Skip to main content
In this lesson you’ll learn how to use AWS Systems Manager to perform ad‑hoc operations with Run Command and to enforce ongoing configuration using State Manager associations. We’ll:
  • Create an IAM role for EC2 that grants Systems Manager permissions.
  • Launch an EC2 instance with that role attached.
  • Use Run Command to update the SSM Agent on the instance.
  • Create a State Manager association to keep the agent updated on a schedule.
Prerequisites: an AWS account with permissions to create IAM roles, EC2 instances, and Systems Manager associations.

​
1. Create an EC2 role for Systems Manager

Create an IAM role for EC2 that allows Systems Manager to manage the instance:
  1. In the IAM console, create a new role and choose EC2 as the trusted entity.
  2. Attach the managed policy AmazonSSMManagedInstanceCore. This policy grants the core Systems Manager permissions that a managed instance needs to communicate with Systems Manager.
  3. Name the role SSM-EC2-Role (or choose a clear, descriptive name) and finish creating the role.
A screenshot of the AWS Identity and Access Management (IAM) Roles console showing a green confirmation banner "Role SSM-EC2-ROLE created." The page lists IAM roles and shows controls to create or delete roles.
Tip: AmazonSSMManagedInstanceCore includes permissions for SSM Agent communication and Session Manager. If you need additional access (for example, to write results to S3), grant only the minimum required permissions via a separate role or an inline policy.

​
2. Launch an EC2 instance with the SSM role

Attach the IAM role to a new EC2 instance so Systems Manager can manage it.
  1. Open the EC2 console and choose Launch instances.
  2. Provide a name (for example, EC2-Instance) and select your AMI and instance type (t3.micro is fine for testing).
  3. Under Advanced details, set the IAM Instance Profile to the SSM-EC2-Role you created.
  4. Launch the instance.
Once the instance is running and the SSM Agent is installed and has network connectivity to Systems Manager endpoints, Systems Manager can manage it. See the SSM Agent documentation for installation and configuration details: https://docs.aws.amazon.com/systems-manager/latest/userguide/ssm-agent.html
A screenshot of the AWS EC2 web console showing an instance launch progress bar at 33% with the message "Creating security group rules." Below it is text asking the user to wait and not close the browser while the instance is launched.
Ensure the SSM Agent is installed and running on the instance. Many official AMIs (for example, Amazon Linux) include it by default. Also verify network access to Systems Manager endpoints through an Internet Gateway/NAT or VPC endpoints for Systems Manager.

​
3. Use Run Command to update the SSM Agent

Run Command is ideal for one‑off or immediate operations across managed instances.
  1. Open Systems Manager and navigate to Run Command.
  2. Click Run command.
  3. Choose the AWS-UpdateSSMAgent document — this document updates the SSM Agent on the target instance.
  4. Select target instance(s) — you can target instances directly, by tag, or by other target types.
  5. Leave parameters as default unless you need to change them, then execute the command.
Run Command executes immediately (or on demand) and reports per-target status and output.
A screenshot of the AWS Systems Manager "Run Command" console showing the Commands tab with options like View details, Cancel command, Rerun and a highlighted "Run command" button. The command list area is empty and displays "No commands are executing."
When selecting targets you can choose instances by tags. This is useful for dynamically grouping instances (for example, Environment=prod).
A screenshot of the AWS Systems Manager "Run a command" Target selection page, showing target selection options with "Specify instance tags" highlighted. The lower area shows input fields for Tag key and Tag value and an "Add" button.
After execution, inspect the command status and output in the Run Command console. Successful runs show completed targets and any errors if present.
Screenshot of the AWS Systems Manager Run Command console showing a specific Command ID. The command status shows "Success" with 1 target completed and 0 errors.

​
4. Introduction to State Manager

Run Command performs ad‑hoc tasks. State Manager is designed to declare and maintain a desired state over time by creating associations:
  • An association ties a Systems Manager document (for example, AWS-UpdateSSMAgent) to a set of targets and optionally schedules recurring execution.
  • State Manager ensures the document runs on the targets according to the association’s schedule and parameters.
Reference: https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-state.html

​
5. Create a State Manager association

Create an association to keep the SSM Agent updated on a recurring schedule.
  1. In Systems Manager, open State Manager and choose Create association.
  2. Provide a name (for example, Demo-State-Manager) and select the AWS-UpdateSSMAgent document.
  3. Keep default document parameters unless you need to override specific options.
A screenshot of the AWS Systems Manager web console on the "Create association" page, showing the Parameters section with a Version input and "Allow Downgrade" set to false. The left navigation menu and top browser tabs are also visible.
Specify targets and an optional association execution role:
  • Choose targets manually, by tag, or apply to all instances depending on scope.
  • Optionally provide an association execution role (dispatch role) that State Manager can assume to call other AWS services on your behalf — for example, to write execution output to S3 or to invoke Lambda.
A screenshot of the AWS Management Console showing AWS Systems Manager → State Manager (Create association) with the "Association Dispatch Assume Role" settings panel visible. The left navigation and a selected EC2 instance ID are also shown.
When specifying an association execution role, follow the principle of least privilege. Grant only the permissions required for the association (for example, S3 PutObject if writing results to an S3 bucket). Excessive permissions increase risk.

​
6. Scheduling, rate controls, and monitoring

  • Choose whether the association runs once, on a schedule, or at set intervals. Use the schedule builder to create simple intervals or CRON expressions.
  • Configure concurrency and error threshold rate controls to limit how many instances run concurrently and when to stop on errors.
  • Send execution output to Amazon S3 or CloudWatch Logs for auditing.
  • Add CloudWatch Alarms to trigger on unhealthy association executions.
The schedule builder defaults to a 30‑minute interval for the “Default” option; customize this with CRON or other interval settings as needed.
A screenshot of the AWS Systems Manager "Create association" page showing the CRON schedule builder with the "Default" option (associations run every 30 minutes) selected, and the left navigation menu listing Systems Manager features.

​
7. Create and review the association

After creating the association:
  • View details such as targets, document version, parameters, and execution history.
  • Use Apply association now to run immediately against current targets.
  • Edit or delete the association as requirements change.
A screenshot of the AWS Systems Manager console showing an association details page with Association ID 960167f3-4b6b-43c8-a524-0bc2805d49c8 and buttons like "Apply association now," "Edit," and "Delete." The page displays tabs (Description, Resources, Parameters, Targets, Versions, Execution history) and association metadata such as document name AWS-UpdateSSMAgent and a "Success" status.

​
Quick comparison: Run Command vs State Manager

​
Summary

  • Use Run Command for immediate, one‑off tasks across managed instances.
  • Use State Manager to declare a desired state (via a Systems Manager document) and enforce it on a schedule using associations.
  • Combining Run Command and State Manager gives operational flexibility: ad‑hoc troubleshooting and long‑term configuration management.
Links and references

Watch Video