7 questions found
What is AWS Systems Manager and what operational tasks does it help automate across your AWS resources?
Beginner
AWS Systems Manager is a management service that gives you visibility and control over your infrastructure on AWS, providing capabilities such as running commands remotely across many instances at once, managing configuration and patching, storing parameters and secrets, and organizing operational data, all from a single unified interface, reducing the need for manual, one off operational work across your fleet of resources.
aws ssm send-command --instance-ids i-1234567890abcdef0 --document-name AWS-RunShellScript --parameters commands='["sudo yum update -y"]'
Real-world example
A systems administrator uses Systems Manager to simultaneously apply a security patch across two hundred EC2 instances with a single command, rather than manually connecting to and updating each instance individually.
Common follow-ups: What are Systems Manager documents and how do they define automated actions?;Does using Systems Manager require an agent installed on managed instances?
EC2 & Compute;AWS CLI & SDKs
What is Systems Manager Session Manager, and how does it improve the security of accessing EC2 instances compared to traditional SSH?
Beginner
Session Manager lets you start a secure interactive shell session directly with an EC2 instance through the AWS console or CLI without needing to open any inbound SSH ports, manage SSH keys, or maintain a bastion host, since all connections are established using IAM permissions and logged centrally, significantly reducing the attack surface and administrative overhead compared to traditional SSH based access.
aws ssm start-session --target i-1234567890abcdef0
Real-world example
A company eliminates its previous bastion host architecture entirely, switching to Session Manager for all administrative access to its private EC2 instances, closing off inbound SSH access completely while still allowing authorized engineers secure shell access.
Common follow-ups: What IAM permissions are required to use Session Manager?;How are Session Manager sessions logged for audit purposes?
IAM;VPC & Networking
How does Systems Manager Patch Manager automate the process of keeping instances up to date with the latest security patches?
Intermediate
Patch Manager lets you define patch baselines specifying which patches should be automatically approved, and then apply them across your fleet of instances on a defined maintenance window schedule, automatically reporting which instances are compliant or missing specific patches, removing the need for manually tracking and applying operating system and application patches across potentially hundreds of individual servers.
aws ssm create-patch-baseline --name my-baseline --operating-system AMAZON_LINUX_2 --approval-rules file://approval-rules.json
Real-world example
An operations team configures Patch Manager to automatically apply critical security patches to all production Linux instances every Sunday night during a scheduled maintenance window, eliminating the need for anyone to manually track and apply patches server by server.
Common follow-ups: How do you test patches in a staging environment before rolling them out broadly?;What happens if a patch causes an instance to fail after being applied?
Monitoring (CloudWatch);Auto Scaling Groups
What are Systems Manager Automation documents, or runbooks, and how do they help standardize common operational procedures?
Intermediate
Systems Manager Automation lets you define a sequence of steps as a reusable document, commonly called a runbook, that automates common operational procedures, such as safely restarting an application, creating an AMI backup before a change, or remediating a specific type of security finding, ensuring these procedures are executed consistently every time rather than relying on someone manually following a written checklist that could introduce human error.
aws ssm start-automation-execution --document-name AWS-RestartEC2Instance --parameters InstanceId=i-1234567890abcdef0
Real-world example
An operations team creates a standardized automation runbook for safely restarting a specific application service, ensuring every team member performs the exact same verified sequence of steps rather than relying on individually remembered, inconsistent procedures.
Common follow-ups: Can Automation documents call other Automation documents as sub steps?;How do you version control changes to a custom Automation document?
AWS Config;AWS CloudTrail & Auditing
How does Systems Manager Inventory help maintain visibility into the software and configuration details installed across a fleet of managed instances?
Intermediate
Systems Manager Inventory automatically collects and centralizes metadata about your instances, such as installed applications, operating system patches, and network configuration, giving you a searchable, up to date view across your entire fleet, which is valuable for tasks like quickly identifying every instance running a specific vulnerable software version that needs immediate attention.
aws ssm list-inventory-entries --instance-id i-1234567890abcdef0 --type-name AWS:Application
Real-world example
A security team uses Systems Manager Inventory to quickly identify every EC2 instance across the company still running a specific vulnerable version of a software package, allowing them to prioritize remediation efforts immediately after a new vulnerability disclosure.
Common follow-ups: How frequently does Inventory data get refreshed by default?;Can custom inventory data types be defined beyond the standard built in types?
AWS Config;Monitoring (CloudWatch)
How can Systems Manager State Manager ensure that instances remain in a consistently defined configuration state over time, even after reboots or scaling events?
Advanced
State Manager lets you define a desired configuration state, such as ensuring a specific security agent remains installed and running or that a particular configuration file always contains the correct settings, and continuously enforces that state on a defined schedule across your managed instances, automatically correcting any configuration drift that might otherwise occur due to manual changes, failed updates, or new instances launched by an Auto Scaling Group that were not part of the original golden image.
aws ssm create-association --name AWS-ConfigureAWSPackage --targets Key=tag:Environment,Values=Production --schedule-expression 'rate(1 day)'
Real-world example
A company uses State Manager to continuously verify that a required security monitoring agent remains installed and running on every production instance, automatically reinstalling it if a manual change or a new Auto Scaling launched instance is ever found missing that required agent.
Common follow-ups: How does State Manager handle instances that fail to reach the desired state after several attempts?;What is the difference between State Manager and a full configuration management tool like Ansible?
Auto Scaling Groups;AWS Config
How can Systems Manager be integrated with AWS Config and Security Hub to build a comprehensive automated compliance remediation pipeline?
Advanced
AWS Config can detect a non compliant resource configuration and trigger a Systems Manager Automation document as a remediation action, which then executes the necessary corrective steps, such as closing an overly permissive security group rule, and the results of both the detection and remediation can flow into Security Hub for centralized visibility, creating an end to end pipeline where compliance issues are automatically detected, corrected, and tracked without requiring constant manual intervention from a security or operations team.
aws configservice put-remediation-configurations --remediation-configurations '[{"ConfigRuleName":"restricted-ssh","TargetType":"SSM_DOCUMENT","TargetId":"AWS-DisablePublicAccessForSecurityGroup"}]'
Real-world example
A company builds an automated pipeline where AWS Config detects any security group accidentally allowing unrestricted SSH access, triggers a Systems Manager Automation document that immediately removes the offending rule, and logs the entire detection and remediation event into Security Hub for the security team's ongoing visibility.
Common follow-ups: How do you ensure an automated remediation action does not accidentally break a legitimate business need?;What role does testing play before enabling fully automated remediation broadly?
AWS Config;AWS Security Hub & GuardDuty