicyOperator
- AmazonInspector2ThirdPartyServiceRolePolicyOperator
- AmazonSSMServiceRolePolicyOperator
- AWSConfigRemediationServiceRolePolicyOperator
- AWSDirectoryServiceServiceRolePolicyOperator
- AWSEC2SqlHaServiceRolePolicyOperator
- AWSIncidentManagerServiceRolePolicyOperator
- AWSLicenseManagerMemberAccountRolePolicyOperator
- AWSLicenseManagerServiceRolePolicyOperator
- AWSLicenseManagerUserSubscriptionsServiceRolePolicyOperator
- AWSMigrationHubOrchestratorServiceRolePolicyOperator
- AWSServiceRoleForCloudWatchAlarmsActionSSMServiceRolePolicyOperator
- AWSServiceRoleForImageBuilderOperator
- AWSSSMOpsInsightsServiceRolePolicyOperator
- AWSSystemsManagerChangeManagementServicePolicyOperator
- AWSSystemsManagerJustInTimeAccessServicePolicyOperator
- AWSSystemsManagerOpsDataSyncServiceRolePolicyOperator
- CloudwatchApplicationInsightsServiceLinkedRolePolicyOperator
- SSMQuickSetupRolePolicyOperator
Also grants Systems Manager actions (81)
- AdministratorAccess
- AdministratorAccess-Amplify
- AIDevOpsAgentAccessPolicy
- AIDevOpsAgentActionsPolicy
- AIOpsAssistantPolicy
- AIOpsConsoleAdminPolicy
- AmazonDataZoneFullAccess
- AmazonDataZoneProjectDeploymentPermissionsBoundary
- AmazonDevOpsGuruServiceRolePolicy
- AmazonEC2RolePolicyForLaunchWizard
- AmazonECS_FullAccess
- AmazonECSServiceRolePolicy
- AmazonEKSLocalOutpostServiceRolePolicy
- AmazonInspector2ReadOnlyAccess
- AmazonLaunchWizard_Fullaccess
- AmazonLaunchWizardFullAccessV2
- AmazonRDSCustomPreviewServiceRolePolicy
- AmazonRDSCustomServiceRolePolicy
- AssuranceServiceRolePolicy
- AutoScalingServiceRolePolicy
- AWS_ConfigRole
- AWSApplicationMigrationFullAccess
- AWSApplicationMigrationNetworkMigrationMultiAccount
- AWSApplicationMigrationReadOnlyAccess
- AWSBackupFullAccess
- AWSBackupOperatorAccess
- AWSBackupServiceRolePolicyForBackup
- AWSBudgetsSpendLimitMemberRolePolicy
- AWSCloud9Administrator
- AWSCODAPermissionsBoundary
- AWSCodeBuildAdminAccess
- AWSCodeBuildDeveloperAccess
- AWSConfigServiceRolePolicy
- AWSEC2SqlHaInstancePolicy
- AWSElasticDisasterRecoveryConsoleFullAccess_v2
- AWSIoTDeviceTesterForFreeRTOSFullAccess
- AWSMarketplaceFullAccess
- AWSMcpServiceActionsFullAccess
- AWSPartnerLedSupportReadOnlyAccess
- AWSQuickSetupEnableAREXExecutionPolicy
- AWSQuickSetupPatchPolicyDeploymentRolePolicy
- AWSQuickSetupPatchPolicyPermissionsBoundary
- AWSRefactoringToolkitFullAccess
- AWSResilienceHubAsssessmentExecutionPolicy
- AWSResilienceHubV2AssessmentExecutionPolicy
- AWSResourceExplorerServiceRolePolicy
- AWSResourceGroupsReadOnlyAccess
- AWSServiceCatalogAdminFullAccess
- AWSServiceCatalogAdminReadOnlyAccess
- AWSServiceCatalogEndUserFullAccess
- AWSServiceCatalogEndUserReadOnlyAccess
- AWSServiceRoleForSMS
- AWSSSMForSAPServiceLinkedRolePolicy
- AWSStorageGatewayFullAccess
- AWSStorageGatewayReadOnlyAccess
- AWSSupportServiceRolePolicy
- AWSSystemsManagerEnableConfigRecordingExecutionPolicy
- AWSTransformApplicationDeploymentPolicy
- AWSTransformNetworkMigrationAgentPolicy
- AWSTransformServerMigrationAgentPolicy
- AWSWellArchitectedAgentResourceScanningServiceRolePolicy
- CloudWatchAgentServerPolicy
- CloudWatchOmniAWSIntegrationPolicy
- ConfigConformsServiceRolePolicy
- PowerUserAccess
- ReadOnlyAccess
- ResourceGroupsTaggingAPITagUntagSupportedResources
- SageMakerStudioAdminIAMConsolePolicy
- SageMakerStudioAdminIAMDefaultExecutionPolicy
- SageMakerStudioAdminIAMPermissiveExecutionPolicy
- SageMakerStudioDomainExecutionRolePolicy
- SageMakerStudioFullAccess
- SageMakerStudioProjectRoleMachineLearningPolicy
- SageMakerStudioProjectUserRolePermissionsBoundary
- SageMakerStudioUserIAMDefaultExecutionPolicy
- SageMakerStudioUserIAMPermissiveExecutionPolicy
- SecurityAudit
- ServerMigration_ServiceRole
- SupportUser
- ViewOnlyAccess
- WellArchitectedAgentResourceScanning
addtagstoresource associateopsitemrelateditem cancelcommand cancelmaintenancewindowexecution createactivation createassociation createassociationbatch createcloudconnector createdocument createmaintenancewindow createopsitem createopsmetadata createpatchbaseline createresourcedatasync deleteactivation deleteassociation deletecloudconnector deletedocument deleteinventory deletemaintenancewindow deleteopsitem deleteopsmetadata deleteparameter deleteparameters deletepatchbaseline deleteresourcedatasync deleteresourcepolicy deregisterdefaulthostmanagementconfiguration deregistermanagedinstance deregisterpatchbaselineforpatchgroup deregistertargetfrommaintenancewindow deregistertaskfrommaintenancewindow describeactivations describeassociation describeassociationexecutiontargets describeassociationexecutions describeautomationexecutions describeautomationstepexecutions describeavailablepatches describedocument describedocumentparameters describedocumentpermission describeeffectiveinstanceassociations describeeffectivepatchesforpatchbaseline describeinstanceassociationsstatus describeinstanceinformation describeinstancepatchstates describeinstancepatchstatesforpatchgroup describeinstancepatches describeinstanceproperties describeinventorydeletions describemaintenancewindowexecutiontaskinvocations describemaintenancewindowexecutiontasks describemaintenancewindowexecutions describemaintenancewindowschedule describemaintenancewindowtargets describemaintenancewindowtasks describemaintenancewindows describemaintenancewindowsfortarget describeopsitems describeparameters describepatchbaselines describepatchgroupstate describepatchgroups describepatchproperties describesessions disassociateopsitemrelateditem executeapi getaccesstoken getautomationexecution getcalendar getcalendarstate getcloudconnector getcommandinvocation getconnectionstatus getdefaultpatchbaseline getdeployablepatchsnapshotforinstance getdocument getexecutionpreview getinventory getinventoryschema getmaintenancewindow getmaintenancewindowexecution getmaintenancewindowexecutiontask getmaintenancewindowexecutiontaskinvocation getmaintenancewindowtask getmanifest getopsitem getopsmetadata getopssummary getparameter getparameterhistory getparameters getparametersbypath getpatchbaseline getpatchbaselineforpatchgroup getresourcepolicies getservicesetting labelparameterversion listassociationversions listassociations listcloudconnectors listcommandinvocations listcommands listcomplianceitems listcompliancesummaries listdocumentmetadatahistory listdocumentversions listdocuments listinstanceassociations listinventoryentries listnodes listnodessummary listopsitemevents listopsitemrelateditems listopsmetadata listresourcecompliancesummaries listresourcedatasync listtagsforresource modifydocumentpermission putcalendar putcomplianceitems putconfigurepackageresult putinventory putparameter putresourcepolicy registerdefaulthostmanagementconfiguration registerdefaultpatchbaseline registermanagedinstance registerpatchbaselineforpatchgroup registertargetwithmaintenancewindow registertaskwithmaintenancewindow removetagsfromresource requestmanagedinstanceroletoken resetservicesetting resumesession sendautomationsignal sendcommand startaccessrequest startassociationsonce startautomationexecution startchangerequestexecution startexecutionpreview startsession stopautomationexecution terminatesession unlabelparameterversion updateassociation updateassociationstatus updatecloudconnector updatedocument updatedocumentdefaultversion updatedocumentmetadata updateinstanceassociationstatus updateinstanceinformation updatemaintenancewindow updatemaintenancewindowtarget updatemaintenancewindowtask updatemanagedinstancepublickey updatemanagedinstancerole updateopsitem updateopsmetadata updatepatchbaseline updateresourcedatasync updateservicesetting validatecloudconnector
Actions (166)
| Action | Access level | Policies granting without limits | Policies granting with resource or condition limits |
|---|---|---|---|
| ssm:AddTagsToResource | Tagging | 9 | 27 |
| ssm:AssociateOpsItemRelatedItem | Write | 7 | 1 |
| ssm:CancelCommand | Write | 15 | 2 |
| ssm:CancelMaintenanceWindowExecution | Write | 6 | 1 |
| ssm:CreateActivation | Write | 7 | 2 |
| ssm:CreateAssociation | Write | 9 | 13 |
| ssm:CreateAssociationBatch | Write | 6 | 1 |
| ssm:CreateCloudConnector | Write | 6 | 2 |
| ssm:CreateDocument | Write | 8 | 5 |
| ssm:CreateMaintenanceWindow | Write | 6 | 1 |
| ssm:CreateOpsItem | Write | 13 | 4 |
| ssm:CreateOpsMetadata | Write | 7 | 2 |
| ssm:CreatePatchBaseline | Write | 6 | 1 |
| ssm:CreateResourceDataSync | Write | 7 | 2 |
| ssm:DeleteActivation | Write | 8 | 1 |
| ssm:DeleteAssociation | Write | 7 | 13 |
| ssm:DeleteCloudConnector | Write | 6 | 2 |
| ssm:DeleteDocument | Write | 6 | 6 |
| ssm:DeleteInventory | Write | 6 | 1 |
| ssm:DeleteMaintenanceWindow | Write | 6 | 1 |
| ssm:DeleteOpsItem | Write | 6 | 2 |
| ssm:DeleteOpsMetadata | Write | 6 | 3 |
| ssm:DeleteParameter | Write | 6 | 17 |
| ssm:DeleteParameters | Write | 6 | 6 |
| ssm:DeletePatchBaseline | Write | 6 | 1 |
| ssm:DeleteResourceDataSync | Write | 7 | 3 |
| ssm:DeleteResourcePolicy | Permissions management | 6 | 4 |
| ssm:DeregisterDefaultHostManagementConfiguration | Write | 6 | 1 |
| ssm:DeregisterManagedInstance | Write | 6 | 3 |
| ssm:DeregisterPatchBaselineForPatchGroup | Write | 6 | 1 |
| ssm:DeregisterTargetFromMaintenanceWindow | Write | 6 | 1 |
| ssm:DeregisterTaskFromMaintenanceWindow | Write | 6 | 1 |
| ssm:DescribeActivations | Read | 18 | 1 |
| ssm:DescribeAssociation | Read | 26 | 11 |
| ssm:DescribeAssociationExecutionTargets | Read | 17 | 2 |
| ssm:DescribeAssociationExecutions | Read | 20 | 5 |
| ssm:DescribeAutomationExecutions | Read | 27 | 3 |
| ssm:DescribeAutomationStepExecutions | Read | 22 | 3 |
| ssm:DescribeAvailablePatches | Read | 16 | 1 |
| ssm:DescribeDocument | Read | 33 | 21 |
| ssm:DescribeDocumentParameters | Read | 15 | 3 |
| ssm:DescribeDocumentPermission | Read | 19 | 3 |
| ssm:DescribeEffectiveInstanceAssociations | Read | 16 | 1 |
| ssm:DescribeEffectivePatchesForPatchBaseline | Read | 16 | 2 |
| ssm:DescribeInstanceAssociationsStatus | Read | 17 | 2 |
| ssm:DescribeInstanceInformation | Read | 39 | 8 |
| ssm:DescribeInstancePatchStates | Read | 16 | 1 |
| ssm:DescribeInstancePatchStatesForPatchGroup | Read | 16 | 1 |
| ssm:DescribeInstancePatches | Read | 16 | 1 |
| ssm:DescribeInstanceProperties | Read | 16 | 1 |
| ssm:DescribeInventoryDeletions | Read | 16 | 1 |
| ssm:DescribeMaintenanceWindowExecutionTaskInvocations | List | 16 | 1 |
| ssm:DescribeMaintenanceWindowExecutionTasks | List | 16 | 1 |
| ssm:DescribeMaintenanceWindowExecutions | List | 16 | 1 |
| ssm:DescribeMaintenanceWindowSchedule | List | 16 | 1 |
| ssm:DescribeMaintenanceWindowTargets | List | 18 | 2 |
| ssm:DescribeMaintenanceWindowTasks | List | 18 | 2 |
| ssm:DescribeMaintenanceWindows | List | 20 | 2 |
| ssm:DescribeMaintenanceWindowsForTarget | List | 16 | 1 |
| ssm:DescribeOpsItems | Read | 19 | 1 |
| ssm:DescribeParameters | List | 24 | 6 |
| ssm:DescribePatchBaselines | List | 21 | 3 |
| ssm:DescribePatchGroupState | List | 16 | 1 |
| ssm:DescribePatchGroups | List | 16 | 1 |
| ssm:DescribePatchProperties | List | 16 | 1 |
| ssm:DescribeSessions | List | 21 | 2 |
| ssm:DisassociateOpsItemRelatedItem | Write | 6 | 1 |
| ssm:ExecuteAPI | Read | 6 | 1 |
| ssm:GetAccessToken | Read | 8 | 1 |
| ssm:GetAutomationExecution | Read | 34 | 12 |
| ssm:GetCalendar | Read | 8 | 1 |
| ssm:GetCalendarState | Read | 12 | 10 |
| ssm:GetCloudConnector | Read | 11 | 2 |
| ssm:GetCommandInvocation | Read | 33 | 9 |
| ssm:GetConnectionStatus | Read | 15 | 4 |
| ssm:GetDefaultPatchBaseline | Read | 17 | 3 |
| ssm:GetDeployablePatchSnapshotForInstance | Read | 14 | 1 |
| ssm:GetDocument | Read | 22 | 23 |
| ssm:GetExecutionPreview | Read | 8 | 1 |
| ssm:GetInventory | Read | 13 | 1 |
| ssm:GetInventorySchema | Read | 10 | 1 |
| ssm:GetMaintenanceWindow | Read | 15 | 2 |
| ssm:GetMaintenanceWindowExecution | Read | 10 | 1 |
| ssm:GetMaintenanceWindowExecutionTask | Read | 10 | 1 |
| ssm:GetMaintenanceWindowExecutionTaskInvocation | Read | 10 | 1 |
| ssm:GetMaintenanceWindowTask | Read | 11 | 2 |
| ssm:GetManifest | Read | 13 | 1 |
| ssm:GetOpsItem | Read | 13 | 5 |
| ssm:GetOpsMetadata | Read | 11 | 1 |
| ssm:GetOpsSummary | Read | 11 | 2 |
| ssm:GetParameter | Read | 14 | 24 |
| ssm:GetParameterHistory | Read | 10 | 5 |
| ssm:GetParameters | Read | 20 | 24 |
| ssm:GetParametersByPath | Read | 11 | 13 |
| ssm:GetPatchBaseline | Read | 18 | 4 |
| ssm:GetPatchBaselineForPatchGroup | Read | 10 | 1 |
| ssm:GetResourcePolicies | List | 17 | 5 |
| ssm:GetServiceSetting | Read | 15 | 15 |
| ssm:LabelParameterVersion | Write | 6 | 1 |
| ssm:ListAssociationVersions | List | 16 | 1 |
| ssm:ListAssociations | List | 29 | 3 |
| ssm:ListCloudConnectors | List | 17 | 2 |
| ssm:ListCommandInvocations | List | 27 | 3 |
| ssm:ListCommands | List | 28 | 4 |
| ssm:ListComplianceItems | List | 16 | 1 |
| ssm:ListComplianceSummaries | List | 16 | 1 |
| ssm:ListDocumentMetadataHistory | List | 18 | 1 |
| ssm:ListDocumentVersions | List | 20 | 4 |
| ssm:ListDocuments | List | 32 | 4 |
| ssm:ListInstanceAssociations | List | 19 | 1 |
| ssm:ListInventoryEntries | List | 18 | 1 |
| ssm:ListNodes | List | 14 | 1 |
| ssm:ListNodesSummary | List | 14 | 1 |
| ssm:ListOpsItemEvents | List | 15 | 1 |
| ssm:ListOpsItemRelatedItems | List | 15 | 1 |
| ssm:ListOpsMetadata | List | 17 | 1 |
| ssm:ListResourceComplianceSummaries | List | 16 | 1 |
| ssm:ListResourceDataSync | List | 23 | 3 |
| ssm:ListTagsForResource | List | 24 | 12 |
| ssm:ModifyDocumentPermission | Permissions management | 6 | 1 |
| ssm:PutCalendar | Write | 6 | 1 |
| ssm:PutComplianceItems | Write | 11 | 1 |
| ssm:PutConfigurePackageResult | Read | 11 | 1 |
| ssm:PutInventory | Write | 11 | 2 |
| ssm:PutParameter | Write | 6 | 27 |
| ssm:PutResourcePolicy | Permissions management | 6 | 4 |
| ssm:RegisterDefaultHostManagementConfiguration | Write | 6 | 1 |
| ssm:RegisterDefaultPatchBaseline | Write | 6 | 1 |
| ssm:RegisterManagedInstance | Write | 7 | 1 |
| ssm:RegisterPatchBaselineForPatchGroup | Write | 6 | 1 |
| ssm:RegisterTargetWithMaintenanceWindow | Write | 6 | 1 |
| ssm:RegisterTaskWithMaintenanceWindow | Write | 6 | 1 |
| ssm:RemoveTagsFromResource | Tagging | 7 | 12 |
| ssm:RequestManagedInstanceRoleToken | Write | 6 | 1 |
| ssm:ResetServiceSetting | Write | 6 | 2 |
| ssm:ResumeSession | Write | 7 | 2 |
| ssm:SendAutomationSignal | Write | 10 | 1 |
| ssm:SendCommand | Write | 8 | 36 |
| ssm:StartAccessRequest | Write | 6 | 1 |
| ssm:StartAssociationsOnce | Write | 6 | 6 |
| ssm:StartAutomationExecution | Write | 10 | 25 |
| ssm:StartChangeRequestExecution | Write | 6 | 1 |
| ssm:StartExecutionPreview | Read | 6 | 1 |
| ssm:StartSession | Write | 6 | 13 |
| ssm:StopAutomationExecution | Write | 9 | 6 |
| ssm:TerminateSession | Write | 7 | 2 |
| ssm:UnlabelParameterVersion | Write | 6 | 1 |
| ssm:UpdateAssociation | Write | 6 | 11 |
| ssm:UpdateAssociationStatus | Write | 10 | 1 |
| ssm:UpdateCloudConnector | Write | 6 | 2 |
| ssm:UpdateDocument | Write | 6 | 4 |
| ssm:UpdateDocumentDefaultVersion | Write | 6 | 4 |
| ssm:UpdateDocumentMetadata | Write | 6 | 2 |
| ssm:UpdateInstanceAssociationStatus | Write | 11 | 1 |
| ssm:UpdateInstanceInformation | Write | 12 | 3 |
| ssm:UpdateMaintenanceWindow | Write | 6 | 1 |
| ssm:UpdateMaintenanceWindowTarget | Write | 6 | 1 |
| ssm:UpdateMaintenanceWindowTask | Write | 6 | 1 |
| ssm:UpdateManagedInstancePublicKey | Write | 6 | 1 |
| ssm:UpdateManagedInstanceRole | Write | 8 | 1 |
| ssm:UpdateOpsItem | Write | 8 | 6 |
| ssm:UpdateOpsMetadata | Write | 6 | 1 |
| ssm:UpdatePatchBaseline | Write | 6 | 1 |
| ssm:UpdateResourceDataSync | Write | 6 | 1 |
| ssm:UpdateServiceSetting | Write | 6 | 14 |
| ssm:ValidateCloudConnector | Read | 7 | 1 |