Skip to main content
In this lesson we cover AWS Systems Manager — a unified service for managing EC2 instances, on‑premises servers, and other compute resources across AWS, other clouds, and data centers. Systems Manager reduces operational overhead at scale by centralizing inventory, configuration, patching, runbook automation, and remote access. The service helps prevent configuration drift, enforce compliance, and simplify incident response across heterogeneous environments.
An infographic titled "Systems Manager" showing icons for various management features (Inventory, Patch Manager, Parameter Store, State Manager, Run Command, OpsCenter, Incident Manager, Maintenance/Change windows, Application/Session/Change Manager, etc.). Arrows link those services to targets on the right like Other Cloud Provider, AWS, Data Centers and IoT fleets.

​
How Systems Manager communicates with managed instances

To be managed by Systems Manager, an instance or server must run the Systems Manager Agent (SSM Agent). The SSM Agent is a small service installed on supported operating systems (EC2 instances, on‑premises servers, or VMs in other clouds). It brokers communication between the managed resource and the Systems Manager control plane so you can collect inventory, run commands, apply configurations, and fetch telemetry.
A simple diagram showing an Amazon EC2 / on‑prem server with an SSM Agent that connects to AWS Systems Manager. It labels the EC2/on‑prem box on the left, the SSM Agent in the middle, and the Systems Manager service on the right.
SSM Agent is the communication channel: you push commands or documents from the console, AWS CLI, or SDKs, and the agent executes them on the target instance and returns output and status.
A simplified architecture diagram for AWS Systems Manager, showing a central Systems Manager service icon sending "Run Command" and "Documents" to resources inside an AWS VPC. Green icons on the left represent client/resource types and the right shows the AWS VPC container.

​
Key capabilities

Systems Manager provides a broad set of features to manage compute fleets consistently:
  • Centralized control: single UI and API to administer many systems.
  • Resource grouping: target instances by tags, resource groups, or attributes.
  • Automation: define and run safe, repeatable runbooks for routine operations.
  • Patch management: schedule and automate OS patching.
  • Operational insights: aggregated views via Explorer and OpsCenter.
  • Remote management: secure shell access via Session Manager without open inbound ports.
  • Compliance: scan and report on patch/configuration compliance.
  • Hybrid support: manage on‑premises servers and other-cloud VMs.
An infographic titled "Key Features and Capabilities" showing ten numbered cards with colorful circular icons and labels (e.g., Centralized Control, Automation, Patch Management, Operational Insights, Configuration Management, Remote Management, Compliance Enforcement, Hybrid Capabilities). Each card displays a simple icon and brief feature name in a 2-row grid.

​
Core subservices and typical use cases

Below are grouped Systems Manager capabilities and recommended use cases. Application management
  • Application Manager: visualize and investigate application components and their operational health. You can map the resources that comprise an application (for example EC2, RDS, Lambda) and identify failing components quickly.
  • Parameter Store: secure, hierarchical storage for configuration data and secrets (optional KMS encryption). Use Parameter Store to avoid hard‑coding credentials and to enable runtime configuration changes.
Example: when an e‑commerce service reports increased errors, Application Manager helps localize which component is failing; you can then use Run Command to run remediation actions (restart services, clear disk space, rotate credentials).
A simple architecture diagram titled "Application Manager" showing an AWS VPC containing Amazon EC2, Amazon RDS and AWS Lambda icons. An Application Manager icon sits outside the VPC with a red warning/alert triangle on the connection between them.
For secrets and configuration, store database credentials encrypted with KMS in Parameter Store and fetch them at application startup or via environment injection to improve security and simplify rotation.
A simplified AWS diagram showing Amazon EC2, AWS Lambda, and Amazon RDS inside a VPC. An arrow points from the VPC to an external Parameter Store icon labeled "Parameter Store."
Change management
  • Change Manager: enterprise workflows to plan, approve, and implement operational changes (for example, coordinating database upgrades with required approvers).
  • Automation: author runbooks to automate routine and safety‑checked tasks (e.g., hardening new instances at boot).
  • Change Calendar: create blackout windows and scheduling restrictions to prevent changes during critical business periods.
  • Maintenance Windows: schedule tasks (patching, updates) to run during off‑peak hours to minimize user impact.
Use Change Manager plus Maintenance Windows to run updates in a controlled, auditable, and auditable fashion.
A presentation slide titled "Change Management" showing four purple circular icons across the bottom labeled Change Manager, Automation, Change Calendar, and Maintenance Windows. Each icon contains a white line-art illustration related to gears, processes, or a calendar.
Node management features
  • Compliance: scan instances for missing patches and configuration drift.
  • Inventory: collect metadata about installed applications, packages, and network settings.
  • Session Manager: securely connect to instances using a browser shell or CLI — no inbound SSH/RDP required.
  • Run Command: execute ad‑hoc commands or scripts across fleets.
  • State Manager: define and enforce desired configuration state to prevent drift.
  • Patch Manager: automate scheduling and rollout of OS patches.
  • Distributor: package and deploy internal software across your fleet.
Operations management
  • Incident Manager: detect incidents (via CloudWatch alarms), notify on‑call responders, and orchestrate runbooked mitigation and recovery steps.
  • OpsCenter: centralize operational issues and findings so responders can investigate and resolve problems with linked runbooks and remediation guidance.
A slide titled "Operations Management" showing two orange circular icons labeled "Incident Manager" (cloud with a notification bell) and "OpsCenter" (documents, images and a magnifying glass). The slide appears to illustrate tools for incident notification and operations investigation.

​
Quick reference: Systems Manager components

​
Prerequisites and best practices

To use Systems Manager effectively:
  • Install and run the SSM Agent on each managed instance (refer to the official documentation for OS‑specific steps).
  • Attach an instance profile or provide credentials that grant Systems Manager the required permissions (for example, the managed policy AmazonSSMManagedInstanceCore).
  • Ensure network connectivity to Systems Manager endpoints either via internet access or VPC endpoints for Systems Manager and related services.
Ensure SSM Agent, proper IAM permissions, and network access are in place before attempting to manage instances. Without these, Systems Manager cannot communicate with the instance.
Use these resources for detailed installation steps, IAM examples, and VPC endpoint configuration when integrating Systems Manager into production environments.

Watch Video