State Manager Association Non-Compliance vs. Failure

That's an excellent question about Systems Manager State Manager associations and compliance reporting. Let me clarify how compliance reporting works with State Manager associations.

1. Compliance Reporting Behavior:

• The documentation is correct - when an association completely fails to execute (like in the S3 permission example), no compliance data is typically reported
• This is because compliance status is generated only when the association can actually run and evaluate the desired state

2. Scenarios where non-compliant status would be reported:

• When the association successfully executes but finds a drift from the desired state
• When the command/script within the association runs but returns a non-successful exit code
• When the association can evaluate the target state but finds it doesn't match expectations

3. Examples of reportable non-compliance:

• An AWS-GatherSoftwareInventory association successfully runs but finds unauthorized software
• A patch baseline association runs and discovers missing required patches
• A configuration check runs successfully but finds parameters that don't match specifications

4. Complete failures vs. Execution failures:

• Complete failures (like permission issues preventing execution) = No compliance data
• Execution failures (where the association runs but fails its checks) = Non-compliant status

The key distinction is between associations that can't run at all (no compliance data) versus those that run but find problems (non-compliant status).

To ensure you get meaningful compliance data, make sure:

• Permissions are properly configured
• Resources are accessible
• The association can actually execute and evaluate state

https://docs.aws.amazon.com/systems-manager/latest/userguide/compliance-about.html#compliance-view