# AWS Config compliance results plus the State Manager association list proving a defined configuration is actually applied and re-applied to every managed node — instances are under SSM management, and the associations that carry your baseline report COMPLIANT on a schedule rather than drifting

> FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14
> Canonical page: /collect/ssm-configuration-baseline-enforced

Recipe id: `ssm-configuration-baseline-enforced` · cadence continuous · partial

> **Authored opinion.** AWS overlay v3.0.0, written
> against dataset 2026.07.14.01. The upstream
> FedRAMP rules name none of these tools; this mapping is ours.

## What it proves

- KSI `KSI-SVC-ACM`
- KSI `KSI-CMT-RMV`
- KSI `KSI-MLA-EVC`
- KSI `KSI-CNA-IBP`
- control `cm-2`
- control `cm-6`

## Collection

Kind: `cli`

```sh
# ec2-instance-managed-by-systems-manager
aws configservice get-compliance-details-by-config-rule --config-rule-name ec2-instance-managed-by-systems-manager --compliance-types NON_COMPLIANT
# ec2-managedinstance-association-compliance-status-check
aws configservice get-compliance-details-by-config-rule --config-rule-name ec2-managedinstance-association-compliance-status-check --compliance-types NON_COMPLIANT
# list-associations
aws ssm list-associations --query 'Associations[].{Name:Name,AssociationId:AssociationId,Schedule:ScheduleExpression,Targets:Targets,Status:Overview.Status,LastRun:LastExecutionDate}'
```

## Expected output

Two EvaluationResults arrays plus an Associations list. Empty NON_COMPLIANT sets mean every running EC2 instance has a running SSM Agent and every SSM association compliance record reads COMPLIANT after execution; the Associations list names the documents, schedules, and targets that carry the baseline, with Overview.Status and LastExecutionDate showing it ran. Managed rule identifiers: EC2_INSTANCE_MANAGED_BY_SSM (rule name ec2-instance-managed-by-systems-manager), EC2_MANAGEDINSTANCE_ASSOCIATION_COMPLIANCE_STATUS_CHECK

## Assertions

_No machine-checkable assertion is authored for this recipe._

## GovCloud

AWS Config and Systems Manager are available in AWS GovCloud (US); instance, document, and association ARNs use partition arn:aws-us-gov

## Notes

The telemetry proves a configuration is being enforced and drift corrected — it does not prove the enforced content IS your approved baseline. That the association's SSM document encodes the hardened settings you baselined (CIS/STIG content, approved through your change process) is the human judgement half; keep the document version and its approval record alongside this output. Two limits to state plainly: EC2_INSTANCE_MANAGED_BY_SSM does not flag a stopped instance whose agent is running, and this whole recipe is EC2-only — container images, Lambda, and managed-service settings need their own baseline evidence. CM-08 inventory is a separate recipe, not this one.

## References

- {"title":"AWS Config managed rule: ec2-instance-managed-by-systems-manager","url":"https://docs.aws.amazon.com/config/latest/developerguide/ec2-instance-managed-by-systems-manager.html"}
- {"title":"AWS Config managed rule: ec2-managedinstance-association-compliance-status-check","url":"https://docs.aws.amazon.com/config/latest/developerguide/ec2-managedinstance-association-compliance-status-check.html"}
- {"title":"AWS Systems Manager State Manager (associations define the state to maintain)","url":"https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-state.html"}
- {"title":"AWS CLI: ssm list-associations","url":"https://docs.aws.amazon.com/cli/latest/reference/ssm/list-associations.html"}