AWS Tutorials: AWS Systems Manager (SSM)

Introduction to AWS Systems Manager (SSM)

AWS Systems Manager (SSM) is a comprehensive management service designed to help you automate and manage your EC2 instances, on-premises servers, and other AWS resources. It provides features such as RunCommand, Parameter Store, Automation, Session Manager, and Patch Manager, allowing you to streamline operational tasks and ensure consistent configurations.

Why Use AWS Systems Manager?

1. Centralized Management: Manage multiple resources (both on AWS and on-premises) from a single interface.
2. Automation: Automate common operational tasks such as patching, configurations, and deployments.
3. Security and Compliance: Enforce security best practices and maintain compliance through centralized access and control.
4. Cost-Effectiveness: Reduce operational overhead by automating tasks and reducing manual intervention.
5. Enhanced Troubleshooting: Use features like Session Manager to securely access instances without SSH keys, enabling easier troubleshooting.

Core Features of AWS Systems Manager

1. RunCommand

RunCommand allows you to remotely execute scripts, commands, or automation workflows on your EC2 instances without needing SSH or RDP access.

• Common Use Cases:
  • Remotely installing software.
  • Restarting services or checking system status.
  • Collecting logs for analysis.
• Steps to Use RunCommand:
  1. Navigate to the AWS Systems Manager console.
  2. Select RunCommand from the navigation pane.
  3. Choose a Document like AWS-RunShellScript.
  4. Target specific instances using filters or Instance IDs.
  5. Define the command to run, such as a script, and execute it.

Example:

bashCopy codeaws ssm send-command 
  --document-name "AWS-RunShellScript" 
  --targets "Key=instanceIds,Values=i-0abcdef1234567890" 
  --parameters "commands=echo 'Hello World'"

2. Session Manager

Session Manager provides a secure way to access your EC2 instances without opening SSH ports or managing keys.

• Benefits:
  • No need for SSH keys or inbound ports.
  • Centralized logging of all session activity.
  • Works for both Linux and Windows instances.
• Steps to Use Session Manager:
  1. Install the SSM Agent on your EC2 instance (pre-installed on some AMIs).
  2. Ensure your instance has an IAM role with AmazonSSMManagedInstanceCore permissions.
  3. Open Session Manager in the AWS console.
  4. Start a session to access the shell directly from the AWS console.

3. Parameter Store

Parameter Store allows you to store configuration data such as database connection strings, API keys, and other sensitive data securely.

• Key Features:
  • Securely store strings, encrypted secrets, and hierarchical configurations.
  • Easy integration with other AWS services like Lambda and EC2.
  • Versioning for tracking changes to parameters.
• Steps to Use Parameter Store:
  1. Navigate to AWS Systems Manager.
  2. Choose Parameter Store and click Create Parameter.
  3. Define your parameter’s name, value, and data type (String, SecureString).
  4. Use the parameter in your applications by querying it using the SDK or CLI.

Example to retrieve a parameter:

aws ssm get-parameter --name "my-database-password" --with-decryption

4. Automation

Automation helps in creating workflows to perform tasks like instance patching, AMI creation, and remediation workflows.

• Key Features:
  • Automate tasks across AWS resources with predefined or custom automation documents.
  • Integration with services like EC2, S3, and Lambda.
  • Supports multi-step workflows for complex operations.
• Steps to Create an Automation Workflow:
  1. Go to AWS Systems Manager and select Automation.
  2. Choose an automation document like AWS-UpdateLinuxAmi.
  3. Configure inputs such as instance IDs, desired actions, and parameters.
  4. Execute the automation, and Systems Manager will perform the tasks.

5. Patch Manager

Patch Manager automates the process of applying patches to your EC2 instances, ensuring that your infrastructure remains secure and up-to-date.

• Features:
  • Schedule patching operations.
  • Set patch baselines for both Linux and Windows instances.
  • Integration with automation for patching at scale.
• Steps to Use Patch Manager:
  1. Define a patch baseline that specifies the patches to be applied.
  2. Schedule a maintenance window for patching.
  3. Patch instances automatically within the defined window.

6. Inventory

Inventory collects metadata from your instances about installed applications, configurations, and files, helping you keep track of your resources.

• Key Benefits:
  • Get insights into installed applications and system configurations.
  • Generate detailed reports for compliance audits.
  • Track inventory changes over time.

Security Best Practices for AWS Systems Manager

• IAM Role Permissions: Ensure that only required permissions are assigned to the roles associated with EC2 instances. The AmazonSSMManagedInstanceCore role provides the minimum necessary permissions.
• Secure Parameter Store Data: Use SecureString for sensitive data in Parameter Store and enable encryption using AWS KMS.
• Session Manager Logging: Enable centralized logging and auditing of all Session Manager sessions using AWS CloudTrail and Amazon S3.

Monitoring and Auditing with Systems Manager

• CloudWatch Logs: Systems Manager can be integrated with CloudWatch to monitor command outputs, errors, and logs from your instances.
• CloudTrail Integration: Track every API call made through Systems Manager using AWS CloudTrail for security and auditing purposes.
• Compliance Reporting: Systems Manager allows you to report on compliance for patches, configurations, and inventory across your resources.

Conclusion

AWS Systems Manager (SSM) is a powerful service for managing, automating, and securing EC2 instances and other AWS resources. Whether you’re managing a fleet of instances or applying patches to specific resources, SSM provides a unified interface to handle common operational tasks. With its focus on automation and security, Systems Manager helps reduce operational overhead and ensures your infrastructure remains compliant and up-to-date.

Further Reading

1. ssm-user

The ssm-user is the default user created by AWS Systems Manager (SSM) when you connect to a managed instance (like an EC2 instance) using the Session Manager feature. Session Manager allows you to establish a shell session on your instance without needing to open an SSH connection or manage SSH keys.

• When you use Session Manager to connect to an EC2 instance, the default user for the session is ssm-user.
• This user has limited privileges and is used to provide access to the instance while still maintaining the security practices around session control.

2. SSM Document

An SSM document (or Systems Manager document) is a JSON or YAML file that defines actions for AWS Systems Manager to execute on your instances. It can be used for automating tasks like running commands, patching, or managing configurations.

• AWS provides predefined SSM documents, and you can also create custom SSM documents to suit your specific needs.
• SSM documents can include different types of operations, such as running scripts, configuring services, or applying patches.
• Each document contains steps that the Systems Manager performs, which can be configured with input parameters.

3. RunCommand

RunCommand is an action within AWS Systems Manager that allows you to remotely execute commands on your EC2 instances. You can use RunCommand to:

• Run shell commands or PowerShell scripts on your instances.
• Install software or patches.
• Manage configurations.

RunCommand operates through SSM Agent, which needs to be installed and running on your EC2 instance. You can run commands either via the AWS Management Console, the AWS CLI, or through an automation process like SSM documents.

Here’s a comparison of ssm-user, SSM Document, and RunCommand presented in a tabular format:

Mentor for DevOps – DevSecOps – SRE – Cloud – Container & Micorservices at Software AG

Join my following certification courses…
– DevOps Certified Professionals (DCP)
– Site Reliability Engineering Certified Professionals (SRECP)
– Master in DevOps Engineering (MDE)
– DevSecOps Certified Professionals (DSOCP)
URL – https://www.devopsschool.com/certification/

My Linkedin – https://www.linkedin.com/in/rajeshkumarin

Latest posts by Rajesh Kumar (see all)