Modify SSM Document using CDK

Hello! I understand that you'd like to modify the permissions of the AWS Systems Manager document created using CDK. CDK uses AWS CloudFormation to provision the resources defined in code. Currently, when a SSM document is defined using the CfnDocument construct the resource is provisioned using the AWS::SSM::Document resource type. Currently, this resource type doesn't support updating the permissions of a document. As a result, modifying permissions of a document is not supported via CDK.

That being said, I have created a feature request for supporting permission management via the AWS::SSM:Document resource type. This request can be tracked here.

In the meantime, it is possible to leverage CustomResources construct to perform the ModifyDocumentPermission API call and manage permissions for the SSM document via the same CDK application. An example for using custom-resources is available here.

Please let us know if you have any questions.