Use AWS Systems Manager to run commands on managed nodes, read and write Parameter Store values, inspect inventory and compliance, and manage Automation runbooks.
The following notes explain how secret values appear in workflow inputs, outputs, and run logs.
Parameter Store decryption is opt-in: Get Parameter, Get Parameters, and Get Parameters By Path leave WithDecryption off unless you explicitly enable it, so a SecureString stays encrypted by default.
The value you supply to Put Parameter is masked in the editor and is never echoed back in the operation's result, and Sim never puts a parameter value into an error message. It is not kept out of the run log: block inputs are recorded, and a value typed directly into the field is recorded verbatim. Referencing an environment variable instead — {{MY_SECRET}} — keeps the literal out of the log, because references are restored to their placeholder before the log is written.
Reads are exposed the same way. Once you enable decryption the plaintext is ordinary block output: it flows to downstream blocks as intended, and it is written to the run log and the execution trace like any other output.
Enable decryption only on the steps that need the plaintext, prefer environment-variable references over typed literals when writing, and treat the run logs of any workflow that touches SecureString values as secret material.
Use the block
Run commands on managed nodes, read and write Parameter Store values, inspect node inventory and patch compliance, and drive Automation runbooks.
Actions
SSM Send Command
Run an SSM document on managed nodes with AWS Systems Manager Run Command
SSM List Commands
List Run Command executions in an AWS account
SSM List Command Invocations
List the per-node invocations of Run Command executions
SSM Get Command Invocation
Read the output and status of a Run Command execution on one managed node
SSM Cancel Command
Cancel an in-flight Run Command execution
SSM Get Parameter
Read one parameter from AWS Systems Manager Parameter Store
SSM Get Parameters
Read up to ten parameters from AWS Systems Manager Parameter Store by name
SSM Get Parameters By Path
Read parameters under a Parameter Store hierarchy path
SSM Put Parameter
Create or update a parameter in AWS Systems Manager Parameter Store
SSM Delete Parameter
Delete a parameter from AWS Systems Manager Parameter Store
SSM Describe Parameters
List Parameter Store parameter metadata without reading any values
SSM Describe Instance Information
List managed nodes registered with AWS Systems Manager and their agent status
SSM Describe Instance Patches
List the patches reported for one managed node
SSM Describe Instance Patch States
Read patch compliance summaries for a set of managed nodes
SSM List Compliance Items
List individual compliance findings reported to AWS Systems Manager
SSM List Compliance Summaries
Read compliant and non-compliant counts per compliance type
SSM Start Automation Execution
Start an AWS Systems Manager Automation runbook execution
SSM Describe Automation Executions
List Automation runbook executions in an AWS account
SSM Get Automation Execution
Read the status, outputs, and step results of one Automation execution
SSM Stop Automation Execution
Stop a running AWS Systems Manager Automation execution
SSM List Documents
List SSM documents and runbooks available to an AWS account
SSM Get Document
Read the content of an SSM document or Automation runbook