feat(aws-ssm): Run Command lifecycle, parameter checks, list and cancel ops (SSM-2)

docs/coverage/aws/ssm.md

@@ -41,13 +41,24 @@ Documents is an OPTIONAL capability, discovered by type assertion. It covers
 | `UpdateDocument` |  |
 | `UpdateDocumentDefaultVersion` |  |
 
+### ManagedNodes
+
+ManagedNodes is an OPTIONAL capability, discovered by type assertion. Every
+
+| Operation | Description |
+| --- | --- |
+| `DescribeInstanceInformation` |  |
+
 ### RunCommand
 
 RunCommand is an OPTIONAL capability, discovered by type assertion.
 
 | Operation | Description |
 | --- | --- |
-| `GetCommandInvocation` |  |
+| `CancelCommand` | CancelCommand cancels the command on the given instances, or on all of |
+| `GetCommandInvocation` | GetCommandInvocation reports one instance's run. pluginName selects a |
+| `ListCommandInvocations` | ListCommandInvocations returns the matching invocations, newest command |
+| `ListCommands` | ListCommands returns the matching commands, newest first. |
 | `SendCommand` |  |
 
 ### ServiceSettings

docs/coverage/coverage.json

@@ -12512,12 +12512,34 @@
           }
         ]
       },
+      {
+        "name": "ManagedNodes",
+        "doc": "ManagedNodes is an OPTIONAL capability, discovered by type assertion. Every",
+        "operations": [
+          {
+            "name": "DescribeInstanceInformation"
+          }
+        ]
+      },
       {
         "name": "RunCommand",
         "doc": "RunCommand is an OPTIONAL capability, discovered by type assertion.",
         "operations": [
           {
-            "name": "GetCommandInvocation"
+            "name": "CancelCommand",
+            "doc": "CancelCommand cancels the command on the given instances, or on all of"
+          },
+          {
+            "name": "GetCommandInvocation",
+            "doc": "GetCommandInvocation reports one instance's run. pluginName selects a"
+          },
+          {
+            "name": "ListCommandInvocations",
+            "doc": "ListCommandInvocations returns the matching invocations, newest command"
+          },
+          {
+            "name": "ListCommands",
+            "doc": "ListCommands returns the matching commands, newest first."
           },
           {
             "name": "SendCommand"

internal/settle/settle.go

@@ -34,6 +34,9 @@ const (
 
 	DefaultExperimentInitiateSettle = 1 * time.Second // FIS experiment initiating->running
 
+	DefaultCommandDeliverySettle = 1 * time.Second // SSM Run Command invocation Pending->InProgress
+	DefaultCommandRunSettle      = 5 * time.Second // SSM Run Command invocation InProgress->Success
+
 	DefaultCacheSettle       = 2 * time.Second // ElastiCache/Redis/Memorystore creating->available
 	DefaultCacheModifySettle = 1 * time.Second // cache modifying->available
 	DefaultClusterSettle     = 3 * time.Second // Redshift/MemoryDB/Bigtable creating->available

providers/aws/aws.go

@@ -447,6 +447,8 @@ func newProvider(o *config.Options, shared *GlobalServices) *Provider {
 	p.SecretsManager.SetKMSCrypto(kmsCrypto)
 	p.SSM.SetKMSCrypto(kmsCrypto)
 	p.SSM.SetInstanceResolver(p.EC2)
+	// Run Command writes invocation output to the command's OutputS3BucketName.
+	p.SSM.SetOutputStore(p.S3)
 	// ECS-registered container instances surface as managed EC2 instances, so
 	// #159 (ECS) composes with #300 (EC2 managed-resource visibility).
 	p.ECS.SetManagedInstanceLauncher(p.EC2)