AWS Systems Manager
AWS Systems Manager gives you one place to view and manage servers, whether they run in AWS or in your own data center. Administrators patch software, run commands, and open secure shell sessions without logging in to each machine one by one.
Imagine a facilities manager who maintains a hundred buildings. Walking to every building to change a light bulb wastes days. A central control panel that adjusts every building at once saves effort. Systems Manager is that control panel for servers.
How Systems Manager Reaches Your Servers
Each managed server runs a small program called the SSM Agent. Many Amazon Linux and Windows images include it already. The agent talks to the Systems Manager service over HTTPS. The server also needs an IAM role that allows this communication, such as the AmazonSSMManagedInstanceCore policy.
Administrator
|
Systems Manager (console / CLI)
|
+----+------------+--------------+
| | |
EC2 Server EC2 Server On-premises Server
(SSM Agent) (SSM Agent) (SSM Agent)
Key Capabilities
Session Manager
Session Manager opens a terminal on a server through the browser or the CLI. No SSH keys, no bastion host, and no open inbound port 22 are required. Every session can be logged to S3 or CloudWatch Logs for review. The approach removes a common security risk.
Run Command
Run Command executes a script on many servers at once. Target servers by tag, such as Environment equals Production. The console shows success or failure for each machine.
aws ssm send-command \ --document-name "AWS-RunShellScript" \ --targets "Key=tag:Environment,Values=Dev" \ --parameters 'commands=["uptime"]'
Patch Manager
Patch Manager scans servers for missing operating system updates and installs them on a schedule. A patch baseline defines which updates count as approved. A maintenance window sets the time slot so updates never interrupt business hours.
Automation
Automation runs step-by-step runbooks for common tasks, such as restarting an instance, creating an image, or attaching a snapshot. Teams write their own runbooks or use AWS ready-made ones.
Inventory
Inventory collects details about each server: installed software, network settings, and operating system versions. Use the data to answer audit questions quickly.
Parameter Store
Parameter Store holds configuration values and secrets. Applications read values at start time rather than keeping them in code. The Secrets Manager topic covers the comparison in more depth.
Patch Cycle in Practice
Scan servers for missing patches
|
v
Compare with patch baseline
|
v
Wait for the maintenance window
|
v
Install approved patches
|
v
Report compliance status
Example: Fixing a Configuration Across 50 Servers
A team discovers a wrong setting in a configuration file on fifty web servers. Logging in to each server would consume a whole day. An administrator writes a short script and sends it through Run Command to all servers tagged Role equals Web. The console reports success on forty-eight servers and shows errors on two. The team fixes those two directly.
Security Benefits
- Session Manager removes the need for open SSH ports and shared key files.
- IAM policies decide who can start sessions or run commands.
- CloudTrail records every Systems Manager action.
- Patch Manager shortens the time that known flaws stay unfixed.
Cost Notes
Many core features, such as Session Manager and Run Command, have no extra charge for EC2 instances. Some features, such as advanced on-premises instances, carry fees. Check current pricing before enabling them widely.
Practice Steps
- Launch an Amazon Linux instance with an IAM role that includes the managed instance core policy.
- Open Systems Manager and confirm the instance appears under Fleet Manager.
- Start a Session Manager session and run a simple command.
- Send a Run Command to print the date.
- Terminate the instance when practice ends.
Best Practices
- Tag servers consistently so commands target the right groups.
- Test patches on development servers before production.
- Store session logs in an encrypted bucket.
- Close port 22 once Session Manager works.