In the ever-evolving landscape of cloud computing, AWS (Amazon Web Services) continually introduces innovative solutions to enhance operational efficiency, security, and ease of management. One such powerful tool is AWS Systems Manager (SSM), which empowers users to manage their server infrastructure without the need for SSH access and traditional EC2 key pairs. In this comprehensive guide, we’ll delve into setting up AWS SSM, exploring its advanced use cases, and demonstrating how it can transform your workflow.

Understanding AWS Systems Manager

AWS Systems Manager (SSM) is a comprehensive solution that provides a unified interface for managing resources across your AWS environment. It enables you to automate tasks, manage instances at scale, and maintain compliance across your infrastructure.

Key Features and Benefits

  • Automation: Automate operational tasks using predefined or custom-built documents, reducing manual intervention and potential errors.
  • Secure File Transfer: Safely transfer files between your instances and your local environment without exposing sensitive data.
  • Patch Management: Seamlessly manage patches and updates across instances, ensuring security and compliance.
  • Run Commands: Run commands remotely across multiple instances, eliminating the need for SSH access.
  • Inventory and Compliance: Collect and manage inventory data for instances, facilitating compliance audits.
  • Hybrid Environment Support: Extend SSM capabilities to on-premises servers and hybrid environments.

Setting Up AWS SSM

Prerequisites

To get started with AWS SSM, you’ll need an active AWS account and some EC2 instances. Ensure that you have the necessary IAM permissions to set up and use SSM.

Enabling SSM on EC2 Instances

  1. Open the AWS Management Console.
  2. Navigate to the EC2 Dashboard.
  3. Select the instances you want to manage with SSM.
  4. Choose “Actions” > “Instance Settings” > “Attach/Replace IAM Role.”
  5. Select an existing IAM role with SSM permissions or create a new role.
  6. Click “Apply” to attach the IAM role.

IAM Role and Permissions

It’s crucial to configure IAM roles with least privilege principles for enhanced security. Create a custom IAM policy that includes permissions for SSM actions like ssm:SendCommand, ssm:CreateDocument, and others. Attach this policy to the IAM role you’ve associated with your instances.

Getting Started with SSM

Using the AWS Management Console

  1. Navigate to the SSM Dashboard in the AWS Management Console.
  2. Explore the various functionalities like “Run Command,” “Automation,” “State Manager,” and “Patch Manager.”

Command Document and Parameters

SSM operates using documents—a JSON or YAML configuration that specifies the actions you want to perform on instances. Documents define the commands, parameters, and targets.

SSM Document Examples

Here’s a simple SSM document example to run a basic shell command:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

{
  "schemaVersion": "2.2",
  "description": "Run a shell command",
  "mainSteps": [
    {
      "action": "aws:runShellScript",
      "name": "runShellScript",
      "inputs": {
        "runCommand": ["echo Hello, SSM!"]
      }
    }
  ]
}

Advanced Use Cases for AWS SSM

Automating Patch Management

SSM’s Patch Manager lets you automate patching for instances, ensuring they’re up-to-date with the latest security updates.

You can use AWS CloudFormation to create a Patch Baseline and associate it with your EC2 instances to automate patch management.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26

Resources:
  MyPatchBaseline:
    Type: AWS::SSM::PatchBaseline
    Properties:
      Name: MyPatchBaseline
      OperatingSystem: AMAZON_LINUX
      ApprovalRules:
        PatchRules:
          - PatchFilterGroup:
              - Key: CLASSIFICATION
                Values:
                  - Security
          - ApproveAfterDays: 7

  MyEC2Instance:
    Type: AWS::EC2::Instance
    Properties:
      ...
      Tags:
        - Key: Name
          Value: MyInstance
      UserData:
        Fn::Base64: !Sub |
          #!/bin/bash
          yum install -y aws-cfn-bootstrap
          /opt/aws/bin/cfn-init -v --stack ${AWS::StackName} --resource MyEC2Instance --region ${AWS::Region}

Run Commands at Scale

Execute commands simultaneously on multiple instances, streamlining tasks like software installations or log retrieval.

You can use the AWS CLI to run commands on multiple instances using SSM Run Command.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

aws ssm create-document --name "MyRunCommandDocument" --document-type "Command" --document-format "JSON" --content '{
  "schemaVersion": "2.2",
  "description": "Run a custom command on instances",
  "mainSteps": [
    {
      "action": "aws:runShellScript",
      "name": "runShellScript",
      "inputs": {
        "runCommand": ["echo Hello from SSM Run Command"]
      }
    }
  ]
}'

aws ssm create-association --name "MyAssociation" --targets "Key=InstanceIds,Values=i-1234567890abcdef0,i-abcdef01234567890" --schedule-expression "rate(5 minutes)"

Secure File Transfer

Transfer files securely between your local machine and instances without exposing sensitive data to security risks.

You can use AWS SSM Session Manager to securely transfer files between your local machine and instances.

1
2
3

aws ssm start-session --target i-1234567890abcdef0
# Once inside the session:
scp /path/to/local/file.txt ec2-user@i-1234567890abcdef0:/home/ec2-user/

Inventory and Compliance Management

Collect comprehensive inventory data about your instances and ensure compliance with organizational policies.

SSM Inventory helps you collect inventory data about your instances.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

Resources:
  MyEC2Instance:
    Type: AWS::EC2::Instance
    Properties:
      ...
      Tags:
        - Key: Name
          Value: MyInstance

  MyInventoryConfig:
    Type: AWS::SSM::ResourceDataSync
    Properties:
      SyncName: MyInventorySync
      S3BucketName: my-inventory-bucket
      S3Prefix: inventory-data/
      BucketRegion: us-east-1

Hybrid Environments and On-Premises Servers

Extend SSM capabilities beyond AWS to manage on-premises servers in a consistent manner.

You can extend SSM capabilities to on-premises servers using the SSM Agent.

1
2
3
4
5
6
7
8

# Install SSM Agent on an on-premises server
sudo yum install -y https://s3.amazonaws.com/ec2-downloads-windows/SSMAgent/latest/linux_amd64/amazon-ssm-agent.rpm

# Start the SSM Agent
sudo systemctl start amazon-ssm-agent

# Register the on-premises server in the AWS Management Console
aws ssm create-activation --default-instance-name "MyOnPremServer" --iam-role "arn:aws:iam::123456789012:role/MySSMRole"

Integrating SSM into Your Workflow

Replacing SSH and EC2 Key Pairs

By leveraging SSM, you reduce the attack surface and enhance security by minimizing SSH access.

To replace SSH access with SSM, you’ll use the AWS Management Console or AWS CLI to initiate a session to your instance:

1. Using AWS Management Console:

  • Go to the AWS Systems Manager Console.
  • Navigate to “Session Manager” on the left sidebar.
  • Choose the instance you want to access.
  • Click “Start session.”

2. Using AWS CLI:

aws ssm start-session --target i-1234567890abcdef0

This command starts an SSM session to the specified instance.

Improved Security and Auditability

SSM logs and records every action, providing an audit trail for compliance purposes.

SSM logs every action performed during a session, providing an audit trail for compliance purposes. You can access these logs in Amazon CloudWatch Logs.

1. Viewing SSM Session Logs:

  • Open the AWS Management Console.
  • Navigate to CloudWatch Logs.
  • Search for log groups named /aws/ssm/SessionManager.

Centralized Management and Monitoring

Manage all your instances centrally, simplifying operations and troubleshooting.

You can use AWS CloudWatch to create custom dashboards for monitoring and centralized management of your instances.

1. Creating a Custom CloudWatch Dashboard:

  • Go to the AWS Management Console.
  • Navigate to CloudWatch.
  • In the left sidebar, click on “Dashboards.”
  • Click “Create dashboard.”
  • Add widgets to your dashboard to monitor instance health, SSM command execution, and other relevant metrics.
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

aws cloudwatch put-dashboard --dashboard-name "MyInstanceDashboard" --dashboard-body '{
  "widgets": [
    {
      "type": "metric",
      "x": 0,
      "y": 0,
      "width": 12,
      "height": 6,
      "properties": {
        "view": "timeSeries",
        "metrics": [
          ["AWS/SSM", "CommandsExecuted", "InstanceId", "i-1234567890abcdef0"]
        ],
        "period": 300,
        "stat": "Sum",
        "region": "us-east-1"
      }
    }
  ]
}'

This code creates a CloudWatch dashboard with a widget displaying the number of SSM commands executed on the specified instance.

By integrating SSM into your workflow, you can enhance security, improve auditability, and centralize management and monitoring, making your infrastructure management more efficient and robust.

Code Examples

Let’s explore some practical code examples to demonstrate SSM’s capabilities.

Running Commands via AWS CLI

aws ssm send-command --instance-ids i-1234567890abcdef0 --document-name "AWS-RunShellScript" --parameters '{"commands":["echo Hello from AWS SSM"]}'

Automating Patching with CloudFormation

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

Resources:
  MyEC2Instance:
    Type: AWS::EC2::Instance
    Properties:
      ...
      Tags:
        - Key: Name
          Value: MyInstance

  PatchBaseline:
    Type: AWS::SSM::PatchBaseline
    Properties:
      Name: MyPatchBaseline
      ...

Secure File Transfer with SSM

aws ssm start-session --target i-1234567890abcdef0

Custom SSM Documents for Advanced Tasks

Craft custom SSM documents for your specific automation needs, like software installations or configurations.

Best Practices and Tips

Follow the principle of least privilege when configuring IAM roles and permissions. Implement tagging strategies to categorize and organize instances. Establish robust error handling and logging mechanisms in your SSM documents.

Monitoring and Reporting

Utilize CloudWatch Metrics to track SSM usage, create custom dashboards, and generate compliance reports.

Performance and Cost Optimization

Control SSM costs by monitoring command execution and optimizing your document configurations.

Conclusion

AWS Systems Manager (SSM) is a game-changer in the world of server management, providing powerful automation, enhanced security, and streamlined operations. By embracing SSM, you can bid farewell to traditional SSH and EC2 key pairs, and step into a future where efficient and secure server management is at your fingertips. So go ahead, explore the endless possibilities with AWS SSM and elevate your cloud infrastructure management to new heights.