:doc:`SSM <../../ssm>` / Client / put_compliance_items

********************
put_compliance_items
********************



.. py:method:: SSM.Client.put_compliance_items(**kwargs)

  

  Registers a compliance type and other compliance details on a designated resource. This operation lets you register custom compliance details with a resource. This call overwrites existing compliance information on the resource, so you must provide a full list of compliance items each time that you send the request.

   

  ComplianceType can be one of the following:

   

  
  * ExecutionId: The execution ID when the patch, association, or custom compliance item was applied.
   
  * ExecutionType: Specify patch, association, or Custom: ``string``.
   
  * ExecutionTime. The time the patch, association, or custom compliance item was applied to the managed node. 

  .. warning::

    For State Manager associations, this represents the time when compliance status was captured by the Systems Manager service during its internal compliance aggregation workflow, not necessarily when the association was executed on the managed node. State Manager updates compliance information for all associations on an instance whenever any association executes, which may result in multiple associations showing the same execution time.

  
   
  * Id: The patch, association, or custom compliance ID.
   
  * Title: A title.
   
  * Status: The status of the compliance item. For example, ``approved`` for patches, or ``Failed`` for associations.
   
  * Severity: A patch severity. For example, ``Critical``.
   
  * DocumentName: An SSM document name. For example, ``AWS-RunPatchBaseline``.
   
  * DocumentVersion: An SSM document version number. For example, 4.
   
  * Classification: A patch classification. For example, ``security updates``.
   
  * PatchBaselineId: A patch baseline ID.
   
  * PatchSeverity: A patch severity. For example, ``Critical``.
   
  * PatchState: A patch state. For example, ``InstancesWithFailedPatches``.
   
  * PatchGroup: The name of a patch group.
   
  * InstalledTime: The time the association, patch, or custom compliance item was applied to the resource. Specify the time by using the following format: ``yyyy-MM-dd'T'HH:mm:ss'Z'``
  

  

  See also: `AWS API Documentation <https://docs.aws.amazon.com/goto/WebAPI/ssm-2014-11-06/PutComplianceItems>`_  


  **Request Syntax**
  ::

    response = client.put_compliance_items(
        ResourceId='string',
        ResourceType='string',
        ComplianceType='string',
        ExecutionSummary={
            'ExecutionTime': datetime(2015, 1, 1),
            'ExecutionId': 'string',
            'ExecutionType': 'string'
        },
        Items=[
            {
                'Id': 'string',
                'Title': 'string',
                'Severity': 'CRITICAL'|'HIGH'|'MEDIUM'|'LOW'|'INFORMATIONAL'|'UNSPECIFIED',
                'Status': 'COMPLIANT'|'NON_COMPLIANT',
                'Details': {
                    'string': 'string'
                }
            },
        ],
        ItemContentHash='string',
        UploadType='COMPLETE'|'PARTIAL'
    )
    
  :type ResourceId: string
  :param ResourceId: **[REQUIRED]** 

    Specify an ID for this resource. For a managed node, this is the node ID.

    

  
  :type ResourceType: string
  :param ResourceType: **[REQUIRED]** 

    Specify the type of resource. ``ManagedInstance`` is currently the only supported resource type.

    

  
  :type ComplianceType: string
  :param ComplianceType: **[REQUIRED]** 

    Specify the compliance type. For example, specify Association (for a State Manager association), Patch, or Custom: ``string``.

    

  
  :type ExecutionSummary: dict
  :param ExecutionSummary: **[REQUIRED]** 

    A summary of the call execution that includes an execution ID, the type of execution (for example, ``Command``), and the date/time of the execution using a datetime object that is saved in the following format: ``yyyy-MM-dd'T'HH:mm:ss'Z'``

    

  
    - **ExecutionTime** *(datetime) --* **[REQUIRED]** 

      The time the execution ran as a datetime object that is saved in the following format: ``yyyy-MM-dd'T'HH:mm:ss'Z'``

       

      .. warning::

         

        For State Manager associations, this timestamp represents when the compliance status was captured and reported by the Systems Manager service, not when the underlying association was actually executed on the managed node. To track actual association execution times, use the  DescribeAssociationExecutionTargets command or check the association execution history in the Systems Manager console.

        

      

    
    - **ExecutionId** *(string) --* 

      An ID created by the system when ``PutComplianceItems`` was called. For example, ``CommandID`` is a valid execution ID. You can use this ID in subsequent calls.

      

    
    - **ExecutionType** *(string) --* 

      The type of execution. For example, ``Command`` is a valid execution type.

      

    
  
  :type Items: list
  :param Items: **[REQUIRED]** 

    Information about the compliance as defined by the resource type. For example, for a patch compliance type, ``Items`` includes information about the PatchSeverity, Classification, and so on.

    

  
    - *(dict) --* 

      Information about a compliance item.

      

    
      - **Id** *(string) --* 

        The compliance item ID. For example, if the compliance item is a Windows patch, the ID could be the number of the KB article.

        

      
      - **Title** *(string) --* 

        The title of the compliance item. For example, if the compliance item is a Windows patch, the title could be the title of the KB article for the patch; for example: Security Update for Active Directory Federation Services.

        

      
      - **Severity** *(string) --* **[REQUIRED]** 

        The severity of the compliance status. Severity can be one of the following: Critical, High, Medium, Low, Informational, Unspecified.

        

      
      - **Status** *(string) --* **[REQUIRED]** 

        The status of the compliance item. An item is either COMPLIANT or NON_COMPLIANT.

        

      
      - **Details** *(dict) --* 

        A "Key": "Value" tag combination for the compliance item.

        

      
        - *(string) --* 

        
          - *(string) --* 

          
    
  
    

  :type ItemContentHash: string
  :param ItemContentHash: 

    MD5 or SHA-256 content hash. The content hash is used to determine if existing information should be overwritten or ignored. If the content hashes match, the request to put compliance information is ignored.

    

  
  :type UploadType: string
  :param UploadType: 

    The mode for uploading compliance items. You can specify ``COMPLETE`` or ``PARTIAL``. In ``COMPLETE`` mode, the system overwrites all existing compliance information for the resource. You must provide a full list of compliance items each time you send the request.

     

    In ``PARTIAL`` mode, the system overwrites compliance information for a specific association. The association must be configured with ``SyncCompliance`` set to ``MANUAL``. By default, all requests use ``COMPLETE`` mode.

     

    .. note::

      

      This attribute is only valid for association compliance.

      

    

  
  
  :rtype: dict
  :returns: 
    
    **Response Syntax**

    
    ::

      {}
      
    **Response Structure**

    

    - *(dict) --* 
  
  **Exceptions**
  
  *   :py:class:`SSM.Client.exceptions.InternalServerError`

  
  *   :py:class:`SSM.Client.exceptions.InvalidItemContentException`

  
  *   :py:class:`SSM.Client.exceptions.TotalSizeLimitExceededException`

  
  *   :py:class:`SSM.Client.exceptions.ItemSizeLimitExceededException`

  
  *   :py:class:`SSM.Client.exceptions.ComplianceTypeCountLimitExceededException`

  
  *   :py:class:`SSM.Client.exceptions.InvalidResourceType`

  
  *   :py:class:`SSM.Client.exceptions.InvalidResourceId`

  