Skip to content

Instantly share code, notes, and snippets.

@austoonz
Last active April 5, 2019 22:31
Show Gist options
  • Save austoonz/7f8434f840480c2d55558bef23ea685e to your computer and use it in GitHub Desktop.
Save austoonz/7f8434f840480c2d55558bef23ea685e to your computer and use it in GitHub Desktop.
Sample code for writing an AWS Systems Manager Compliance Item.
$managedInstanceId = (Get-Content -Path 'C:\ProgramData\Amazon\SSM\InstanceData\Vault\Store\RegistrationKey' -Raw | ConvertFrom-Json).instanceID
$moduleNames = @(
'AWSPowerShell',
'ClipboardText',
'Convert',
'PSWindowsUpdate'
)
$complianceItems = [System.Collections.Generic.List[Amazon.SimpleSystemsManagement.Model.ComplianceItemEntry]]::new()
foreach ($moduleName in $moduleNames)
{
$module = Get-Module -Name $moduleName -ListAvailable | Sort-Object -Property Version -Descending | Select-Object -First 1
$item = [Amazon.SimpleSystemsManagement.Model.ComplianceItemEntry]::new()
$item.Id = $module.Version.ToString()
$item.Severity = [Amazon.SimpleSystemsManagement.ComplianceSeverity]::INFORMATIONAL
$item.Status = [Amazon.SimpleSystemsManagement.ComplianceStatus]::COMPLIANT
$item.Title = $moduleName
$null = $complianceItems.Add($item)
}
$writeSSMComplianceItem = @{
ComplianceType = 'Custom:PowerShellModule'
ResourceId = $managedInstanceId
ResourceType = 'ManagedInstance'
Item = $complianceItems
ExecutionSummary_ExecutionTime = Get-Date
ExecutionSummary_ExecutionType = 'Command'
}
Write-SSMComplianceItem @writeSSMComplianceItem
@sheldonhull
Copy link

Thank you for this! This is a great help to get started. From my slack message...

From what I'm understanding, the current agent does software collection inventory, but if I use Write-SSMCompliance I'm overwriting all inventory content period? Or just overwriting my custom content? I want to basically create some inventory items for software agents I want running, but I don't want to lose all the other stuff AWS Collects

@austoonz
Copy link
Author

austoonz commented Apr 5, 2019

Write-SSMCompliance posts compliance items to Systems Manager Compliance, and IIRC overwrites based on the ComplianceType field.

This gist demonstrates how to post your own Inventory data.
https://gist.github.com/austoonz/0e8a4ff8c9b26c81d6a2b4ddc9b5f63f

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment