I have drafted a CF template for automating windows ec2 patching, unfortunatly ended with the below error. error details are given in description. kindly have a look and help me to fix it.

Question

"Resource handler returned message: "Invalid request provided: Invalid document provided (Service: Ssm, Status Code: 400, Request ID: 723907ad-4da8-4cfd-8d32-f3e0e37efe01)" (RequestToken: 389c0ddf-ee7a-154a-d2a5-f70a7ccc4677, HandlerErrorCode: InvalidRequest)"

```
AWSTemplateFormatVersion: "2010-09-09"
Parameters:
  InstanceId:
    Type: "String"
    Description: "ID of the EC2 instance to patch"
  SnsTopicName:
    Type: "String"
    Description: "Name of the SNS topic for notifications"

Resources:
  PatchingDocument:
    Type: "AWS::SSM::Document"
    Properties:
      DocumentType: "Command"
      Content:
        schemaVersion: "2.2"
        description: "WindowsPatch"
        mainSteps:
          - action: "aws:runPowerShellScript"
            name: "ScanAndInstallPatches"
            inputs:
              runCommand:
                - "& { Install-WindowsUpdate -AcceptAll -AutoReboot }"

PatchingAssociation:
    Type: "AWS::SSM::Association"
    Properties:
      AssociationName: "WindowsPatchAssociation"
      Targets:
        - Key: "instanceids"
          Values:
            - Ref: "InstanceId"
      DocumentVersion: "1"
      Name: "AWS-InstallPatches"
      ScheduleExpression: "rate(1 day)"  # Modify the schedule as needed

SnsTopic:
    Type: "AWS::SNS::Topic"
    Properties:
      DisplayName: "WindowsPatchNotifications"
      TopicName: !Ref "SnsTopicName"

SnsSubscription:
    Type: "AWS::SNS::Subscription"
    Properties:
      Protocol: "email"  # You can change this to other protocols like "sms", "lambda", etc.
      TopicArn: !Ref "SnsTopic"
      Endpoint: "your-email@example.com"  # Replace with your email address

SnsPermission:
    Type: "AWS::SNS::TopicPolicy"
    Properties:
      Topics:
        - Ref: "SnsTopic"
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: "Allow"
            Principal:
              Service: "ssm.amazonaws.com"
            Action: "SNS:Publish"
            Resource: !Ref "SnsTopic"

```

Answer

The "Invalid document provided" error indicates that the SSM document referenced for the association does not exist.

Looking at your CFN template, I see two possible reasons for the error:
1. You are creating a Command document with name as "ScanAndInstallPatches" whereas in your Association, you are referencing a different document "AWS-InstallPatches". So, I would suggest reviewing the template again to make sure that correct document name is provided in Association.

2. If a "DependsOn" Attribute or a Reference intrinsic function is not specified in CFN template, then CloudFormation will initiate the resource provisioning API calls simultaneously for both SSM document and SSM Association. If the calls were made simultaneously indeed, then the document resource was not yet created while the Association was getting created leading to the "Invalid Document" error.

You can update the Stack template so that the "AWS::SSM::Association" resource references the document name, when using Reference intrinsic function (1), CloudFormation will automatically take care of the internal dependency between the 2 resources.

```
PatchingAssociation:
    Type: "AWS::SSM::Association"
    Properties:
      AssociationName: "WindowsPatchAssociation"
      Targets:
        - Key: "instanceids"
          Values:
            - Ref: "InstanceId"
      DocumentVersion: "1"
      Name: !Ref "AWS-InstallPatches"
      ScheduleExpression: "rate(1 day)"  # Modify the schedule as needed
```

-------
#### Reference:
(1) https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/intrinsic-function-reference-ref.html

I have drafted a CF template for automating windows ec2 patching, unfortunatly ended with the below error. error details are given in description. kindly have a look and help me to fix it.

Reference:

Relevant content