Amazon SSM

Amazon SSM (Systems Manager) by Amazon Web Services (AWS) provides operational visibility and control of your infrastructure on AWS. You can bring managed instance inventory and agent status data from Amazon SSM into Brinqa to gain a unified view of your attack surface, thus strengthening your cybersecurity posture.

This document details the information you must provide for the connector to authenticate with Amazon SSM and how to obtain that information from Amazon. See create a data integration for step-by-step instructions on setting up the integration.

Required connection settings

When setting up a data integration, select Amazon SSM from the Connector dropdown. If you cannot find the connector in the dropdown, make sure that you have installed it first. You must provide the following information to authenticate Amazon SSM with Brinqa:

• Access key ID and Secret access key: The access keys associated with the AWS account. The account must have the required read-only permissions for the Systems Manager service. For additional information, see Create an IAM user for AWS access.

• Default region: The AWS region for the connector. If not specified, the connector uses the AWS Default Region Provider Chain to automatically determine the most appropriate region. For additional information on the AWS Default Region Provider Chain, refer to the AWS documentation.

The connector authenticates using the AWS SDK's credential resolution chain. If an assume-role ARN is configured, the connector assumes that IAM role using the provided credentials. Otherwise, it uses the provided access keys directly, falling back to the AWS Default Credential Provider Chain (environment variables, ~/.aws/credentials, or EC2 instance metadata).

Create an IAM user for AWS access

For the Amazon SSM connector to interact with the AWS SDK and retrieve managed instance data, you must provide specific AWS credentials and permissions. To create an IAM user, follow these steps:

1. Log in to your organization's AWS Management Console as an administrator.

2. Navigate to the Identity and Access Management (IAM) dashboard.

3. From the navigation pane under Access management, click Users, and then click Create user.

4. Provide a User name, leave the Provide user access to AWS Management Console option unchecked, and then click Next.

5. Click the Attach policies directly option and then click Create policy.

6. Click the JSON tab and paste the following minimum required policy:

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Allow",
         "Action": [
           "ssm:DescribeInstanceInformation"
         ],
         "Resource": "*"
       }
     ]
   }

7. Click Next, provide a name for the policy, and then click Create policy.

8. Back on the Add permissions page, search for and select the policy you just created, and then click Next.

9. Click Create user.

note

If you do not have permissions to create a new IAM user, contact your AWS administrator. For additional information, see AWS documentation.

Additional settings

The Amazon SSM connector contains additional options for specific configuration:

• Assume role ARN: ARN of an IAM role to assume. Comma-separated to assume multiple roles in the same sync.
• Session duration: Assume-role session duration in seconds. The default setting is 3600.
• Page size: The maximum number of records to get per API request. The default setting is 100. It is not recommended to go over 100.
• Parallel requests: The maximum number of parallel API requests. The default setting is 8.
• Maximum retries: The maximum number of times that the integration attempts to connect to the Amazon SSM API before giving up and reporting a failure. The default setting is 10.

Types of data to retrieve

The Amazon SSM connector can retrieve the following types of data from the Amazon SSM API:

Table 1: Data retrieved from Amazon SSM

Connector Object	Required	Maps to Data Model
SsmManagedInstance	Yes	Cloud Resource

info

For detailed steps on how to view the data retrieved from Amazon SSM in the Brinqa Platform, see How to view your data.

Attribute mappings

Expand the sections below to view the mappings between the source and the Brinqa data model attributes.

SsmManagedInstance

Table 2: SsmManagedInstance attribute mappings

Source Field Name	SDM Attribute
InstanceInformation.agentVersion	AGENT_VERSION
InstanceInformation.computerName	COMPUTER_NAME
InstanceInformation.computerName (falls back to instanceId)	NAME
InstanceInformation.iamRole	IAM_ROLE
InstanceInformation.instanceId	INSTANCE_ID
InstanceInformation.ipAddress	IP_ADDRESSES
InstanceInformation.isLatestVersion	IS_LATEST_VERSION
InstanceInformation.lastPingDateTime	LAST_SEEN
InstanceInformation.pingStatusAsString	PING_STATUS
InstanceInformation.pingStatusAsString	SOURCE_STATUS
InstanceInformation.platformName	OPERATING_SYSTEM
InstanceInformation.platformName	PLATFORM_NAME
InstanceInformation.platformTypeAsString	PLATFORM_TYPE
InstanceInformation.platformVersion	PLATFORM_VERSION
InstanceInformation.resourceTypeAsString	RESOURCE_TYPE
Generated (constant AWS)	CLOUD_PROVIDER
Generated (derived: pingStatus == "Online")	IS_ONLINE
Generated (sync region)	REGION
Generated (sync timestamp)	LAST_CAPTURED
Generated ({region}:{instanceId})	UID

Operation options

info

The Amazon SSM connector does not currently support operation options for the types of data it retrieves.

For detailed steps on how to view the data retrieved from Amazon SSM in the Brinqa Platform, see How to view your data.

APIs

The Amazon SSM connector uses the AWS Systems Manager API. Specifically, it uses the following endpoints:

Table 3: Amazon SSM API endpoints

Connector Object	API Endpoint
SsmManagedInstance	ssm:DescribeInstanceInformation

Changelog

The Amazon SSM connector has undergone the following changes:

note

This connector is part of a bundled release with other connectors from the same vendor. If a version shows "No change", it means that the connector version was updated for consistency as part of the bundle, but no functional changes were made to this specific connector. You can update to or skip this version without affecting your existing configuration.

Table 4: Amazon SSM connector changelog

Version	Description	Date Published
3.1.0	Initial Integration+ release.	June 1st, 2026

note

This changelog will be updated as new versions are released. For the latest connector updates, see Integration+ connector releases.