# Templatefile with json file and aws ssm automation

**URL:** <https://discuss.hashicorp.com/t/templatefile-with-json-file-and-aws-ssm-automation/60231>\
**Category:** AWS\
**Created:** [November 21, 2023, 3:42pm UTC](https://discuss.hashicorp.com/t/templatefile-with-json-file-and-aws-ssm-automation/60231 "2023-11-21T15:42:00Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Johana30](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/johana30/32/35220_2.png) [@Johana30](https://discuss.hashicorp.com/u/Johana30)\
**Post date:** [November 21, 2023, 3:42pm UTC](https://discuss.hashicorp.com/t/templatefile-with-json-file-and-aws-ssm-automation/60231/1 "2023-11-21T15:42:00Z")

</div>

I used ssm Terraform module to create windows maintenance, I have created a task on one of this windows maintenance.

I have created a json file what it will help me to create a new ssm document.  
The creations of the ssm document works fine, the document needs security\_id and other values, I have tried to use templeatefile but still not working, the windows maintenance fails with error “ **The supplied parameters for invoking the specified Automation document are incorrect.** ”  
I have tried without local, just the resource but still not working.

Terraform code:

```auto
resource "aws_ssm_document" "t-document" {
  name = "SGDocument"
  document_type = "Automation"
  document_format = "JSON"

  content = templatefile("${path.module}/internet-SG.json.tpl",
    {
      SecurityGroupId = local.SecurityGroupId 
      AutomationAssumeRole = local.AutomationAssumeRole
       
    })
}

```

Jeson file:

```auto
{
  "schemaVersion": "0.3",
  "parameters": {
    "SecurityGroupId": {
      "type": "String",
      "description": "(Required) The security group ID.",
      "allowedPattern": "^(sg-)([0-9a-f]){1,}$"
    },
    "AutomationAssumeRole": {
      "type": "String",
      "description": "(Optional) The ARN of the role that allows Automation to perform the actions on your behalf.",
      "default": "",
      "allowedPattern": "^arn:aws(-cn|-us-gov)?:iam::\\d{12}:role\\/[\\w+=,.@_\\/-]+|^$"
    }
  },
  "mainSteps": [
    {
      "name": "ModifySecurityGroup",
      "action": "aws:executeScript",
      "onFailure": "Abort",
      
    }
  ]
}

```

---

<div class="post-metadata">

**Author:** ![Johana30](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/johana30/32/35220_2.png) [@Johana30](https://discuss.hashicorp.com/u/Johana30)\
**Post date:** [December 6, 2023, 10:20am UTC](https://discuss.hashicorp.com/t/templatefile-with-json-file-and-aws-ssm-automation/60231/2 "2023-12-06T10:20:34Z")

</div>

After doing more research I found the correct way to pass the variables to the document.

```auto
{
  "schemaVersion": "0.3",
  "parameters": {
    "SecurityGroupId": {
      "type": "String",
      "description": "(Required) The security group ID.",
      "allowedPattern": "^(sg-)([0-9a-f]){1,}$"
    },
    "AutomationAssumeRole": {
      "type": "String",
      "description": "(Optional) The ARN of the role that allows Automation to perform the actions on your behalf.",
      "default": "",
      "allowedPattern": "^arn:aws(-cn|-us-gov)?:iam::\\d{12}:role\\/[\\w+=,.@_\\/-]+|^$"
    }
  },
  "mainSteps": [
    {
      "name": "ModifySecurityGroup",
      "action": "aws:executeScript",
      "onFailure": "Abort",
      "isCritical": true,
      "isEnd": true,
      "timeoutSeconds": 600,
      "description": "## ModifySecurityGroup\nAdds a new rule to the security group allowing all traffic (0.0.0.0/0).\n## Inputs\n* SecurityGroupId: The security group ID.\n## Outputs\nThis step has no outputs.\n",
      "inputs": {
        "Runtime": "python3.7",
        "Handler": "modify_security_group_handler",
        "InputPayload": {
          "SecurityGroupId": "${SecurityGroupId}"
        },
        "Script": "import boto3\n\nec2_resource = boto3.resource(\"ec2\")\nec2_client = boto3.client(\"ec2\")\n\ndef modify_security_group_handler(event, context):\n sg_id = event[\"SecurityGroupId\"]\n sg_resource = ec2_resource.SecurityGroup(sg_id)\n successful = True\n errorMsg = \"\"\n //more code
      }
  ]
}

```

in the document steps details I can see the value, the sg-id is correct, but when I run the maintenance windows still the error and it is the same "_The supplied parameters for invoking the specified Automation document are incorrect."_

 ![image](https://global.discourse-cdn.com/hashicorp/original/3X/f/3/f3dc968b2cd203b2b32a09257c6e854ae26f0a8e.png)

---

<div class="post-metadata">

**Author:** ![Johana30](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/johana30/32/35220_2.png) [@Johana30](https://discuss.hashicorp.com/u/Johana30)\
**Post date:** [December 19, 2023, 4:20pm UTC](https://discuss.hashicorp.com/t/templatefile-with-json-file-and-aws-ssm-automation/60231/3 "2023-12-19T16:20:13Z")

</div>

All Working now.

> Blockquote