Systems Manager

12 resource kinds. Generated from the operator's CRD schemas.

API Group: aws.konfig.io/v1alpha1

SSMAssociation # GA

SSMAssociation is the Schema for managing SSM State Manager associations.

kubectl get ssmassociations · example on GitHub

Example

# SSMAssociation — Systems Manager
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ssm.html#ssmassociation
apiVersion: aws.konfig.io/v1alpha1
kind: SSMAssociation
metadata:
  name: example-ssmassociation
  namespace: default
spec:
  associationName: example-ssmassociation
  documentRef:
    documentName: example-ssmassociation
    name: example-ssmassociation
  name: example-ssmassociation
  parameters: {}
  providerRef:
    name: example-ssmassociation
    region: us-east-1
  scheduleExpression: example
  targets:
  - key: example
    values:
    - example

Spec

FieldTypeRequiredDescription
associationNamestring—AssociationName is a human-readable name for the association.
documentRefobject—DocumentRef references the SSM document to associate.
documentRef.documentNamestring—DocumentName is a direct SSM document name (e.g.
documentRef.namestring—Name of an SSMDocument CR in the same namespace.
namestring—Name is a direct SSM document name to associate.
parametersmap<string>—Parameters passed to the document.
providerRefobject—ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
providerRef.namestringyesName of a cluster-scoped AWSProvider.
providerRef.regionstring—Region overrides the provider's region for this resource only.
scheduleExpressionstring—ScheduleExpression is a cron or rate expression for re-application.
targetsarray<object>—Targets select the managed nodes.
targets[].keystringyesKey is the target key, e.g.
targets[].valuesarray<string>yesValues for the target key.

Status

FieldTypeRequiredDescription
associationIdstring—AssociationID is the AWS association ID.
awsProviderobject—AWSProvider confirms the account and region this resource was reconciled against.
awsProvider.accountIdstring—AccountID the resource lives in.
awsProvider.namestring—Name of the AWSProvider used; empty when the operator's own credentials were used.
awsProvider.regionstring—Region the resource lives in (empty for global services).
conditionsarray<object>—Conditions describe the current state of the resource.
conditions[].lastTransitionTimestringyeslastTransitionTime is the last time the condition transitioned from one status to another.
conditions[].messagestringyesmessage is a human readable message indicating details about the transition.
conditions[].observedGenerationinteger—observedGeneration represents the .metadata.generation that the condition was set based upon.
conditions[].reasonstringyesreason contains a programmatic identifier indicating the reason for the condition's last transition.
conditions[].statusenumyesstatus of the condition, one of True, False, Unknown. Allowed: True, False, Unknown
conditions[].typestringyestype of condition in CamelCase or in foo.example.com/CamelCase.
lastSyncTimestring—LastSyncTime is when the resource was last successfully reconciled.
observedGenerationinteger—ObservedGeneration is the most recent .metadata.generation reconciled.

SSMCloudConnector # CLOUD CONTROL · AWS::SSM::CloudConnector

SSMCloudConnector manages AWS::SSM::CloudConnector through the AWS Cloud Control API.

kubectl get ssmcloudconnectors · example on GitHub

Example

# SSMCloudConnector — Systems Manager
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ssm.html#ssmcloudconnector
apiVersion: aws.konfig.io/v1alpha1
kind: SSMCloudConnector
metadata:
  name: example-ssmcloudconnector
  namespace: default
spec:
  configConnectorArn: arn:aws:iam::123456789012:role/example-role
  configuration:
    azureConfiguration:
      applicationDisplayName: example-ssmcloudconnector
      applicationId: example-id
      targets:
        subscriptions:
        - displayName: example-ssmcloudconnector
          id: example-id
      tenantDisplayName: example-ssmcloudconnector
      tenantId: example-id
  description: Managed by konfig-konector
  displayName: example-ssmcloudconnector
  providerRef:
    name: example-ssmcloudconnector
    region: us-east-1
  roleArn: arn:aws:iam::123456789012:role/example-role
  tags:
  - key: example
    value: example

Spec

FieldTypeRequiredDescription
configConnectorArnstringyesThe ARN of the AWS Config connector.
configurationobjectyesThe configuration for the cloud connector.
configuration.azureConfigurationobjectyesSSMCloudConnectorAzureConfiguration is a nested property type of AWS::SSM::CloudConnector.
configuration.azureConfiguration.applicationDisplayNamestring—The display name of the Azure AD application.
configuration.azureConfiguration.applicationIdstringyesThe Azure AD application ID.
configuration.azureConfiguration.targetsobject—SSMCloudConnectorConfigurationTargets is a nested property type of AWS::SSM::CloudConnector.
configuration.azureConfiguration.targets.subscriptionsarray<object>yesList of Azure subscriptions.
configuration.azureConfiguration.targets.subscriptions[].displayNamestring—The display name of the Azure subscription.
configuration.azureConfiguration.targets.subscriptions[].idstringyesThe Azure subscription ID.
configuration.azureConfiguration.tenantDisplayNamestring—The display name of the Azure AD tenant.
configuration.azureConfiguration.tenantIdstringyesThe Azure AD tenant ID.
descriptionstring—The description of the cloud connector.
displayNamestringyesThe display name of the cloud connector.
providerRefobject—ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
providerRef.namestringyesName of a cluster-scoped AWSProvider.
providerRef.regionstring—Region overrides the provider's region for this resource only.
roleArnstringyesThe IAM role ARN used by the cloud connector.
tagsarray<object>—Tags to apply to the cloud connector.
tags[].keystringyes
tags[].valuestringyes

Status

FieldTypeRequiredDescription
attemptinteger—Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
awsProviderobject—AWSProvider confirms the account and region this resource was reconciled against.
awsProvider.accountIdstring—AccountID the resource lives in.
awsProvider.namestring—Name of the AWSProvider used; empty when the operator's own credentials were used.
awsProvider.regionstring—Region the resource lives in (empty for global services).
cloudConnectorArnstring—The ARN of the cloud connector.
cloudConnectorIdstring—The unique identifier of the cloud connector.
conditionsarray<object>—Conditions describe the current state of the resource.
conditions[].lastTransitionTimestringyeslastTransitionTime is the last time the condition transitioned from one status to another.
conditions[].messagestringyesmessage is a human readable message indicating details about the transition.
conditions[].observedGenerationinteger—observedGeneration represents the .metadata.generation that the condition was set based upon.
conditions[].reasonstringyesreason contains a programmatic identifier indicating the reason for the condition's last transition.
conditions[].statusenumyesstatus of the condition, one of True, False, Unknown. Allowed: True, False, Unknown
conditions[].typestringyestype of condition in CamelCase or in foo.example.com/CamelCase.
createdAtstring—The timestamp when the cloud connector was created.
identifierstring—Identifier is the Cloud Control primary identifier of the resource.
lastSyncTimestring—
observedGenerationinteger—
operationstring—Operation is the in-flight operation (CREATE, UPDATE, DELETE).
operationStatusstring—OperationStatus is the last reported operation status.
requestTokenstring—RequestToken tracks an in-flight asynchronous operation.
updatedAtstring—The timestamp when the cloud connector was last updated.

SSMDocument # GA

SSMDocument is the Schema for managing SSM documents.

kubectl get ssmdocuments · example on GitHub

Example

# SSMDocument — Systems Manager
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ssm.html#ssmdocument
apiVersion: aws.konfig.io/v1alpha1
kind: SSMDocument
metadata:
  name: example-ssmdocument
  namespace: default
spec:
  content: example
  documentFormat: JSON
  documentType: Command
  name: example-ssmdocument
  providerRef:
    name: example-ssmdocument
    region: us-east-1
  tags:
    environment: dev
    team: platform
  versionName: example-ssmdocument

Spec

FieldTypeRequiredDescription
contentstringyesContent is the document content in JSON or YAML format.
documentFormatenum—DocumentFormat is the format of the document (JSON or YAML). Allowed: JSON, YAML, TEXT
documentTypeenum—DocumentType is the type of the document. Allowed: Command, Policy, Automation, Session, Package, ApplicationConfiguration, ApplicationConfigurationSchema, DeploymentStrategy…
namestringyesName is the name of the SSM document.
providerRefobject—ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
providerRef.namestringyesName of a cluster-scoped AWSProvider.
providerRef.regionstring—Region overrides the provider's region for this resource only.
tagsmap<string>—Tags are metadata tags for the document.
versionNamestring—VersionName is an optional version identifier.

Status

FieldTypeRequiredDescription
awsProviderobject—AWSProvider confirms the account and region this resource was reconciled against.
awsProvider.accountIdstring—AccountID the resource lives in.
awsProvider.namestring—Name of the AWSProvider used; empty when the operator's own credentials were used.
awsProvider.regionstring—Region the resource lives in (empty for global services).
conditionsarray<object>—Conditions describe the current state of the resource.
conditions[].lastTransitionTimestringyeslastTransitionTime is the last time the condition transitioned from one status to another.
conditions[].messagestringyesmessage is a human readable message indicating details about the transition.
conditions[].observedGenerationinteger—observedGeneration represents the .metadata.generation that the condition was set based upon.
conditions[].reasonstringyesreason contains a programmatic identifier indicating the reason for the condition's last transition.
conditions[].statusenumyesstatus of the condition, one of True, False, Unknown. Allowed: True, False, Unknown
conditions[].typestringyestype of condition in CamelCase or in foo.example.com/CamelCase.
documentVersionstring—DocumentVersion is the current version of the document.
lastSyncTimestring—LastSyncTime is when the resource was last successfully reconciled.
observedGenerationinteger—ObservedGeneration is the most recent .metadata.generation reconciled.
statusstring—Status is the current status of the document.

SSMMaintenanceWindow # GA

SSMMaintenanceWindow is the Schema for managing SSM maintenance windows.

kubectl get ssmmaintenancewindows · example on GitHub

Example

# SSMMaintenanceWindow — Systems Manager
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ssm.html#ssmmaintenancewindow
apiVersion: aws.konfig.io/v1alpha1
kind: SSMMaintenanceWindow
metadata:
  name: example-ssmmaintenancewindow
  namespace: default
spec:
  allowUnassociatedTargets: false
  cutoff: 1
  description: Managed by konfig-konector
  duration: 1
  name: example-ssmmaintenancewindow
  providerRef:
    name: example-ssmmaintenancewindow
    region: us-east-1
  schedule: example
  tags:
    environment: dev
    team: platform
  timezone: example

Spec

FieldTypeRequiredDescription
allowUnassociatedTargetsboolean—AllowUnassociatedTargets permits running tasks on targets not registered with the window.
cutoffintegeryesCutoff is the number of hours before the end of the window that new tasks stop being scheduled.
descriptionstring—Description of the maintenance window.
durationintegeryesDuration of the maintenance window in hours.
namestringyesName is the name of the maintenance window.
providerRefobject—ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
providerRef.namestringyesName of a cluster-scoped AWSProvider.
providerRef.regionstring—Region overrides the provider's region for this resource only.
schedulestringyesSchedule is a cron or rate expression, e.g.
tagsmap<string>—Tags are AWS resource tags to apply on creation.
timezonestring—Timezone in IANA format, e.g.

Status

FieldTypeRequiredDescription
awsProviderobject—AWSProvider confirms the account and region this resource was reconciled against.
awsProvider.accountIdstring—AccountID the resource lives in.
awsProvider.namestring—Name of the AWSProvider used; empty when the operator's own credentials were used.
awsProvider.regionstring—Region the resource lives in (empty for global services).
conditionsarray<object>—Conditions describe the current state of the resource.
conditions[].lastTransitionTimestringyeslastTransitionTime is the last time the condition transitioned from one status to another.
conditions[].messagestringyesmessage is a human readable message indicating details about the transition.
conditions[].observedGenerationinteger—observedGeneration represents the .metadata.generation that the condition was set based upon.
conditions[].reasonstringyesreason contains a programmatic identifier indicating the reason for the condition's last transition.
conditions[].statusenumyesstatus of the condition, one of True, False, Unknown. Allowed: True, False, Unknown
conditions[].typestringyestype of condition in CamelCase or in foo.example.com/CamelCase.
lastSyncTimestring—LastSyncTime is when the resource was last successfully reconciled.
observedGenerationinteger—ObservedGeneration is the most recent .metadata.generation reconciled.
windowIdstring—WindowID is the AWS maintenance window ID (mw-...).

SSMMaintenanceWindowTarget # CLOUD CONTROL · AWS::SSM::MaintenanceWindowTarget

SSMMaintenanceWindowTarget manages AWS::SSM::MaintenanceWindowTarget through the AWS Cloud Control API.

kubectl get ssmmaintenancewindowtargets · example on GitHub

Example

# SSMMaintenanceWindowTarget — Systems Manager
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ssm.html#ssmmaintenancewindowtarget
apiVersion: aws.konfig.io/v1alpha1
kind: SSMMaintenanceWindowTarget
metadata:
  name: example-ssmmaintenancewindowtarget
  namespace: default
spec:
  description: Managed by konfig-konector
  name: example-ssmmaintenancewindowtarget
  ownerInformation: example
  providerRef:
    name: example-ssmmaintenancewindowtarget
    region: us-east-1
  resourceType: example
  targets:
  - key: example
    values:
    - example
  windowId: example-id

Spec

FieldTypeRequiredDescription
descriptionstring—A description for the target.
namestring—The name for the maintenance window target.
ownerInformationstring—A user-provided value that will be included in any Amazon CloudWatch Events events that are raised while running tasks for these targets in this maintenance window.
providerRefobject—ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
providerRef.namestringyesName of a cluster-scoped AWSProvider.
providerRef.regionstring—Region overrides the provider's region for this resource only.
resourceTypestringyesThe type of target that is being registered with the maintenance window.
targetsarray<object>yesThe targets to register with the maintenance window.
targets[].keystringyesUser-defined criteria for sending commands that target managed nodes that meet the criteria.
targets[].valuesarray<string>yesUser-defined criteria that maps to Key.
windowIdstringyesThe ID of the maintenance window to register the target with.

Status

FieldTypeRequiredDescription
attemptinteger—Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
awsProviderobject—AWSProvider confirms the account and region this resource was reconciled against.
awsProvider.accountIdstring—AccountID the resource lives in.
awsProvider.namestring—Name of the AWSProvider used; empty when the operator's own credentials were used.
awsProvider.regionstring—Region the resource lives in (empty for global services).
conditionsarray<object>—Conditions describe the current state of the resource.
conditions[].lastTransitionTimestringyeslastTransitionTime is the last time the condition transitioned from one status to another.
conditions[].messagestringyesmessage is a human readable message indicating details about the transition.
conditions[].observedGenerationinteger—observedGeneration represents the .metadata.generation that the condition was set based upon.
conditions[].reasonstringyesreason contains a programmatic identifier indicating the reason for the condition's last transition.
conditions[].statusenumyesstatus of the condition, one of True, False, Unknown. Allowed: True, False, Unknown
conditions[].typestringyestype of condition in CamelCase or in foo.example.com/CamelCase.
identifierstring—Identifier is the Cloud Control primary identifier of the resource.
lastSyncTimestring—
observedGenerationinteger—
operationstring—Operation is the in-flight operation (CREATE, UPDATE, DELETE).
operationStatusstring—OperationStatus is the last reported operation status.
requestTokenstring—RequestToken tracks an in-flight asynchronous operation.
windowTargetIdstring—The ID of the target.

SSMMaintenanceWindowTask # CLOUD CONTROL · AWS::SSM::MaintenanceWindowTask

SSMMaintenanceWindowTask manages AWS::SSM::MaintenanceWindowTask through the AWS Cloud Control API.

kubectl get ssmmaintenancewindowtasks · example on GitHub

Example

# SSMMaintenanceWindowTask — Systems Manager
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ssm.html#ssmmaintenancewindowtask
apiVersion: aws.konfig.io/v1alpha1
kind: SSMMaintenanceWindowTask
metadata:
  name: example-ssmmaintenancewindowtask
  namespace: default
spec:
  cutoffBehavior: example
  description: Managed by konfig-konector
  loggingInfo:
    region: us-east-1
    s3Bucket: example
    s3Prefix: example
  maxConcurrency: example
  maxErrors: example
  name: example-ssmmaintenancewindowtask
  priority: 1
  providerRef:
    name: example-ssmmaintenancewindowtask
    region: us-east-1
  serviceRoleArn: arn:aws:iam::123456789012:role/example-role
  targets:
  - key: example
    values:
    - example
  taskArn: arn:aws:iam::123456789012:role/example-role
  taskInvocationParameters:
    maintenanceWindowAutomationParameters:
      documentVersion: '1.0'
    maintenanceWindowLambdaParameters:
      clientContext: example
      payload: example
      qualifier: example
    maintenanceWindowRunCommandParameters:
      cloudWatchOutputConfig:
        cloudWatchLogGroupName: example-ssmmaintenancewindowtask
        cloudWatchOutputEnabled: true
      comment: Managed by konfig-konector
      documentHash: example
      documentHashType: example
      documentVersion: '1.0'
      notificationConfig:
        notificationArn: arn:aws:iam::123456789012:role/example-role
        notificationEvents:
        - example
        notificationType: example
      outputS3BucketName: example-ssmmaintenancewindowtask
      outputS3KeyPrefix: example
      serviceRoleArn: arn:aws:iam::123456789012:role/example-role
      timeoutSeconds: 300
    maintenanceWindowStepFunctionsParameters:
      input: example
      name: example-ssmmaintenancewindowtask
  taskType: example
  windowId: example-id

Spec

FieldTypeRequiredDescription
cutoffBehaviorstring—The specification for whether tasks should continue to run after the cutoff time specified in the maintenance windows is reached.
descriptionstring—A description of the task.
loggingInfoobject—Information about an Amazon S3 bucket to write Run Command task-level logs to.
loggingInfo.regionstringyes
loggingInfo.s3Bucketstringyes
loggingInfo.s3Prefixstring—
maxConcurrencystring—The maximum number of targets this task can be run for, in parallel.
maxErrorsstring—The maximum number of errors allowed before this task stops being scheduled.
namestring—The task name.
priorityintegeryesThe priority of the task in the maintenance window.
providerRefobject—ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
providerRef.namestringyesName of a cluster-scoped AWSProvider.
providerRef.regionstring—Region overrides the provider's region for this resource only.
serviceRoleArnstring—The Amazon Resource Name (ARN) of the IAM service role for AWS Systems Manager to assume when running a maintenance window task.
targetsarray<object>—The targets (either instances or window target ids).
targets[].keystringyes
targets[].valuesarray<string>yes
taskArnstringyesThe resource that the task uses during execution.
taskInvocationParametersobject—The parameters to pass to the task when it runs.
taskInvocationParameters.maintenanceWindowAutomationParametersobject—SSMMaintenanceWindowTaskMaintenanceWindowAutomationParameters is a nested property type of AWS::SSM::MaintenanceWindowTask.
taskInvocationParameters.maintenanceWindowAutomationParameters.documentVersionstring—
taskInvocationParameters.maintenanceWindowAutomationParameters.parametersobject—
taskInvocationParameters.maintenanceWindowLambdaParametersobject—SSMMaintenanceWindowTaskMaintenanceWindowLambdaParameters is a nested property type of AWS::SSM::MaintenanceWindowTask.
taskInvocationParameters.maintenanceWindowLambdaParameters.clientContextstring—
taskInvocationParameters.maintenanceWindowLambdaParameters.payloadstring—
taskInvocationParameters.maintenanceWindowLambdaParameters.qualifierstring—
taskInvocationParameters.maintenanceWindowRunCommandParametersobject—SSMMaintenanceWindowTaskMaintenanceWindowRunCommandParameters is a nested property type of AWS::SSM::MaintenanceWindowTask.
taskInvocationParameters.maintenanceWindowRunCommandParameters.cloudWatchOutputConfigobject—SSMMaintenanceWindowTaskCloudWatchOutputConfig is a nested property type of AWS::SSM::MaintenanceWindowTask.
taskInvocationParameters.maintenanceWindowRunCommandParameters.cloudWatchOutputConfig.cloudWatchLogGroupNamestring—The name of the CloudWatch log group where you want to send command output.
taskInvocationParameters.maintenanceWindowRunCommandParameters.cloudWatchOutputConfig.cloudWatchOutputEnabledboolean—Enables Systems Manager to send command output to CloudWatch Logs.
taskInvocationParameters.maintenanceWindowRunCommandParameters.commentstring—
taskInvocationParameters.maintenanceWindowRunCommandParameters.documentHashstring—
taskInvocationParameters.maintenanceWindowRunCommandParameters.documentHashTypestring—
taskInvocationParameters.maintenanceWindowRunCommandParameters.documentVersionstring—
taskInvocationParameters.maintenanceWindowRunCommandParameters.notificationConfigobject—SSMMaintenanceWindowTaskNotificationConfig is a nested property type of AWS::SSM::MaintenanceWindowTask.
taskInvocationParameters.maintenanceWindowRunCommandParameters.notificationConfig.notificationArnstringyes
taskInvocationParameters.maintenanceWindowRunCommandParameters.notificationConfig.notificationEventsarray<string>—
taskInvocationParameters.maintenanceWindowRunCommandParameters.notificationConfig.notificationTypestring—
taskInvocationParameters.maintenanceWindowRunCommandParameters.outputS3BucketNamestring—
taskInvocationParameters.maintenanceWindowRunCommandParameters.outputS3KeyPrefixstring—
taskInvocationParameters.maintenanceWindowRunCommandParameters.parametersobject—
taskInvocationParameters.maintenanceWindowRunCommandParameters.serviceRoleArnstring—
taskInvocationParameters.maintenanceWindowRunCommandParameters.timeoutSecondsinteger—
taskInvocationParameters.maintenanceWindowStepFunctionsParametersobject—SSMMaintenanceWindowTaskMaintenanceWindowStepFunctionsParameters is a nested property type of AWS::SSM::MaintenanceWindowTask.
taskInvocationParameters.maintenanceWindowStepFunctionsParameters.inputstring—
taskInvocationParameters.maintenanceWindowStepFunctionsParameters.namestring—
taskParametersobject—The parameters to pass to the task when it runs.
taskTypestringyesThe type of task.
windowIdstringyesThe ID of the maintenance window where the task is registered.

Status

FieldTypeRequiredDescription
attemptinteger—Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
awsProviderobject—AWSProvider confirms the account and region this resource was reconciled against.
awsProvider.accountIdstring—AccountID the resource lives in.
awsProvider.namestring—Name of the AWSProvider used; empty when the operator's own credentials were used.
awsProvider.regionstring—Region the resource lives in (empty for global services).
conditionsarray<object>—Conditions describe the current state of the resource.
conditions[].lastTransitionTimestringyeslastTransitionTime is the last time the condition transitioned from one status to another.
conditions[].messagestringyesmessage is a human readable message indicating details about the transition.
conditions[].observedGenerationinteger—observedGeneration represents the .metadata.generation that the condition was set based upon.
conditions[].reasonstringyesreason contains a programmatic identifier indicating the reason for the condition's last transition.
conditions[].statusenumyesstatus of the condition, one of True, False, Unknown. Allowed: True, False, Unknown
conditions[].typestringyestype of condition in CamelCase or in foo.example.com/CamelCase.
identifierstring—Identifier is the Cloud Control primary identifier of the resource.
lastSyncTimestring—
observedGenerationinteger—
operationstring—Operation is the in-flight operation (CREATE, UPDATE, DELETE).
operationStatusstring—OperationStatus is the last reported operation status.
requestTokenstring—RequestToken tracks an in-flight asynchronous operation.
windowTaskIdstring—Unique identifier of the maintenance window task.

SSMOpsItem # CLOUD CONTROL · AWS::SSM::OpsItem

SSMOpsItem manages AWS::SSM::OpsItem through the AWS Cloud Control API.

kubectl get ssmopsitems · example on GitHub

Example

# SSMOpsItem — Systems Manager
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ssm.html#ssmopsitem
apiVersion: aws.konfig.io/v1alpha1
kind: SSMOpsItem
metadata:
  name: example-ssmopsitem
  namespace: default
spec:
  category: example
  description: Managed by konfig-konector
  priority: 1
  providerRef:
    name: example-ssmopsitem
    region: us-east-1
  severity: example
  source: example
  tags:
  - key: example
    value: example
  title: example

Spec

FieldTypeRequiredDescription
categorystring—The category of the OpsItem.
descriptionstringyesThe description of the OpsItem.
priorityinteger—The priority of the OpsItem.
providerRefobject—ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
providerRef.namestringyesName of a cluster-scoped AWSProvider.
providerRef.regionstring—Region overrides the provider's region for this resource only.
severitystring—The severity of the OpsItem.
sourcestringyesThe origin of the OpsItem.
tagsarray<object>—Tags for the OpsItem.
tags[].keystringyes
tags[].valuestringyes
titlestringyesThe title of the OpsItem.

Status

FieldTypeRequiredDescription
attemptinteger—Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
awsProviderobject—AWSProvider confirms the account and region this resource was reconciled against.
awsProvider.accountIdstring—AccountID the resource lives in.
awsProvider.namestring—Name of the AWSProvider used; empty when the operator's own credentials were used.
awsProvider.regionstring—Region the resource lives in (empty for global services).
conditionsarray<object>—Conditions describe the current state of the resource.
conditions[].lastTransitionTimestringyeslastTransitionTime is the last time the condition transitioned from one status to another.
conditions[].messagestringyesmessage is a human readable message indicating details about the transition.
conditions[].observedGenerationinteger—observedGeneration represents the .metadata.generation that the condition was set based upon.
conditions[].reasonstringyesreason contains a programmatic identifier indicating the reason for the condition's last transition.
conditions[].statusenumyesstatus of the condition, one of True, False, Unknown. Allowed: True, False, Unknown
conditions[].typestringyestype of condition in CamelCase or in foo.example.com/CamelCase.
createdBystring—The user who created the OpsItem.
createdTimestring—The time the OpsItem was created.
identifierstring—Identifier is the Cloud Control primary identifier of the resource.
lastModifiedBystring—The user who last modified the OpsItem.
lastModifiedTimestring—The time the OpsItem was last modified.
lastSyncTimestring—
observedGenerationinteger—
operationstring—Operation is the in-flight operation (CREATE, UPDATE, DELETE).
operationStatusstring—OperationStatus is the last reported operation status.
opsItemArnstring—The ARN of the OpsItem.
opsItemIdstring—The ID of the OpsItem.
opsItemTypestring—The type of OpsItem.
requestTokenstring—RequestToken tracks an in-flight asynchronous operation.
statusstring—The status of the OpsItem.
versionstring—The version of the OpsItem.

SSMParameter # GA

SSMParameter is the Schema for managing AWS SSM Parameters.

kubectl get ssmparameters · example on GitHub

Example

# SSMParameter — Systems Manager
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ssm.html#ssmparameter
apiVersion: aws.konfig.io/v1alpha1
kind: SSMParameter
metadata:
  name: example-ssmparameter
  namespace: default
spec:
  description: Managed by konfig-konector
  kmsKeyId: arn:aws:kms:us-east-1:123456789012:key/1234abcd-12ab-34cd-56ef-1234567890ab
  overwrite: false
  parameterName: example-ssmparameter
  providerRef:
    name: example-ssmparameter
    region: us-east-1
  tags:
    environment: dev
    team: platform
  tier: Standard
  type: String
  value: example
  valueFrom:
    key: example
    name: example-ssmparameter

Spec

FieldTypeRequiredDescription
descriptionstring—Description is a human-readable description.
kmsKeyIdstring—KMSKeyID is the KMS key ID for SecureString parameters.
overwriteboolean—Overwrite allows updating an existing parameter.
parameterNamestringyesParameterName is the full name of the parameter (e.g.
providerRefobject—ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
providerRef.namestringyesName of a cluster-scoped AWSProvider.
providerRef.regionstring—Region overrides the provider's region for this resource only.
tagsmap<string>—Tags are AWS resource tags to apply.
tierenum—Tier is the parameter tier. Allowed: Standard, Advanced, Intelligent-Tiering
typeenumyesType is the parameter type. Allowed: String, StringList, SecureString
valuestring—Value is the parameter value.
valueFromobject—ValueFrom references a Kubernetes Secret containing the parameter value.
valueFrom.keystringyesKey is the key within the Secret whose value to use.
valueFrom.namestringyesName of the Kubernetes Secret.

Status

FieldTypeRequiredDescription
arnstring—ARN is the ARN of the SSM parameter.
awsProviderobject—AWSProvider confirms the account and region this resource was reconciled against.
awsProvider.accountIdstring—AccountID the resource lives in.
awsProvider.namestring—Name of the AWSProvider used; empty when the operator's own credentials were used.
awsProvider.regionstring—Region the resource lives in (empty for global services).
conditionsarray<object>—Conditions describe the current state of the resource.
conditions[].lastTransitionTimestringyeslastTransitionTime is the last time the condition transitioned from one status to another.
conditions[].messagestringyesmessage is a human readable message indicating details about the transition.
conditions[].observedGenerationinteger—observedGeneration represents the .metadata.generation that the condition was set based upon.
conditions[].reasonstringyesreason contains a programmatic identifier indicating the reason for the condition's last transition.
conditions[].statusenumyesstatus of the condition, one of True, False, Unknown. Allowed: True, False, Unknown
conditions[].typestringyestype of condition in CamelCase or in foo.example.com/CamelCase.
lastSyncTimestring—LastSyncTime is when the resource was last successfully reconciled.
observedGenerationinteger—ObservedGeneration is the most recent .metadata.generation reconciled.
versioninteger—Version is the current version of the parameter.

SSMPatchBaseline # GA

SSMPatchBaseline is the Schema for managing SSM patch baselines.

kubectl get ssmpatchbaselines · example on GitHub

Example

# SSMPatchBaseline — Systems Manager
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ssm.html#ssmpatchbaseline
apiVersion: aws.konfig.io/v1alpha1
kind: SSMPatchBaseline
metadata:
  name: example-ssmpatchbaseline
  namespace: default
spec:
  approvalRules:
  - approveAfterDays: 1
    complianceLevel: CRITICAL
    patchFilters:
    - key: example
      values:
      - example
  approvedPatches:
  - example
  description: Managed by konfig-konector
  name: example-ssmpatchbaseline
  operatingSystem: example
  providerRef:
    name: example-ssmpatchbaseline
    region: us-east-1
  rejectedPatches:
  - example
  tags:
    environment: dev
    team: platform

Spec

FieldTypeRequiredDescription
approvalRulesarray<object>—ApprovalRules are the auto-approval rules.
approvalRules[].approveAfterDaysinteger—ApproveAfterDays auto-approves patches this many days after release.
approvalRules[].complianceLevelenum—ComplianceLevel assigned to approved patches: CRITICAL, HIGH, MEDIUM, LOW, INFORMATIONAL, or UNSPECIFIED. Allowed: CRITICAL, HIGH, MEDIUM, LOW, INFORMATIONAL, UNSPECIFIED
approvalRules[].patchFiltersarray<object>yesPatchFilters select the patches the rule applies to.
approvalRules[].patchFilters[].keystringyesKey is the patch filter key, e.g.
approvalRules[].patchFilters[].valuesarray<string>yesValues for the filter key.
approvedPatchesarray<string>—ApprovedPatches is an explicit list of approved patch IDs.
descriptionstring—Description of the patch baseline.
namestringyesName is the name of the patch baseline.
operatingSystemstringyesOperatingSystem the baseline applies to, e.g.
providerRefobject—ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
providerRef.namestringyesName of a cluster-scoped AWSProvider.
providerRef.regionstring—Region overrides the provider's region for this resource only.
rejectedPatchesarray<string>—RejectedPatches is an explicit list of rejected patch IDs.
tagsmap<string>—Tags are AWS resource tags to apply on creation.

Status

FieldTypeRequiredDescription
awsProviderobject—AWSProvider confirms the account and region this resource was reconciled against.
awsProvider.accountIdstring—AccountID the resource lives in.
awsProvider.namestring—Name of the AWSProvider used; empty when the operator's own credentials were used.
awsProvider.regionstring—Region the resource lives in (empty for global services).
baselineIdstring—BaselineID is the AWS patch baseline ID (pb-...).
conditionsarray<object>—Conditions describe the current state of the resource.
conditions[].lastTransitionTimestringyeslastTransitionTime is the last time the condition transitioned from one status to another.
conditions[].messagestringyesmessage is a human readable message indicating details about the transition.
conditions[].observedGenerationinteger—observedGeneration represents the .metadata.generation that the condition was set based upon.
conditions[].reasonstringyesreason contains a programmatic identifier indicating the reason for the condition's last transition.
conditions[].statusenumyesstatus of the condition, one of True, False, Unknown. Allowed: True, False, Unknown
conditions[].typestringyestype of condition in CamelCase or in foo.example.com/CamelCase.
lastSyncTimestring—LastSyncTime is when the resource was last successfully reconciled.
observedGenerationinteger—ObservedGeneration is the most recent .metadata.generation reconciled.

SSMResourceDataSync # CLOUD CONTROL · AWS::SSM::ResourceDataSync

SSMResourceDataSync manages AWS::SSM::ResourceDataSync through the AWS Cloud Control API.

kubectl get ssmresourcedatasyncs · example on GitHub

Example

# SSMResourceDataSync — Systems Manager
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ssm.html#ssmresourcedatasync
apiVersion: aws.konfig.io/v1alpha1
kind: SSMResourceDataSync
metadata:
  name: example-ssmresourcedatasync
  namespace: default
spec:
  bucketName: example-ssmresourcedatasync
  bucketPrefix: example
  bucketRegion: example
  kmsKeyArn: arn:aws:iam::123456789012:role/example-role
  providerRef:
    name: example-ssmresourcedatasync
    region: us-east-1
  s3Destination:
    bucketName: example-ssmresourcedatasync
    bucketPrefix: example
    bucketRegion: example
    kmsKeyArn: arn:aws:iam::123456789012:role/example-role
    syncFormat: example
  syncFormat: example
  syncName: example-ssmresourcedatasync
  syncSource:
    awsOrganizationsSource:
      organizationSourceType: example
      organizationalUnits:
      - example
    includeFutureRegions: false
    sourceRegions:
    - example
    sourceType: example
  syncType: example

Spec

FieldTypeRequiredDescription
bucketNamestring—Create-only in AWS: changing it requires replacing the resource.
bucketPrefixstring—Create-only in AWS: changing it requires replacing the resource.
bucketRegionstring—Create-only in AWS: changing it requires replacing the resource.
kmsKeyArnstring—Create-only in AWS: changing it requires replacing the resource.
providerRefobject—ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
providerRef.namestringyesName of a cluster-scoped AWSProvider.
providerRef.regionstring—Region overrides the provider's region for this resource only.
s3Destinationobject—Create-only in AWS: changing it requires replacing the resource.
s3Destination.bucketNamestringyes
s3Destination.bucketPrefixstring—
s3Destination.bucketRegionstringyes
s3Destination.kmsKeyArnstring—
s3Destination.syncFormatstringyes
syncFormatstring—Create-only in AWS: changing it requires replacing the resource.
syncNamestringyesCreate-only in AWS: changing it requires replacing the resource.
syncSourceobject—SSMResourceDataSyncSyncSource is a nested property type of AWS::SSM::ResourceDataSync.
syncSource.awsOrganizationsSourceobject—SSMResourceDataSyncAwsOrganizationsSource is a nested property type of AWS::SSM::ResourceDataSync.
syncSource.awsOrganizationsSource.organizationSourceTypestringyes
syncSource.awsOrganizationsSource.organizationalUnitsarray<string>—
syncSource.includeFutureRegionsboolean—
syncSource.sourceRegionsarray<string>yes
syncSource.sourceTypestringyes
syncTypestring—Create-only in AWS: changing it requires replacing the resource.

Status

FieldTypeRequiredDescription
attemptinteger—Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
awsProviderobject—AWSProvider confirms the account and region this resource was reconciled against.
awsProvider.accountIdstring—AccountID the resource lives in.
awsProvider.namestring—Name of the AWSProvider used; empty when the operator's own credentials were used.
awsProvider.regionstring—Region the resource lives in (empty for global services).
conditionsarray<object>—Conditions describe the current state of the resource.
conditions[].lastTransitionTimestringyeslastTransitionTime is the last time the condition transitioned from one status to another.
conditions[].messagestringyesmessage is a human readable message indicating details about the transition.
conditions[].observedGenerationinteger—observedGeneration represents the .metadata.generation that the condition was set based upon.
conditions[].reasonstringyesreason contains a programmatic identifier indicating the reason for the condition's last transition.
conditions[].statusenumyesstatus of the condition, one of True, False, Unknown. Allowed: True, False, Unknown
conditions[].typestringyestype of condition in CamelCase or in foo.example.com/CamelCase.
identifierstring—Identifier is the Cloud Control primary identifier of the resource.
lastSyncTimestring—
observedGenerationinteger—
operationstring—Operation is the in-flight operation (CREATE, UPDATE, DELETE).
operationStatusstring—OperationStatus is the last reported operation status.
requestTokenstring—RequestToken tracks an in-flight asynchronous operation.

SSMResourcePolicy # CLOUD CONTROL · AWS::SSM::ResourcePolicy

SSMResourcePolicy manages AWS::SSM::ResourcePolicy through the AWS Cloud Control API.

kubectl get ssmresourcepolicies · example on GitHub

Example

# SSMResourcePolicy — Systems Manager
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ssm.html#ssmresourcepolicy
apiVersion: aws.konfig.io/v1alpha1
kind: SSMResourcePolicy
metadata:
  name: example-ssmresourcepolicy
  namespace: default
spec:
  providerRef:
    name: example-ssmresourcepolicy
    region: us-east-1
  resourceArn: arn:aws:iam::123456789012:role/example-role

Spec

FieldTypeRequiredDescription
policyobjectyesActual policy statement.
providerRefobject—ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
providerRef.namestringyesName of a cluster-scoped AWSProvider.
providerRef.regionstring—Region overrides the provider's region for this resource only.
resourceArnstringyesArn of OpsItemGroup etc.

Status

FieldTypeRequiredDescription
attemptinteger—Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
awsProviderobject—AWSProvider confirms the account and region this resource was reconciled against.
awsProvider.accountIdstring—AccountID the resource lives in.
awsProvider.namestring—Name of the AWSProvider used; empty when the operator's own credentials were used.
awsProvider.regionstring—Region the resource lives in (empty for global services).
conditionsarray<object>—Conditions describe the current state of the resource.
conditions[].lastTransitionTimestringyeslastTransitionTime is the last time the condition transitioned from one status to another.
conditions[].messagestringyesmessage is a human readable message indicating details about the transition.
conditions[].observedGenerationinteger—observedGeneration represents the .metadata.generation that the condition was set based upon.
conditions[].reasonstringyesreason contains a programmatic identifier indicating the reason for the condition's last transition.
conditions[].statusenumyesstatus of the condition, one of True, False, Unknown. Allowed: True, False, Unknown
conditions[].typestringyestype of condition in CamelCase or in foo.example.com/CamelCase.
identifierstring—Identifier is the Cloud Control primary identifier of the resource.
lastSyncTimestring—
observedGenerationinteger—
operationstring—Operation is the in-flight operation (CREATE, UPDATE, DELETE).
operationStatusstring—OperationStatus is the last reported operation status.
policyHashstring—A snapshot identifier for the policy over time.
policyIdstring—An unique identifier within the policies of a resource.
requestTokenstring—RequestToken tracks an in-flight asynchronous operation.

SSMServiceSetting # CLOUD CONTROL · AWS::SSM::ServiceSetting

SSMServiceSetting manages AWS::SSM::ServiceSetting through the AWS Cloud Control API.

kubectl get ssmservicesettings · example on GitHub

Example

# SSMServiceSetting — Systems Manager
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/ssm.html#ssmservicesetting
apiVersion: aws.konfig.io/v1alpha1
kind: SSMServiceSetting
metadata:
  name: example-ssmservicesetting
  namespace: default
spec:
  providerRef:
    name: example-ssmservicesetting
    region: us-east-1
  settingId: example-id
  settingValue: example

Spec

FieldTypeRequiredDescription
providerRefobject—ProviderRef selects the AWSProvider (account/region) this resource is reconciled against.
providerRef.namestringyesName of a cluster-scoped AWSProvider.
providerRef.regionstring—Region overrides the provider's region for this resource only.
settingIdstringyesThe ID of the service setting, such as /ssm/parameter-store/high-throughput-enabled.
settingValuestringyesThe value of the service setting.

Status

FieldTypeRequiredDescription
arnstring—The ARN of the service setting.
attemptinteger—Attempt counts failed create/delete requests; it salts the Cloud Control idempotency token so a retry is not served the cached failure.
awsProviderobject—AWSProvider confirms the account and region this resource was reconciled against.
awsProvider.accountIdstring—AccountID the resource lives in.
awsProvider.namestring—Name of the AWSProvider used; empty when the operator's own credentials were used.
awsProvider.regionstring—Region the resource lives in (empty for global services).
conditionsarray<object>—Conditions describe the current state of the resource.
conditions[].lastTransitionTimestringyeslastTransitionTime is the last time the condition transitioned from one status to another.
conditions[].messagestringyesmessage is a human readable message indicating details about the transition.
conditions[].observedGenerationinteger—observedGeneration represents the .metadata.generation that the condition was set based upon.
conditions[].reasonstringyesreason contains a programmatic identifier indicating the reason for the condition's last transition.
conditions[].statusenumyesstatus of the condition, one of True, False, Unknown. Allowed: True, False, Unknown
conditions[].typestringyestype of condition in CamelCase or in foo.example.com/CamelCase.
identifierstring—Identifier is the Cloud Control primary identifier of the resource.
lastModifiedDatestring—The last time the service setting was modified.
lastModifiedUserstring—The ARN of the last modified user.
lastSyncTimestring—
observedGenerationinteger—
operationstring—Operation is the in-flight operation (CREATE, UPDATE, DELETE).
operationStatusstring—OperationStatus is the last reported operation status.
requestTokenstring—RequestToken tracks an in-flight asynchronous operation.
statusstring—The status of the service setting.