AWS Systems Manager

Store and update Parameter Store values and their history, and create and read command-document records.

Plan: Pro143 of 152 operations implemented5Known differences

SecureString uses reversible local encoding; document storage does not establish command, Automation or session execution.

Example checked on Vera 1.2.2, 8 November 2026. Each coverage note names its own evidence and date.

Connect

Activate your license key and start the emulator with the Vera launcher, as in Activate Pro, then run this in a terminal of its own, from an empty scratch directory. It gives the official AWS CLI dummy credentials and a config file of its own, so no AWS account is needed and your own AWS profile isn't touched.

export VERA_ENDPOINT="http://localhost:5003"
export AWS_ACCESS_KEY_ID=test AWS_SECRET_ACCESS_KEY=test
export AWS_REGION=us-east-1 AWS_DEFAULT_REGION=us-east-1
export AWS_SHARED_CREDENTIALS_FILE=/dev/null
export AWS_EC2_METADATA_DISABLED=true
export AWS_PAGER="" AWS_CLI_AUTO_PROMPT=off
unset AWS_PROFILE AWS_DEFAULT_PROFILE
unset AWS_SESSION_TOKEN AWS_SECURITY_TOKEN
unset AWS_WEB_IDENTITY_TOKEN_FILE AWS_ROLE_ARN AWS_ROLE_SESSION_NAME
unset AWS_CONTAINER_CREDENTIALS_FULL_URI
unset AWS_CONTAINER_CREDENTIALS_RELATIVE_URI
cat > vera-aws-config <<'EOF'
[default]
region = us-east-1
output = json
cli_binary_format = base64
s3 =
    addressing_style = path
EOF
export AWS_CONFIG_FILE="$PWD/vera-aws-config"

When you've finished every example in this terminal, close it and delete vera-aws-config, not before.

Use the AWS CLI’s ssm commands. The emulator serves the 2014-11-06 API over the AWS JSON protocol.

Example

Create a String parameter and read it back:

aws --endpoint-url "$VERA_ENDPOINT" ssm put-parameter --name /vera-docs/audit/message \
  --type String --value 'hello from example.net' --description 'Documentation parameter'
aws --endpoint-url "$VERA_ENDPOINT" ssm get-parameter --name /vera-docs/audit/message

The parameter comes back at version 1. These are selected fields; the LastModifiedDate differs on every run.

{
    "Parameter": {
        "Name": "/vera-docs/audit/message",
        "Type": "String",
        "Value": "hello from example.net",
        "Version": 1,
        "LastModifiedDate": "2026-11-05T20:38:02+00:00",
        "ARN": "arn:aws:ssm:us-east-1:123456789012:parameter/vera-docs/audit/message",
        "DataType": "text"
    }
}

Overwrite it, and the update returns version 2. The history then lists both versions:

aws --endpoint-url "$VERA_ENDPOINT" ssm put-parameter --name /vera-docs/audit/message \
  --type String --value 'updated example.net' --overwrite
aws --endpoint-url "$VERA_ENDPOINT" ssm get-parameter-history --name /vera-docs/audit/message

Store a command document and read it back. Its content comes back as written. The document is a stored record: its aws:runShellScript step doesn’t run.

aws --endpoint-url "$VERA_ENDPOINT" ssm create-document --name DocsAudit \
  --document-type Command --document-format JSON \
  --content '{"schemaVersion": "2.2", "description": "Documentation command record", "mainSteps": [{"action": "aws:runShellScript", "name": "docs", "inputs": {"runCommand": ["echo documentation"]}}]}'
aws --endpoint-url "$VERA_ENDPOINT" ssm get-document --name DocsAudit

To clean up, delete the document and the parameter:

aws --endpoint-url "$VERA_ENDPOINT" ssm delete-document --name DocsAudit
aws --endpoint-url "$VERA_ENDPOINT" ssm delete-parameter --name /vera-docs/audit/message

Supported features

Parameters: String parameters, created, read, overwritten and deleted. Each overwrite adds a version to the history. In earlier recorded comparisons, the PutParameter, LabelParameterVersion and DeleteParameter responses matched AWS’s, and after deletion GetParameters listed the name under InvalidParameters.
Command documents, stored, read back with their JSON content as submitted, and deleted.
SecureString parameters, with local encoding: a value is stored and read back, but it isn’t encrypted with KMS: see Limitations.
Also served, not checked in Vera 1.2.0 preview or Vera 1.2.0-rc.3: reads by path, associations, maintenance windows, patch baselines, inventory and compliance, OpsCenter items, managed-node activations and tags. Commands, Automation and sessions are served too, with the limits under Limitations.

Limitations

The main limits are below. A few more apply to every service, and the API coverage notes cover smaller differences.

No command, Automation or session execution was established. Storing a command document doesn’t run it, and no command was seen to run on a node. In Vera 1.2.0 preview, a SendCommand request naming an instance that doesn’t exist was rejected with InvalidInstanceId, so instance references aren’t simply ignored. Earlier source inspection found that commands, Automation and sessions record synthetic results; testing of Vera 1.2.0 preview didn’t positively exercise managed nodes, Automation, patching or interactive sessions. A session can return a stream URL on an AWS host: don’t connect to it to check the emulator.
SecureString uses reversible local encoding. A SecureString write naming a KMS alias that doesn’t exist succeeded. A normal read returned emulated-kms:cHJpdmF0ZS1leGFtcGxl, and a read with WithDecryption returned the original value, private-example. That’s local encoding, not KMS cryptography.
Not yet verified: parameter policies, expiry and the full semantics of parameter hierarchies.

API coverage

Every operation in AWS's published 2014-11-06 API (SDK model, botocore 1.43.105), and whether the emulator implements it. Availability combines the earlier implementation inventory with the dated observations below; checking a page's example does not verify every operation. Each note names its evidence first; an observation given without a build or date comes from earlier testing, on 3 November 2026. What the statuses mean

Operation	Status	Notes
AddTagsToResource	Implemented
AssociateOpsItemRelatedItem	Implemented
CancelCommand	Implemented
CancelMaintenanceWindowExecution	Implemented
CreateActivation	Implemented
CreateAssociation	Implemented
CreateAssociationBatch	Implemented
CreateCloudConnector	Not implemented
CreateDocument	Implemented	Local observation: Vera 1.2.0 preview, 5 November 2026 — Stored a JSON `Command` document. Storing it doesn't run its steps.
CreateMaintenanceWindow	Implemented
CreateOpsItem	Implemented
CreateOpsMetadata	Implemented
CreatePatchBaseline	Implemented
CreateResourceDataSync	Implemented
DeleteActivation	Implemented
DeleteAssociation	Implemented
DeleteCloudConnector	Not implemented
DeleteDocument	Implemented	Local observation: Vera 1.2.0 preview, 5 November 2026 — Deleted the example's document.
DeleteInventory	Implemented
DeleteMaintenanceWindow	Implemented
DeleteOpsItem	Implemented
DeleteOpsMetadata	Implemented
DeleteParameter	Implemented	Local observation: Vera 1.2.0 preview, 5 November 2026 — Deleted the example's parameter.
DeleteParameters	Implemented
DeletePatchBaseline	Implemented
DeleteResourceDataSync	Implemented
DeleteResourcePolicy	Implemented
DeregisterManagedInstance	Implemented
DeregisterPatchBaselineForPatchGroup	Implemented
DeregisterTargetFromMaintenanceWindow	Implemented
DeregisterTaskFromMaintenanceWindow	Implemented
DescribeActivations	Implemented
DescribeAssociation	Implemented
DescribeAssociationExecutionTargets	Implemented
DescribeAssociationExecutions	Implemented
DescribeAutomationExecutions	Implemented
DescribeAutomationStepExecutions	Implemented
DescribeAvailablePatches	Implemented
DescribeDocument	Implemented
DescribeDocumentPermission	Implemented
DescribeEffectiveInstanceAssociations	Implemented
DescribeEffectivePatchesForPatchBaseline	Implemented
DescribeInstanceAssociationsStatus	Implemented
DescribeInstanceInformation	Implemented
DescribeInstancePatchStates	Implemented
DescribeInstancePatchStatesForPatchGroup	Implemented
DescribeInstancePatches	Implemented
DescribeInstanceProperties	Implemented
DescribeInventoryDeletions	Implemented
DescribeMaintenanceWindowExecutionTaskInvocations	Implemented
DescribeMaintenanceWindowExecutionTasks	Implemented
DescribeMaintenanceWindowExecutions	Implemented
DescribeMaintenanceWindowSchedule	Implemented
DescribeMaintenanceWindowTargets	Implemented
DescribeMaintenanceWindowTasks	Implemented
DescribeMaintenanceWindows	Implemented
DescribeMaintenanceWindowsForTarget	Implemented
DescribeOpsItems	Implemented
DescribeParameters	Implemented
DescribePatchBaselines	Implemented
DescribePatchGroupState	Implemented
DescribePatchGroups	Implemented
DescribePatchProperties	Implemented
DescribeSessions	Implemented
DisassociateOpsItemRelatedItem	Implemented
GetAccessToken	Implemented
GetAutomationExecution	Implemented
GetCalendarState	Implemented
GetCloudConnector	Not implemented
GetCommandInvocation	Implemented
GetConnectionStatus	Implemented
GetDefaultPatchBaseline	Implemented
GetDeployablePatchSnapshotForInstance	Implemented
GetDocument	Implemented	Local observation: Vera 1.2.0 preview, 5 November 2026 — Returned the stored document, with content matching the submitted JSON.
GetExecutionPreview	Implemented
GetInventory	Implemented
GetInventorySchema	Implemented
GetMaintenanceWindow	Implemented
GetMaintenanceWindowExecution	Implemented
GetMaintenanceWindowExecutionTask	Implemented
GetMaintenanceWindowExecutionTaskInvocation	Implemented
GetMaintenanceWindowTask	Implemented
GetOpsItem	Implemented
GetOpsMetadata	Implemented
GetOpsSummary	Not implemented
GetParameter	Known difference	Local observation: Vera 1.2.0 preview, 5 November 2026 — For a `SecureString`, a normal read returned `emulated-kms:cHJpdmF0ZS1leGFtcGxl` and a read with `WithDecryption` returned the original value, `private-example`: reversible local encoding, not KMS ciphertext or decryption compatibility, as earlier source inspection found. `String` reads returned the stored value and version.
GetParameterHistory	Implemented	Local observation: Vera 1.2.0 preview, 5 November 2026 — Listed both versions of an overwritten `String` parameter.
GetParameters	Implemented
GetParametersByPath	Implemented
GetPatchBaseline	Implemented
GetPatchBaselineForPatchGroup	Implemented
GetResourcePolicies	Implemented
GetServiceSetting	Implemented
LabelParameterVersion	Implemented
ListAssociationVersions	Implemented
ListAssociations	Implemented
ListCloudConnectors	Not implemented
ListCommandInvocations	Implemented
ListCommands	Implemented
ListComplianceItems	Implemented
ListComplianceSummaries	Implemented
ListDocumentMetadataHistory	Implemented
ListDocumentVersions	Implemented
ListDocuments	Implemented
ListInventoryEntries	Implemented
ListNodes	Implemented
ListNodesSummary	Not implemented
ListOpsItemEvents	Implemented
ListOpsItemRelatedItems	Implemented
ListOpsMetadata	Implemented
ListResourceComplianceSummaries	Not implemented
ListResourceDataSync	Implemented
ListTagsForResource	Implemented
ModifyDocumentPermission	Implemented
PutComplianceItems	Implemented
PutInventory	Implemented
PutParameter	Known difference	Local observation: Vera 1.2.0 preview, 5 November 2026 — A `SecureString` write naming a KMS alias that doesn't exist succeeded, and the value was stored with reversible local encoding rather than KMS encryption: see `GetParameter`. `String` writes, and an overwrite from version 1 to 2, worked.
PutResourcePolicy	Implemented
RegisterDefaultPatchBaseline	Implemented
RegisterPatchBaselineForPatchGroup	Implemented
RegisterTargetWithMaintenanceWindow	Implemented
RegisterTaskWithMaintenanceWindow	Implemented
RemoveTagsFromResource	Implemented
ResetServiceSetting	Implemented
ResumeSession	Implemented
SendAutomationSignal	Implemented
SendCommand	Known difference	Source inspection: Earlier build, 3 November 2026 — Stores `Success` and completed target counts without executing a command on a node. Local observation: Vera 1.2.0 preview, 5 November 2026 — A request naming an instance that doesn't exist returned `InvalidInstanceId`. That's validation, not proof that a valid node runs commands.
StartAccessRequest	Implemented
StartAssociationsOnce	Implemented
StartAutomationExecution	Known difference	Source inspection: Earlier build, 3 November 2026 — Immediately stores `Success`, matching start and end times and synthetic successful-step progress without executing the Automation document. Not exercised in Vera 1.2.0 preview.
StartChangeRequestExecution	Implemented
StartExecutionPreview	Implemented
StartSession	Known difference	Source inspection: Earlier build, 3 November 2026 — Stores a `Connected` session with a synthetic token and an AWS-hosted `ssmmessages` stream URL. This path does not provide an emulator-hosted interactive session channel. Do not connect to the returned AWS URL to validate local behavior. Not exercised in Vera 1.2.0 preview.
StopAutomationExecution	Implemented
TerminateSession	Implemented
UnlabelParameterVersion	Implemented
UpdateAssociation	Implemented
UpdateAssociationStatus	Implemented
UpdateCloudConnector	Not implemented
UpdateDocument	Implemented
UpdateDocumentDefaultVersion	Implemented
UpdateDocumentMetadata	Implemented
UpdateMaintenanceWindow	Implemented
UpdateMaintenanceWindowTarget	Implemented
UpdateMaintenanceWindowTask	Implemented
UpdateManagedInstanceRole	Implemented
UpdateOpsItem	Implemented
UpdateOpsMetadata	Implemented
UpdatePatchBaseline	Implemented
UpdateResourceDataSync	Implemented
UpdateServiceSetting	Implemented
ValidateCloudConnector	Not implemented