AWS Systems Manager

AWS Systems Manager is the operations hub for AWS. It gives you a single place to run commands across fleets of managed nodes, store configuration and secrets, track patch and compliance state, and execute runbooks — without opening SSH, managing bastion hosts, or distributing long-lived credentials.

With AWS Systems Manager, you can:

Run commands remotely: Execute shell or PowerShell across a fleet by instance ID or tag-based targets, with concurrency and error thresholds you control
Store configuration and secrets: Keep parameters in Parameter Store as plain strings, string lists, or KMS-encrypted SecureStrings
Inspect your fleet: List managed nodes with their platform, agent version, and last ping time
Track patch state: Read per-instance patch installations and summary compliance counts
Audit compliance: Query compliance items and summaries across your managed nodes
Automate runbooks: Start, monitor, and stop Automation executions built on SSM documents

In Sim, the Systems Manager integration is what lets an agent act on infrastructure rather than only report on it. Paired with CloudWatch or CloudTrail for detection, a workflow can investigate an alert, run a diagnostic command against the affected nodes, read the configuration behind the failure from Parameter Store, and kick off an Automation runbook to remediate — end to end, with every step logged in your run history.

Parameter Store decryption is opt-in: Get Parameter, Get Parameters, and Get Parameters By Path leave WithDecryption off unless you explicitly enable it, so a SecureString stays encrypted by default.

Be precise about what that protects, because it is narrower than it looks. The value you supply to Put Parameter is masked in the editor and is never echoed back in the operation's result, and Sim never puts a parameter value into an error message. It is not kept out of the run log: block inputs are recorded, and a value typed directly into the field is recorded verbatim. Referencing an environment variable instead — {{MY_SECRET}} — keeps the literal out of the log, because references are restored to their placeholder before the log is written.

Reads are exposed the same way. Once you enable decryption the plaintext is ordinary block output: it flows to downstream blocks as intended, and it is written to the run log and the execution trace like any other output.

So enable decryption only on the steps that genuinely need the plaintext, prefer environment-variable references over typed literals when writing, and treat the run logs of any workflow that touches SecureString values as secret material.

Parameter	Type	Required	Description
`region`	string	Yes	AWS region (e.g., us-east-1)
`accessKeyId`	string	Yes	AWS access key ID
`secretAccessKey`	string	Yes	AWS secret access key
`documentName`	string	Yes	Name of the SSM document to run (e.g., AWS-RunShellScript)
`instanceIds`	json	No	Managed node IDs to target, as an array of strings (e.g., ["i-0123456789abcdef0"]). Provide instanceIds or targets
`targets`	json	No	Tag or resource-group targets, as an array of {Key, Values} objects. Provide instanceIds or targets
`documentVersion`	string	No	Document version to run ($LATEST, $DEFAULT, or a version number)
`parameters`	json	No	Document parameters, as an object mapping each parameter name to an array of string values
`comment`	string	No	Comment describing the command, at most 100 characters
`executionTimeoutSeconds`	number	No	Seconds to wait for a node to acknowledge the command before it times out (30-2592000)
`maxConcurrency`	string	No	Number or percentage of nodes to run the command on at once (e.g., 10 or 50%)
`maxErrors`	string	No	Number or percentage of errors allowed before the command stops (e.g., 0 or 10%)
`outputS3BucketName`	string	No	S3 bucket to store command output in
`outputS3KeyPrefix`	string	No	S3 key prefix for stored command output
`serviceRoleArn`	string	No	ARN of the IAM service role Systems Manager uses to publish notifications

Parameter	Type	Description
`commands`	json	Commands, each with commandId, documentName, status, statusDetails, requestedDateTime, instanceIds, targets, targetCount, completedCount, and errorCount
`nextToken`	string	Pagination token for the next page of results
`count`	number	Number of commands returned

Parameter	Type	Description
`commandInvocations`	json	Invocations, each with commandId, instanceId, instanceName, status, statusDetails, requestedDateTime, standardOutputUrl, standardErrorUrl, and commandPlugins
`nextToken`	string	Pagination token for the next page of results
`count`	number	Number of invocations returned

Parameter	Type	Description
`commandId`	string	ID of the command
`instanceId`	string	Managed node the command ran on
`comment`	string	Comment supplied with the command
`documentName`	string	Document that was run
`documentVersion`	string	Document version that was run
`pluginName`	string	Plugin the output belongs to
`responseCode`	number	Exit code of the command, or -1 if it has not started
`executionStartDateTime`	string	When the command started running on the node
`executionElapsedTime`	string	How long the command ran, as an ISO 8601 duration
`executionEndDateTime`	string	When the command finished running on the node
`status`	string	Invocation status (Pending, InProgress, Delayed, Success, Cancelled, TimedOut, Failed, Cancelling)
`statusDetails`	string	Detailed status of the invocation
`standardOutputContent`	string	First 24000 characters of stdout; longer output is available at standardOutputUrl
`standardOutputUrl`	string	S3 URL of the full stdout, if S3 output was configured
`standardErrorContent`	string	First 8000 characters of stderr; longer output is available at standardErrorUrl
`standardErrorUrl`	string	S3 URL of the full stderr, if S3 output was configured

Parameter	Type	Description
`parameters`	json	Parameters that were found, each with name, type, value, version, arn, dataType, and lastModifiedDate
`invalidParameters`	array	Names that could not be read because they do not exist or are malformed
`count`	number	Number of parameters returned

AWS Systems Manager

On this page