SSM

SSM.1 - Amazon EC2 instances should be managed by AWS Systems Manager
SSM.2 - Amazon EC2 instances managed by Systems Manager should have a patch compliance status of COMPLIANT after a patch installation
SSM.3 - Amazon EC2 instances managed by Systems Manager should have an association compliance status of COMPLIANT
SSM.4 - SSM documents should not be public
SSM.5 - SSM documents should be tagged
SSM.6 - SSM Automation should have CloudWatch logging enabled
SSM.7 - SSM documents should have the block public sharing setting enabled

** Extra links**

• https://hub.powerpipe.io/mods/turbot/steampipe-mod-aws-compliance/benchmarks/control.foundational_security_ssm_7

• https://aws.amazon.com/blogs/mt/best-practice-considerations-aws-systems-manager-document-sharing/