What problem does it solve? Applying CIS or remediation SSM documents to AWS instances is risky without validation, version pinning, and durable evidence. This Skill provides a controlled workflow that validates inputs and target reachability before mutation, pins document versions, applies to a single instance first, and captures rollback-ready evidence for every run. ## Core Features & Use Cases - Pre-mutation validation: Checks the SSM document file, parameter JSON structure, instance state, and SSM agent online status before any change. - Safe publish and apply: Creates or updates the SSM document, skips no-op uploads via content hashing, pins the default version, and sends the command to one instance with polling and timeout handling. - Durable evidence and rollback: Saves logs, command output, document metadata, and pre-mutation state per run, and automatically reverts the default document version when the command fails. - Use Case: A security engineer updates a CIS hardening SSM document, validates it against one test instance, applies it, and keeps a full evidence trail with automatic rollback if the command fails. ## Quick Start Ask the agent to validate and apply your SSM remediation document to one instance by providing the document file, parameters JSON file, target instance ID, and a unique output directory.
