Skip to content
AWS for Query.Farm

aws.ssm.list_commands

Example SQL Queries

SELECT * FROM
aws.ssm.list_commands;

Description

Lists the commands requested by users of the Amazon Web Services account.

Table Definition

Column NameColumn Data Type
command_id Input Column

A unique identifier for this command.

VARCHAR
filters Input Column

(Optional) One or more filters. Use a filter to return a more specific list of results. 

STRUCT(
    "key" VARCHAR,
    "value" VARCHAR
)[]
Show child fields
filters[]
Show child fields
filters[].key

The name of the filter.

The ExecutionStage filter can't be used with the ListCommandInvocations operation, only with ListCommands.

filters[].value

The filter value. Valid values for each filter key are as follows:

  • InvokedAfter: Specify a timestamp to limit your results. For example, specify 2021-07-07T00:00:00Z to see a list of command executions occurring July 7, 2021, and later.

  • InvokedBefore: Specify a timestamp to limit your results. For example, specify 2021-07-07T00:00:00Z to see a list of command executions from before July 7, 2021.

  • Status: Specify a valid command status to see a list of all command executions with that status. The status choices depend on the API you call.

    The status values you can specify for ListCommands are:

    • Pending

    • InProgress

    • Success

    • Cancelled

    • Failed

    • TimedOut (this includes both Delivery and Execution time outs)

    • AccessDenied

    • DeliveryTimedOut

    • ExecutionTimedOut

    • Incomplete

    • NoInstancesInTag

    • LimitExceeded

    The status values you can specify for ListCommandInvocations are:

    • Pending

    • InProgress

    • Delayed

    • Success

    • Cancelled

    • Failed

    • TimedOut (this includes both Delivery and Execution time outs)

    • AccessDenied

    • DeliveryTimedOut

    • ExecutionTimedOut

    • Undeliverable

    • InvalidPlatform

    • Terminated

  • DocumentName: Specify name of the Amazon Web Services Systems Manager document (SSM document) for which you want to see command execution results. For example, specify AWS-RunPatchBaseline to see command executions that used this SSM document to perform security patching operations on managed nodes.

  • ExecutionStage: Specify one of the following values (ListCommands operations only):

    • Executing: Returns a list of command executions that are currently still running.

    • Complete: Returns a list of command executions that have already completed.

instance_id Input Column

(Optional) Lists commands issued against this managed node ID.

You can't specify a managed node ID in the same command that you specify Status = Pending. This is because the command hasn't reached the managed node yet.

VARCHAR
_aws_profile Input Column

The AWS profile defines the AWS identity used. It can be defined via credentials or by assuming a IAM role.

STRUCT(
    "type" VARCHAR,
    "name" VARCHAR,
    "account_id" VARCHAR,
    "via_profile_name" VARCHAR,
    "assumed_role_arn" VARCHAR,
    "organization" STRUCT(
        "account_name" VARCHAR,
        "id" VARCHAR,
        "tags" STRUCT(
            "key" VARCHAR,
            "value" VARCHAR
        )[],
        "master_account" STRUCT(
            "id" VARCHAR,
            "email" VARCHAR
        ),
        "parents" STRUCT(
            "type" VARCHAR,
            "id" VARCHAR,
            "name" VARCHAR,
            "tags" STRUCT(
                "key" VARCHAR,
                "value" VARCHAR
            )[]
        )[]
    )
)
Show child fields
_aws_profile.account_id

The AWS account id

_aws_profile.assumed_role_arn

The ARN of the assumed role

_aws_profile.name

The unique name of the profile.

_aws_profile.organization

Information about this profile's membership in the AWS organization.

Show child fields
_aws_profile.organization.account_name

The name of account speciifed by the organization

_aws_profile.organization.id

The organization id

_aws_profile.organization.master_account
Show child fields
_aws_profile.organization.master_account.email

The organization master account email address

_aws_profile.organization.master_account.id

The organization master account id

_aws_profile.organization.parents[]
Show child fields
_aws_profile.organization.parents[].id

The id of the parent

_aws_profile.organization.parents[].name

The name of the parent

_aws_profile.organization.parents[].tags[]
Show child fields
_aws_profile.organization.parents[].tags[].key
_aws_profile.organization.parents[].tags[].value
_aws_profile.organization.parents[].type

The type of parent can be an organization unit or a root

_aws_profile.organization.tags[]
Show child fields
_aws_profile.organization.tags[].key
_aws_profile.organization.tags[].value
_aws_profile.type

The type of profile, either 'credentials' or 'assumed_role'

_aws_profile.via_profile_name

This IAM role for this profile is assumed by first utilizing another profile with this name to obtain credentials.

_aws_region Input Column

The AWS region to use.

VARCHAR
alarm_configuration

The details for the CloudWatch alarm applied to your command.

STRUCT(
    "ignore_poll_alarm_failure" BOOLEAN,
    "alarms" STRUCT(
        "name" VARCHAR
    )[]
)
Show child fields
alarm_configuration.alarms[]
Show child fields
alarm_configuration.alarms[].name

The name of your CloudWatch alarm.

alarm_configuration.ignore_poll_alarm_failure

When this value is true, your automation or command continues to run in cases where we can’t retrieve alarm status information from CloudWatch. In cases where we successfully retrieve an alarm status of OK or INSUFFICIENT_DATA, the automation or command continues to run, regardless of this value. Default is false.

cloud_watch_output_config

Amazon CloudWatch Logs information where you want Amazon Web Services Systems Manager to send the command output.

STRUCT(
    "cloud_watch_log_group_name" VARCHAR,
    "cloud_watch_output_enabled" BOOLEAN
)
Show child fields
cloud_watch_output_config.cloud_watch_log_group_name

The name of the CloudWatch Logs log group where you want to send command output. If you don't specify a group name, Amazon Web Services Systems Manager automatically creates a log group for you. The log group uses the following naming format:

aws/ssm/SystemsManagerDocumentName

cloud_watch_output_config.cloud_watch_output_enabled

Enables Systems Manager to send command output to CloudWatch Logs.

comment

User-specified information about the command, such as a brief description of what the command should do.

VARCHAR
completed_count

The number of targets for which the command invocation reached a terminal state. Terminal states include the following: Success, Failed, Execution Timed Out, Delivery Timed Out, Cancelled, Terminated, or Undeliverable.

BIGINT
delivery_timed_out_count

The number of targets for which the status is Delivery Timed Out.

BIGINT
document_name

The name of the document requested for execution.

VARCHAR
document_version

The Systems Manager document (SSM document) version.

VARCHAR
error_count

The number of targets for which the status is Failed or Execution Timed Out.

BIGINT
expires_after

If a command expires, it changes status to DeliveryTimedOut for all invocations that have the status InProgress, Pending, or Delayed. ExpiresAfter is calculated based on the total timeout for the overall command. For more information, see Understanding command timeout values in the Amazon Web Services Systems Manager User Guide.

TIMESTAMP_S
instance_ids

The managed node IDs against which this command was requested.

VARCHAR[]
Show child fields
instance_ids[]
max_concurrency

The maximum number of managed nodes that are allowed to run the command at the same time. You can specify a number of managed nodes, such as 10, or a percentage of nodes, such as 10%. The default value is 50. For more information about how to use MaxConcurrency, see Amazon Web Services Systems Manager Run Command in the Amazon Web Services Systems Manager User Guide.

VARCHAR
max_errors

The maximum number of errors allowed before the system stops sending the command to additional targets. You can specify a number of errors, such as 10, or a percentage or errors, such as 10%. The default value is 0. For more information about how to use MaxErrors, see Amazon Web Services Systems Manager Run Command in the Amazon Web Services Systems Manager User Guide.

VARCHAR
notification_config

Configurations for sending notifications about command status changes. 

STRUCT(
    "notification_arn" VARCHAR,
    "notification_events" VARCHAR[],
    "notification_type" VARCHAR
)
Show child fields
notification_config.notification_arn

An Amazon Resource Name (ARN) for an Amazon Simple Notification Service (Amazon SNS) topic. Run Command pushes notifications about command status changes to this topic.

notification_config.notification_events[]
notification_config.notification_type

The type of notification.

  • Command: Receive notification when the status of a command changes.

  • Invocation: For commands sent to multiple managed nodes, receive notification on a per-node basis when the status of a command changes.

output_s3_bucket_name

The S3 bucket where the responses to the command executions should be stored. This was requested when issuing the command.

VARCHAR
output_s3_key_prefix

The S3 directory path inside the bucket where the responses to the command executions should be stored. This was requested when issuing the command.

VARCHAR
output_s3_region

(Deprecated) You can no longer specify this parameter. The system ignores it. Instead, Systems Manager automatically determines the Amazon Web Services Region of the S3 bucket.

VARCHAR
parameters

The parameter values to be inserted in the document when running the command.

MAP(VARCHAR, VARCHAR[])
requested_date_time

The date and time the command was requested.

TIMESTAMP_S
service_role

The Identity and Access Management (IAM) service role that Run Command, a capability of Amazon Web Services Systems Manager, uses to act on your behalf when sending notifications about command status changes. 

VARCHAR
status

The status of the command.

VARCHAR
status_details

A detailed status of the command execution. StatusDetails includes more information than Status because it includes states resulting from error and concurrency control parameters. StatusDetails can show different results than Status. For more information about these statuses, see Understanding command statuses in the Amazon Web Services Systems Manager User Guide. StatusDetails can be one of the following values:

  • Pending: The command hasn't been sent to any managed nodes.

  • In Progress: The command has been sent to at least one managed node but hasn't reached a final state on all managed nodes.

  • Success: The command successfully ran on all invocations. This is a terminal state.

  • Delivery Timed Out: The value of MaxErrors or more command invocations shows a status of Delivery Timed Out. This is a terminal state.

  • Execution Timed Out: The value of MaxErrors or more command invocations shows a status of Execution Timed Out. This is a terminal state.

  • Failed: The value of MaxErrors or more command invocations shows a status of Failed. This is a terminal state.

  • Incomplete: The command was attempted on all managed nodes and one or more invocations doesn't have a value of Success but not enough invocations failed for the status to be Failed. This is a terminal state.

  • Cancelled: The command was terminated before it was completed. This is a terminal state.

  • Rate Exceeded: The number of managed nodes targeted by the command exceeded the account limit for pending invocations. The system has canceled the command before running it on any managed node. This is a terminal state.

  • Delayed: The system attempted to send the command to the managed node but wasn't successful. The system retries again.

VARCHAR
target_count

The number of targets for the command.

BIGINT
targets

An array of search criteria that targets managed nodes using a Key,Value combination that you specify. Targets is required if you don't provide one or more managed node IDs in the call.

STRUCT(
    "key" VARCHAR,
    "values" VARCHAR[]
)[]
Show child fields
targets[]
Show child fields
targets[].key

User-defined criteria for sending commands that target managed nodes that meet the criteria.

targets[].values[]
timeout_seconds

The TimeoutSeconds value specified for a command.

BIGINT
triggered_alarms

The CloudWatch alarm that was invoked by the command.

STRUCT(
    "name" VARCHAR,
    "state" VARCHAR
)[]
Show child fields
triggered_alarms[]
Show child fields
triggered_alarms[].name

The name of your CloudWatch alarm.

triggered_alarms[].state

The state of your CloudWatch alarm.