All checks
Low
EC2 instances managed by Systems Manager should have an association compliance status of COMPLIANT
Checks that the node managed by Systems Manager has an association compliance status of COMPLIANT after its State Manager associations run; one failing association fails the node. An association keeps a state on its instances, such as antivirus installed or certain ports closed, so a non-compliant one means that state did not apply.
- service
- SSM
- severity
- Low
- scope
- evaluated in every region
How to fix it
In the console
Systems Manager → State Manager → the association → Execution history
- Execution history
- The failed execution's targets, to see which node failed and the output of the step that failed
- Edit
- Correct the cause, such as targets, parameters or document version; saving creates a new association version
- Apply association now
- After the fix, so compliance updates before the next scheduled run
With the AWS CLI
aws ssm start-associations-once --association-ids <association-id> --region <region>See which of your accounts this check is failing on.
Book a live scan