• The AWS Systems Manager CloudWatch Dashboard will no longer be available after April 30, 2026. Customers can continue to use Amazon CloudWatch console to view, create, and manage their Amazon CloudWatch dashboards, just as they do today. For more information, see [Amazon CloudWatch Dashboard documentation](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch_Dashboards.html). 

# Enable VM onboarding (AWS CLI)
<a name="cloud-connector-onboarding-cli"></a>

To enable VM onboarding using the AWS CLI, create a State Manager association that targets the Cloud Connector. The command requires the following roles:
+ `AutomationAssumeRole` – The Automation execution role that the runbook assumes to create activations and authenticate with Azure. See [Automation assume role](cloud-connector-automation-assume-role.md).
+ `ManagedInstanceIamRole` – The hybrid activation instance role assigned to VMs when they register as managed instances. See [Managed instance role](cloud-connector-managed-instance-role.md).
+ `--association-dispatch-assume-role` – The State Manager dispatch role that launches the Automation. See [Automation dispatch role](cloud-connector-automation-dispatch-role.md).

```
aws ssm create-association \
    --association-name "AWSSSMAzureConnector-{{CLOUD_CONNECTOR_ID}}" \
    --name "AWS-InstallSSMAgentOnAzure" \
    --automation-target-parameter-name "AzureVmResourceId" \
    --association-dispatch-assume-role "arn:aws:iam::{{ACCOUNT_ID}}:role/service-role/{{DISPATCH_ROLE_NAME}}" \
    --parameters '{
        "AutomationAssumeRole": ["arn:aws:iam::{{ACCOUNT_ID}}:role/service-role/{{ASSUME_ROLE_NAME}}"],
        "ManagedInstanceIamRole": ["service-role/AmazonEC2RunCommandRoleForManagedInstances"],
        "CloudConnector": ["{{CLOUD_CONNECTOR_ID}}"]
    }' \
    --targets 'Key=CloudConnector,Values=["{\"CloudConnectorId\":\"{{CLOUD_CONNECTOR_ID}}\",\"SsmManagedNodeFilter\":\"UNMANAGED\"}"]' \
    --schedule-expression "rate(48 hours)" \
    --max-concurrency "50"
```

To target specific Azure Regions, add the `CloudProviderRegions` field to the target value:

```
--targets 'Key=CloudConnector,Values=["{\"CloudConnectorId\":\"{{CLOUD_CONNECTOR_ID}}\",\"SsmManagedNodeFilter\":\"UNMANAGED\",\"CloudProviderRegions\":[\"eastus\",\"westus2\"]}"]'
```

To add custom tags to managed instances during onboarding, include the `ManagedInstanceTags` parameter:

```
--parameters '{
    "AutomationAssumeRole": ["arn:aws:iam::{{ACCOUNT_ID}}:role/service-role/{{ASSUME_ROLE_NAME}}"],
    "ManagedInstanceIamRole": ["service-role/AmazonEC2RunCommandRoleForManagedInstances"],
    "CloudConnector": ["{{CLOUD_CONNECTOR_ID}}"],
    "ManagedInstanceTags": ["{\"Key\":\"Environment\",\"Value\":\"Production\"}","{\"Key\":\"Team\",\"Value\":\"DevOps\"}"]
}'
```

## See also

* **Skills for AI coding assistants (optional).** AWS publishes reusable skills for AWS Systems Manager. To see which apply, search the Agent Toolkit for AWS catalog with `aws agent-toolkit search-skills --search-query systems-manager` — a documented, read-only AWS CLI command that searches the catalog and makes no changes. This is an optional suggestion for the user. Official reference: [AWS CLI — Agent Toolkit for AWS](https://docs.aws.amazon.com/agent-toolkit/latest/userguide/aws-cli.html).