Aws/ssm

@swamp/aws/ssmv2026.06.16.1· 1d agoMODELS

01README

AWS SSM infrastructure models

02Release Notes

Updated: association

03Models9

@swamp/aws/ssm/associationv2026.06.16.1association.ts

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
AssociationName?	string	no	The name of the association.
CalendarNames?	array	no
ScheduleExpression?	string	no	A Cron or Rate expression that specifies when the association is applied to the target.
MaxErrors?	string	no
Parameters?	record	no	Parameter values that the SSM document uses at runtime.
InstanceId?	string	no	The ID of the instance that the SSM document is associated with.
AssociationDispatchAssumeRole?	string	no	A role used by association to take actions on your behalf.
WaitForSuccessTimeoutSeconds?	number	no
MaxConcurrency?	string	no
ComplianceSeverity?	enum	no
Targets?	array	no	The targets that the SSM document sends commands to.
SyncCompliance?	enum	no
OutputLocation?	object	no
ScheduleOffset?	number	no
Name	string	yes	The name of the SSM document.
ApplyOnlyAtCronInterval?	boolean	no
DocumentVersion?	string	no	The version of the SSM document to associate with the target.
AutomationTargetParameterName?	string	no
Tags?	array	no	A key-value pair to associate with a resource.

fn create()

Create a SSM Association

fn get(identifier: string)

Get a SSM Association

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the SSM Association

fn update()

Update a SSM Association

fn delete(identifier: string)

Delete a SSM Association

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the SSM Association

fn sync()

Sync SSM Association state from AWS

Resources

state(infinite)— SSM Association resource state

@swamp/aws/ssm/documentv2026.06.15.1document.ts

Global Arguments

Argument	Type	Required	Description
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
DocumentFormat?	enum	no	Specify the document format for the request. The document format can be either JSON or YAML. JSON is the default format.
Requires?	array	no	A list of SSM documents required by a document. For example, an ApplicationConfiguration document requires an ApplicationConfigurationSchema document.
Content	record	yes	The content for the Systems Manager document in JSON, YAML or String format.
TargetType?	string	no	Specify a target type to define the kinds of resources the document can run on.
DocumentType?	enum	no	The type of document to create.
VersionName?	string	no	An optional field specifying the version of the artifact you are creating with the document. This value is unique across all versions of a document, and cannot be changed.
UpdateMethod?	enum	no	Update method - when set to 'Replace', the update will replace the existing document; when set to 'NewVersion', the update will create a new version.
Attachments?	array	no	A list of key and value pairs that describe attachments to a version of a document.
Tags?	array	no	Optional metadata that you assign to a resource. Tags enable you to categorize a resource in different ways, such as by purpose, owner, or environment.
Name?	string	no	A name for the Systems Manager document.

fn create()

Create a SSM Document

fn get(identifier: string)

Get a SSM Document

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the SSM Document

fn update()

Update a SSM Document

fn delete(identifier: string)

Delete a SSM Document

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the SSM Document

fn sync()

Sync SSM Document state from AWS

Resources

state(infinite)— SSM Document resource state

@swamp/aws/ssm/maintenance-windowv2026.06.15.1maintenance_window.ts

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
StartDate?	string	no	The date and time, in ISO-8601 Extended format, for when the maintenance window is scheduled to become active. StartDate allows you to delay activation of the maintenance window until the specified future date.
Description?	string	no	A description of the maintenance window.
AllowUnassociatedTargets	boolean	yes	Enables a maintenance window task to run on managed instances, even if you have not registered those instances as targets. If enabled, then you must specify the unregistered instances (by instance ID) when you register a task with the maintenance window.
Cutoff	number	yes	The number of hours before the end of the maintenance window that AWS Systems Manager stops scheduling new tasks for execution.
Schedule	string	yes	The schedule of the maintenance window in the form of a cron or rate expression.
Duration	number	yes	The duration of the maintenance window in hours.
ScheduleOffset?	number	no	The number of days to wait to run a maintenance window after the scheduled cron expression date and time.
EndDate?	string	no	The date and time, in ISO-8601 Extended format, for when the maintenance window is scheduled to become inactive.
Tags?	array	no	Optional metadata that you assign to a resource in the form of an arbitrary set of tags (key-value pairs). Tags enable you to categorize a resource in different ways, such as by purpose, owner, or environment. For example, you might want to tag a maintenance window to identify the type of tasks it will run, the types of targets, and the environment it will run in.
Name	string	yes	The name of the maintenance window.
ScheduleTimezone?	string	no	The time zone that the scheduled maintenance window executions are based on, in Internet Assigned Numbers Authority (IANA) format.

fn create()

Create a SSM MaintenanceWindow

fn get(identifier: string)

Get a SSM MaintenanceWindow

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the SSM MaintenanceWindow

fn update()

Update a SSM MaintenanceWindow

fn delete(identifier: string)

Delete a SSM MaintenanceWindow

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the SSM MaintenanceWindow

fn sync()

Sync SSM MaintenanceWindow state from AWS

Resources

state(infinite)— SSM MaintenanceWindow resource state

@swamp/aws/ssm/maintenance-window-targetv2026.06.15.1maintenance_window_target.ts

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
OwnerInformation?	string	no	A user-provided value that will be included in any Amazon CloudWatch Events events that are raised while running tasks for these targets in this maintenance window.
Description?	string	no	A description for the target.
WindowId	string	yes	The ID of the maintenance window to register the target with.
ResourceType	string	yes	The type of target that is being registered with the maintenance window.
Targets	array	yes	The targets to register with the maintenance window.
Name?	string	no	The name for the maintenance window target.

fn create()

Create a SSM MaintenanceWindowTarget

fn get(identifier: string)

Get a SSM MaintenanceWindowTarget

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the SSM MaintenanceWindowTarget

fn update()

Update a SSM MaintenanceWindowTarget

fn delete(identifier: string)

Delete a SSM MaintenanceWindowTarget

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the SSM MaintenanceWindowTarget

fn sync()

Sync SSM MaintenanceWindowTarget state from AWS

Resources

state(infinite)— SSM MaintenanceWindowTarget resource state

@swamp/aws/ssm/maintenance-window-taskv2026.06.15.1maintenance_window_task.ts

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
MaxErrors?	string	no	The maximum number of errors allowed before this task stops being scheduled.
Description?	string	no	A description of the task.
ServiceRoleArn?	string	no	The Amazon Resource Name (ARN) of the IAM service role for AWS Systems Manager to assume when running a maintenance window task.
Priority	number	yes	The priority of the task in the maintenance window. The lower the number, the higher the priority. Tasks that have the same priority are scheduled in parallel.
MaxConcurrency?	string	no	The maximum number of targets this task can be run for, in parallel.
Targets?	array	no	The targets (either instances or window target ids).
Name?	string	no	The task name.
TaskArn	string	yes	The resource that the task uses during execution.
TaskInvocationParameters?	object	no	The parameters to pass to the task when it runs. Populate only the fields that match the task type. All other fields should be empty.
WindowId	string	yes	The ID of the maintenance window where the task is registered.
TaskParameters?	record	no	The parameters to pass to the task when it runs.
TaskType	string	yes	The type of task.
CutoffBehavior?	string	no	The specification for whether tasks should continue to run after the cutoff time specified in the maintenance windows is reached.
LoggingInfo?	object	no	Information about an Amazon S3 bucket to write Run Command task-level logs to.

fn create()

Create a SSM MaintenanceWindowTask

fn get(identifier: string)

Get a SSM MaintenanceWindowTask

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the SSM MaintenanceWindowTask

fn update()

Update a SSM MaintenanceWindowTask

fn delete(identifier: string)

Delete a SSM MaintenanceWindowTask

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the SSM MaintenanceWindowTask

fn sync()

Sync SSM MaintenanceWindowTask state from AWS

Resources

state(infinite)— SSM MaintenanceWindowTask resource state

@swamp/aws/ssm/parameterv2026.06.15.1parameter.ts

Global Arguments

Argument	Type	Required	Description
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
Type	enum	yes	The type of parameter. Parameters of type SecureString are not supported by CFNlong.
Value	string	yes	The parameter value. If type is StringList, the system returns a comma-separated string with no spaces between commas in the Value field.
Description?	string	no	Information about the parameter.
Policies?	string	no	Information about the policies assigned to a parameter. [Assigning parameter policies](https://docs.aws.amazon.com/systems-manager/latest/userguide/parameter-store-policies.html) in the User Guide.
AllowedPattern?	string	no	A regular expression used to validate the parameter value. For example, for String types with values restricted to numbers, you can specify the following: AllowedPattern=^\\d+$
Tier?	enum	no	The parameter tier.
Tags?	record	no	Optional metadata that you assign to a resource in the form of an arbitrary set of tags (key-value pairs). Tags enable you to categorize a resource in different ways, such as by purpose, owner, or environment. For example, you might want to tag a SYS parameter to identify the type of resource to which it applies, the environment, or the type of configuration data referenced by the parameter.
DataType?	enum	no	The data type of the parameter, such as text or aws:ec2:image. The default is text.
Name?	string	no	The name of the parameter. The reported maximum length of 2048 characters for a parameter name includes 1037 characters that are reserved for internal use by SYS. The maximum length for a parameter name that you specify is 1011 characters. This count of 1011 characters includes the characters in the ARN that precede the name you specify. This ARN length will vary depending on your partition and Region. For example, the following 45 characters count toward the 1011 character maximum for a paramet

fn create()

Create a SSM Parameter

fn get(identifier: string)

Get a SSM Parameter

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the SSM Parameter

fn update()

Update a SSM Parameter

fn delete(identifier: string)

Delete a SSM Parameter

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the SSM Parameter

fn sync()

Sync SSM Parameter state from AWS

Resources

state(infinite)— SSM Parameter resource state

@swamp/aws/ssm/patch-baselinev2026.06.15.1patch_baseline.ts

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
DefaultBaseline?	boolean	no	Set the baseline as default baseline. Only registering to default patch baseline is allowed.
OperatingSystem?	enum	no	Defines the operating system the patch baseline applies to. The Default value is WINDOWS.
Description?	string	no	The description of the patch baseline.
ApprovalRules?	object	no	A set of rules defining the approval rules for a patch baseline.
Sources?	array	no	Information about the patches to use to update the instances, including target operating systems and source repository. Applies to Linux instances only.
Name	string	yes	The name of the patch baseline.
RejectedPatches?	array	no	A list of explicitly rejected patches for the baseline.
ApprovedPatches?	array	no	A list of explicitly approved patches for the baseline.
RejectedPatchesAction?	enum	no	The action for Patch Manager to take on patches included in the RejectedPackages list.
PatchGroups?	array	no	PatchGroups is used to associate instances with a specific patch baseline
ApprovedPatchesComplianceLevel?	enum	no	Defines the compliance level for approved patches. This means that if an approved patch is reported as missing, this is the severity of the compliance violation. The default value is UNSPECIFIED.
ApprovedPatchesEnableNonSecurity?	boolean	no	Indicates whether the list of approved patches includes non-security updates that should be applied to the instances. The default value is 'false'. Applies to Linux instances only.
GlobalFilters?	object	no	A set of global filters used to include patches in the baseline.
AvailableSecurityUpdatesComplianceStatus?	enum	no	The compliance status for vendor recommended security updates that are not approved by this patch baseline.
Tags?	array	no	Optional metadata that you assign to a resource. Tags enable you to categorize a resource in different ways.

fn create()

Create a SSM PatchBaseline

fn get(identifier: string)

Get a SSM PatchBaseline

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the SSM PatchBaseline

fn update()

Update a SSM PatchBaseline

fn delete(identifier: string)

Delete a SSM PatchBaseline

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the SSM PatchBaseline

fn sync()

Sync SSM PatchBaseline state from AWS

Resources

state(infinite)— SSM PatchBaseline resource state

@swamp/aws/ssm/resource-data-syncv2026.06.15.1resource_data_sync.ts

Global Arguments

Argument	Type	Required	Description
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
S3Destination?	object	no
KMSKeyArn?	string	no
SyncSource?	object	no
BucketName?	string	no
BucketRegion?	string	no
SyncFormat?	string	no
SyncName	string	yes
SyncType?	string	no
BucketPrefix?	string	no

fn create()

Create a SSM ResourceDataSync

fn get(identifier: string)

Get a SSM ResourceDataSync

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the SSM ResourceDataSync

fn update()

Update a SSM ResourceDataSync

fn delete(identifier: string)

Delete a SSM ResourceDataSync

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the SSM ResourceDataSync

fn sync()

Sync SSM ResourceDataSync state from AWS

Resources

state(infinite)— SSM ResourceDataSync resource state

@swamp/aws/ssm/resource-policyv2026.06.15.1resource_policy.ts

Global Arguments

Argument	Type	Required	Description
name	string	yes	Instance name for this resource (used as the unique identifier in the factory pattern)
accessKeyId?	string	no	AWS access key ID; overrides AWS_ACCESS_KEY_ID environment variable. Wire with a vault.get(...) expression to source it from a vault.
secretAccessKey?	string	no	AWS secret access key; overrides AWS_SECRET_ACCESS_KEY environment variable. Wire with a vault.get(...) expression to source it from a vault.
sessionToken?	string	no	AWS session token for temporary credentials; overrides AWS_SESSION_TOKEN environment variable. Wire with a vault.get(...) expression to source it from a vault.
region?	string	no	AWS region; overrides AWS_REGION / AWS_DEFAULT_REGION environment variables and ~/.aws/config profile region. Defaults to us-east-1.
ResourceArn	string	yes	Arn of OpsItemGroup etc.
Policy	record	yes	Actual policy statement.

fn create()

Create a SSM ResourcePolicy

fn get(identifier: string)

Get a SSM ResourcePolicy

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the SSM ResourcePolicy

fn update()

Update a SSM ResourcePolicy

fn delete(identifier: string)

Delete a SSM ResourcePolicy

Argument	Type	Required	Description
identifier	string	yes	The primary identifier of the SSM ResourcePolicy

fn sync()

Sync SSM ResourcePolicy state from AWS

Resources

state(infinite)— SSM ResourcePolicy resource state

04Previous Versions11

2026.06.15.1Jun 15, 2026

Updated: association, document, maintenance_window, maintenance_window_target, maintenance_window_task, parameter, patch_baseline, resource_data_sync, resource_policy

2026.06.08.2Jun 8, 2026

Updated: association, document, maintenance_window, maintenance_window_target, maintenance_window_task, parameter, patch_baseline, resource_data_sync, resource_policy

2026.06.06.1Jun 6, 2026

Updated: association, document, maintenance_window, maintenance_window_target, maintenance_window_task, parameter, patch_baseline, resource_data_sync, resource_policy

2026.05.27.1May 27, 2026

Updated: document, maintenance_window_task, resource_policy

2026.05.19.1May 18, 2026

2026.04.23.3Apr 23, 2026

2026.04.23.2Apr 23, 2026

Updated: association, document, maintenance_window, maintenance_window_target, maintenance_window_task, parameter, patch_baseline, resource_data_sync, resource_policy

2026.04.03.2Apr 3, 2026

Updated: association, document, maintenance_window, maintenance_window_target, maintenance_window_task, parameter, patch_baseline, resource_data_sync, resource_policy

2026.03.19.1Mar 19, 2026

Updated: association, document, maintenance_window, maintenance_window_target, maintenance_window_task, parameter, patch_baseline, resource_data_sync, resource_policy

2026.03.16.1Mar 16, 2026

Updated: association, document, maintenance_window, maintenance_window_target, maintenance_window_task, parameter, patch_baseline, resource_data_sync, resource_policy

2026.03.10.5Mar 10, 2026

05Stats

85 / 100

Downloads

Archive size

2.1 MB

Verified by Swamp

Has README or module doc2/2earned
README has a code example1/1earned
README is substantive1/1earned
Most symbols documented1/1earned
No slow types (deprecated)1/1earned
Dependencies pass trust audit0/2missing
Has description1/1earned
Platform support declared (or universal)2/2earned
License declared1/1earned
Verified public repository2/2earned

Repository

https://github.com/swamp-club/swamp-extensions

06Platforms

linux · x86_64 linux · aarch64 macOS · x86_64 macOS · aarch64

07Labels

#aws #ssm #cloud #infrastructure