CS Techie
Comments
courseAWS
AWS lesson

AWS Systems Manager (SSM)

​AWS Systems Manager (SSM) is a collection of capabilities that helps you automate operational tasks across your AWS resources and on-premises servers. It provides a unified interface to view operational data from multiple AWS services and allows you to automate tasks such as collecting software inventory, applying operating system patches, creating system images, and configuring operating systems.


Key Capabilities and Components

  1. Operations Management:
    • Explorer: An operations dashboard that aggregates operational data from various AWS services (e.g., EC2, CloudWatch, Config) into a single view. It helps you quickly identify and resolve operational issues.
    • OpsCenter: A centralized place for operations engineers to view, investigate, and resolve operational work items (OpsItems) related to AWS resources.
    • Incidents Manager: Automates incident response by helping you prepare for, respond to, and recover from incidents faster.
  2. Application Management:
    • Application Manager: A centralized console to view and manage your applications, including data from CloudFormation, Elastic Beanstalk, and other services.
    • AppConfig: Helps you create, manage, and deploy application configurations and feature flags. It supports controlled rollouts and validation to minimize impact.
  3. Change Management:
    • Change Manager: A framework for requesting, approving, implementing, and reporting on operational changes to your application configuration and infrastructure.
    • Maintenance Windows: Schedule when to perform potentially disruptive actions on your instances, such as patching operating systems, updating drivers, or installing software.
  4. Node Management (for EC2 instances, on-premises servers, and VMs):
    • Run Command: Securely and remotely execute commands on one or more instances. It's ideal for ad-hoc tasks, troubleshooting, or running scripts.
    • State Manager: Maintains a defined state for your instances. You can use it to ensure that your instances are configured consistently and comply with your policies.
    • Patch Manager: Automates the process of patching managed instances with security updates and other bug fixes. It supports both operating systems and applications.
    • Inventory: Collects and displays detailed information about your instances, including installed applications, network configurations, and operating system details.
    • Session Manager: Provides secure and auditable instance management without the need to open inbound ports, manage SSH keys, or use bastion hosts. You can access instances through a browser-based shell or the AWS CLI.
    • Distributor: Helps you securely store and distribute software packages to your instances.
  5. Shared Resources:
    • Parameter Store: Provides secure, hierarchical storage for configuration data management and secrets management. You can store data such as passwords, database strings, and license codes as parameter values.
    • Automation: Simplifies common maintenance and deployment tasks of AWS resources. It uses runbooks (predefined or custom) to execute a series of steps.


How it Works

SSM uses an SSM Agent that runs on your EC2 instances, on-premises servers, or virtual machines. This agent processes requests from the Systems Manager service in the cloud and sends back status and execution information. For on-premises servers, you register them as "managed instances" with Systems Manager.

Benefits

  • Increased Operational Agility: Automate routine tasks, freeing up time for more strategic work.
  • Improved Security: Securely manage instances without opening ports or managing SSH keys. Centralized secrets management.
  • Enhanced Compliance: Maintain desired state, apply patches, and track inventory to meet compliance requirements.
  • Centralized Control: Unified console for managing operations across a hybrid environment.
  • Cost Savings: Reduce manual effort and potential errors.


Example Use Case: Patching EC2 Instances

Instead of manually logging into each EC2 instance to apply patches, you can use Patch Manager:

  1. Define a Patch Baseline: Specify which patches to approve or reject for your operating systems (e.g., critical updates only, or all updates).
  2. Configure a Maintenance Window: Schedule a recurring time (e.g., every Sunday at 2 AM) when patching can occur without disrupting business operations.
  3. Target Instances: Select the EC2 instances (e.g., by tag) that should receive patches during this window.
  4. Automate Patching: During the maintenance window, Patch Manager automatically applies the approved patches to the targeted instances.
  5. Monitor Compliance: Use Inventory and Compliance to view the patching status of your fleet and identify any non-compliant instances.