Systems Manager

Every capability in Systems Manager depends on the SSM Agent running on the target instance and the instance having an IAM instance profile with the AmazonSSMManagedInstanceCore policy. The agent establishes an outbound HTTPS connection to the SSM service endpoints - no inbound ports need to be open.

# Verify SSM agent status on Linux
sudo systemctl status amazon-ssm-agent

# Check if instance is managed by SSM
aws ssm describe-instance-information \
  --filters "Key=InstanceIds,Values=i-0123456789abcdef0"

# Register an on-premises server with hybrid activation
aws ssm create-activation \
  --default-instance-name "on-prem-web-01" \
  --iam-role "AmazonEC2RunCommandRoleForManagedInstances" \
  --registration-limit 1 \
  --region us-east-1

Session Manager and Run Command are the two most commonly used SSM features. Session Manager provides an interactive shell (or port forwarding) without SSH keys or open ports. Run Command executes scripts or documents across fleets of instances.

Session Manager port forwarding is a powerful but underused feature. It tunnels any TCP port from a private instance to your local machine through the SSM channel - useful for accessing RDS, Elasticsearch, or internal web apps from your laptop without a VPN.

# Start a shell session (no SSH, no bastion host needed)
aws ssm start-session --target i-0123456789abcdef0

# Port forward RDS port to localhost:5432
aws ssm start-session \
  --target i-0123456789abcdef0 \
  --document-name AWS-StartPortForwardingSessionToRemoteHost \
  --parameters "host=my-db.cluster-xyz.us-east-1.rds.amazonaws.com,portNumber=5432,localPortNumber=5432"

# Run command across all instances tagged env=prod
aws ssm send-command \
  --targets "Key=tag:env,Values=prod" \
  --document-name "AWS-RunShellScript" \
  --parameters "commands=['systemctl restart nginx']" \
  --max-concurrency "20%" \
  --max-errors "5%"

Patch Manager automates the process of patching managed instances with security-related updates. It uses Patch Baselines to define which patches are approved for installation and Maintenance Windows to define when patching occurs.

Patch compliance state is reported per instance and visible in the Systems Manager Compliance dashboard and in AWS Config. You can create CloudWatch alarms on non-compliant instance counts and integrate this with your security reporting.

Parameter Store provides secure, hierarchical storage for configuration data and secrets. It integrates natively with IAM for access control, CloudTrail for audit, and most AWS services (Lambda, ECS, EC2 UserData, CodeBuild) for secret injection.

# Store a secret string
aws ssm put-parameter \
  --name "/myapp/prod/db-password" \
  --value "supersecretpassword" \
  --type SecureString \
  --key-id "alias/myapp-key"

# Retrieve all parameters under a path
aws ssm get-parameters-by-path \
  --path "/myapp/prod/" \
  --with-decryption \
  --recursive

SSM Documents (formerly called SSM Documents or just "documents") are the automation primitives in Systems Manager. There are several document types for different use cases:

State Manager ensures instances maintain a defined configuration over time. Associations link a document to target instances and run on a schedule. If an instance drifts from the desired configuration (e.g., CloudWatch agent gets uninstalled), the next association run will re-apply it.

Automation documents support approval steps, multi-account execution, and rate control. They're the right tool for operational runbooks that used to be manual SOPs - things like "rotate RDS credentials", "create golden AMI", or "respond to a security finding".