Skip to content

AWS

Manage resources and execute AWS commands in workflows

Initially, you can leave the “IAM Role ARN” field empty, as you will be guided through the identity provider and IAM role creation process.

The On Alarm trigger starts a workflow execution when a CloudWatch alarm transitions to the ALARM state.

  • Incident response: Notify responders and open incidents when alarms fire
  • Auto-remediation: Execute rollback or recovery workflows immediately
  • Audit and reporting: Track alarm transitions over time
  • Region: AWS region where alarms are evaluated
  • Alarms: Optional alarm name filters (supports equals, not-equals, and regex matches)
  • State: Only trigger for alarms in the specified state (OK, ALARM, or INSUFFICIENT_DATA)

Each alarm event includes:

  • detail.alarmName: CloudWatch alarm name
  • detail.state.value: Current alarm state
  • detail.previousState.value: Previous alarm state
{
"data": {
"account": "123456789012",
"detail": {
"alarmName": "HighCPUUtilization",
"previousState": {
"reason": "Threshold Crossed: 1 datapoint [35.0 (20/11/24 20:29:00)] was not greater than or equal to the threshold (90.0).",
"timestamp": "2024-11-20T20:30:33.000+0000",
"value": "OK"
},
"state": {
"reason": "Threshold Crossed: 1 datapoint [95.0 (20/11/24 20:34:00)] was greater than or equal to the threshold (90.0).",
"timestamp": "2024-11-20T20:35:33.000+0000",
"value": "ALARM"
}
},
"detail-type": "CloudWatch Alarm State Change",
"id": "2f1ecf5c-8bc9-4b7d-9e76-8df420e8e1a7",
"region": "us-east-1",
"resources": [
"arn:aws:cloudwatch:us-east-1:123456789012:alarm:HighCPUUtilization"
],
"source": "aws.cloudwatch",
"time": "2024-11-20T20:35:33Z",
"version": "0"
},
"timestamp": "2026-02-10T12:00:00Z",
"type": "aws.cloudwatch.alarm"
}

The On Package Version trigger starts a workflow execution when a package version is created, modified, or deleted in AWS CodeArtifact.

  • Release automation: Trigger downstream workflows when a new package version is published
  • Dependency monitoring: Notify teams about changes to shared libraries
  • Compliance checks: Validate artifacts before promotion
{
"data": {
"account": "123456789012",
"detail": {
"changes": {
"assetsAdded": 1,
"assetsRemoved": 0,
"assetsUpdated": 0,
"metadataUpdated": false,
"statusChanged": true
},
"domainName": "example-domain",
"domainOwner": "123456789012",
"eventDeduplicationId": "5f87d1a3-2c1f-4ab0-8f55-8f4c2b4a5c76",
"operationType": "Created",
"packageFormat": "npm",
"packageName": "@scope/example-package",
"packageNamespace": null,
"packageVersion": "1.2.3",
"packageVersionRevision": "E30D52B451F42F41",
"packageVersionState": "Published",
"repositoryAdministrator": "arn:aws:sts::123456789012:assumed-role/ExampleRole/example-user",
"repositoryName": "example-repo",
"sequenceNumber": 1
},
"detail-type": "CodeArtifact Package Version State Change",
"id": "d9e9ff4a-3514-3d2c-b6b8-1fb5e0b9d3b2",
"region": "us-east-1",
"resources": [
"arn:aws:codeartifact:us-east-1:123456789012:repository/example-domain/example-repo"
],
"source": "aws.codeartifact",
"time": "2024-11-20T20:35:33Z",
"version": "0"
},
"timestamp": "2026-03-10T14:25:30.31254162Z",
"type": "aws.codeartifact.package.version"
}

The On Image trigger starts a workflow execution when an EC2 AMI changes state.

  • Image pipeline orchestration: Continue workflows when a new AMI becomes available
  • Failure handling: Alert and remediate when AMI creation fails
  • Compliance workflows: Run validation and distribution after image creation
  • Region: AWS region where AMI state changes are monitored
  • Image State: State to trigger on (pending, available, failed)

Each AMI state event includes:

  • detail.ImageId: AMI ID (for example: ami-1234567890abcdef0)
  • detail.State: AMI state
  • detail.ErrorMessage: Error message for failed states (if available)
{
"data": {
"account": "123456789012",
"detail": {
"ImageId": "ami-07f0e4f3e9c123abc",
"State": "available"
},
"detail-type": "EC2 AMI State Change",
"id": "f74f3de5-f9b7-4f3d-909a-531fc3ff2f14",
"region": "us-east-1",
"resources": [
"arn:aws:ec2:us-east-1::image/ami-07f0e4f3e9c123abc"
],
"source": "aws.ec2",
"time": "2026-02-10T12:10:00Z",
"version": "0"
},
"timestamp": "2026-02-10T12:10:01Z",
"type": "aws.ec2.image"
}

The On Image Push trigger starts a workflow execution when an image is pushed to an ECR repository.

  • Build pipelines: Trigger builds and deployments on container pushes
  • Security automation: Kick off scans or alerts for newly pushed images
  • Release workflows: Promote artifacts when a tag is published
  • Repositories: Optional filters for ECR repository names
  • Image Tags: Optional filters for image tags (for example: latest or ^v[0-9]+)

Each image push event includes:

  • detail.repository-name: ECR repository name
  • detail.image-tag: Tag that was pushed
  • detail.image-digest: Digest of the image
{
"data": {
"account": "123456789012",
"detail": {
"action-type": "PUSH",
"image-digest": "sha256:2c26b46b68ffc68ff99b453c1d30413413422f1642f0e2b8c7b8a0b8a96a909e",
"image-tag": "latest",
"repository-arn": "arn:aws:ecr:us-east-1:123456789012:repository/my-repo",
"repository-name": "my-repo",
"result": "SUCCESS"
},
"detail-type": "ECR Image Action",
"id": "c1b45a2c-9c3f-4c52-bc98-5ea31ce17692",
"region": "us-east-1",
"resources": [
"arn:aws:ecr:us-east-1:123456789012:repository/my-repo"
],
"source": "aws.ecr",
"time": "2024-01-01T12:00:00Z",
"version": "0"
},
"timestamp": "2026-02-03T12:00:00Z",
"type": "aws.ecr.image.push"
}

The On Image Scan trigger starts a workflow execution when an ECR image scan completes.

  • Security automation: Notify teams or open issues on new findings
  • Compliance checks: Gate promotions based on severity thresholds
  • Reporting: Aggregate scan findings across repositories
  • Repositories: Optional filters for ECR repository names
  • Enhanced scanning: Enhanced scanning events are sent by Amazon Inspector (aws.inspector2)

Each image scan event includes:

  • detail.scan-status: Scan status (for example: COMPLETE)
  • detail.repository-name: ECR repository name
  • detail.image-digest: Digest of the image
  • detail.image-tags: Tags associated with the image
  • detail.finding-severity-counts: Counts per severity level (if any)
{
"data": {
"account": "123456789012",
"detail": {
"finding-severity-counts": {
"CRITICAL": 10,
"MEDIUM": 9
},
"image-digest": "sha256:7f5b2640fe6fb4f46592dfd3410c4a79dac4f89e4782432e0378abcd1234",
"image-tags": [],
"repository-name": "my-repo",
"scan-status": "COMPLETE"
},
"detail-type": "ECR Image Scan",
"id": "df8b66c7-62c7-4b8a-9a6b-6ad7d6d8b3a2",
"region": "us-east-1",
"resources": [
"arn:aws:ecr:us-east-1:123456789012:repository/my-repo"
],
"source": "aws.ecr",
"time": "2024-01-01T12:00:00Z",
"version": "0"
},
"timestamp": "2026-03-10T14:25:30.31254162Z",
"type": "aws.ecr.image.scan"
}

The On Topic Message trigger starts a workflow execution when a message is published to an AWS SNS topic.

  • Event-driven automation: React to messages published by external systems
  • Notification processing: Handle SNS payloads in workflow steps
  • Routing and enrichment: Trigger downstream workflows based on topic activity

During setup, SuperPlane creates a webhook endpoint for this trigger and subscribes it to the selected SNS topic using HTTPS. SNS sends notification payloads to the webhook endpoint, which then emits workflow events.

{
"data": {
"account": "123456789012",
"detail": {
"message": "{\"orderId\":\"ord_123\",\"status\":\"created\"}",
"messageId": "95df01b4-ee98-5cb9-9903-4c221d41eb5e",
"subject": "order.created",
"timestamp": "2026-01-10T10:00:00Z",
"topicArn": "arn:aws:sns:us-east-1:123456789012:orders-events"
},
"message": "{\"orderId\":\"ord_123\",\"status\":\"created\"}",
"messageAttributes": {
"eventType": {
"Type": "String",
"Value": "order.created"
}
},
"messageId": "95df01b4-ee98-5cb9-9903-4c221d41eb5e",
"region": "us-east-1",
"subject": "order.created",
"timestamp": "2026-01-10T10:00:00Z",
"topicArn": "arn:aws:sns:us-east-1:123456789012:orders-events",
"type": "Notification"
},
"timestamp": "2026-01-10T10:00:02.000000000Z",
"type": "aws.sns.topic.message"
}

The Copy Package Versions component copies one or more package versions from a source repository to a destination repository in the same domain.

  • Promotion: Copy approved versions from staging to production
  • Replication: Mirror packages across repositories
  • Migration: Move versions between repos in the same domain
{
"failedVersions": {},
"successfulVersions": {
"1.0.0": {
"revision": "REVISION1",
"status": "Published"
},
"1.0.1": {
"revision": "REVISION2",
"status": "Published"
}
}
}

The Create Repository component creates a new repository in an AWS CodeArtifact domain.

  • Automated setup: Create repositories as part of onboarding or pipeline setup
  • Environment replication: Mirror repository structure across domains
  • Workflow provisioning: Create a destination repository before copying packages
{
"repository": {
"administratorAccount": "123456789012",
"arn": "arn:aws:codeartifact:us-east-1:123456789012:repository/example-domain/my-repo",
"createdTime": 1706961600,
"description": "Example repository created by workflow",
"domainName": "example-domain",
"domainOwner": "123456789012",
"name": "my-repo"
}
}

The Delete Package Versions component permanently removes package versions and their assets. Deleted versions cannot be restored. To remove from view but keep the option to restore later, use Update Package Versions Status to set status to Archived instead.

  • Cleanup: Remove obsolete or invalid versions
  • Compliance: Permanently remove versions that must not be retained
  • Storage: Free space by deleting unused versions
{
"failedVersions": {},
"successfulVersions": {
"1.0.0": {
"revision": "REVISION1",
"status": "Deleted"
}
}
}

The Delete Repository component deletes a repository from an AWS CodeArtifact domain.

  • Cleanup: Remove repositories after migration or deprecation
  • Environment teardown: Delete temporary repositories created by workflows
  • Lifecycle management: Enforce retention by deleting old repositories
{
"repository": {
"administratorAccount": "123456789012",
"arn": "arn:aws:codeartifact:us-east-1:123456789012:repository/example-domain/my-repo",
"createdTime": 1706961600,
"description": "Deleted repository",
"domainName": "example-domain",
"domainOwner": "123456789012",
"name": "my-repo"
}
}

The Dispose Package Versions component deletes the assets of package versions and sets their status to Disposed. The version record remains so you can still see it in ListPackageVersions with status Disposed; assets cannot be restored.

  • Retention: Keep version metadata for audit while removing binary assets
  • Storage: Free asset storage while preserving version history
  • Lifecycle: Mark versions as disposed after a retention period
{
"failedVersions": {},
"successfulVersions": {
"1.0.0": {
"revision": "REVISION1",
"status": "Disposed"
}
}
}

The Get Package Version component retrieves metadata for a specific package version in AWS CodeArtifact.

  • Release automation: Resolve package metadata before promotion
  • Audit trails: Capture version details for reporting
  • Dependency checks: Validate status and origin of package versions
{
"data": {
"assets": [
{
"hashes": {
"sha256": "1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef"
},
"name": "example-package-1.2.3.tgz",
"size": 1234567890
}
],
"package": {
"displayName": "example-package",
"format": "npm",
"homePage": "https://example.com/example-package",
"licenses": [
{
"name": "MIT",
"url": "https://opensource.org/licenses/MIT"
}
],
"namespace": "@scope",
"origin": {
"domainEntryPoint": {
"externalConnectionName": "npmjs",
"repositoryName": "example-repo"
},
"originType": "EXTERNAL"
},
"packageName": "@scope/example-package",
"revision": "E30D52B451F42F41",
"sourceCodeRepository": "https://github.com/example/example-package",
"status": "Published",
"summary": "Example package for demonstration.",
"version": "1.2.3"
}
},
"timestamp": "2026-02-03T12:00:00Z",
"type": "aws.codeartifact.package.version"
}

CodeArtifact • Update Package Versions Status

Section titled “CodeArtifact • Update Package Versions Status”

The Update Package Versions Status component sets the status of package versions to Archived, Published, or Unlisted.

  • Lifecycle management: Archive old versions or publish after validation
  • Visibility: Unlist versions without deleting them
  • Compliance: Align version status with release policies
{
"failedVersions": {},
"successfulVersions": {
"1.0.0": {
"revision": "REVISION1",
"status": "Archived"
},
"1.0.1": {
"revision": "REVISION2",
"status": "Archived"
}
}
}

The Run Pipeline component triggers an AWS CodePipeline execution and waits for it to complete.

  • CI/CD orchestration: Trigger deployments from SuperPlane workflows
  • Pipeline automation: Run CodePipeline pipelines as part of workflow automation
  • Multi-stage deployments: Coordinate complex deployment pipelines
  • Workflow chaining: Chain multiple CodePipeline pipelines together
  1. Starts a CodePipeline execution with the specified pipeline name
  2. Waits for the pipeline to complete (monitored via EventBridge webhook and polling)
  3. Routes execution based on pipeline result:
    • Passed channel: Pipeline completed successfully
    • Failed channel: Pipeline failed or was cancelled
  • Region: AWS region where the pipeline exists
  • Pipeline: Pipeline name or ARN to execute
  • Passed: Emitted when pipeline completes successfully
  • Failed: Emitted when pipeline fails or is cancelled
  • The component automatically sets up EventBridge monitoring for pipeline completion
  • Falls back to polling if webhook doesn’t arrive
  • Can be cancelled, which will stop the running pipeline execution
{
"data": {
"detail": {
"execution-id": "a1b2c3d4-5678-90ab-cdef-111122223333",
"pipeline": "my-deploy-pipeline",
"state": "SUCCEEDED",
"version": 1
},
"pipeline": {
"executionId": "a1b2c3d4-5678-90ab-cdef-111122223333",
"name": "my-deploy-pipeline",
"state": "SUCCEEDED",
"status": "Succeeded"
}
},
"timestamp": "2026-02-10T14:35:22.518372841Z",
"type": "aws.codepipeline.pipeline.finished"
}

The Copy Image component copies an AMI to another AWS region.

  • Multi-region rollouts: Replicate golden images to deployment regions
  • Disaster recovery: Keep AMI backups in secondary regions
  • Promotion workflows: Copy validated images across environments
  • Destination Region: AWS region where the copied AMI is created
  • Source Region: AWS region where the source AMI exists
  • Source Image ID: AMI ID to copy
  • Image Name: Name for the copied AMI
  • Description: Optional AMI description
  • The component waits for EventBridge EC2 AMI State Change events for the copied AMI.
  • It completes when the AMI state becomes available.
  • It fails if the AMI state becomes failed.
{
"data": {
"image": {
"architecture": "x86_64",
"creationDate": "2026-02-19T09:00:00.000Z",
"description": "Copied for disaster recovery",
"hypervisor": "xen",
"imageId": "ami-0c0ffee1234567890",
"imageType": "machine",
"name": "my-app-2026-02-19",
"ownerId": "123456789012",
"region": "us-west-2",
"rootDeviceName": "/dev/xvda",
"rootDeviceType": "ebs",
"state": "available",
"virtualizationType": "hvm"
}
},
"timestamp": "2026-02-19T09:00:00Z",
"type": "aws.ec2.image"
}

The Create Image component creates a new Amazon Machine Image (AMI) from an EC2 instance.

  • Golden image pipelines: Build immutable infrastructure images from validated instances
  • Backup workflows: Snapshot instance state before deployments or migrations
  • Release automation: Produce versioned AMIs as part of CI/CD
  • Region: AWS region where the instance runs
  • Instance: EC2 instance ID to create an image from
  • Image Name: Name for the AMI
  • Description: Optional image description
  • No Reboot: If enabled, create the image without rebooting the instance
  • The component waits for EventBridge EC2 AMI State Change events for the created AMI.
  • It completes when the AMI state becomes available.
  • It fails if the AMI state becomes failed.
{
"data": {
"image": {
"architecture": "x86_64",
"creationDate": "2026-02-18T12:00:00.000Z",
"description": "Golden image for production",
"hypervisor": "xen",
"imageId": "ami-07f0e4f3e9c123abc",
"imageType": "machine",
"name": "my-app-2026-02-18",
"ownerId": "123456789012",
"region": "us-east-1",
"rootDeviceName": "/dev/xvda",
"rootDeviceType": "ebs",
"state": "available",
"virtualizationType": "hvm"
}
},
"timestamp": "2026-02-18T12:00:00Z",
"type": "aws.ec2.image"
}

The Deregister Image component removes an AMI from your account in a region.

  • Image lifecycle cleanup: Remove unused AMIs after promotion
  • Compliance operations: Retire images that should no longer be launched
  • Automation rollback: Clean up AMIs created by failed workflows
  • Region: AWS region where the AMI exists
  • Image ID: AMI ID to deregister
  • Delete Snapshots: If enabled, delete the snapshots associated with the AMI
{
"data": {
"deregistered": true,
"imageId": "ami-07f0e4f3e9c123abc",
"region": "us-east-1",
"requestId": "req-deregister"
},
"timestamp": "2026-02-19T09:10:00Z",
"type": "aws.ec2.image.deregistered"
}

The Disable Image component disables an AMI so it cannot be launched.

  • Risk containment: Prevent new launches from vulnerable images
  • Release control: Temporarily block image usage during maintenance
  • Lifecycle governance: Enforce policies before image retirement
  • Region: AWS region where the AMI exists
  • Image ID: AMI ID to disable
{
"data": {
"disabled": true,
"imageId": "ami-07f0e4f3e9c123abc",
"region": "us-east-1",
"requestId": "req-disable"
},
"timestamp": "2026-02-19T09:30:00Z",
"type": "aws.ec2.image.disabled"
}

The Disable Image Deprecation component removes the deprecation schedule from an AMI.

  • Release extension: Keep an image available longer than planned
  • Rollback support: Reopen older images for temporary use
  • Policy exceptions: Remove deprecation when operational needs change
  • Region: AWS region where the AMI exists
  • Image ID: AMI ID to remove deprecation from
{
"data": {
"deprecationEnabled": false,
"imageId": "ami-07f0e4f3e9c123abc",
"region": "us-east-1",
"requestId": "req-disable-deprecation"
},
"timestamp": "2026-02-19T09:50:00Z",
"type": "aws.ec2.image.deprecation.disabled"
}

The Enable Image component enables a previously disabled AMI.

  • Release promotion: Re-enable AMIs after staged validation
  • Operational recovery: Restore image availability after temporary restrictions
  • Lifecycle workflows: Toggle image launchability based on policy checks
  • Region: AWS region where the AMI exists
  • Image ID: AMI ID to enable
{
"data": {
"enabled": true,
"imageId": "ami-07f0e4f3e9c123abc",
"region": "us-east-1",
"requestId": "req-enable"
},
"timestamp": "2026-02-19T09:20:00Z",
"type": "aws.ec2.image.enabled"
}

The Enable Image Deprecation component sets a deprecation time for an AMI.

  • Release lifecycle: Schedule AMI retirement dates
  • Compliance enforcement: Ensure images expire on policy deadlines
  • Operational hygiene: Phase out outdated images in a controlled window
  • Region: AWS region where the AMI exists
  • Image ID: AMI ID to deprecate
  • Deprecate At: RFC3339 timestamp when deprecation takes effect
{
"data": {
"deprecateAt": "2026-04-01T00:00:00Z",
"deprecationEnabled": true,
"imageId": "ami-07f0e4f3e9c123abc",
"region": "us-east-1",
"requestId": "req-enable-deprecation"
},
"timestamp": "2026-02-19T09:40:00Z",
"type": "aws.ec2.image.deprecation.enabled"
}

The Get Image component retrieves metadata for an EC2 AMI.

  • Release automation: Validate AMI metadata before deployment
  • Operational checks: Inspect AMI state and ownership in workflows
  • Traceability: Resolve AMI details by image ID
  • Region: AWS region of the AMI
  • Image ID: AMI ID (for example: ami-1234567890abcdef0)
{
"data": {
"image": {
"architecture": "x86_64",
"creationDate": "2026-02-18T12:00:00.000Z",
"description": "Golden image for production",
"hypervisor": "xen",
"imageId": "ami-1234567890abcdef0",
"imageType": "machine",
"name": "my-app-2026-02-18",
"ownerId": "123456789012",
"region": "us-east-1",
"rootDeviceName": "/dev/xvda",
"rootDeviceType": "ebs",
"state": "available",
"virtualizationType": "hvm"
}
},
"timestamp": "2026-02-18T12:00:00Z",
"type": "aws.ec2.image"
}

The Get Image component retrieves image metadata from an ECR repository by digest, tag, or both.

  • Release automation: Fetch image details before deployment
  • Audit trails: Resolve digests and tags for traceability
  • Security workflows: Enrich findings with image metadata
  • Region: AWS region of the ECR repository
  • Repository: ECR repository name or ARN
  • Image Digest: Digest of the image (optional)
  • Image Tag: Tag of the image (optional)

At least one of Image Digest or Image Tag is required. If both are provided, the request includes both.

{
"data": {
"artifactMediaType": "application/vnd.docker.container.image.v1+json",
"imageDigest": "sha256:8f1d3e4f5a6b7c8d9e0f11121314151617181920212223242526272829303132",
"imageManifestMediaType": "application/vnd.docker.distribution.manifest.v2+json",
"imagePushedAt": "2026-02-03T12:00:00Z",
"imageSizeInBytes": 48273912,
"imageTags": [
"latest",
"v1.2.3"
],
"registryId": "123456789012",
"repositoryName": "my-repo"
},
"timestamp": "2026-02-03T12:00:00Z",
"type": "aws.ecr.image"
}

The Get Image Scan Findings component retrieves vulnerability scan results for an ECR image.

  • Security automation: Pull scan findings to drive alerting or approvals
  • Compliance checks: Validate images against severity thresholds
  • Reporting: Capture scan summaries and findings for audits
  • Region: AWS region of the ECR repository
  • Repository: ECR repository name or ARN
  • Image Digest: Digest of the image (optional)
  • Image Tag: Tag of the image (optional)

At least one of Image Digest or Image Tag is required. If both are provided, the request includes both.

{
"data": {
"imageId": {
"imageDigest": "sha256:8f1d3e4f5a6b7c8d9e0f11121314151617181920212223242526272829303132",
"imageTag": "latest"
},
"imageScanFindings": {
"findingSeverityCounts": {
"HIGH": 1
},
"findings": [
{
"attributes": [
{
"key": "package_name",
"value": "openssl"
},
{
"key": "package_version",
"value": "1.1.1k"
}
],
"description": "Example vulnerability in a package.",
"name": "CVE-2024-12345",
"severity": "HIGH",
"uri": "https://example.com/cve-2024-12345"
}
],
"imageScanCompletedAt": "2026-02-03T12:05:00Z",
"vulnerabilitySourceUpdatedAt": "2026-02-03T00:00:00Z"
},
"imageScanStatus": {
"description": "Scan completed",
"status": "COMPLETE"
},
"registryId": "123456789012",
"repositoryName": "my-repo"
},
"timestamp": "2026-02-03T12:05:00Z",
"type": "aws.ecr.image.scanFindings"
}

The Scan Image component scans an ECR image for vulnerabilities.

  • Security automation: Scan images for vulnerabilities
  • Compliance checks: Validate images against severity thresholds
  • Reporting: Capture scan summaries and findings for audits
  • Region: AWS region of the ECR repository
  • Repository: ECR repository name or ARN
  • Image Digest: Digest of the image (optional)
  • Image Tag: Tag of the image (optional)

At least one of Image Digest or Image Tag is required. If both are provided, the request includes both.

{
"data": {
"imageId": {
"imageDigest": "sha256:8f1d3e4f5a6b7c8d9e0f11121314151617181920212223242526272829303132",
"imageTag": "latest"
},
"imageScanFindings": {
"findingSeverityCounts": {
"HIGH": 1
},
"findings": [
{
"attributes": [
{
"key": "package_name",
"value": "openssl"
},
{
"key": "package_version",
"value": "1.1.1k"
}
],
"description": "Example vulnerability in a package.",
"name": "CVE-2024-12345",
"severity": "HIGH",
"uri": "https://example.com/cve-2024-12345"
}
],
"imageScanCompletedAt": "2026-02-03T12:05:00Z",
"vulnerabilitySourceUpdatedAt": "2026-02-03T00:00:00Z"
},
"imageScanStatus": {
"description": "Scan completed",
"status": "COMPLETE"
},
"registryId": "123456789012",
"repositoryName": "my-repo"
},
"timestamp": "2026-02-03T12:05:00Z",
"type": "aws.ecr.image.scanFindings"
}

The Create Service component creates a new ECS service in a cluster.

  • Provisioning workflows: Create a service during environment setup
  • Deployment automation: Roll out new workloads from workflows
  • Infrastructure orchestration: Configure ECS service settings as part of release pipelines
  • You can pass advanced ECS CreateService fields through Additional ECS API Arguments.
  • Do not combine Launch Type with Capacity Provider Strategy.
{
"data": {
"service": {
"clusterArn": "arn:aws:ecs:us-east-1:111122223333:cluster/superplane-demo-cluster",
"createdAt": "2026-02-12T08:15:10Z",
"desiredCount": 2,
"enableExecuteCommand": true,
"launchType": "FARGATE",
"pendingCount": 0,
"platformVersion": "1.4.0",
"propagateTags": "SERVICE",
"runningCount": 2,
"schedulingStrategy": "REPLICA",
"serviceArn": "arn:aws:ecs:us-east-1:111122223333:service/superplane-demo-cluster/superplane-api",
"serviceName": "superplane-api",
"status": "ACTIVE",
"taskDefinition": "arn:aws:ecs:us-east-1:111122223333:task-definition/superplane-api:5",
"taskSets": []
}
},
"timestamp": "2026-02-12T08:15:32.101112131Z",
"type": "aws.ecs.service"
}

The Describe Service component fetches details about a single ECS service.

  • Deployment checks: Inspect running/desired task counts before or after deployment
  • Operational visibility: Fetch service status and task definition details in workflows
  • Automation branching: Route workflow execution based on ECS service state
{
"data": {
"service": {
"clusterArn": "arn:aws:ecs:us-west-1:123456789012:cluster/production-cluster-alpha",
"createdAt": "2026-01-20T10:12:33Z",
"deployments": [
{
"createdAt": "2026-01-20T10:12:33Z",
"desiredCount": 3,
"id": "ecs-svc/8473629182736450912",
"pendingCount": 0,
"runningCount": 3,
"status": "PRIMARY",
"taskDefinition": "arn:aws:ecs:us-west-1:123456789012:task-definition/api-gateway-service:7",
"updatedAt": "2026-01-20T10:18:11Z"
}
],
"desiredCount": 3,
"enableExecuteCommand": true,
"events": [
{
"createdAt": "2026-01-20T10:18:11Z",
"id": "d91b5e4a-7a5f-4b1d-bdb4-3d4f8f8a9912",
"message": "(service api-gateway-service-prod) has reached a steady state."
},
{
"createdAt": "2026-01-20T10:17:02Z",
"id": "a12f9c47-92c3-4c9f-8d12-88d6ab3f8e72",
"message": "(service api-gateway-service-prod) (deployment ecs-svc/8473629182736450912) deployment completed."
},
{
"createdAt": "2026-01-20T10:13:05Z",
"id": "c7a8e3b1-11f2-4fbc-9d8e-2194bb0eaf55",
"message": "(service api-gateway-service-prod) has started 3 tasks: (task 9f8e7d6c5b4a3210e1f2a3b4c5d6e7f8)."
}
],
"launchType": "FARGATE",
"networkConfiguration": {
"awsvpcConfiguration": {
"assignPublicIp": "DISABLED",
"securityGroups": [
"sg-0a1b2c3d4e5f6a7b8",
"sg-1b2c3d4e5f6a7b8c9"
],
"subnets": [
"subnet-01a2b3c4d5e6f7a8b",
"subnet-09f8e7d6c5b4a3210"
]
}
},
"pendingCount": 0,
"platformVersion": "1.4.0",
"propagateTags": "SERVICE",
"runningCount": 3,
"schedulingStrategy": "REPLICA",
"serviceArn": "arn:aws:ecs:us-west-1:123456789012:service/production-cluster-alpha/api-gateway-service-prod",
"serviceName": "api-gateway-service-prod",
"status": "ACTIVE",
"taskDefinition": "arn:aws:ecs:us-west-1:123456789012:task-definition/api-gateway-service:7",
"taskSets": []
}
},
"timestamp": "2026-01-20T12:45:09.123456789Z",
"type": "aws.ecs.service"
}

The Execute Command component runs ECS Exec against a running task container.

  • Operational debugging: Run diagnostics inside a live task
  • Runtime inspection: Check process state or config from workflows
  • Automated remediation: Trigger one-off commands in containerized services
  • ECS Exec must be enabled and properly configured for the task/service.
  • Interactive mode opens an ECS session and returns session connection details.
{
"data": {
"command": {
"clusterArn": "arn:aws:ecs:us-east-1:111122223333:cluster/superplane-demo-cluster",
"containerArn": "arn:aws:ecs:us-east-1:111122223333:container/superplane-demo-cluster/aaaaaaaa11111111bbbbbbbb22222222/2d7f98c1e4d14f98a4d1f36e6f4f5d23",
"containerName": "api",
"interactive": false,
"session": {
"sessionId": "ecs-execute-command-0f2ea5a931534f9f8f37f7e706a2c100",
"streamUrl": "wss://ssmmessages.us-east-1.amazonaws.com/v1/data-channel/ecs-execute-command-0f2ea5a931534f9f8f37f7e706a2c100?role=publish_subscribe",
"tokenValue": "AQoDYXdzEJr//////////wEaDAi4cUd2QqXQwq2NAiD3rWkK9mYc9..."
},
"taskArn": "arn:aws:ecs:us-east-1:111122223333:task/superplane-demo-cluster/aaaaaaaa11111111bbbbbbbb22222222"
}
},
"timestamp": "2026-02-12T09:10:21.445566778Z",
"type": "aws.ecs.executeCommand"
}

The Run Task component starts one or more ECS tasks and completes based on task lifecycle events.

  • One-off workloads: Execute ad-hoc jobs on ECS
  • Batch processing: Trigger task runs from workflow events
  • Operational automation: Run remediation or maintenance tasks
  • Always waits for tasks to leave startup states (for example, PENDING) before completing.
  • If Timeout (seconds) is set, waits for all tracked tasks to reach STOPPED, or completes with timeout when that deadline is reached.
  • For Fargate tasks, set Network Configuration using the ECS awsvpcConfiguration format.
  • Use Capacity Provider Strategy when you want ECS to choose capacity providers; it cannot be combined with Launch Type.
{
"data": {
"failures": [],
"tasks": [
{
"clusterArn": "arn:aws:ecs:us-east-1:111122223333:cluster/superplane-demo-cluster",
"createdAt": "2026-02-10T14:30:01Z",
"desiredStatus": "RUNNING",
"group": "family:superplane-ecs-task",
"lastStatus": "RUNNING",
"launchType": "FARGATE",
"platformVersion": "1.4.0",
"startedBy": "",
"stoppedReason": "",
"taskArn": "arn:aws:ecs:us-east-1:111122223333:task/superplane-demo-cluster/aaaaaaaa11111111bbbbbbbb22222222",
"taskDefinitionArn": "arn:aws:ecs:us-east-1:111122223333:task-definition/superplane-ecs-task:1"
}
],
"timedOut": false
},
"timestamp": "2026-02-10T14:30:37.633534466Z",
"type": "aws.ecs.task"
}

The Stop Task component requests ECS to stop a running task and waits for the task to reach STOPPED.

  • Operational control: Stop ad-hoc or long-running tasks from workflows
  • Remediation: Terminate unhealthy tasks during automated incident response
  • Cost control: Stop no-longer-needed background workloads
  • ECS sends a SIGTERM signal and then force-stops the task if it does not exit gracefully.
  • Reason is optional and appears in ECS task stop metadata when provided.
{
"data": {
"task": {
"clusterArn": "arn:aws:ecs:us-east-1:111122223333:cluster/superplane-demo-cluster",
"createdAt": "2026-02-10T14:30:01Z",
"desiredStatus": "STOPPED",
"group": "family:superplane-ecs-task",
"lastStatus": "STOPPED",
"launchType": "FARGATE",
"platformVersion": "1.4.0",
"startedBy": "",
"stoppedReason": "stopping",
"taskArn": "arn:aws:ecs:us-east-1:111122223333:task/superplane-demo-cluster/aaaaaaaa11111111bbbbbbbb22222222",
"taskDefinitionArn": "arn:aws:ecs:us-east-1:111122223333:task-definition/superplane-ecs-task:1"
}
},
"timestamp": "2026-02-10T14:31:19.987196041Z",
"type": "aws.ecs.task"
}

The Update Service component updates configuration for an existing ECS service.

  • Deployments: Roll out a new task definition
  • Scaling workflows: Change desired count dynamically
  • Operational tuning: Update deployment, network, or tag behavior
  • You can pass advanced ECS UpdateService fields through Additional ECS API Arguments.
  • Do not combine Launch Type with Capacity Provider Strategy.
{
"data": {
"service": {
"clusterArn": "arn:aws:ecs:us-east-1:111122223333:cluster/superplane-demo-cluster",
"createdAt": "2026-02-12T08:15:10Z",
"desiredCount": 3,
"enableExecuteCommand": true,
"launchType": "FARGATE",
"pendingCount": 1,
"platformVersion": "1.4.0",
"propagateTags": "SERVICE",
"runningCount": 2,
"schedulingStrategy": "REPLICA",
"serviceArn": "arn:aws:ecs:us-east-1:111122223333:service/superplane-demo-cluster/superplane-api",
"serviceName": "superplane-api",
"status": "ACTIVE",
"taskDefinition": "arn:aws:ecs:us-east-1:111122223333:task-definition/superplane-api:6",
"taskSets": []
}
},
"timestamp": "2026-02-12T09:00:03.987654321Z",
"type": "aws.ecs.service"
}

The Run Lambda component invokes a Lambda function.

  • Automated workflows: Trigger Lambda functions from SuperPlane workflows
  • Event processing: Process events from other applications
  • Data transformation: Transform data in real-time
  • API integrations: Call Lambda functions from other applications
  1. Invokes the specified Lambda function with the provided payload
  2. Returns the function’s response including status code, payload, and log output
  3. Optionally creates a new Lambda function from inline JavaScript code
{
"payload": {
"message": "hello from lambda"
},
"report": {
"billedDuration": "100 ms",
"duration": "89.81 ms",
"initDuration": "160.97 ms",
"maxMemoryUsed": "82 MB",
"memorySize": "128 MB"
},
"requestId": "9f8d2b5e-1c7a-4d62-8f1a-0f8b8e4f3a12"
}

The Create DNS Record component creates a new DNS record in an AWS Route 53 hosted zone.

  • Domain management: Create DNS records for new services or endpoints
  • Automated provisioning: Set up DNS entries as part of infrastructure workflows
  • Multi-environment setup: Create environment-specific DNS records automatically
  1. Connects to AWS Route 53 using the integration credentials
  2. Creates a new DNS record in the specified hosted zone
  3. Returns the change status and submission timestamp
{
"data": {
"change": {
"id": "/change/C1234567890ABC",
"status": "INSYNC",
"submittedAt": "2026-01-28T10:30:00.000Z"
},
"record": {
"name": "api.example.com",
"type": "A"
}
},
"timestamp": "2026-01-28T10:30:00.000Z",
"type": "aws.route53.change"
}

The Delete DNS Record component deletes a DNS record from an AWS Route 53 hosted zone.

  • Cleanup: Remove DNS records when decommissioning services
  • Environment teardown: Delete DNS entries for temporary environments
  • Migration: Remove old DNS records after migrating to new endpoints
  1. Connects to AWS Route 53 using the integration credentials
  2. Deletes the specified DNS record from the hosted zone
  3. The record name, type, TTL, and values must match the existing record exactly
  4. Returns the change status and submission timestamp
{
"data": {
"change": {
"id": "/change/C5555555555GHI",
"status": "INSYNC",
"submittedAt": "2026-01-28T10:30:00.000Z"
},
"record": {
"name": "api.example.com",
"type": "A"
}
},
"timestamp": "2026-01-28T10:30:00.000Z",
"type": "aws.route53.change"
}

The Upsert DNS Record component creates or updates a DNS record in an AWS Route 53 hosted zone.

  • Idempotent updates: Safely create or update DNS records without checking existence first
  • Rolling deployments: Update DNS records to point to new infrastructure
  • Failover management: Switch DNS records between primary and secondary endpoints
  1. Connects to AWS Route 53 using the integration credentials
  2. Creates the DNS record if it doesn’t exist, or updates it if it does
  3. Returns the change status and submission timestamp
{
"data": {
"change": {
"id": "/change/C9876543210DEF",
"status": "INSYNC",
"submittedAt": "2026-01-28T10:30:00.000Z"
},
"record": {
"name": "api.example.com",
"type": "A"
}
},
"timestamp": "2026-01-28T10:30:00.000Z",
"type": "aws.route53.change"
}

The Create Topic component creates an AWS SNS topic and returns its metadata.

  • Provisioning workflows: Create topics as part of environment setup
  • Automation bootstrap: Prepare topics before publishing messages
  • Self-service operations: Provision messaging resources on demand
{
"data": {
"attributes": {
"DisplayName": "Orders Events",
"Owner": "123456789012",
"TopicArn": "arn:aws:sns:us-east-1:123456789012:orders-events"
},
"contentBasedDeduplication": false,
"displayName": "Orders Events",
"fifoTopic": false,
"name": "orders-events",
"owner": "123456789012",
"topicArn": "arn:aws:sns:us-east-1:123456789012:orders-events"
},
"timestamp": "2026-01-10T10:00:02.000000000Z",
"type": "aws.sns.topic"
}

The Delete Topic component deletes an AWS SNS topic.

  • Cleanup workflows: Remove temporary topics after execution
  • Lifecycle management: Decommission unused messaging resources
  • Rollback automation: Remove topics created in failed provisioning runs
{
"data": {
"deleted": true,
"topicArn": "arn:aws:sns:us-east-1:123456789012:orders-events"
},
"timestamp": "2026-01-10T10:00:02.000000000Z",
"type": "aws.sns.topic.deleted"
}

The Get Subscription component retrieves metadata and attributes for an AWS SNS subscription.

  • Subscription audits: Inspect endpoint and delivery configuration
  • Workflow enrichment: Load subscription metadata before downstream actions
  • Validation: Confirm subscription existence and protocol
{
"data": {
"attributes": {
"Endpoint": "https://example.com/sns/events",
"Protocol": "https",
"RawMessageDelivery": "true",
"TopicArn": "arn:aws:sns:us-east-1:123456789012:orders-events"
},
"endpoint": "https://example.com/sns/events",
"owner": "123456789012",
"pendingConfirmation": false,
"protocol": "https",
"rawMessageDelivery": true,
"subscriptionArn": "arn:aws:sns:us-east-1:123456789012:orders-events:7f8a3d50-f160-4d2d-8f8a-fb95d7f86a51",
"topicArn": "arn:aws:sns:us-east-1:123456789012:orders-events"
},
"timestamp": "2026-01-10T10:00:02.000000000Z",
"type": "aws.sns.subscription"
}

The Get Topic component retrieves metadata and attributes for an AWS SNS topic.

  • Configuration audits: Verify topic settings and attributes
  • Workflow enrichment: Load topic metadata before downstream actions
  • Validation: Confirm topic existence and ownership
{
"data": {
"attributes": {
"DisplayName": "Orders Events",
"Owner": "123456789012",
"TopicArn": "arn:aws:sns:us-east-1:123456789012:orders-events"
},
"contentBasedDeduplication": false,
"displayName": "Orders Events",
"fifoTopic": false,
"name": "orders-events",
"owner": "123456789012",
"topicArn": "arn:aws:sns:us-east-1:123456789012:orders-events"
},
"timestamp": "2026-01-10T10:00:02.000000000Z",
"type": "aws.sns.topic"
}

The Publish Message component sends a message to an AWS SNS topic.

  • Event fan-out: Broadcast workflow results to multiple subscribers
  • Notifications: Send operational updates to users and systems
  • Automation: Trigger downstream subscribers through SNS delivery
{
"data": {
"messageId": "a730a53a-a86d-5fcb-9ad1-ff72b8d0f104",
"topicArn": "arn:aws:sns:us-east-1:123456789012:orders-events"
},
"timestamp": "2026-01-10T10:00:02.000000000Z",
"type": "aws.sns.message.published"
}

The Create Queue component creates a new AWS SQS queue.

  • Region: AWS region for the SQS queue
  • Queue Name: Name of the queue to create
{
"data": {
"queueName": "my-created-queue",
"queueUrl": "https://sqs.us-east-1.amazonaws.com/123456789012/my-created-queue"
},
"timestamp": "2026-02-11T12:00:00Z",
"type": "aws.sqs.queue"
}

The Delete Queue component deletes an AWS SQS queue.

  • Region: AWS region of the SQS queue
  • Queue: Target SQS queue to delete
{
"data": {
"deleted": true,
"queueUrl": "https://sqs.us-east-1.amazonaws.com/123456789012/my-queue"
},
"timestamp": "2026-02-11T12:00:00Z",
"type": "aws.sqs.queue.deleted"
}

The Get Queue component retrieves metadata and attributes for an AWS SQS queue.

  • Region: AWS region of the SQS queue
  • Queue: Target SQS queue
{
"data": {
"attributes": {
"DelaySeconds": "0",
"MaximumMessageSize": "262144",
"MessageRetentionPeriod": "345600",
"QueueArn": "arn:aws:sqs:us-east-1:123456789012:my-queue",
"ReceiveMessageWaitTimeSeconds": "0",
"VisibilityTimeout": "30"
},
"queueUrl": "https://sqs.us-east-1.amazonaws.com/123456789012/my-queue"
},
"timestamp": "2026-02-11T12:00:00Z",
"type": "aws.sqs.queue"
}

The Purge Queue component removes all messages from an AWS SQS queue.

  • Region: AWS region of the SQS queue
  • Queue: Target SQS queue to purge
{
"data": {
"purged": true,
"queueUrl": "https://sqs.us-east-1.amazonaws.com/123456789012/my-queue"
},
"timestamp": "2026-02-11T12:00:00Z",
"type": "aws.sqs.queue.purged"
}

The Send Message component publishes a message to an AWS SQS queue.

  • Region: AWS region of the SQS queue
  • Queue: Target SQS queue
  • Message Body: The message payload to send
{
"data": {
"messageId": "d84c1b4d-1f3b-4b6c-9d9f-5c3a2b1f9e7a",
"queueUrl": "https://sqs.us-east-1.amazonaws.com/123456789012/my-queue"
},
"timestamp": "2026-02-11T12:00:00Z",
"type": "aws.sqs.message"
}