创建SSM文档时出现InvalidDocumentContent错误的原因是什么？

错误原因 #

你的SSM文档中mainSteps里的步骤名称包含空格，AWS SSM文档对步骤名称的命名有严格限制：只能使用字母、数字、连字符（-）和下划线（_），不允许出现空格或其他特殊字符。你当前的步骤名称"Deploy svc db proxy container"包含空格，这就是触发InvalidDocumentContent错误的直接原因。

修正后的文档 #

将步骤名称中的空格替换为连字符或下划线即可解决问题，以下是修正后的完整JSON文档：

{
  "schemaVersion": "2.2",
  "description": "Run svc-db-proxy Container",
  "parameters": {
    "AccessKeyID": {
      "type": "String",
      "description": "AWS Access Key ID"
    },
    "SecretAccessKey": {
      "type": "String",
      "description": "AWS Secret Access Key"
    },
    "AWSRegion": {
      "type": "String",
      "description": "AWS Region",
      "default": "ca-central-1"
    },
    "Registry": {
      "type": "String",
      "description": "AWS ECR Registry URL"
    },
    "Repo": {
      "type": "String",
      "description": "AWS ECR Repository"
    },
    "Tag": {
      "type": "String",
      "description": "GitHub SHA used for Image tag"
    }
  },
  "mainSteps": [
    {
      "action": "aws:runShellScript",
      "name": "Deploy-svc-db-proxy-container",
      "inputs": {
        "timeoutSeconds": "3600",
        "runCommand": [
          "#!/bin/bash",
          "export AWS_ACCESS_KEY_ID=\"{{AccessKeyID}}\"",
          "export AWS_SECRET_ACCESS_KEY=\"{{SecretAccessKey}}\"",
          "docker login -u AWS -p $(aws ecr get-login-password --region \"{{AWSRegion}}\") {{Registry}}",
          "docker kill {{Repo}} || true",
          "docker container prune -f || true",
          "docker image prune -af || true",
          "docker pull {{Registry}}/{{Repo}}:{{Tag}}",
          "docker run --name {{Repo}} -p 8001:8000 -d {{Registry}}/{{Repo}}:{{Tag}}",
          "docker logout {{Registry}}",
          "unset \"AWS_ACCESS_KEY_ID\"",
          "unset \"AWS_SECRET_ACCESS_KEY\""
        ]
      }
    }
  ]
}

额外优化建议 #

• 避免明文传递密钥：当前文档直接将AccessKey和SecretKey作为参数传递，存在严重安全风险。建议为EC2实例关联具有ECR访问权限的IAM角色，这样无需手动配置密钥，aws ecr get-login-password会自动使用实例角色权限。
• 参数安全优化：可以将SecretAccessKey的类型设置为String并开启sensitive: true，这样在控制台和日志中会隐藏该参数的值，增强安全性：

  "SecretAccessKey": {
    "type": "String",
    "description": "AWS Secret Access Key",
    "sensitive": true
  }
  

内容的提问来源于stack exchange，提问作者Sree Teja