AWS eventbridge documentation change

Service: eventbridge · 2026-03-19 · Documentation low

File: eventbridge/latest/userguide/eb-targets.md

Summary

Added documentation for Systems Manager Run Command as an EventBridge target, including configuration parameters and CLI example

Security assessment

The change adds documentation about integrating with SSM Run Command but does not address security vulnerabilities. While Run Command execution requires proper permissions, the documentation focuses on feature usage rather than security controls.

Diff

diff --git a/eventbridge/latest/userguide/eb-targets.md b/eventbridge/latest/userguide/eb-targets.md
index 02a13cb79..9dba003e7 100644
--- a//eventbridge/latest/userguide/eb-targets.md
+++ b//eventbridge/latest/userguide/eb-targets.md
@@ -5 +5 @@
-Target typesTarget parametersPermissionsAWS Batch job queuesCloudWatch Logs groupsCodeBuild projectsAmazon ECS tasksIncident Manager Response PlansAmazon SQS queues
+Target typesTarget parametersPermissionsAWS Batch job queuesCloudWatch Logs groupsCodeBuild projectsAmazon ECS tasksIncident Manager Response PlansSystems Manager Run CommandAmazon SQS queues
@@ -115,0 +116,4 @@ Use [`SqsParameters`](https://docs.aws.amazon.com/eventbridge/latest/APIReferenc
+  * Systems Manager Run Command
+
+Use [`RunCommandParameters`](https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_RunCommandParameters.html) to specify the SSM document and target instances. For more information, see Systems Manager Run Command as a target.
+
@@ -302,0 +307,53 @@ If the matched event came from CloudWatch Alarms, the alarm state change details
+## Systems Manager Run Command as a target
+
+When you specify Systems Manager Run Command as a target, EventBridge calls the [`SendCommand`](https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_SendCommand.html) API on your behalf. Configure the target using [`RunCommandParameters`](https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_RunCommandParameters.html), which specifies the SSM document to run and the target instances or tags.
+
+`RunCommandParameters` contains the following fields:
+
+  * `RunCommandTargets` — (Required) A list of key-value pairs that specify the target instances. Use `Key` set to `InstanceIds` with a list of instance IDs, or `Key` set to `tag:`tag-name`` with tag values to target instances by tag. You can specify between 1 and 5 run command targets.
+
+
+
+
+To specify which SSM document to run and pass parameters to it, use the `Input` field on the [`Target`](https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_Target.html) object. The `Input` value must be a JSON object with the following structure:
+    
+    
+    {
+      "DocumentName": "document-name",
+      "DocumentVersion": "version",
+      "Parameters": {
+        "parameter-key": ["parameter-value"]
+      }
+    }
+
+Where:
+
+  * `DocumentName` — The name or ARN of the SSM document to run.
+
+  * `DocumentVersion` — (Optional) The version of the document. If omitted, the default version is used.
+
+  * `Parameters` — (Optional) A map of parameter names to value arrays, matching the parameters defined in the SSM document.
+
+
+
+
+For example, the following AWS CLI command creates a rule that runs the `AWS-RunShellScript` document on a specific instance when an EventBridge event matches:
+    
+    
+    aws events put-targets --rule "my-rule" --targets '[{
+      "Id": "ssm-target-1",
+      "Arn": "arn:aws:ssm:region:account-id:document/AWS-RunShellScript",
+      "RoleArn": "arn:aws:iam::account-id:role/EventBridgeSSMRole",
+      "Input": "{\\"Parameters\\":{\\"commands\\":[\\"echo Hello from EventBridge\\"]}}",
+      "RunCommandParameters": {
+        "RunCommandTargets": [{
+          "Key": "InstanceIds",
+          "Values": ["i-0123456789abcdef0"]
+        }]
+      }
+    }]'
+
+###### Note
+
+The `Input` field on the `Target` object is used to pass the document name and parameters to Systems Manager Run Command. This is different from the [`InputTransformer`](https://docs.aws.amazon.com/eventbridge/latest/APIReference/API_InputTransformer.html), which transforms the event payload. When using Systems Manager Run Command as a target, set the document parameters in `Input` and specify the target instances in `RunCommandParameters`.
+