AWS systems-manager documentation change
Summary
Expanded documentation about inventory association priority order, conflict resolution scenarios, and added resolution steps for skipped associations
Security assessment
The changes clarify association precedence rules and troubleshooting steps but do not address any specific security vulnerabilities or introduce security features. The modifications improve operational understanding of association prioritization without indicating security fixes.
Diff
diff --git a/systems-manager/latest/userguide/syman-inventory-troubleshooting.md b/systems-manager/latest/userguide/syman-inventory-troubleshooting.md index b93d8db24..727ad9811 100644 --- a//systems-manager/latest/userguide/syman-inventory-troubleshooting.md +++ b//systems-manager/latest/userguide/syman-inventory-troubleshooting.md @@ -101 +101,90 @@ If the detailed status of an inventory association shows **UnsupportedAgent** , -If the status of the inventory association for a node shows **Skipped** , this means that you created a _global inventory association_ (to collect inventory from all nodes), but the skipped node already had an inventory association assigned to it. The global inventory association wasn't assigned to this node, and no inventory was collected by the global inventory association. However, the node will still report inventory data when the existing inventory association runs. +If the status of the inventory association for a node shows **Skipped** , this means that a higher-priority inventory association is already running on that node. Systems Manager follows a specific priority order when multiple inventory associations could apply to the same managed node. + +### Inventory association priority order + +Systems Manager applies inventory associations in the following priority order: + + 1. **Quick Setup inventory associations** \- Associations created using Quick Setup and the unified console. These associations have names that start with `AWS-QuickSetup-SSM-CollectInventory-` and target all managed nodes. + + 2. **Explicit inventory associations** \- Associations that target specific managed nodes using: + + * Instance IDs + + * Tag key-value pairs + + * AWS resource groups + + 3. **Global inventory associations** \- Associations that target all managed nodes (using `--targets "Key=InstanceIds,Values=*"`) but were **not** created through Quick Setup. + + + + +### Common scenarios + +**Scenario 1: Quick Setup association overrides explicit association** + + * You have a Quick Setup inventory association targeting all instances + + * You create a manual association targeting specific managed nodes by tag + + * Result: The manual association shows `Skipped` with detailed status `OverriddenByExplicitInventoryAssociation` + + * The Quick Setup association continues to collect inventory from all instances + + + + +**Scenario 2: Explicit association overrides global association** + + * You have a global inventory association targeting all instances (not created by Quick Setup) + + * You create an association targeting specific instances + + * Result: The global association shows `Skipped` for the specifically targeted instances + + * The explicit association runs on the targeted instances + + + + +### Resolution steps + +**If you want to use your own inventory association instead of Quick Setup:** + + 1. **Identify Quick Setup associations** : In the Systems Manager console, go to State Manager and look for associations with names starting with `AWS-QuickSetup-SSM-CollectInventory-`. + + 2. **Remove Quick Setup configuration** : + + * Go to Quick Setup in the Systems Manager console. + + * Find your inventory collection configuration. + + * Delete the Quick Setup configuration (this removes the associated inventory association). + +###### Note + +You don't need to manually delete the association created by Quick Setup. + + 3. **Verify your association runs** : After removing the Quick Setup configuration, your explicit inventory association should start running successfully. + + + + +**If you want to modify existing behavior:** + + * To view all existing inventory associations, choose **State Manager** in the Systems Manager console and locate associations that use the `AWS-GatherSoftwareInventory` SSM document. + + * Remember that each managed node can only have one active inventory association at a time. + + + + +###### Important + + * Inventory data is still collected from skipped nodes when their assigned (higher-priority) inventory association runs. + + * Quick Setup inventory associations take precedence over all other types, even those with explicit targeting. + + * The detailed status message `OverriddenByExplicitInventoryAssociation` appears when any association is overridden by a higher-priority one, regardless of the association type. + + @@ -103 +191,0 @@ If the status of the inventory association for a node shows **Skipped** , this m -If you don't want the node to be skipped by the global inventory association, you must delete the existing inventory association. To view existing inventory associations, choose **State Manager** in the Systems Manager console and then locate associations that use the `AWS-GatherSoftwareInventory` SSM document. @@ -110,2 +198 @@ If the status of the inventory association for a node shows **Failed** , this co - aws ssm describe-instance-associations-status - --instance-id instance ID + aws ssm describe-instance-associations-status --instance-id instance-ID