AWS Systems Manager actions

This page provides a reference for AWS Systems Manager actions available in the workflow automation actions catalog. Use these actions to create, run, and manage AWS Systems Manager automation documents.

Prerequisites

Before using AWS actions in workflow automation, ensure you have:

An AWS account with appropriate permissions.
AWS credentials configured (IAM user credentials, IAM role ARN, or session credentials).
The necessary IAM permissions for the specific AWS services you plan to use.

See Set up AWS credentials for information on how to create IAM users and IAM roles, and set up static and session AWS credentials for integration with workflow automation AWS actions.

Create a document

The action identifier is aws.systemsManager.writeDocument.

Creates or updates an SSM document in your AWS account. See AWS Systems Manager documentation.

The following table describes the input fields for this action.

Input	Type	Description	Example
`awsRoleArn`	String	Optional. IAM role ARN to assume for AWS API calls.	`arn:aws:iam::123456789012:role/my-workflow-role`
`awsAccessKeyId`	String	Optional. AWS access key ID. Pass as a secret.	`${{ :secrets:awsAccessKeyId }}`
`awsSecretAccessKey`	String	Optional. AWS secret access key. Pass as a secret.	`${{ :secrets:awsSecretAccessKey }}`
`awsSessionToken`	String	Optional. Temporary session token for STS authentication. Pass as a secret.	`${{ :secrets:awsSessionToken }}`
`region`	String	Required. AWS region where the document will be created.	`us-east-2`
`documentName`	String	Required. Name for the SSM document.	`my-ssm-document`
`documentType`	String	Optional. Type of SSM document. Valid values are listed in the AWS Systems Manager API Reference.	`Command`
`documentFormat`	String	Optional. Format of the document content. Valid values: `JSON`, `YAML`, `TEXT`.	`YAML`
`documentContent`	String	Required. The SSM document content as a string.	See the example below.
`override`	Boolean	Optional. When `true` (default), overwrites an existing document with the same name. When `false`, returns an error if a document with that name already exists.	`true`
`selectors`	List	Optional. JQ selectors to extract specific fields from the action output.	`[{"name": "documentName", "expression": ".documentName"}]`

The following table describes the output fields for this action.

Output	Type	Example
`documentName`	String	`my-ssm-document`
`documentVersion`	String	`1`
`documentType`	String	`Command`
`documentStatus`	String	`Active`. The value will be one of the statuses from the AWS Systems Manager API Reference.
`success`	Boolean	`true`
`errorMessage`	String	`"Some error message from ssm"`

Example: List all Lambda functions

SSM document content:

schemaVersion: '0.3'
description: List all Lambda function names.
mainSteps:
  - name: ExecuteAwsApi
    action: aws:executeAwsApi
    isEnd: true
    inputs:
      Service: lambda
      Api: ListFunctions
    outputs:
      - Name: resultFunctionName
        Selector: $..FunctionName
        Type: StringList
outputs:
  - ExecuteAwsApi.resultFunctionName

Complete workflow using this document:

name: aws-api
workflowInputs:
  key:
    type: String
    defaultValue: "${{ :secrets:11933347:USERNAME_AWS_ACCESS_KEY_ID }}"
  access:
    type: String
    defaultValue: "${{ :secrets:11933347:USERNAME_AWS_SECRET_ACCESS_KEY }}"
  token:
    type: String
    defaultValue: "${{ :secrets:11933347:USERNAME_AWS_SESSION_TOKEN }}"
  region:
    type: String
    defaultValue: us-east-2
steps:
  - name: createSsmDocument
    type: action
    action: aws.systemsManager.writeDocument
    version: 1
    inputs:
      awsAccessKeyId: ${{ .workflowInputs.key }}
      awsSecretAccessKey: ${{ .workflowInputs.access }}
      awsSessionToken: ${{ .workflowInputs.token }}
      region: ${{ .workflowInputs.region }}
      documentName: "LambdaListFunctionNames"
      documentContent: |
        schemaVersion: '0.3'
        description: List all Lambda function names.
        mainSteps:
          - name: ExecuteAwsApi
            action: aws:executeAwsApi
            isEnd: true
            inputs:
              Service: lambda
              Api: ListFunctions
            outputs:
              - Name: resultFunctionName
                Selector: $..FunctionName
                Type: StringList
        outputs:
          - ExecuteAwsApi.resultFunctionName
  - name: start1
    type: action
    action: aws.systemsManager.startAutomation
    version: 1
    inputs:
      awsAccessKeyId: ${{ .workflowInputs.key }}
      awsSecretAccessKey: ${{ .workflowInputs.access }}
      awsSessionToken: ${{ .workflowInputs.token }}
      region: ${{ .workflowInputs.region }}
      documentName: "${{ .steps.createSsmDocument.outputs.documentName }}"

Delete a document

The action identifier is aws.systemsManager.deleteDocument.

Deletes an AWS SSM document from your account. See AWS Systems Manager documentation.

The following table describes the input fields for this action.

Input	Type	Description	Example
`awsRoleArn`	String	Optional. IAM role ARN to assume for AWS API calls.	`arn:aws:iam::123456789012:role/my-workflow-role`
`awsAccessKeyId`	String	Optional. AWS access key ID. Pass as a secret.	`${{ :secrets:awsAccessKeyId }}`
`awsSecretAccessKey`	String	Optional. AWS secret access key. Pass as a secret.	`${{ :secrets:awsSecretAccessKey }}`
`awsSessionToken`	String	Optional. Temporary session token for STS authentication. Pass as a secret.	`${{ :secrets:awsSessionToken }}`
`region`	String	Required. AWS region where the document is located.	`us-east-2`
`documentName`	String	Required. Name of the SSM document to delete.	`my-ssm-document`
`selectors`	List	Optional. JQ selectors to extract specific fields from the action output.	`[{"name": "success", "expression": ".success"}]`

The following table describes the output fields for this action.

Output	Type	Example
`documentName`	String	`my-ssm-document`
`success`	Boolean	`true`
`errorMessage`	String	`"Some error message from ssm"`

Start an automation

The action identifier is aws.systemsManager.startAutomation.

Starts an automation using an AWS SSM document. See AWS Systems Manager documentation.

The following table describes the input fields for this action.

Input	Type	Description	Example
`awsRoleArn`	String	Optional. IAM role ARN to assume for AWS API calls.	`arn:aws:iam::123456789012:role/my-workflow-role`
`awsAccessKeyId`	String	Optional. AWS access key ID. Pass as a secret.	`${{ :secrets:awsAccessKeyId }}`
`awsSecretAccessKey`	String	Optional. AWS secret access key. Pass as a secret.	`${{ :secrets:awsSecretAccessKey }}`
`awsSessionToken`	String	Optional. Temporary session token for STS authentication. Pass as a secret.	`${{ :secrets:awsSessionToken }}`
`region`	String	Required. AWS region where the SSM document is located.	`us-east-2`
`documentName`	String	Required. Name of the SSM document to execute.	`my-ssm-document`
`parameters`	Map	Optional. Key-value pairs to pass as parameters to the SSM document.	`{"myKey": "myValue"}`
`idempotencyToken`	UUID	Optional. Passed as the client token for idempotency when starting the automation.	`any-token`
`selectors`	List	Optional. JQ selectors to extract specific fields from the action output.	`[{"name": "automationExecutionId", "expression": ".automationExecutionId"}]`

The following table describes the output fields for this action.

Output	Type	Example
`automationExecutionId`	String	`3143a28d-241c-4abd-a3ca-9c0ff3890241`
`success`	Boolean	`true`
`errorMessage`	String	`"Some error message from ssm"`

Wait for automation status

The action identifier is aws.systemsManager.waitForAutomationStatus.

Polls an AWS SSM automation execution until it reaches one of the specified terminal statuses or the timeout expires. See AWS Systems Manager documentation.

The following table describes the input fields for this action.

Input	Type	Description	Example
`awsRoleArn`	String	Optional. IAM role ARN to assume for AWS API calls.	`arn:aws:iam::123456789012:role/my-workflow-role`
`awsAccessKeyId`	String	Optional. AWS access key ID. Pass as a secret.	`${{ :secrets:awsAccessKeyId }}`
`awsSecretAccessKey`	String	Optional. AWS secret access key. Pass as a secret.	`${{ :secrets:awsSecretAccessKey }}`
`awsSessionToken`	String	Optional. Temporary session token for STS authentication. Pass as a secret.	`${{ :secrets:awsSessionToken }}`
`region`	String	Required. AWS region where the automation execution is running.	`us-east-2`
`automationExecutionId`	String	Required. The execution ID to wait on.	`3143a28d-241c-4abd-a3ca-9c0ff3890241`
`automationExecutionStatuses`	List	Optional. List of AutomationExecution statuses that stop the wait. Default: `["Success", "Failed"]`.	`["Success", "Failed"]`
`timeout`	Int	Optional. Duration in seconds to wait. Default is `180`, maximum is `600`. If exceeded, returns `success: false` with `errorMessage: "Timeout waiting for automation status"`.	`180`
`selectors`	List	Optional. JQ selectors to extract specific fields from the action output.	`[{"name": "automationExecutionStatus", "expression": ".automationExecutionStatus"}]`

The following table describes the output fields for this action.

Output	Type	Example
`automationExecutionId`	String	`3143a28d-241c-4abd-a3ca-9c0ff3890241`
`automationExecutionStatus`	String	`Success`. One of the statuses passed in `automationExecutionStatuses`, or null if the action failed.
`automationExecutionOutputs`	Map	`{"ExecuteGetApiResources": {"resultResourceId": ["pky3cb"]}}`. Map of output values from the SSM document; use these in subsequent workflow steps.
`success`	Boolean	`true`
`errorMessage`	String	`"Some error message from ssm"`

Prerequisites.css-21sua1{background:none;border:none;width:0;padding:0;}

Create a document

Delete a document

Start an automation

Wait for automation status

Prerequisites