@propulsionworks/cloudformation 0.0.2 → 0.1.0

package/out/exports/resources.generated/aws-ssm-maintenancewindowtask.d.ts

@@ -0,0 +1,308 @@
+import type { ResourceDefinitionWithAttributes } from "../main.ts";
+export type SSMMaintenanceWindowTask = ResourceDefinitionWithAttributes<"AWS::SSM::MaintenanceWindowTask", SSMMaintenanceWindowTaskProps, SSMMaintenanceWindowTaskAttribs>;
+/**
+ * The `AWS::SSM::MaintenanceWindowTask` resource defines information about a task for an AWS Systems Manager maintenance window. For more information, see [RegisterTaskWithMaintenanceWindow](https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_RegisterTaskWithMaintenanceWindow.html) in the *AWS Systems Manager API Reference* .
+ */
+export type SSMMaintenanceWindowTaskProps = {
+    /**
+     * The specification for whether tasks should continue to run after the cutoff time specified in the maintenance windows is reached.
+     */
+    CutoffBehavior?: string | undefined;
+    /**
+     * A description of the task.
+     */
+    Description?: string | undefined;
+    /**
+     * Information about an Amazon S3 bucket to write Run Command task-level logs to.
+     *
+     * > `LoggingInfo` has been deprecated. To specify an Amazon S3 bucket to contain logs for Run Command tasks, instead use the `OutputS3BucketName` and `OutputS3KeyPrefix` options in the `TaskInvocationParameters` structure. For information about how Systems Manager handles these options for the supported maintenance window task types, see [AWS ::SSM::MaintenanceWindowTask MaintenanceWindowRunCommandParameters](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ssm-maintenancewindowtask-maintenancewindowruncommandparameters.html) .
+     */
+    LoggingInfo?: LoggingInfo | undefined;
+    /**
+     * The maximum number of targets this task can be run for, in parallel.
+     *
+     * > Although this element is listed as "Required: No", a value can be omitted only when you are registering or updating a [targetless task](https://docs.aws.amazon.com/systems-manager/latest/userguide/maintenance-windows-targetless-tasks.html) You must provide a value in all other cases.
+     * >
+     * > For maintenance window tasks without a target specified, you can't supply a value for this option. Instead, the system inserts a placeholder value of `1` . This value doesn't affect the running of your task.
+     */
+    MaxConcurrency?: string | undefined;
+    /**
+     * The maximum number of errors allowed before this task stops being scheduled.
+     *
+     * > Although this element is listed as "Required: No", a value can be omitted only when you are registering or updating a [targetless task](https://docs.aws.amazon.com/systems-manager/latest/userguide/maintenance-windows-targetless-tasks.html) You must provide a value in all other cases.
+     * >
+     * > For maintenance window tasks without a target specified, you can't supply a value for this option. Instead, the system inserts a placeholder value of `1` . This value doesn't affect the running of your task.
+     */
+    MaxErrors?: string | undefined;
+    /**
+     * The task name.
+     */
+    Name?: string | undefined;
+    /**
+     * The priority of the task in the maintenance window. The lower the number, the higher the priority. Tasks that have the same priority are scheduled in parallel.
+     */
+    Priority: number;
+    /**
+     * The Amazon Resource Name (ARN) of the IAM service role for AWS Systems Manager to assume when running a maintenance window task. If you do not specify a service role ARN, Systems Manager uses a service-linked role in your account. If no appropriate service-linked role for Systems Manager exists in your account, it is created when you run `RegisterTaskWithMaintenanceWindow` .
+     *
+     * However, for an improved security posture, we strongly recommend creating a custom policy and custom service role for running your maintenance window tasks. The policy can be crafted to provide only the permissions needed for your particular maintenance window tasks. For more information, see [Setting up Maintenance Windows](https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-maintenance-permissions.html) in the in the *AWS Systems Manager User Guide* .
+     */
+    ServiceRoleArn?: string | undefined;
+    /**
+     * The targets, either instances or window target IDs.
+     *
+     * - Specify instances using `Key=InstanceIds,Values= *instanceid1* , *instanceid2*` .
+     * - Specify window target IDs using `Key=WindowTargetIds,Values= *window-target-id-1* , *window-target-id-2*` .
+     */
+    Targets?: Target[] | undefined;
+    /**
+     * The resource that the task uses during execution.
+     *
+     * For `RUN_COMMAND` and `AUTOMATION` task types, `TaskArn` is the SSM document name or Amazon Resource Name (ARN).
+     *
+     * For `LAMBDA` tasks, `TaskArn` is the function name or ARN.
+     *
+     * For `STEP_FUNCTIONS` tasks, `TaskArn` is the state machine ARN.
+     */
+    TaskArn: string;
+    /**
+     * The parameters to pass to the task when it runs. Populate only the fields that match the task type. All other fields should be empty.
+     *
+     * > When you update a maintenance window task that has options specified in `TaskInvocationParameters` , you must provide again all the `TaskInvocationParameters` values that you want to retain. The values you do not specify again are removed. For example, suppose that when you registered a Run Command task, you specified `TaskInvocationParameters` values for `Comment` , `NotificationConfig` , and `OutputS3BucketName` . If you update the maintenance window task and specify only a different `OutputS3BucketName` value, the values for `Comment` and `NotificationConfig` are removed.
+     */
+    TaskInvocationParameters?: TaskInvocationParameters | undefined;
+    /**
+     * The parameters to pass to the task when it runs.
+     *
+     * > `TaskParameters` has been deprecated. To specify parameters to pass to a task when it runs, instead use the `Parameters` option in the `TaskInvocationParameters` structure. For information about how Systems Manager handles these options for the supported maintenance window task types, see [MaintenanceWindowTaskInvocationParameters](https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_MaintenanceWindowTaskInvocationParameters.html) .
+     */
+    TaskParameters?: Record<string, unknown> | undefined;
+    /**
+     * The type of task. Valid values: `RUN_COMMAND` , `AUTOMATION` , `LAMBDA` , `STEP_FUNCTIONS` .
+     */
+    TaskType: string;
+    /**
+     * The ID of the maintenance window where the task is registered.
+     */
+    WindowId: string;
+};
+export type SSMMaintenanceWindowTaskAttribs = {
+    Id: string;
+};
+/**
+ * Configuration options for sending command output to Amazon CloudWatch Logs.
+ */
+export type CloudWatchOutputConfig = {
+    /**
+     * The name of the CloudWatch Logs log group where you want to send command output. If you don't specify a group name, AWS Systems Manager automatically creates a log group for you. The log group uses the following naming format:
+     *
+     * `aws/ssm/ *SystemsManagerDocumentName*`
+     */
+    CloudWatchLogGroupName?: string | undefined;
+    /**
+     * Enables Systems Manager to send command output to CloudWatch Logs.
+     */
+    CloudWatchOutputEnabled?: boolean | undefined;
+};
+/**
+ * The `LoggingInfo` property type specifies information about the Amazon S3 bucket to write instance-level logs to.
+ *
+ * `LoggingInfo` is a property of the [AWS::SSM::MaintenanceWindowTask](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ssm-maintenancewindowtask.html) resource.
+ *
+ * > `LoggingInfo` has been deprecated. To specify an Amazon S3 bucket to contain logs, instead use the `OutputS3BucketName` and `OutputS3KeyPrefix` options in the `TaskInvocationParameters` structure. For information about how Systems Manager handles these options for the supported maintenance window task types, see [AWS ::SSM::MaintenanceWindowTask MaintenanceWindowRunCommandParameters](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ssm-maintenancewindowtask-maintenancewindowruncommandparameters.html) .
+ */
+export type LoggingInfo = {
+    /**
+     * The AWS Region where the S3 bucket is located.
+     */
+    Region: string;
+    /**
+     * The name of an S3 bucket where execution logs are stored.
+     */
+    S3Bucket: string;
+    /**
+     * The Amazon S3 bucket subfolder.
+     */
+    S3Prefix?: string | undefined;
+};
+/**
+ * The `MaintenanceWindowAutomationParameters` property type specifies the parameters for an `AUTOMATION` task type for a maintenance window task in AWS Systems Manager .
+ *
+ * `MaintenanceWindowAutomationParameters` is a property of the [TaskInvocationParameters](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ssm-maintenancewindowtask-taskinvocationparameters.html) property type.
+ *
+ * For information about available parameters in Automation runbooks, you can view the content of the runbook itself in the Systems Manager console. For information, see [View runbook content](https://docs.aws.amazon.com/systems-manager/latest/userguide/automation-documents-reference-details.html#view-automation-json) in the *AWS Systems Manager User Guide* .
+ */
+export type MaintenanceWindowAutomationParameters = {
+    /**
+     * The version of an Automation runbook to use during task execution.
+     */
+    DocumentVersion?: string | undefined;
+    /**
+     * The parameters for the `AUTOMATION` type task.
+     */
+    Parameters?: Record<string, unknown> | undefined;
+};
+/**
+ * The `MaintenanceWindowLambdaParameters` property type specifies the parameters for a `LAMBDA` task type for a maintenance window task in AWS Systems Manager .
+ *
+ * `MaintenanceWindowLambdaParameters` is a property of the [TaskInvocationParameters](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ssm-maintenancewindowtask-taskinvocationparameters.html) property type.
+ */
+export type MaintenanceWindowLambdaParameters = {
+    /**
+     * Client-specific information to pass to the AWS Lambda function that you're invoking. You can then use the `context` variable to process the client information in your AWS Lambda function.
+     */
+    ClientContext?: string | undefined;
+    /**
+     * JSON to provide to your AWS Lambda function as input.
+     *
+     * > Although `Type` is listed as "String" for this property, the payload content must be formatted as a Base64-encoded binary data object.
+     *
+     * *Length Constraint:* 4096
+     */
+    Payload?: string | undefined;
+    /**
+     * An AWS Lambda function version or alias name. If you specify a function version, the action uses the qualified function Amazon Resource Name (ARN) to invoke a specific Lambda function. If you specify an alias name, the action uses the alias ARN to invoke the Lambda function version that the alias points to.
+     */
+    Qualifier?: string | undefined;
+};
+/**
+ * The `MaintenanceWindowRunCommandParameters` property type specifies the parameters for a `RUN_COMMAND` task type for a maintenance window task in AWS Systems Manager . This means that these parameters are the same as those for the `SendCommand` API call. For more information about `SendCommand` parameters, see [SendCommand](https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_SendCommand.html) in the *AWS Systems Manager API Reference* .
+ *
+ * For information about available parameters in SSM Command documents, you can view the content of the document itself in the Systems Manager console. For information, see [Viewing SSM command document content](https://docs.aws.amazon.com/systems-manager/latest/userguide/viewing-ssm-document-content.html) in the *AWS Systems Manager User Guide* .
+ *
+ * `MaintenanceWindowRunCommandParameters` is a property of the [TaskInvocationParameters](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ssm-maintenancewindowtask-taskinvocationparameters.html) property type.
+ */
+export type MaintenanceWindowRunCommandParameters = {
+    /**
+     * Configuration options for sending command output to Amazon CloudWatch Logs.
+     */
+    CloudWatchOutputConfig?: CloudWatchOutputConfig | undefined;
+    /**
+     * Information about the command or commands to run.
+     */
+    Comment?: string | undefined;
+    /**
+     * The SHA-256 or SHA-1 hash created by the system when the document was created. SHA-1 hashes have been deprecated.
+     */
+    DocumentHash?: string | undefined;
+    /**
+     * The SHA-256 or SHA-1 hash type. SHA-1 hashes are deprecated.
+     */
+    DocumentHashType?: string | undefined;
+    /**
+     * The AWS Systems Manager document (SSM document) version to use in the request. You can specify `$DEFAULT` , `$LATEST` , or a specific version number. If you run commands by using the AWS CLI, then you must escape the first two options by using a backslash. If you specify a version number, then you don't need to use the backslash. For example:
+     *
+     * `--document-version "\$DEFAULT"`
+     *
+     * `--document-version "\$LATEST"`
+     *
+     * `--document-version "3"`
+     */
+    DocumentVersion?: string | undefined;
+    /**
+     * Configurations for sending notifications about command status changes on a per-managed node basis.
+     */
+    NotificationConfig?: NotificationConfig | undefined;
+    /**
+     * The name of the Amazon Simple Storage Service (Amazon S3) bucket.
+     */
+    OutputS3BucketName?: string | undefined;
+    /**
+     * The S3 bucket subfolder.
+     */
+    OutputS3KeyPrefix?: string | undefined;
+    /**
+     * The parameters for the `RUN_COMMAND` task execution.
+     *
+     * The supported parameters are the same as those for the `SendCommand` API call. For more information, see [SendCommand](https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_SendCommand.html) in the *AWS Systems Manager API Reference* .
+     */
+    Parameters?: Record<string, unknown> | undefined;
+    /**
+     * The Amazon Resource Name (ARN) of the IAM service role for AWS Systems Manager to assume when running a maintenance window task. If you do not specify a service role ARN, Systems Manager uses a service-linked role in your account. If no appropriate service-linked role for Systems Manager exists in your account, it is created when you run `RegisterTaskWithMaintenanceWindow` .
+     *
+     * However, for an improved security posture, we strongly recommend creating a custom policy and custom service role for running your maintenance window tasks. The policy can be crafted to provide only the permissions needed for your particular maintenance window tasks. For more information, see [Setting up Maintenance Windows](https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-maintenance-permissions.html) in the in the *AWS Systems Manager User Guide* .
+     */
+    ServiceRoleArn?: string | undefined;
+    /**
+     * If this time is reached and the command hasn't already started running, it doesn't run.
+     */
+    TimeoutSeconds?: number | undefined;
+};
+/**
+ * The `MaintenanceWindowStepFunctionsParameters` property type specifies the parameters for the execution of a `STEP_FUNCTIONS` task in a Systems Manager maintenance window.
+ *
+ * `MaintenanceWindowStepFunctionsParameters` is a property of the [TaskInvocationParameters](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ssm-maintenancewindowtask-taskinvocationparameters.html) property type.
+ */
+export type MaintenanceWindowStepFunctionsParameters = {
+    /**
+     * The inputs for the `STEP_FUNCTIONS` task.
+     */
+    Input?: string | undefined;
+    /**
+     * The name of the `STEP_FUNCTIONS` task.
+     */
+    Name?: string | undefined;
+};
+/**
+ * The `NotificationConfig` property type specifies configurations for sending notifications for a maintenance window task in AWS Systems Manager .
+ *
+ * `NotificationConfig` is a property of the [MaintenanceWindowRunCommandParameters](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ssm-maintenancewindowtask-maintenancewindowruncommandparameters.html) property type.
+ */
+export type NotificationConfig = {
+    /**
+     * An Amazon Resource Name (ARN) for an Amazon Simple Notification Service (Amazon SNS) topic. Run Command pushes notifications about command status changes to this topic.
+     */
+    NotificationArn: string;
+    /**
+     * The different events that you can receive notifications for. These events include the following: `All` (events), `InProgress` , `Success` , `TimedOut` , `Cancelled` , `Failed` . To learn more about these events, see [Configuring Amazon SNS Notifications for AWS Systems Manager](https://docs.aws.amazon.com/systems-manager/latest/userguide/monitoring-sns-notifications.html) in the *AWS Systems Manager User Guide* .
+     */
+    NotificationEvents?: string[] | undefined;
+    /**
+     * The notification type.
+     *
+     * - `Command` : Receive notification when the status of a command changes.
+     * - `Invocation` : For commands sent to multiple instances, receive notification on a per-instance basis when the status of a command changes.
+     */
+    NotificationType?: string | undefined;
+};
+/**
+ * The `Target` property type specifies targets (either instances or window target IDs). You specify instances by using `Key=InstanceIds,Values=< *instanceid1* >,< *instanceid2* >` . You specify window target IDs using `Key=WindowTargetIds,Values=< *window-target-id-1* >,< *window-target-id-2* >` for a maintenance window task in AWS Systems Manager .
+ *
+ * `Target` is a property of the [AWS::SSM::MaintenanceWindowTask](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ssm-maintenancewindowtask.html) property type.
+ *
+ * > To use `resource-groups:Name` as the key for a maintenance window target, specify the resource group as a `AWS::SSM::MaintenanceWindowTarget` type, and use the `Ref` function to specify the target for `AWS::SSM::MaintenanceWindowTask` . For an example, see *Create a Run Command task that targets instances using a resource group name* in [AWS::SSM::MaintenanceWindowTask Examples](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ssm-maintenancewindowtask.html#aws-resource-ssm-maintenancewindowtask--examples) .
+ */
+export type Target = {
+    /**
+     * User-defined criteria for sending commands that target instances that meet the criteria. `Key` can be `InstanceIds` or `WindowTargetIds` . For more information about how to target instances within a maintenance window task, see [About 'register-task-with-maintenance-window' Options and Values](https://docs.aws.amazon.com/systems-manager/latest/userguide/register-tasks-options.html) in the *AWS Systems Manager User Guide* .
+     */
+    Key: string;
+    /**
+     * User-defined criteria that maps to `Key` . For example, if you specify `InstanceIds` , you can specify `i-1234567890abcdef0,i-9876543210abcdef0` to run a command on two EC2 instances. For more information about how to target instances within a maintenance window task, see [About 'register-task-with-maintenance-window' Options and Values](https://docs.aws.amazon.com/systems-manager/latest/userguide/register-tasks-options.html) in the *AWS Systems Manager User Guide* .
+     */
+    Values: string[];
+};
+/**
+ * The `TaskInvocationParameters` property type specifies the task execution parameters for a maintenance window task in AWS Systems Manager .
+ *
+ * `TaskInvocationParameters` is a property of the [AWS::SSM::MaintenanceWindowTask](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ssm-maintenancewindowtask.html) property type.
+ */
+export type TaskInvocationParameters = {
+    /**
+     * The parameters for an `AUTOMATION` task type.
+     */
+    MaintenanceWindowAutomationParameters?: MaintenanceWindowAutomationParameters | undefined;
+    /**
+     * The parameters for a `LAMBDA` task type.
+     */
+    MaintenanceWindowLambdaParameters?: MaintenanceWindowLambdaParameters | undefined;
+    /**
+     * The parameters for a `RUN_COMMAND` task type.
+     */
+    MaintenanceWindowRunCommandParameters?: MaintenanceWindowRunCommandParameters | undefined;
+    /**
+     * The parameters for a `STEP_FUNCTIONS` task type.
+     */
+    MaintenanceWindowStepFunctionsParameters?: MaintenanceWindowStepFunctionsParameters | undefined;
+};
+//# sourceMappingURL=aws-ssm-maintenancewindowtask.d.ts.map

package/out/exports/resources.generated/aws-ssm-parameter.d.ts

@@ -0,0 +1,70 @@
+import type { ResourceDefinitionWithAttributes } from "../main.ts";
+export type SSMParameter = ResourceDefinitionWithAttributes<"AWS::SSM::Parameter", SSMParameterProps, SSMParameterAttribs>;
+/**
+ * The `AWS::SSM::Parameter` resource creates an SSM parameter in AWS Systems Manager Parameter Store.
+ *
+ * > To create an SSM parameter, you must have the AWS Identity and Access Management ( IAM ) permissions `ssm:PutParameter` and `ssm:AddTagsToResource` . On stack creation, AWS CloudFormation adds the following three tags to the parameter: `aws:cloudformation:stack-name` , `aws:cloudformation:logical-id` , and `aws:cloudformation:stack-id` , in addition to any custom tags you specify.
+ * >
+ * > To add, update, or remove tags during stack update, you must have IAM permissions for both `ssm:AddTagsToResource` and `ssm:RemoveTagsFromResource` . For more information, see [Managing Access Using Policies](https://docs.aws.amazon.com/systems-manager/latest/userguide/security-iam.html#security_iam_access-manage) in the *AWS Systems Manager User Guide* .
+ *
+ * For information about valid values for parameters, see [About requirements and constraints for parameter names](https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-paramstore-su-create.html#sysman-parameter-name-constraints) in the *AWS Systems Manager User Guide* and [PutParameter](https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_PutParameter.html) in the *AWS Systems Manager API Reference* .
+ *
+ * > Parameters of type `SecureString` are not supported by AWS CloudFormation .
+ */
+export type SSMParameterProps = {
+    /**
+     * A regular expression used to validate the parameter value. For example, for `String` types with values restricted to numbers, you can specify the following: `AllowedPattern=^\d+$`
+     */
+    AllowedPattern?: string | undefined;
+    /**
+     * The data type of the parameter, such as `text` or `aws:ec2:image` . The default is `text` .
+     */
+    DataType?: "text" | "aws:ec2:image" | undefined;
+    /**
+     * Information about the parameter.
+     */
+    Description?: string | undefined;
+    /**
+     * The name of the parameter.
+     *
+     * > The maximum length constraint listed below includes capacity for additional system attributes that aren't part of the name. The maximum length for a parameter name, including the full length of the parameter Amazon Resource Name (ARN), is 1011 characters. For example, the length of the following parameter name is 65 characters, not 20 characters: `arn:aws:ssm:us-east-2:111222333444:parameter/ExampleParameterName`
+     */
+    Name?: string | undefined;
+    /**
+     * Information about the policies assigned to a parameter.
+     *
+     * [Assigning parameter policies](https://docs.aws.amazon.com/systems-manager/latest/userguide/parameter-store-policies.html) in the *AWS Systems Manager User Guide* .
+     */
+    Policies?: string | undefined;
+    /**
+     * Optional metadata that you assign to a resource in the form of an arbitrary set of tags (key-value pairs). Tags enable you to categorize a resource in different ways, such as by purpose, owner, or environment. For example, you might want to tag a Systems Manager parameter to identify the type of resource to which it applies, the environment, or the type of configuration data referenced by the parameter.
+     */
+    Tags?: Record<string, string> | undefined;
+    /**
+     * The parameter tier.
+     */
+    Tier?: "Standard" | "Advanced" | "Intelligent-Tiering" | undefined;
+    /**
+     * The type of parameter.
+     *
+     * > Parameters of type `SecureString` are not supported by AWS CloudFormation .
+     */
+    Type: "String" | "StringList";
+    /**
+     * The parameter value.
+     *
+     * > If type is `StringList` , the system returns a comma-separated string with no spaces between commas in the `Value` field.
+     */
+    Value: string;
+};
+export type SSMParameterAttribs = {
+    /**
+     * Returns the type of the parameter. Valid values are `String` or `StringList` .
+     */
+    Type: "String" | "StringList";
+    /**
+     * Returns the value of the parameter.
+     */
+    Value: string;
+};
+//# sourceMappingURL=aws-ssm-parameter.d.ts.map

package/out/exports/resources.generated/aws-ssm-patchbaseline.d.ts

@@ -0,0 +1,217 @@
+import type { ResourceDefinitionWithAttributes, Tag } from "../main.ts";
+export type SSMPatchBaseline = ResourceDefinitionWithAttributes<"AWS::SSM::PatchBaseline", SSMPatchBaselineProps, SSMPatchBaselineAttribs>;
+/**
+ * The `AWS::SSM::PatchBaseline` resource defines the basic information for an AWS Systems Manager patch baseline. A patch baseline defines which patches are approved for installation on your instances.
+ *
+ * For more information, see [CreatePatchBaseline](https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_CreatePatchBaseline.html) in the *AWS Systems Manager API Reference* .
+ */
+export type SSMPatchBaselineProps = {
+    /**
+     * A set of rules used to include patches in the baseline.
+     */
+    ApprovalRules?: RuleGroup | undefined;
+    /**
+     * A list of explicitly approved patches for the baseline.
+     *
+     * For information about accepted formats for lists of approved patches and rejected patches, see [Package name formats for approved and rejected patch lists](https://docs.aws.amazon.com/systems-manager/latest/userguide/patch-manager-approved-rejected-package-name-formats.html) in the *AWS Systems Manager User Guide* .
+     */
+    ApprovedPatches?: string[] | undefined;
+    /**
+     * Defines the compliance level for approved patches. When an approved patch is reported as missing, this value describes the severity of the compliance violation. The default value is `UNSPECIFIED` .
+     * @default "UNSPECIFIED"
+     */
+    ApprovedPatchesComplianceLevel?: "CRITICAL" | "HIGH" | "MEDIUM" | "LOW" | "INFORMATIONAL" | "UNSPECIFIED" | undefined;
+    /**
+     * Indicates whether the list of approved patches includes non-security updates that should be applied to the managed nodes. The default value is `false` . Applies to Linux managed nodes only.
+     * @default false
+     */
+    ApprovedPatchesEnableNonSecurity?: boolean | undefined;
+    /**
+     * Indicates whether this is the default baseline. AWS Systems Manager supports creating multiple default patch baselines. For example, you can create a default patch baseline for each operating system.
+     * @default false
+     */
+    DefaultBaseline?: boolean | undefined;
+    /**
+     * A description of the patch baseline.
+     * @minLength 1
+     * @maxLength 1024
+     */
+    Description?: string | undefined;
+    /**
+     * A set of global filters used to include patches in the baseline.
+     *
+     * > The `GlobalFilters` parameter can be configured only by using the AWS CLI or an AWS SDK. It can't be configured from the Patch Manager console, and its value isn't displayed in the console.
+     */
+    GlobalFilters?: PatchFilterGroup | undefined;
+    /**
+     * The name of the patch baseline.
+     * @minLength 3
+     * @maxLength 128
+     * @pattern ^[a-zA-Z0-9_\-.]{3,128}$
+     */
+    Name: string;
+    /**
+     * Defines the operating system the patch baseline applies to. The default value is `WINDOWS` .
+     * @default "WINDOWS"
+     */
+    OperatingSystem?: "WINDOWS" | "AMAZON_LINUX" | "AMAZON_LINUX_2" | "AMAZON_LINUX_2022" | "AMAZON_LINUX_2023" | "UBUNTU" | "REDHAT_ENTERPRISE_LINUX" | "SUSE" | "CENTOS" | "ORACLE_LINUX" | "DEBIAN" | "MACOS" | "RASPBIAN" | "ROCKY_LINUX" | "ALMA_LINUX" | undefined;
+    /**
+     * The name of the patch group to be registered with the patch baseline.
+     */
+    PatchGroups?: string[] | undefined;
+    /**
+     * A list of explicitly rejected patches for the baseline.
+     *
+     * For information about accepted formats for lists of approved patches and rejected patches, see [Package name formats for approved and rejected patch lists](https://docs.aws.amazon.com/systems-manager/latest/userguide/patch-manager-approved-rejected-package-name-formats.html) in the *AWS Systems Manager User Guide* .
+     */
+    RejectedPatches?: string[] | undefined;
+    /**
+     * The action for Patch Manager to take on patches included in the `RejectedPackages` list.
+     *
+     * - **ALLOW_AS_DEPENDENCY** - *Linux and macOS* : A package in the rejected patches list is installed only if it is a dependency of another package. It is considered compliant with the patch baseline, and its status is reported as `INSTALLED_OTHER` . This is the default action if no option is specified.
+     *
+     * *Windows Server* : Windows Server doesn't support the concept of package dependencies. If a package in the rejected patches list and already installed on the node, its status is reported as `INSTALLED_OTHER` . Any package not already installed on the node is skipped. This is the default action if no option is specified.
+     * - **BLOCK** - *All OSs* : Packages in the rejected patches list, and packages that include them as dependencies, aren't installed by Patch Manager under any circumstances. If a package was installed before it was added to the rejected patches list, or is installed outside of Patch Manager afterward, it's considered noncompliant with the patch baseline and its status is reported as `INSTALLED_REJECTED` .
+     * @default "ALLOW_AS_DEPENDENCY"
+     */
+    RejectedPatchesAction?: "ALLOW_AS_DEPENDENCY" | "BLOCK" | undefined;
+    /**
+     * Information about the patches to use to update the managed nodes, including target operating systems and source repositories. Applies to Linux managed nodes only.
+     */
+    Sources?: PatchSource[] | undefined;
+    /**
+     * Optional metadata that you assign to a resource. Tags enable you to categorize a resource in different ways, such as by purpose, owner, or environment. For example, you might want to tag a patch baseline to identify the severity level of patches it specifies and the operating system family it applies to.
+     */
+    Tags?: Tag[] | undefined;
+};
+export type SSMPatchBaselineAttribs = {
+    /**
+     * The ID of the patch baseline.
+     * @minLength 20
+     * @maxLength 128
+     * @pattern ^[a-zA-Z0-9_\-:/]{20,128}$
+     */
+    Id: string;
+};
+/**
+ * The `PatchFilter` property type defines a patch filter for an AWS Systems Manager patch baseline.
+ *
+ * The `PatchFilters` property of the [PatchFilterGroup](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ssm-patchbaseline-patchfiltergroup.html) property type contains a list of `PatchFilter` property types.
+ *
+ * You can view lists of valid values for the patch properties by running the `DescribePatchProperties` command. For more information, see [DescribePatchProperties](https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_DescribePatchProperties.html) in the *AWS Systems Manager API Reference* .
+ */
+export type PatchFilter = {
+    /**
+     * The key for the filter.
+     *
+     * For information about valid keys, see [PatchFilter](https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_PatchFilter.html) in the *AWS Systems Manager API Reference* .
+     */
+    Key?: "ADVISORY_ID" | "ARCH" | "BUGZILLA_ID" | "CLASSIFICATION" | "CVE_ID" | "EPOCH" | "MSRC_SEVERITY" | "NAME" | "PATCH_ID" | "PATCH_SET" | "PRIORITY" | "PRODUCT" | "PRODUCT_FAMILY" | "RELEASE" | "REPOSITORY" | "SECTION" | "SECURITY" | "SEVERITY" | "VERSION" | undefined;
+    /**
+     * The value for the filter key.
+     *
+     * For information about valid values for each key based on operating system type, see [PatchFilter](https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_PatchFilter.html) in the *AWS Systems Manager API Reference* .
+     */
+    Values?: string[] | undefined;
+};
+/**
+ * The `PatchFilterGroup` property type specifies a set of patch filters for an AWS Systems Manager patch baseline, typically used for approval rules for a Systems Manager patch baseline.
+ *
+ * `PatchFilterGroup` is the property type for the `GlobalFilters` property of the [AWS::SSM::PatchBaseline](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ssm-patchbaseline.html) resource and the `PatchFilterGroup` property of the [Rule](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ssm-patchbaseline-rule.html) property type.
+ */
+export type PatchFilterGroup = {
+    /**
+     * The set of patch filters that make up the group.
+     */
+    PatchFilters?: PatchFilter[] | undefined;
+};
+/**
+ * `PatchSource` is the property type for the `Sources` resource of the [AWS::SSM::PatchBaseline](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ssm-patchbaseline.html) resource.
+ *
+ * The AWS CloudFormation `AWS::SSM::PatchSource` resource is used to provide information about the patches to use to update target instances, including target operating systems and source repository. Applies to Linux managed nodes only.
+ */
+export type PatchSource = {
+    /**
+     * The value of the yum repo configuration. For example:
+     *
+     * `[main]`
+     *
+     * `name=MyCustomRepository`
+     *
+     * `baseurl=https://my-custom-repository`
+     *
+     * `enabled=1`
+     *
+     * > For information about other options available for your yum repository configuration, see [dnf.conf(5)](https://docs.aws.amazon.com/https://man7.org/linux/man-pages/man5/dnf.conf.5.html) .
+     * @minLength 1
+     * @maxLength 1024
+     */
+    Configuration?: string | undefined;
+    /**
+     * The name specified to identify the patch source.
+     * @pattern ^[a-zA-Z0-9_\-.]{3,50}$
+     */
+    Name?: string | undefined;
+    /**
+     * The specific operating system versions a patch repository applies to, such as "Ubuntu16.04", "RedhatEnterpriseLinux7.2" or "Suse12.7". For lists of supported product values, see [PatchFilter](https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_PatchFilter.html) in the *AWS Systems Manager API Reference* .
+     */
+    Products?: string[] | undefined;
+};
+/**
+ * The `Rule` property type specifies an approval rule for a Systems Manager patch baseline.
+ *
+ * The `PatchRules` property of the [RuleGroup](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-ssm-patchbaseline-rulegroup.html) property type contains a list of `Rule` property types.
+ */
+export type Rule = {
+    /**
+     * The number of days after the release date of each patch matched by the rule that the patch is marked as approved in the patch baseline. For example, a value of `7` means that patches are approved seven days after they are released.
+     *
+     * This parameter is marked as `Required: No` , but your request must include a value for either `ApproveAfterDays` or `ApproveUntilDate` .
+     *
+     * Not supported for Debian Server or Ubuntu Server.
+     *
+     * > Use caution when setting this value for Windows Server patch baselines. Because patch updates that are replaced by later updates are removed, setting too broad a value for this parameter can result in crucial patches not being installed. For more information, see the *Windows Server* tab in the topic [How security patches are selected](https://docs.aws.amazon.com/systems-manager/latest/userguide/patch-manager-selecting-patches.html) in the *AWS Systems Manager User Guide* .
+     * @min 0
+     * @max 360
+     */
+    ApproveAfterDays?: number | undefined;
+    /**
+     * The cutoff date for auto approval of released patches. Any patches released on or before this date are installed automatically.
+     *
+     * Enter dates in the format `YYYY-MM-DD` . For example, `2024-12-31` .
+     *
+     * This parameter is marked as `Required: No` , but your request must include a value for either `ApproveUntilDate` or `ApproveAfterDays` .
+     *
+     * Not supported for Debian Server or Ubuntu Server.
+     *
+     * > Use caution when setting this value for Windows Server patch baselines. Because patch updates that are replaced by later updates are removed, setting too broad a value for this parameter can result in crucial patches not being installed. For more information, see the *Windows Server* tab in the topic [How security patches are selected](https://docs.aws.amazon.com/systems-manager/latest/userguide/patch-manager-selecting-patches.html) in the *AWS Systems Manager User Guide* .
+     * @minLength 0
+     * @maxLength 10
+     */
+    ApproveUntilDate?: string | undefined;
+    /**
+     * A compliance severity level for all approved patches in a patch baseline. Valid compliance severity levels include the following: `UNSPECIFIED` , `CRITICAL` , `HIGH` , `MEDIUM` , `LOW` , and `INFORMATIONAL` .
+     */
+    ComplianceLevel?: "CRITICAL" | "HIGH" | "INFORMATIONAL" | "LOW" | "MEDIUM" | "UNSPECIFIED" | undefined;
+    /**
+     * For managed nodes identified by the approval rule filters, enables a patch baseline to apply non-security updates available in the specified repository. The default value is `false` . Applies to Linux managed nodes only.
+     * @default false
+     */
+    EnableNonSecurity?: boolean | undefined;
+    /**
+     * The patch filter group that defines the criteria for the rule.
+     */
+    PatchFilterGroup?: PatchFilterGroup | undefined;
+};
+/**
+ * The `RuleGroup` property type specifies a set of rules that define the approval rules for an AWS Systems Manager patch baseline.
+ *
+ * `RuleGroup` is the property type for the `ApprovalRules` property of the [AWS::SSM::PatchBaseline](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ssm-patchbaseline.html) resource.
+ */
+export type RuleGroup = {
+    /**
+     * The rules that make up the rule group.
+     */
+    PatchRules?: Rule[] | undefined;
+};
+//# sourceMappingURL=aws-ssm-patchbaseline.d.ts.map