--- title: AWS Systems Manager actions source: https://docs.newrelic.com/docs/workflow-automation/setup-and-configure/actions-catalog/aws/aws-systemsmanager --- This page provides a reference for AWS Systems Manager actions available in the workflow automation actions catalog. Use these actions to create, run, and manage AWS Systems Manager automation documents. ## Prerequisites Before using AWS actions in workflow automation, ensure you have: - An AWS account with appropriate permissions. - AWS credentials configured (IAM user credentials, IAM role ARN, or session credentials). - The necessary IAM permissions for the specific AWS services you plan to use. See [Set up AWS credentials](https://docs.newrelic.com/docs/workflow-automation/setup-and-configure/set-up-aws-credentials/) for information on how to create IAM users and IAM roles, and set up static and session AWS credentials for integration with workflow automation AWS actions. ## Create a document The action identifier is `aws.systemsManager.writeDocument`. Creates or updates an SSM document in your AWS account. See [AWS Systems Manager documentation](https://docs.aws.amazon.com/systems-manager/?id=docs_gateway). The following table describes the input fields for this action. | **Input** | **Type** | **Description** | **Example** | | -------------------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------- | | `awsRoleArn` | String | Optional. IAM role ARN to assume for AWS API calls. | `arn:aws:iam::123456789012:role/my-workflow-role` | | `awsAccessKeyId` | String | Optional. AWS access key ID. Pass as a secret. | `${{ :secrets:awsAccessKeyId }}` | | `awsSecretAccessKey` | String | Optional. AWS secret access key. Pass as a secret. | `${{ :secrets:awsSecretAccessKey }}` | | `awsSessionToken` | String | Optional. Temporary session token for STS authentication. Pass as a secret. | `${{ :secrets:awsSessionToken }}` | | `region` | String | Required. AWS region where the document will be created. | `us-east-2` | | `documentName` | String | Required. Name for the SSM document. | `my-ssm-document` | | `documentType` | String | Optional. Type of SSM document. Valid values are listed in the [AWS Systems Manager API Reference](https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DocumentDescription.html). | `Command` | | `documentFormat` | String | Optional. Format of the document content. Valid values: `JSON`, `YAML`, `TEXT`. | `YAML` | | `documentContent` | String | Required. The SSM document content as a string. | See the example below. | | `override` | Boolean | Optional. When `true` (default), overwrites an existing document with the same name. When `false`, returns an error if a document with that name already exists. | `true` | | `selectors` | List | Optional. JQ selectors to extract specific fields from the action output. | `[{"name": "documentName", "expression": ".documentName"}]` | The following table describes the output fields for this action. | **Output** | **Type** | **Example** | | ----------------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `documentName` | String | `my-ssm-document` | | `documentVersion` | String | `1` | | `documentType` | String | `Command` | | `documentStatus` | String | `Active`. The value will be one of the statuses from the [AWS Systems Manager API Reference](https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DocumentDescription.html). | | `success` | Boolean | `true` | | `errorMessage` | String | `"Some error message from ssm"` | **Example: List all Lambda functions** SSM document content: ```yaml schemaVersion: '0.3' description: List all Lambda function names. mainSteps: - name: ExecuteAwsApi action: aws:executeAwsApi isEnd: true inputs: Service: lambda Api: ListFunctions outputs: - Name: resultFunctionName Selector: $..FunctionName Type: StringList outputs: - ExecuteAwsApi.resultFunctionName ``` Complete workflow using this document: ```yaml name: aws-api workflowInputs: key: type: String defaultValue: "${{ :secrets:11933347:USERNAME_AWS_ACCESS_KEY_ID }}" access: type: String defaultValue: "${{ :secrets:11933347:USERNAME_AWS_SECRET_ACCESS_KEY }}" token: type: String defaultValue: "${{ :secrets:11933347:USERNAME_AWS_SESSION_TOKEN }}" region: type: String defaultValue: us-east-2 steps: - name: createSsmDocument type: action action: aws.systemsManager.writeDocument version: 1 inputs: awsAccessKeyId: ${{ .workflowInputs.key }} awsSecretAccessKey: ${{ .workflowInputs.access }} awsSessionToken: ${{ .workflowInputs.token }} region: ${{ .workflowInputs.region }} documentName: "LambdaListFunctionNames" documentContent: | schemaVersion: '0.3' description: List all Lambda function names. mainSteps: - name: ExecuteAwsApi action: aws:executeAwsApi isEnd: true inputs: Service: lambda Api: ListFunctions outputs: - Name: resultFunctionName Selector: $..FunctionName Type: StringList outputs: - ExecuteAwsApi.resultFunctionName - name: start1 type: action action: aws.systemsManager.startAutomation version: 1 inputs: awsAccessKeyId: ${{ .workflowInputs.key }} awsSecretAccessKey: ${{ .workflowInputs.access }} awsSessionToken: ${{ .workflowInputs.token }} region: ${{ .workflowInputs.region }} documentName: "${{ .steps.createSsmDocument.outputs.documentName }}" ``` ## Delete a document The action identifier is `aws.systemsManager.deleteDocument`. Deletes an AWS SSM document from your account. See [AWS Systems Manager documentation](https://docs.aws.amazon.com/systems-manager/latest/userguide/documents.html). The following table describes the input fields for this action. | **Input** | **Type** | **Description** | **Example** | | -------------------- | -------- | --------------------------------------------------------------------------- | ------------------------------------------------- | | `awsRoleArn` | String | Optional. IAM role ARN to assume for AWS API calls. | `arn:aws:iam::123456789012:role/my-workflow-role` | | `awsAccessKeyId` | String | Optional. AWS access key ID. Pass as a secret. | `${{ :secrets:awsAccessKeyId }}` | | `awsSecretAccessKey` | String | Optional. AWS secret access key. Pass as a secret. | `${{ :secrets:awsSecretAccessKey }}` | | `awsSessionToken` | String | Optional. Temporary session token for STS authentication. Pass as a secret. | `${{ :secrets:awsSessionToken }}` | | `region` | String | Required. AWS region where the document is located. | `us-east-2` | | `documentName` | String | Required. Name of the SSM document to delete. | `my-ssm-document` | | `selectors` | List | Optional. JQ selectors to extract specific fields from the action output. | `[{"name": "success", "expression": ".success"}]` | The following table describes the output fields for this action. | **Output** | **Type** | **Example** | | -------------- | -------- | ------------------------------- | | `documentName` | String | `my-ssm-document` | | `success` | Boolean | `true` | | `errorMessage` | String | `"Some error message from ssm"` | ## Start an automation The action identifier is `aws.systemsManager.startAutomation`. Starts an automation using an AWS SSM document. See [AWS Systems Manager documentation](https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_StartAutomationExecution.html). The following table describes the input fields for this action. | **Input** | **Type** | **Description** | **Example** | | -------------------- | -------- | ---------------------------------------------------------------------------------- | ----------------------------------------------------------------------------- | | `awsRoleArn` | String | Optional. IAM role ARN to assume for AWS API calls. | `arn:aws:iam::123456789012:role/my-workflow-role` | | `awsAccessKeyId` | String | Optional. AWS access key ID. Pass as a secret. | `${{ :secrets:awsAccessKeyId }}` | | `awsSecretAccessKey` | String | Optional. AWS secret access key. Pass as a secret. | `${{ :secrets:awsSecretAccessKey }}` | | `awsSessionToken` | String | Optional. Temporary session token for STS authentication. Pass as a secret. | `${{ :secrets:awsSessionToken }}` | | `region` | String | Required. AWS region where the SSM document is located. | `us-east-2` | | `documentName` | String | Required. Name of the SSM document to execute. | `my-ssm-document` | | `parameters` | Map | Optional. Key-value pairs to pass as parameters to the SSM document. | `{"myKey": "myValue"}` | | `idempotencyToken` | UUID | Optional. Passed as the client token for idempotency when starting the automation. | `any-token` | | `selectors` | List | Optional. JQ selectors to extract specific fields from the action output. | `[{"name": "automationExecutionId", "expression": ".automationExecutionId"}]` | The following table describes the output fields for this action. | **Output** | **Type** | **Example** | | ----------------------- | -------- | -------------------------------------- | | `automationExecutionId` | String | `3143a28d-241c-4abd-a3ca-9c0ff3890241` | | `success` | Boolean | `true` | | `errorMessage` | String | `"Some error message from ssm"` | ## Wait for automation status The action identifier is `aws.systemsManager.waitForAutomationStatus`. Polls an AWS SSM automation execution until it reaches one of the specified terminal statuses or the timeout expires. See [AWS Systems Manager documentation](https://docs.aws.amazon.com/systems-manager/?id=docs_gateway). The following table describes the input fields for this action. | **Input** | **Type** | **Description** | **Example** | | ----------------------------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------- | | `awsRoleArn` | String | Optional. IAM role ARN to assume for AWS API calls. | `arn:aws:iam::123456789012:role/my-workflow-role` | | `awsAccessKeyId` | String | Optional. AWS access key ID. Pass as a secret. | `${{ :secrets:awsAccessKeyId }}` | | `awsSecretAccessKey` | String | Optional. AWS secret access key. Pass as a secret. | `${{ :secrets:awsSecretAccessKey }}` | | `awsSessionToken` | String | Optional. Temporary session token for STS authentication. Pass as a secret. | `${{ :secrets:awsSessionToken }}` | | `region` | String | Required. AWS region where the automation execution is running. | `us-east-2` | | `automationExecutionId` | String | Required. The execution ID to wait on. | `3143a28d-241c-4abd-a3ca-9c0ff3890241` | | `automationExecutionStatuses` | List | Optional. List of [AutomationExecution statuses](https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_AutomationExecution.html#AutomationExecutionStatus) that stop the wait. Default: `["Success", "Failed"]`. | `["Success", "Failed"]` | | `timeout` | Int | Optional. Duration in seconds to wait. Default is `180`, maximum is `600`. If exceeded, returns `success: false` with `errorMessage: "Timeout waiting for automation status"`. | `180` | | `selectors` | List | Optional. JQ selectors to extract specific fields from the action output. | `[{"name": "automationExecutionStatus", "expression": ".automationExecutionStatus"}]` | The following table describes the output fields for this action. | **Output** | **Type** | **Example** | | ---------------------------- | -------- | --------------------------------------------------------------------------------------------------------------------------------------------------- | | `automationExecutionId` | String | `3143a28d-241c-4abd-a3ca-9c0ff3890241` | | `automationExecutionStatus` | String | `Success`. One of the statuses passed in `automationExecutionStatuses`, or null if the action failed. | | `automationExecutionOutputs` | Map | `{"ExecuteGetApiResources": {"resultResourceId": ["pky3cb"]}}`. Map of output values from the SSM document; use these in subsequent workflow steps. | | `success` | Boolean | `true` | | `errorMessage` | String | `"Some error message from ssm"` |