ACKF logoACKF
Management and Governance

AWS Systems Manager

View on GitHub

AWS Systems Manager

AWS Systems Manager provides a unified set of capabilities to view, manage, and automate operational tasks across AWS resources and hybrid environments. It operates via service APIs, the Systems Manager console, and agents installed on managed instances to run commands, collect inventory, apply configuration state, and orchestrate automation. It normally sits in the management plane to coordinate operational actions against EC2 instances, on-prem servers, Lambda, and other resources.

🗂 Resource Category

Management and Governance • Security, Identity, and Compliance

🧠 Exam Memory Hook

Think: "Fleet management + automation + hybrid control plane = AWS Systems Manager"

📖 Ownership

Classification: Shared Responsibility Service

AWS responsibilities: AWS operates and patches the Systems Manager control plane, regional service endpoints, APIs, and the underlying physical infrastructure and managed runtime that host the service. AWS secures the service platform and maintains availability of the control plane and service features. AWS is responsible for patching the AWS-owned physical infrastructure and managed service components that deliver Systems Manager functionality.

Customer responsibilities: The customer configures IAM permissions, Systems Manager documents and automation workflows, patch baselines, maintenance windows, Parameter Store entries, and the SSM Agent deployment and configuration on managed instances; the customer secures credentials, data stored by the service, and access control policies, and monitors operational logs and run results. The customer is responsible for defining automation, scheduling tasks, and integrating Systems Manager with other services where required.

Patching responsibilities: AWS patches the AWS-owned physical infrastructure and the managed Systems Manager control plane and service runtime. The customer patches the guest operating systems, installed runtimes, libraries, dependencies, and customer-deployed applications on managed instances. Responsibility for installing or updating the SSM Agent depends on the AMI and operating system used; when the agent is not provided or updated by an AWS-provided image, the customer is responsible for installing and updating the agent. If a compute model or AMI explicitly includes agent management, specific update behaviour should be validated against that AMI's documentation.

🏗 Typical Architecture

💡 Top 5 Features

  • Run Command to execute ad-hoc commands on groups of managed instances without SSH or RDP.
  • State Manager to define and enforce desired configuration on instances using association documents.
  • Automation to orchestrate multi-step runbooks and operational workflows using documents.
  • Session Manager to provide interactive, auditable shell access to instances without opening inbound ports.
  • Parameter Store for centralized storage of configuration data and encrypted strings.

✅ Top 5 Use Cases

  • Remotely execute operational commands across a fleet of EC2 and hybrid instances without inbound access.
  • Enforce and remediate configuration drift by applying State Manager associations to managed instances.
  • Coordinate and run OS patching workflows across instances using Patch Manager and maintenance windows.
  • Store and retrieve application configuration and secrets in Parameter Store for service consumption.
  • Run repeatable operational runbooks and incident response playbooks using Automation documents.

🏗 Architecture Placement

AWS Systems Manager sits in the management plane as an account- and region-scoped service; operators, CI/CD systems, or automation engines call its APIs or console, and it communicates with managed instances using the SSM Agent or service integrations. It normally connects to Amazon EC2, on-prem servers (hybrid), AWS Lambda, and can store outputs or documents in services such as Amazon S3 and Amazon CloudWatch depending on configuration. Network, IAM, and agent presence are prerequisites for managed-instance communication.

🎯 Commonly Used With

- Amazon EC2
- AWS Lambda
- Amazon CloudWatch
- AWS Identity and Access Management
- Amazon S3

🌍 5 Real-World Examples

  • A banking operations team uses Patch Manager and maintenance windows to coordinate approved OS patching across EC2 instances and on-prem servers to meet maintenance schedules and reporting needs.
  • A healthcare platform stores database credentials and API configuration in Parameter Store and uses Automation to rotate keys and update dependent services during deployments.
  • An online retail operations team uses Run Command and State Manager to apply configuration changes and gather software inventory across fleet instances during seasonal preparation.
  • A telecommunications engineering team uses Session Manager to provide auditable administrative access to instances without exposing bastion hosts or opening inbound management ports.
  • A government IT department uses Automation documents to standardize and document incident response steps, invoking Systems Manager to collect logs and run diagnostics into Amazon S3 for analysis.

🎓 AWS Exam Clues

  • Use when you need agent-based management and automation across EC2 and hybrid instances.
  • Use Parameter Store when you need hierarchical configuration storage with optional encryption and versioning.
  • Use Session Manager when you require interactive access to instances without managing bastion hosts or inbound ports.
  • Use Automation documents for repeatable runbooks that require multi-step orchestration and optional approvals.
  • Use Patch Manager when you need centralized orchestration of OS patching using defined patch baselines and maintenance windows.

📝 Quick Revision

AWS Systems Manager is the AWS management-plane service for agent-based operational tasks, configuration enforcement, patch orchestration, parameter storage, and runbooks. Use it when you need centralized control across EC2 and hybrid resources; ensure SSM Agent presence and appropriate IAM and logging configuration for production use.

🏷 Keywords

SSM Agent • Run Command • Session Manager • Automation • State Manager • Patch Manager • Parameter Store • Inventory • Maintenance Window • Documents • OpsCenter • Hybrid Activations