{"id":19407129,"url":"https://github.com/areguera/terraform-aws-ssm","last_synced_at":"2025-07-28T02:04:50.401Z","repository":{"id":38087194,"uuid":"495580017","full_name":"areguera/terraform-aws-ssm","owner":"areguera","description":"Terraform module to compose AWS Systems Manager (SSM) configurations","archived":false,"fork":false,"pushed_at":"2024-02-18T12:50:03.000Z","size":138,"stargazers_count":9,"open_issues_count":0,"forks_count":2,"subscribers_count":3,"default_branch":"main","last_synced_at":"2025-04-24T09:40:46.165Z","etag":null,"topics":["aws-ssm","patch-management","state-management","terraform-module"],"latest_commit_sha":null,"homepage":"https://registry.terraform.io/modules/areguera/ssm/aws/","language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/areguera.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-05-23T21:32:06.000Z","updated_at":"2024-06-07T19:56:44.000Z","dependencies_parsed_at":"2024-11-10T12:16:51.626Z","dependency_job_id":null,"html_url":"https://github.com/areguera/terraform-aws-ssm","commit_stats":null,"previous_names":[],"tags_count":5,"template":false,"template_full_name":null,"purl":"pkg:github/areguera/terraform-aws-ssm","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/areguera%2Fterraform-aws-ssm","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/areguera%2Fterraform-aws-ssm/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/areguera%2Fterraform-aws-ssm/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/areguera%2Fterraform-aws-ssm/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/areguera","download_url":"https://codeload.github.com/areguera/terraform-aws-ssm/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/areguera%2Fterraform-aws-ssm/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":267451489,"owners_count":24089312,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-07-28T02:00:09.689Z","response_time":68,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aws-ssm","patch-management","state-management","terraform-module"],"created_at":"2024-11-10T11:45:31.091Z","updated_at":"2025-07-28T02:04:50.371Z","avatar_url":"https://github.com/areguera.png","language":"HCL","funding_links":[],"categories":[],"sub_categories":[],"readme":"# terraform-aws-ssm\n\nTerraform module to compose [AWS Systems Manager (SSM)](https://docs.aws.amazon.com/systems-manager/latest/userguide/what-is-systems-manager.html) configurations.\n\n## Usage\n\n```hcl=\nmodule \"ssm\" {\n  source = \"areguera/ssm/aws\"\n\n  name = var.name\n\n  operating_system                     = \"AMAZON_LINUX_2\"\n  approved_patches_compliance_level    = \"CRITICAL\"\n  approved_patches_enable_non_security = false\n\n  approval_rules = [{\n    approve_after_days  = 7\n    compliance_level    = \"CRITICAL\"\n    enable_non_security = false\n    patch_filters = [\n      { key = \"PRODUCT\", values = [\"AmazonLinux2\"] },\n      { key = \"CLASSIFICATION\", values = [\"Security\", \"Bugfix\"] },\n      { key = \"SEVERITY\", values = [\"Critical\", \"Important\"] }\n    ]\n  }]\n\n  maintenance_window = {\n    enabled           = true\n    schedule          = \"cron(0 9 */7 * ?)\"\n    schedule_timezone = \"UTC\"\n    cutoff            = 0\n    duration          = 1\n  }\n}\n```\n\n## Patch baseline\n\nThis module creates one patch baseline named `${var.name}`. this patch baseline\napplies to all Amazon Linux 2 EC2 instances tagged with the `Patch Group` tag\nname and value `${var.name}`. These instances will approve all operating system\npatches that are classified as \"Security\" and have a severity level of\n\"Critical\" or \"Important\". Patches are auto-approved seven days after release.\nAlso approves all patches with a classification of \"Bugfix\" seven days after\nrelease.\n\n```\n       *       *       *       *       *\n       |       |       |       |       |\n------\u003e|------\u003e|------\u003e|------\u003e|------\u003e|\n       |       |       |       |       |\n       *       *       *       *       *\n```\n\nThis module configures the `${var.name}` patch baseline to reboot instances\nduring maintenance window automatically, if needed. To prevent down-time, you\nneed to design your infrastructure to keep your application up-and-running in\nspite of system reboots or unexpected application failures because of patching\nitself. For example, you could use the SSM configuration this module provides\nin combination with other AWS technologies like load balancer and auto-scaling\ngroups with the health checks enabled and properly configured on them.\n\nTo know more about patch baseline, see [AWS Systems Manager Patch Manager](https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-patch.html) documentation.\n\n## Maintenance window\n\nThis module creates a maintenance window that runs every seven days at 9 AM\nUTC. This maintenance window is configured with two tasks that run in order.\nThe first task installs new patches and reboots the target operating systems if\nneeded. The second task applies configuration playbooks on target operating\nsystem to grantee their desired state after patching. The second task also\nexecutes simple tests to validate the application is running as expected. In\ncase any of these two tasks fail, the maintenance window will fail and the\npatching action stops from being propagated to remaining target systems.\n\nThis module schedules the maintenance window to run every seven days at 9 A.M.\nThe schedule was set in alignment with the patch baseline approval time frame,\nwhich is also seven days. So, that's the moment in time when system patching\nwill happen.\n\nThis module only supports one maintenance window per module instantiation. To\ncreate more than one maintenance window for your infrastructure, create one\nunique configuration for each one of them. Avoid one unique configuration with\nseveral maintenance windows inside if possible. Having several configurations\nwith only one maintenance window allows you to manage different configurations\neasier. For example, in cases where each configuration represents a specific\nlevel of risk (e.g., dev, stage, prod).\n\nTo know more about maintenance window, see [AWS Systems Manager Maintenance Windows](https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-maintenance.html) documentation.\n\n## Associations\n\nThis module creates the following associations:\n\n\n| Name                                  | Recurrency | Description |\n| ------------------------------------- | ---------- | ----------- |\n| `${var.name}-UpdateSSMAgent`          | 14 days    | Update SSM agent when a new version is available. |\n| `${var.name}-ApplyAnsiblePlaybooks`   | 30 minutes | Apply ansible playbooks available in `${path.root}/ansible/` directory. |\n| `${var.name}-GatherSoftwareInventory` | 30 minutes | Collect system information. |\n| `${var.name}-RunPatchBaseline`        | 24 hours   | Applies the `${var.name}` patch baseline in Scan mode to identify available patching. |\n\nTo know more about associations, see [AWS System Manger State Manager](https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-patch.html) documentation.\n\n## Documents\n\nThis module creates the `${var.name}-ApplyAnsiblePlaybooks` document that you\ncan use to download ansible playbooks from a *private* S3 bucket and apply them\non SSM managed nodes. This document is a modified version of the\n`AWS-ApplyAnsiblePlaybooks` document, which doesn't support private\ncommunication with an S3 bucket.\n\nThe `${var.name}-ApplyAnsiblePlaybooks` document synchronizes the\n`${path.root}/ansible/` directory structure from S3 to\n`/opt/${var.name}-ssm/ansible` directory, locally, in the SSM managed node file\nsystem, where the associations or maintenance window tasks are configured to\nrun at. Finally, the document creates a list of all playbooks found in the\nfirst level of `/opt/${var.name}-ssm/ansible` directory, and executes them one\nby one, in alphabetic order, using the ansible-playbook command.\n\nTo know more about documents, see [AWS Systems Manager documents](https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-ssm-docs.html) documentation.\n\n## Desired state\n\nThis module implements the desired state of SSM managed nodes using the ansible\nplaybooks you provide in the `${path.root}/ansible/` directory. To apply these\nplaybooks on SSM managed nodes, the `terraform-aws-ssm` module deploys a\nprivate S3 bucket named `${var.name}-ssm`, uploads the `${path.root}/ansible/`\ndirectory up to it, and uses the `${var.name}-ApplyAnsiblePlaybooks` document\nto apply them, when it is executed from either associations or maintenance\nwindow tasks.\n\n## Examples\n\n* [Simple SSM configurations](https://github.com/areguera/terraform-aws-ssm/tree/main/examples/simple)\n\n## Requirements\n\n| Name | Version |\n|------|---------|\n| \u003ca name=\"requirement_aws\"\u003e\u003c/a\u003e [aws](#requirement\\_aws) | ~\u003e 4.0 |\n\n## Providers\n\n| Name | Version |\n|------|---------|\n| \u003ca name=\"provider_aws\"\u003e\u003c/a\u003e [aws](#provider\\_aws) | ~\u003e 4.0 |\n\n## Modules\n\n| Name | Source | Version |\n|------|--------|---------|\n| \u003ca name=\"module_s3_bucket\"\u003e\u003c/a\u003e [s3\\_bucket](#module\\_s3\\_bucket) | terraform-aws-modules/s3-bucket/aws | ~\u003e 3.0 |\n\n## Resources\n\n| Name | Type |\n|------|------|\n| [aws_cloudwatch_log_group.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group) | resource |\n| [aws_iam_instance_profile.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_instance_profile) | resource |\n| [aws_iam_policy.AmazonEC2SSMCloudwatch](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |\n| [aws_iam_policy.AmazonEC2SSMS3Logs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |\n| [aws_iam_policy.AmazonEC2SSMS3Playbooks](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |\n| [aws_iam_role.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |\n| [aws_iam_role_policy_attachment.AmazonEC2SSMCloudwatch](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |\n| [aws_iam_role_policy_attachment.AmazonEC2SSMS3Logs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |\n| [aws_iam_role_policy_attachment.AmazonEC2SSMS3Playbooks](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |\n| [aws_iam_role_policy_attachment.AmazonSSMManagedInstanceCore](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |\n| [aws_iam_role_policy_attachment.AmazonSSMPatchAssociation](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |\n| [aws_s3_object.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_object) | resource |\n| [aws_ssm_association.ApplyAnsiblePlaybooks](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssm_association) | resource |\n| [aws_ssm_association.GatherSoftwareInventory](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssm_association) | resource |\n| [aws_ssm_association.RunPatchBaseline](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssm_association) | resource |\n| [aws_ssm_association.UpdateSSMAgent](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssm_association) | resource |\n| [aws_ssm_document.ApplyAnsiblePlaybooks](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssm_document) | resource |\n| [aws_ssm_maintenance_window.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssm_maintenance_window) | resource |\n| [aws_ssm_maintenance_window_target.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssm_maintenance_window_target) | resource |\n| [aws_ssm_maintenance_window_task.ApplyAnsiblePlaybooks](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssm_maintenance_window_task) | resource |\n| [aws_ssm_maintenance_window_task.SystemPatches](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssm_maintenance_window_task) | resource |\n| [aws_ssm_patch_baseline.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssm_patch_baseline) | resource |\n| [aws_ssm_patch_group.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssm_patch_group) | resource |\n| [aws_iam_policy_document.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |\n| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |\n\n## Inputs\n\n| Name | Description | Type | Default | Required |\n|------|-------------|------|---------|:--------:|\n| \u003ca name=\"input_approval_rules\"\u003e\u003c/a\u003e [approval\\_rules](#input\\_approval\\_rules) | (Required) Specify the set of rules used to include patches in the baseline. Up to 10 approval rules can be specified. | \u003cpre\u003elist(object({\u003cbr\u003e    approve_after_days  = number\u003cbr\u003e    compliance_level    = string\u003cbr\u003e    enable_non_security = bool\u003cbr\u003e    patch_filters       = list(object({\u003cbr\u003e      key    = string\u003cbr\u003e      values = list(string)\u003cbr\u003e    }))\u003cbr\u003e  }))\u003c/pre\u003e | n/a | yes |\n| \u003ca name=\"input_approved_patches_compliance_level\"\u003e\u003c/a\u003e [approved\\_patches\\_compliance\\_level](#input\\_approved\\_patches\\_compliance\\_level) | (Optional) Defines the compliance level for approved patches. This means that if an approved patch is reported as missing, this is the severity of the compliance violation. Valid compliance levels include the following: CRITICAL, HIGH, MEDIUM, LOW, INFORMATIONAL, UNSPECIFIED. | `string` | `\"UNSPECIFIED\"` | no |\n| \u003ca name=\"input_approved_patches_enable_non_security\"\u003e\u003c/a\u003e [approved\\_patches\\_enable\\_non\\_security](#input\\_approved\\_patches\\_enable\\_non\\_security) | (Optional) Indicates whether the list of approved patches includes non-security updates that should be applied to the instances. | `bool` | `false` | no |\n| \u003ca name=\"input_description\"\u003e\u003c/a\u003e [description](#input\\_description) | (Optional) The project description. | `string` | `\"\"` | no |\n| \u003ca name=\"input_maintenance_window\"\u003e\u003c/a\u003e [maintenance\\_window](#input\\_maintenance\\_window) | (Required) Specify the set of rules used to configure the maintenance window. | \u003cpre\u003eobject({\u003cbr\u003e    schedule          = string\u003cbr\u003e    schedule_timezone = string\u003cbr\u003e    cutoff            = number\u003cbr\u003e    duration          = number\u003cbr\u003e    enabled           = bool\u003cbr\u003e  })\u003c/pre\u003e | n/a | yes |\n| \u003ca name=\"input_max_concurrency\"\u003e\u003c/a\u003e [max\\_concurrency](#input\\_max\\_concurrency) | (Optional) Specify the number of managed nodes that run a command simultaneously. Posible values can be integers (e.g., '5', '10') or percentages (e.g., '10%', '20%'). In both cases the values must be passed as string. | `string` | `\"10%\"` | no |\n| \u003ca name=\"input_max_errors\"\u003e\u003c/a\u003e [max\\_errors](#input\\_max\\_errors) | (Optional) Specify how many errors are allowed before the system stops sending the command to additional managed nodes. Posible values can be integers (e.g., '5', '10') or percentages (e.g., '10%', '20%'). In both cases the values must be passed as string. | `string` | `\"1\"` | no |\n| \u003ca name=\"input_name\"\u003e\u003c/a\u003e [name](#input\\_name) | (Required) The project name. This value is prefixed to SSM configuration resources. | `string` | n/a | yes |\n| \u003ca name=\"input_operating_system\"\u003e\u003c/a\u003e [operating\\_system](#input\\_operating\\_system) | (Optional) Defines the operating system the patch baseline applies to. Supported operating systems include AMAZON\\_LINUX\\_2. | `string` | `\"AMAZON_LINUX_2\"` | no |\n\n## Outputs\n\n| Name | Description |\n|------|-------------|\n| \u003ca name=\"output_iam_instantace_profile_name\"\u003e\u003c/a\u003e [iam\\_instantace\\_profile\\_name](#output\\_iam\\_instantace\\_profile\\_name) | n/a |\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fareguera%2Fterraform-aws-ssm","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fareguera%2Fterraform-aws-ssm","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fareguera%2Fterraform-aws-ssm/lists"}