Gives permissions to a grantable entity to perform actions on the encryption key.

grantOnKey

grantRead

grantWrite

StringListParameter

The values of the parameter.

It may not reference another parameter and ``{{}}`` cannot be used in the value.

stringListValue

A regular expression used to validate the parameter value.

For example, for String types with values restricted to
numbers, you can specify the following: ``^\d+$``

allowedPattern

Information about the parameter that you want to add to the system.

description

parameterName

Indicates whether the parameter name is a simple name.

A parameter name
without any "/" is considered a simple name. If the parameter name includes
"/", setting simpleName to true might cause unintended issues such
as duplicate "/" in the resulting ARN.

This is required only if `parameterName` is a token, which means we
are unable to detect if the name is simple or "path-like" for the purpose
of rendering SSM parameter ARNs.

If `parameterName` is not specified, `simpleName` must be `true` (or
undefined) since the name generated by AWS CloudFormation is always a
simple name.

simpleName

tier

StringParameter

The value of the parameter.

It may not reference another parameter and ``{{}}`` cannot be used in the value.

stringValue

The data type of the parameter, such as `text` or `aws:ec2:image`.

dataType

type

The `AWS::SSM::Association` resource creates a State Manager association for your managed instances.

A State Manager association defines the state that you want to maintain on your instances. For example, an association can specify that anti-virus software must be installed and running on your instances, or that certain ports must be closed. For static targets, the association specifies a schedule for when the configuration is reapplied. For dynamic targets, such as an Resource Groups or an AWS Auto Scaling Group, State Manager applies the configuration when new instances are added to the group. The association also specifies actions to take when applying the configuration. For example, an association for anti-virus software might run once a day. If the software is not installed, then State Manager installs it. If the software is installed, but the service is not running, then the association might instruct State Manager to start the service.

CfnAssociation

The name of the SSM document that contains the configuration information for the instance.

You can specify `Command` or `Automation` documents. The documents can be AWS -predefined documents, documents you created, or a document that is shared with you from another account. For SSM documents that are shared with you from other AWS accounts , you must specify the complete SSM document ARN, in the following format:

`arn:partition:ssm:region:account-id:document/document-name`

For example: `arn:aws:ssm:us-east-2:12345678912:document/My-Shared-Document`

For AWS -predefined documents and SSM documents you created in your account, you only need to specify the document name. For example, `AWS -ApplyPatchBaseline` or `My-Document` .

name

By default, when you create a new association, the system runs it immediately after it is created and then according to the schedule you specified.

Specify this option if you don't want an association to run immediately after you create it. This parameter is not supported for rate expressions.

applyOnlyAtCronInterval

Specify a descriptive name for the association.

associationName

Choose the parameter that will define how your automation will branch out.

This target is required for associations that use an Automation runbook and target resources by using rate controls. Automation is a tool in AWS Systems Manager .

automationTargetParameterName

The names or Amazon Resource Names (ARNs) of the Change Calendar type documents your associations are gated under.

The associations only run when that Change Calendar is open. For more information, see [AWS Systems Manager Change Calendar](https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-change-calendar) in the *AWS Systems Manager User Guide* .

calendarNames

The severity level that is assigned to the association.

complianceSeverity

The version of the SSM document to associate with the target.

> Note the following important information.
>
> - State Manager doesn't support running associations that use a new version of a document if that document is shared from another account. State Manager always runs the `default` version of a document if shared from another account, even though the Systems Manager console shows that a new version was processed. If you want to run an association using a new version of a document shared form another account, you must set the document version to `default` .
> - `DocumentVersion` is not valid for documents owned by AWS , such as `AWS-RunPatchBaseline` or `AWS-UpdateSSMAgent` . If you specify `DocumentVersion` for an AWS document, the system returns the following error: "Error occurred during operation 'CreateAssociation'." (RequestToken: <token>, HandlerErrorCode: GeneralServiceException).

documentVersion

> `InstanceId` has been deprecated.

To specify an instance ID for an association, use the `Targets` parameter. If you use the parameter `InstanceId` , you cannot use the parameters `AssociationName` , `DocumentVersion` , `MaxErrors` , `MaxConcurrency` , `OutputLocation` , or `ScheduleExpression` . To use these parameters, you must use the `Targets` parameter.
>
> Note that in some examples later in this page, `InstanceIds` is used as the tag-key name in a `Targets` filter. `InstanceId` is not used as a parameter.

The ID of the instance that the SSM document is associated with. You must specify the `InstanceId` or `Targets` property.

instanceId

The maximum number of targets allowed to run the association at the same time.

You can specify a number, for example 10, or a percentage of the target set, for example 10%. The default value is 100%, which means all targets run the association at the same time.

If a new managed node starts and attempts to run an association while Systems Manager is running `MaxConcurrency` associations, the association is allowed to run. During the next association interval, the new managed node will process its association within the limit specified for `MaxConcurrency` .

maxConcurrency

The number of errors that are allowed before the system stops sending requests to run the association on additional targets.

You can specify either an absolute number of errors, for example 10, or a percentage of the target set, for example 10%. If you specify 3, for example, the system stops sending requests when the fourth error is received. If you specify 0, then the system stops sending requests after the first error is returned. If you run an association on 50 managed nodes and set `MaxError` to 10%, then the system stops sending the request when the sixth error is received.

Executions that are already running an association when `MaxErrors` is reached are allowed to complete, but some of these executions may fail as well. If you need to ensure that there won't be more than max-errors failed executions, set `MaxConcurrency` to 1 so that executions proceed one at a time.

maxErrors

An Amazon Simple Storage Service (Amazon S3) bucket where you want to store the output details of the request.

outputLocation

The parameters for the runtime configuration of the document.

parameters

A cron expression that specifies a schedule when the association runs.

The schedule runs in Coordinated Universal Time (UTC).

scheduleExpression

Number of days to wait after the scheduled day to run an association.

scheduleOffset

The mode for generating association compliance.

You can specify `AUTO` or `MANUAL` . In `AUTO` mode, the system uses the status of the association execution to determine the compliance status. If the association execution runs successfully, then the association is `COMPLIANT` . If the association execution doesn't run successfully, the association is `NON-COMPLIANT` .

In `MANUAL` mode, you must specify the `AssociationId` as a parameter for the `PutComplianceItems` API action. In this case, compliance data is not managed by State Manager. It is managed by your direct call to the `PutComplianceItems` API action.

By default, all associations use `AUTO` mode.

syncCompliance

The targets for the association.

You must specify the `InstanceId` or `Targets` property. You can target all instances in an AWS account by specifying t he `InstanceIds` key with a value of `*` .

Supported formats include the following.

- `Key=InstanceIds,Values=<instance-id-1>,<instance-id-2>,<instance-id-3>`
- `Key=tag-key,Values=<my-tag-key-1>,<my-tag-key-2>`

To view a JSON and a YAML example that targets all instances, see "Create an association for all managed instances in an AWS account " on the Examples page.

targets

The number of seconds the service should wait for the association status to show "Success" before proceeding with the stack execution.

If the association status doesn't show "Success" after the specified number of seconds, then stack creation fails.

> When you specify a value for the `WaitForSuccessTimeoutSeconds` , [drift detection](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-stack-drift.html) for your CloudFormation stack’s configuration might yield inaccurate results. If drift detection is important in your scenario, we recommend that you don’t include `WaitForSuccessTimeoutSeconds` in your template.

waitForSuccessTimeoutSeconds

The `AWS::SSM::Document` resource creates a Systems Manager (SSM) document in AWS Systems Manager .

This document defines the actions that Systems Manager performs on your AWS resources.

> This resource does not support CloudFormation drift detection.

CfnDocument

The content for the new SSM document in JSON or YAML.

For more information about the schemas for SSM document content, see [SSM document schema features and examples](https://docs.aws.amazon.com/systems-manager/latest/userguide/document-schemas-features.html) in the *AWS Systems Manager User Guide* .

> This parameter also supports `String` data types.

content

A list of key-value pairs that describe attachments to a version of a document.

attachments

Specify the document format for the request.

`JSON` is the default format.

documentFormat

documentType

A name for the SSM document.

> You can't use the following strings as document name prefixes. These are reserved by AWS for use as document name prefixes:
>
> - `aws`
> - `amazon`
> - `amzn`
> - `AWSEC2`
> - `AWSConfigRemediation`
> - `AWSSupport`

A list of SSM documents required by a document.

This parameter is used exclusively by AWS AppConfig . When a user creates an AWS AppConfig configuration in an SSM document, the user must also specify a required document for validation purposes. In this case, an `ApplicationConfiguration` document requires an `ApplicationConfigurationSchema` document for validation purposes. For more information, see [What is AWS AppConfig ?](https://docs.aws.amazon.com/appconfig/latest/userguide/what-is-appconfig.html) in the *AWS AppConfig User Guide* .

requires

AWS CloudFormation resource tags to apply to the document.

Use tags to help you identify and categorize resources.

targetType

If the document resource you specify in your template already exists, this parameter determines whether a new version of the existing document is created, or the existing document is replaced.

`Replace` is the default method. If you specify `NewVersion` for the `UpdateMethod` parameter, and the `Name` of the document does not match an existing resource, a new document is created. When you specify `NewVersion` , the default version of the document is changed to the newly created version.

updateMethod

An optional field specifying the version of the artifact you are creating with the document.

For example, `Release12.1` . This value is unique across all versions of a document, and can't be changed.

versionName

The `AWS::SSM::MaintenanceWindow` resource represents general information about a maintenance window for AWS Systems Manager .

Maintenance windows let you define a schedule for when to perform potentially disruptive actions on your instances, such as patching an operating system (OS), updating drivers, or installing software. Each maintenance window has a schedule, a duration, a set of registered targets, and a set of registered tasks.

For more information, see [Systems Manager Maintenance Windows](https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-maintenance.html) in the *AWS Systems Manager User Guide* and [CreateMaintenanceWindow](https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_CreateMaintenanceWindow.html) in the *AWS Systems Manager API Reference* .

CfnMaintenanceWindow

Enables a maintenance window task to run on managed instances, even if you have not registered those instances as targets.

If enabled, then you must specify the unregistered instances (by instance ID) when you register a task with the maintenance window.

allowUnassociatedTargets

The number of hours before the end of the maintenance window that AWS Systems Manager stops scheduling new tasks for execution.

cutoff

The duration of the maintenance window in hours.

duration

The schedule of the maintenance window in the form of a cron or rate expression.

schedule

The date and time, in ISO-8601 Extended format, for when the maintenance window is scheduled to become inactive.

endDate

The number of days to wait to run a maintenance window after the scheduled cron expression date and time.

The time zone that the scheduled maintenance window executions are based on, in Internet Assigned Numbers Authority (IANA) format.

scheduleTimezone

The date and time, in ISO-8601 Extended format, for when the maintenance window is scheduled to become active.

`StartDate` allows you to delay activation of the maintenance window until the specified future date.

startDate

Optional metadata that you assign to a resource in the form of an arbitrary set of tags (key-value pairs).

Tags enable you to categorize a resource in different ways, such as by purpose, owner, or environment. For example, you might want to tag a maintenance window to identify the type of tasks it will run, the types of targets, and the environment it will run in.

The `AWS::SSM::MaintenanceWindowTarget` resource registers a target with a maintenance window for AWS Systems Manager .

For more information, see [RegisterTargetWithMaintenanceWindow](https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_RegisterTargetWithMaintenanceWindow.html) in the *AWS Systems Manager API Reference* .

CfnMaintenanceWindowTarget

The type of target that is being registered with the maintenance window.

resourceType

The targets to register with the maintenance window.

In other words, the instances to run commands on when the maintenance window runs.

You must specify targets by using the `WindowTargetIds` parameter.

The ID of the maintenance window to register the target with.

windowId

The name for the maintenance window target.

A user-provided value that will be included in any Amazon CloudWatch Events events that are raised while running tasks for these targets in this maintenance window.

ownerInformation

The `AWS::SSM::MaintenanceWindowTask` resource defines information about a task for an AWS Systems Manager maintenance window.

For more information, see [RegisterTaskWithMaintenanceWindow](https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_RegisterTaskWithMaintenanceWindow.html) in the *AWS Systems Manager API Reference* .

CfnMaintenanceWindowTask

The priority of the task in the maintenance window.

The lower the number, the higher the priority. Tasks that have the same priority are scheduled in parallel.

priority

The resource that the task uses during execution.

For `RUN_COMMAND` and `AUTOMATION` task types, `TaskArn` is the SSM document name or Amazon Resource Name (ARN).

For `LAMBDA` tasks, `TaskArn` is the function name or ARN.

For `STEP_FUNCTIONS` tasks, `TaskArn` is the state machine ARN.

taskArn

The type of task.

Valid values: `RUN_COMMAND` , `AUTOMATION` , `LAMBDA` , `STEP_FUNCTIONS` .

taskType

The ID of the maintenance window where the task is registered.

The specification for whether tasks should continue to run after the cutoff time specified in the maintenance windows is reached.

cutoffBehavior

> `LoggingInfo` has been deprecated.

To specify an Amazon S3 bucket to contain logs for Run Command tasks, instead use the `OutputS3BucketName` and `OutputS3KeyPrefix` options in the `TaskInvocationParameters` structure. For information about how Systems Manager handles these options for the supported maintenance window task types, see [AWS ::SSM::MaintenanceWindowTask MaintenanceWindowRunCommandParameters](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ssm-maintenancewindowtask-maintenancewindowruncommandparameters.html) .

Information about an Amazon S3 bucket to write Run Command task-level logs to.

loggingInfo

The maximum number of targets this task can be run for, in parallel.

> Although this element is listed as "Required: No", a value can be omitted only when you are registering or updating a [targetless task](https://docs.aws.amazon.com/systems-manager/latest/userguide/maintenance-windows-targetless-tasks.html) You must provide a value in all other cases.
>
> For maintenance window tasks without a target specified, you can't supply a value for this option. Instead, the system inserts a placeholder value of `1` . This value doesn't affect the running of your task.

The maximum number of errors allowed before this task stops being scheduled.

> Although this element is listed as "Required: No", a value can be omitted only when you are registering or updating a [targetless task](https://docs.aws.amazon.com/systems-manager/latest/userguide/maintenance-windows-targetless-tasks.html) You must provide a value in all other cases.
>
> For maintenance window tasks without a target specified, you can't supply a value for this option. Instead, the system inserts a placeholder value of `1` . This value doesn't affect the running of your task.

The Amazon Resource Name (ARN) of the IAM service role for AWS Systems Manager to assume when running a maintenance window task.

If you do not specify a service role ARN, Systems Manager uses a service-linked role in your account. If no appropriate service-linked role for Systems Manager exists in your account, it is created when you run `RegisterTaskWithMaintenanceWindow` .

However, for an improved security posture, we strongly recommend creating a custom policy and custom service role for running your maintenance window tasks. The policy can be crafted to provide only the permissions needed for your particular maintenance window tasks. For more information, see [Setting up Maintenance Windows](https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-maintenance-permissions.html) in the in the *AWS Systems Manager User Guide* .

serviceRoleArn

The targets, either instances or window target IDs.

- Specify instances using `Key=InstanceIds,Values= *instanceid1* , *instanceid2*` .
- Specify window target IDs using `Key=WindowTargetIds,Values= *window-target-id-1* , *window-target-id-2*` .

The parameters to pass to the task when it runs.

Populate only the fields that match the task type. All other fields should be empty.

> When you update a maintenance window task that has options specified in `TaskInvocationParameters` , you must provide again all the `TaskInvocationParameters` values that you want to retain. The values you do not specify again are removed. For example, suppose that when you registered a Run Command task, you specified `TaskInvocationParameters` values for `Comment` , `NotificationConfig` , and `OutputS3BucketName` . If you update the maintenance window task and specify only a different `OutputS3BucketName` value, the values for `Comment` and `NotificationConfig` are removed.

taskInvocationParameters

> `TaskParameters` has been deprecated.

To specify parameters to pass to a task when it runs, instead use the `Parameters` option in the `TaskInvocationParameters` structure. For information about how Systems Manager handles these options for the supported maintenance window task types, see [MaintenanceWindowTaskInvocationParameters](https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_MaintenanceWindowTaskInvocationParameters.html) .

The parameters to pass to the task when it runs.

taskParameters

The `AWS::SSM::Parameter` resource creates an SSM parameter in AWS Systems Manager Parameter Store.

> To create an SSM parameter, you must have the AWS Identity and Access Management ( IAM ) permissions `ssm:PutParameter` and `ssm:AddTagsToResource` . On stack creation, AWS CloudFormation adds the following three tags to the parameter: `aws:cloudformation:stack-name` , `aws:cloudformation:logical-id` , and `aws:cloudformation:stack-id` , in addition to any custom tags you specify.
>
> To add, update, or remove tags during stack update, you must have IAM permissions for both `ssm:AddTagsToResource` and `ssm:RemoveTagsFromResource` . For more information, see [Managing access using policies](https://docs.aws.amazon.com/systems-manager/latest/userguide/security-iam.html#security_iam_access-manage) in the *AWS Systems Manager User Guide* .

For information about valid values for parameters, see [About requirements and constraints for parameter names](https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-paramstore-su-create.html#sysman-parameter-name-constraints) in the *AWS Systems Manager User Guide* and [PutParameter](https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_PutParameter.html) in the *AWS Systems Manager API Reference* .

CfnParameter

The type of parameter.

> Parameters of type `SecureString` are not supported by AWS CloudFormation .

The parameter value.

> If type is `StringList` , the system returns a comma-separated string with no spaces between commas in the `Value` field.

value

A regular expression used to validate the parameter value.

For example, for `String` types with values restricted to numbers, you can specify the following: `AllowedPattern=^\d+$`

The data type of the parameter, such as `text` or `aws:ec2:image` .

The default is `text` .

The name of the parameter.

> The reported maximum length of 2048 characters for a parameter name includes 1037 characters that are reserved for internal use by Systems Manager . The maximum length for a parameter name that you specify is 1011 characters.
>
> This count of 1011 characters includes the characters in the ARN that precede the name you specify. This ARN length will vary depending on your partition and Region. For example, the following 45 characters count toward the 1011 character maximum for a parameter created in the US East (Ohio) Region: `arn:aws:ssm:us-east-2:111122223333:parameter/` .

Information about the policies assigned to a parameter.

[Assigning parameter policies](https://docs.aws.amazon.com/systems-manager/latest/userguide/parameter-store-policies.html) in the *AWS Systems Manager User Guide* .

policies

Optional metadata that you assign to a resource in the form of an arbitrary set of tags (key-value pairs).

Tags enable you to categorize a resource in different ways, such as by purpose, owner, or environment. For example, you might want to tag a Systems Manager parameter to identify the type of resource to which it applies, the environment, or the type of configuration data referenced by the parameter.

The `AWS::SSM::PatchBaseline` resource defines the basic information for an AWS Systems Manager patch baseline.

A patch baseline defines which patches are approved for installation on your instances.

For more information, see [CreatePatchBaseline](https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_CreatePatchBaseline.html) in the *AWS Systems Manager API Reference* .

CfnPatchBaseline

A set of rules used to include patches in the baseline.

approvalRules

A list of explicitly approved patches for the baseline.

For information about accepted formats for lists of approved patches and rejected patches, see [Package name formats for approved and rejected patch lists](https://docs.aws.amazon.com/systems-manager/latest/userguide/patch-manager-approved-rejected-package-name-formats.html) in the *AWS Systems Manager User Guide* .

approvedPatches

Defines the compliance level for approved patches.

When an approved patch is reported as missing, this value describes the severity of the compliance violation. The default value is `UNSPECIFIED` .

approvedPatchesComplianceLevel

Indicates whether the list of approved patches includes non-security updates that should be applied to the managed nodes.

The default value is `false` . Applies to Linux managed nodes only.

approvedPatchesEnableNonSecurity

Indicates the status you want to assign to security patches that are available but not approved because they don't meet the installation criteria specified in the patch baseline.

Example scenario: Security patches that you might want installed can be skipped if you have specified a long period to wait after a patch is released before installation. If an update to the patch is released during your specified waiting period, the waiting period for installing the patch starts over. If the waiting period is too long, multiple versions of the patch could be released but never installed.

Supported for Windows Server managed nodes only.

availableSecurityUpdatesComplianceStatus

Indicates whether this is the default baseline.

AWS Systems Manager supports creating multiple default patch baselines. For example, you can create a default patch baseline for each operating system.

defaultBaseline

A set of global filters used to include patches in the baseline.

> The `GlobalFilters` parameter can be configured only by using the AWS CLI or an AWS SDK. It can't be configured from the Patch Manager console, and its value isn't displayed in the console.

globalFilters

Defines the operating system the patch baseline applies to.

The default value is `WINDOWS` .

operatingSystem

The name of the patch group to be registered with the patch baseline.

patchGroups

A list of explicitly rejected patches for the baseline.

For information about accepted formats for lists of approved patches and rejected patches, see [Package name formats for approved and rejected patch lists](https://docs.aws.amazon.com/systems-manager/latest/userguide/patch-manager-approved-rejected-package-name-formats.html) in the *AWS Systems Manager User Guide* .

rejectedPatches

The action for Patch Manager to take on patches included in the `RejectedPackages` list.

- **ALLOW_AS_DEPENDENCY** - *Linux and macOS* : A package in the rejected patches list is installed only if it is a dependency of another package. It is considered compliant with the patch baseline, and its status is reported as `INSTALLED_OTHER` . This is the default action if no option is specified.

*Windows Server* : Windows Server doesn't support the concept of package dependencies. If a package in the rejected patches list and already installed on the node, its status is reported as `INSTALLED_OTHER` . Any package not already installed on the node is skipped. This is the default action if no option is specified.
- **BLOCK** - *All OSs* : Packages in the rejected patches list, and packages that include them as dependencies, aren't installed by Patch Manager under any circumstances.

State value assignment for patch compliance:

- If a package was installed before it was added to the rejected patches list, or is installed outside of Patch Manager afterward, it's considered noncompliant with the patch baseline and its status is reported as `INSTALLED_REJECTED` .
- If an update attempts to install a dependency package that is now rejected by the baseline, when previous versions of the package were not rejected, the package being updated is reported as `MISSING` for `SCAN` operations and as `FAILED` for `INSTALL` operations.

rejectedPatchesAction

Information about the patches to use to update the managed nodes, including target operating systems and source repositories.

Applies to Linux managed nodes only.

sources

Optional metadata that you assign to a resource.

Tags enable you to categorize a resource in different ways, such as by purpose, owner, or environment. For example, you might want to tag a patch baseline to identify the severity level of patches it specifies and the operating system family it applies to.

The `AWS::SSM::ResourceDataSync` resource creates, updates, or deletes a resource data sync for AWS Systems Manager .

A resource data sync helps you view data from multiple sources in a single location. Systems Manager offers two types of resource data sync: `SyncToDestination` and `SyncFromSource` .

You can configure Systems Manager Inventory to use the `SyncToDestination` type to synchronize Inventory data from multiple AWS Regions to a single Amazon S3 bucket.

You can configure Systems Manager Explorer to use the `SyncFromSource` type to synchronize operational work items (OpsItems) and operational data (OpsData) from multiple AWS Regions . This type can synchronize OpsItems and OpsData from multiple AWS accounts and Regions or from an `EntireOrganization` by using AWS Organizations .

A resource data sync is an asynchronous operation that returns immediately. After a successful initial sync is completed, the system continuously syncs data.

By default, data is not encrypted in Amazon S3 . We strongly recommend that you enable encryption in Amazon S3 to ensure secure data storage. We also recommend that you secure access to the Amazon S3 bucket by creating a restrictive bucket policy.

For more information, see [Configuring Inventory Collection](https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-inventory-configuring.html#sysman-inventory-datasync) and [Setting Up Systems Manager Explorer to Display Data from Multiple Accounts and Regions](https://docs.aws.amazon.com/systems-manager/latest/userguide/Explorer-resource-data-sync.html) in the *AWS Systems Manager User Guide* .

> The following *Syntax* section shows all fields that are supported for a resource data sync. The *Examples* section below shows the recommended way to specify configurations for each sync type. Refer to the *Examples* section when you create your resource data sync.

CfnResourceDataSync

syncName

The name of the S3 bucket where the aggregated data is stored.

bucketName

bucketPrefix

The AWS Region with the S3 bucket targeted by the resource data sync.

bucketRegion

The Amazon Resource Name (ARN) of an encryption key for a destination in Amazon S3 .

You can use a KMS key to encrypt inventory data in Amazon S3 . You must specify a key that exist in the same AWS Region as the destination Amazon S3 bucket.

kmsKeyArn

Configuration information for the target S3 bucket.

s3Destination

A supported sync format.

The following format is currently supported: JsonSerDe

syncFormat

Information about the source where the data was synchronized.

syncSource

The type of resource data sync.

If `SyncType` is `SyncToDestination` , then the resource data sync synchronizes data to an S3 bucket. If the `SyncType` is `SyncFromSource` then the resource data sync synchronizes data from AWS Organizations or from multiple AWS Regions .

syncType

Creates or updates a Systems Manager resource policy.

A resource policy helps you to define the IAM entity (for example, an AWS account ) that can manage your Systems Manager resources. Currently, `OpsItemGroup` is the only resource that supports Systems Manager resource policies. The resource policy for `OpsItemGroup` enables AWS accounts to view and interact with OpsCenter operational work items (OpsItems). OpsCenter is a tool in Systems Manager .

CfnResourcePolicy

A policy you want to associate with a resource.

policy

The Amazon Resource Name (ARN) of the resource to which you want to attach a policy.

AWS Systems Manager

L2 Constructs2

StringListParameter

StringParameter

L1 Constructs9

CfnAssociation

CfnDocument

CfnMaintenanceWindow

CfnMaintenanceWindowTarget

CfnMaintenanceWindowTask

CfnParameter

CfnPatchBaseline

CfnResourceDataSync

CfnResourcePolicy

Learn AWS the Practical Way

Quick Facts

Related Links

More AWS Systems Manager deep dives