Systems Manager

Question 1

How does Systems Manager achieve visibility control over an instance? (Make them “managed instances”?)

Answer 1

Via the SSM Agent. Present at default in MODERN Linux and Windows AMIs. Must be installed for older versions and on-prem instances.

Question 2

Functions AWS Systems Manager can perform

Answer 2

Manage Inventory
Patching
Run Commands
Manage Desired State
Parameter Store / Secrets Manager
Session Manager

Question 3

Three things an AWS-based instance needs to use SSM

Answer 3

1. Agent installed
2. EC2 Instance Role
3. IGW or VPC Endpoint to connect to the Systems Manager Endpoint (in the AWS Public Zone)

Question 4

How to enable on-prem servers to use Systems Manager

Answer 4

Need to set up a “Managed Instance Activation” for each
Select IAM role
Receive an “activation code” and an “activation ID”

This process sets up secure communication between the on-premises servers and the Systems Manager Endpoint

Question 5

What does the “Run Command” do, and how does it work?

Answer 5

It runs “command documents” on managed instances (defined by instances, tags, or Resource Groups). The run rate can be defined by “Concurrency” and “Error Threshold.” The command documents are passed to the SSM Agents for execution.

Can have a Run Command as the target of an EventBridge rule.

Question 6

Types and functionality of SSM Documents

Answer 6

JSON or YAML documents, stored in SSM Document Store. They ask for parameters, and include steps.

“Systems Managers uses Documents to support all of its different features.”

Command Documents: Run Command, State Manager, Maintenance
Windows
Automation Documents: Automation, State Manager, Maintenance
Windows
Package Documents: used by Distributor

Question 7

Patch Manager Concepts: Patch Baseline, Patch Groups, Maintenance Windows, Run Command, Concurrency & Error Threshold, Compliance

Answer 7

Patch Baseline – what needs to be installed. Can have many baselines, managed and custom.

    AWS-AmazonLinux2DefaultPatchBaseline

Patch Groups: which resources to patch (“targets” for “patch tasks”)

Maintenance Window: Schedule, Duration, Targets, Tasks

Run Command: what executes the patching behind the scenes

     AWS-RunPatchBaseline

Compliance: after patches are applied, Systems Manager can check the end state (using Systems Manager INVENTORY)