State Manager Associations with SSM Command Documents vs. SSM Automation Documents

Question

I have been successfully using State Manager Associations with SSM Command Documents to automatically apply the documents to EC2 instances based on target tags. The association runs once automatically when the instance with matching tags is available in SSM Fleet Manager, and then never again (with the association set to manual).

I’m trying to get the same behavior out of State Manager Associations with SSM Automation Documents, by creating associations the same way I am doing with Command Documents. However, despite being able to make associations with target tags the same way as Command Documents, the Automation Documents seem to have completely different behavior. The Automation Documents don’t automatically get applied to EC2 instances with the target tags when they are available in Fleet Manager. If I run the association manually, it applies the association to all instances matching the tags, regardless of their state and whether the association has already been applied.

The documentation has a lot of references to using EventBridge rules to apply Automation Documents based on tags, but I find it odd nothing prevents you from creating associations with Automation Documents the same way as Command Documents. Ideally I would love a method to have the same behavior with Automation Documents that I have working with Command Documents.

Am I doing something wrong, have a fundamental misunderstanding of how Automation Docs are supposed to work, or possibly both?

Answer

Hello,

Greetings from AWS! Hope you're safe and doing well. Thank you for posting your query on AWS!

From your query, I understand that you are using SSM state manager association to run SSM Command and Automation documents by targetting the EC2 Instances by their tags. However, the SSM Automation documentation is not working correctly and the SSM Run command document works fine.

Kindly allow me to mention that both the SSM Run command and automation document should have a parameter called "Rate Control" where you can choose your target where you can select the value as "Tags" which should have worked correctly. I have also tested the scenario in my lab and I was able to execute the state manager assocition for both run command and SSM automation successfully targeting the EC2 Instance tags.

In order to investigate further we would need to look into how the Association was created/triggered and what all parameters were passed to the automation when compared to SSM Command document. Therefore, to investigate the issue in more depth, I would recommend creating a case/ticket support teams via your Support Center: http://go.aws/support-center who should be able to investigate the issue that you are facing and provide an accurate solution for the same.

Thank you!

State Manager Associations with SSM Command Documents vs. SSM Automation Documents

Relevant content