Systems Manager (formerly known as SSM) manages EC2 instances at scale (EC2 fleet).
Features
- Systems Manager organizes and groups your EC2 instances.
- Automates common tasks such as patching, running scripts, and installing applications.
- An agent software is installed on each VM.
Systems Manager Run Command
“Run Commands” allows you to run operational tasks across multiple EC2 instances.
- Run commands or scripts on one or more EC2 instances using Resource groups.
- Stop, start, re-size, or terminate instances.
- Install, patch, or uninstall software.
Systems Manager Parameter Store
Parameter Store provides secure serverless storage for the management of configuration data and secrets.
Features
- You can store confidential data such as passwords, database strings, and license codes as parameter values.
- Values can be saved as plain text or encrypted values (using the key from KMS).
- Parameters are stored in hierarchies.
- e.g. /prod/db/aurora/connection, /dev/db/aurora/connection
- The service can be used with EC2, ECS, or Lambda.
Tiers
- Standard
- up to 10,000 parameters
- up to 4KB parameter value size
- No parameter policies
- No charge
- Advanced
- more than 10,000 parameters
- up to 8KB parameter value size
- parameter polices are available
- Charges apply
Types
- String
- Any string value
- StringList
- a comma-separated list of strings
- SecureString
- Encrypted string using KMS keys from your account or another account
Example: Systems Manager Patch Manager
- Create an IAM role
- Trusted Entity: EC2
- Managed Policy: AmazonSSMManagedInstanceCore
- Launch EC2 instances – 2 or more
- Attach the role
- Provide a tag to group instances later
- Open the Systems Manager Console
- You can find instances in the Fleet Manager section.
- If you do not see the instances, please check the attached IAM role in the EC2 instances.
- Create a resource group
- Search and select the service “Resource Groups & Tag Editor“
- Create a resource group based on a tag
- Use Patch Manager in the Systems Manager
- Search the baseline and set it as the default
- Use Patch Manager – Patch Now
- You can schedule the patch or patch now.
- You can select target instances using instance tags or a resource group.
- Install any missing patches
Example: Systems Manager Run Command
- Setup an IAM role with AmazonSSMManagedInstanceCore
- Launch EC2 instances – 2 or more
- Create a resource group
- Run Command
- Select the Command document
- For your custom action, you can select “AWS-RunShellScript“
- Type the commands in the Command parameters
- Select your target using the resource group
- You can save the output in S3 or set up the SNS notification.
- Run the command
- You can confirm the output in Management Console.