aws ssm send-command --document-name "AmazonGuardDuty-ConfigureRuntimeMonitoringSsmPlugin" error

Hello.

I haven't checked with GovCloud, but it seems that you may not have specified enough parameters.
When I checked using the AWS CLI below, I found that it includes a parameter called "name".
I think you need to specify the value "AmazonGuardDuty-RuntimeMonitoringSsmPlugin" for this parameter.

aws ssm describe-document --name "AmazonGuardDuty-ConfigureRuntimeMonitoringSsmPlugin" --document-version "2" --query "Document.Parameters"
[
    {
        "Name": "action",
        "Type": "String",
        "Description": "(Required) Specify whether or not to install or uninstall the package."
    },
    {
        "Name": "installationType",
        "Type": "String",
        "Description": "(Optional) Specify the type of installation. Uninstall and reinstall: The application is taken offline until the reinstallation process completes. In-place update: The application is available while new or updated files are added to the installation.",
        "DefaultValue": "Uninstall and reinstall"
    },
    {
        "Name": "name",
        "Type": "String",
        "Description": "(Required) The package to install/uninstall."
    },
    {
        "Name": "version",
        "Type": "String",
        "Description": "(Optional) The version of the package to install or uninstall. If you don't specify a version, the system installs the latest published version by default. The system will only attempt to uninstall the version that is currently installed. If no version of the package is installed, the system returns an error.",
        "DefaultValue": ""
    }
]

So I think the command should be something like this:
I cannot check with GovCloud using my AWS account, but I tried running the command in a normal region and the GuardDuty agent was installed on the EC2 instance.
https://docs.aws.amazon.com/guardduty/latest/ug/installing-gdu-security-agent-ec2-manually.html

aws ssm send-command --document-name "AmazonGuardDuty-ConfigureRuntimeMonitoringSsmPlugin" --document-version "2" --targets '[{"Key":"InstanceIds","Values":["i-01ae47194f0600210"]}]' --parameters '{"action":["Install"],"installationType":["Uninstall and reinstall"],"version":[""],"name":["AmazonGuardDuty-RuntimeMonitoringSsmPlugin"]}' --timeout-seconds 600 --max-concurrency "50" --max-errors "0" --region us-gov-east-1

The error you're encountering with the SendCommand operation is due to invalid parameters being provided to the "AmazonGuardDuty-ConfigureRuntimeMonitoringSsmPlugin" document.

Based on the error message "InvalidParameters," it appears that one or more of the parameters you're passing are not defined in the SSM document or have incorrect values. When using SendCommand, you can only supply values to parameters that are explicitly defined in the SSM document, and they must match the expected format.

Looking at your specific case with GuardDuty Runtime Monitoring, the issue could be related to:

1. Parameter names or values that don't match what the document expects
2. Incorrect formatting of the parameters JSON
3. Possible version-specific parameter requirements

When the GuardDuty Runtime Monitoring agent installation fails, it typically requires proper sudo permissions on the target instances. The error suggests that the document parameters themselves are invalid, rather than an execution failure on the instance.

To resolve this issue:

1. Verify the exact parameter names and allowed values for the "AmazonGuardDuty-ConfigureRuntimeMonitoringSsmPlugin" document in your region
2. Check if there are any region-specific differences for the document in us-gov-east-1
3. Ensure your parameter format matches what the document expects

If you continue to face issues, you might want to examine the document definition itself to confirm the required parameters and their expected values.
Sources
SendCommand - AWS Systems Manager
GuardDutyRuntimeMonitoring - association failed | AWS re:Post