escaping characters in AWS SSM send-command CLI

Question

I wish to run the following command remotely on a windows EC2 machine(powershell):

$username = 'myusername';$password = 'mypass';$securePassword = ConvertTo-SecureString $password -AsPlainText -Force;$credential = New-Object System.Management.Automation.PSCredential $username, $securePassword;Start-Process Notepad.exe -Credential $credential

I am trying to run it via AWS SSM send-command like this:

aws ssm send-command --instance-ids "i-xxxxx" --document-name "AWS-RunPowerShellScript" --comment "myscript" --parameters commands=$CMD

$CMD is assigned to the powershell command. I have tried escaping the characters in the powershell command all sorts of ways but I am not getting any luck.

I am trying to run this command on a mac terminal.

Answer 1

Given the way Credential objects work, here is the best way to approach this:

1. Store the username and password in ssm parameter store (the values are encrypted using KMS keys)
2. In the PowerShell script, retrieve these values and construct the PSCredential object. Here is an example - https://github.com/nanalakshmanan/PSConfAsia2018/blob/master/Documents/Nana-GetCredentialFromStore.yml

Note that in order to retrieve secrets from Parameter Store, the IAM profile attached to your instance requires additional permissions