Study guide

Technical reference and lesson notes

AWS Systems Manager: Managed Nodes, Automation, Session Manager, and Parameter Store

Purpose of This Lesson

AWS Systems Manager (SSM) is an operations hub for managing AWS resources, on-premises servers, and virtual machines hosted by other cloud providers. For the AWS Certified CloudOps Engineer Associate SOA-C03, focus on recognizing which Systems Manager capability solves a particular operations, access, patching, compliance, or configuration-management problem.

The central requirement is that a resource must be registered as a managed node. This generally requires the SSM Agent and appropriate permissions.

Key Concepts

Managed nodes: EC2 instances, on-premises servers, and supported virtual machines in other clouds can be managed through Systems Manager.
SSM Agent: The agent communicates with Systems Manager. Amazon Linux 2 AMIs include the agent, while other operating systems may require manual installation.
Permissions: An EC2 instance needs an instance profile with the required permissions. Hybrid environments use an IAM service role together with a process called hybrid activation.
Four broad capability categories: Systems Manager supports operations management, application management, change management, and node management.
Core features: Automation, Run Command, Inventory, Patch Manager, Compliance, Session Manager, and Parameter Store.
Documents: Systems Manager actions are commonly defined in documents written in YAML or JSON. Documents describe the operations or commands to perform.

Managed-Node Onboarding and Architecture

For an EC2 instance to become manageable through Systems Manager:

Ensure the SSM Agent is installed. Amazon Linux 2 includes the agent; other operating systems may require installation.
Attach an instance profile containing the required permissions.
Confirm that the instance can communicate with Systems Manager.
Use the Systems Manager capabilities against the registered managed node.

For on-premises servers or virtual machines in another cloud, use hybrid activation and an IAM service role. The important distinction is that installing the agent alone is not enough; the node also needs the authorization required to communicate with Systems Manager.

Systems Manager Capabilities

Automation

Systems Manager Automation performs defined operational tasks using documents. A document describes the actions to execute in YAML or JSON. For example, an Automation document can create an RDS snapshot, and the operation can be run on a schedule.

Choose Automation when the requirement is to orchestrate an operational procedure or management workflow rather than simply execute a shell command on a node.

Run Command

Run Command executes commands on managed instances without requiring interactive login. Documents can represent command, automation, or package operations. A document could check for missing Microsoft Windows updates and, depending on its configuration, install them.

Choose Run Command when the primary requirement is to execute a command or package-related action across one or more managed instances.

Inventory

Systems Manager Inventory collects information reported by managed nodes, such as:

Operating system details
Installed applications
Other system information reported by the agent

Inventory provides visibility into what exists on managed systems. It is an information-gathering capability, not the same as Patch Manager, which is used to manage patch installation.

Patch Manager

Patch Manager handles operating system and software patching across large groups of EC2 instances and on-premises servers. Important controls include:

Patch baselines: Rules that determine which patches can be approved.
Auto-approval rules: Rules for automatically approving selected categories of patches.
Patch overrides: Explicit lists that approve or reject particular patches regardless of normal rules.
Maintenance windows: Scheduled periods during which patching is allowed to occur.

Patch Manager helps keep software current and supports compliance requirements. Maintenance windows are particularly important when patching must occur only during predefined operational periods.

Compliance

Systems Manager Compliance scans managed instances for issues such as:

Patch compliance
Configuration inconsistencies
Compliance data across multiple accounts and Regions

The service displays information about patching and associations by default. Organizations can also define custom compliance types based on their own requirements using the AWS CLI, Windows PowerShell, or the AWS SDK.

Session Manager

Session Manager provides secure command-line access to managed instances without requiring traditional SSH, remote PowerShell, or bastion hosts. It integrates with IAM for granular access control.

Session activity can be recorded through AWS CloudTrail, and session output can be stored in an S3 bucket or sent to CloudWatch Logs. To support this logging, the EC2 instance needs permissions to access the relevant Systems Manager, S3, and CloudWatch Logs resources.

A key operational benefit is that Session Manager avoids the need to open inbound administrative ports such as SSH port 22 or the ports used for remote PowerShell. This makes it a strong choice when a scenario asks for secure command-line access without SSH.

Parameter Store

Systems Manager Parameter Store provides secure, hierarchical storage for configuration data and secrets. Applications can retrieve values programmatically using the parameter’s unique name.

Stored values can include:

Passwords
Database connection strings
RDS connection parameters
License codes
Other configuration values

Values may be stored as plain text or as encrypted ciphertext. Hierarchical names provide an organized namespace for parameters, such as grouping values by application or environment.

Parameter Store does not automatically rotate keys or passwords. Automatic secret rotation is identified in the lesson as a capability of AWS Secrets Manager instead. This distinction is a frequent selection point when choosing between the two services.

A typical application flow is:

An EC2 application makes an API call to Parameter Store.
Parameter Store returns a database password or connection parameter.
The application uses the retrieved value to connect to an RDS database.

Exam- or Assessment-Relevant Takeaways

If the question describes secure command-line access without SSH, remote PowerShell, open administrative ports, or a bastion host, consider Session Manager.
If the requirement is to execute commands across managed instances, choose Run Command.
If the requirement is to orchestrate a multi-step operational task, such as taking an RDS snapshot, choose Automation.
If the requirement is to discover operating systems or installed applications, choose Inventory.
If the requirement is to approve, reject, schedule, and install patches, choose Patch Manager.
If the requirement is to evaluate patch or configuration status, choose Compliance.
If an application needs centrally stored configuration values or secrets, consider Parameter Store.
If automatic secret rotation is required, Parameter Store is not sufficient according to this lesson; consider Secrets Manager.
Managed-node scenarios require both the SSM Agent and suitable permissions. Amazon Linux 2 includes the agent, but permissions are still required.
On-premises and other-cloud machines require hybrid activation and an IAM service role.
Session logging may use CloudTrail for activity records, S3 for session logs, and CloudWatch Logs for log output.

Tool / Feature Decision Guide

Requirement	Best-fit Systems Manager capability	Decisive reason
Create an RDS snapshot through a repeatable operational workflow	Automation	Uses documents to define and automate an operation
Run a command or package action on managed instances	Run Command	Executes defined commands across nodes
Discover operating systems and installed applications	Inventory	Collects system information from managed nodes
Install and control operating-system or software patches	Patch Manager	Uses baselines, overrides, and maintenance windows
Assess patch and configuration status	Compliance	Scans and aggregates compliance information
Open a secure command-line session without SSH or a bastion host	Session Manager	Uses IAM-controlled sessions and avoids traditional administrative ports
Store application configuration or a password under a hierarchical name	Parameter Store	Provides programmatic retrieval of plain-text or encrypted values
Automatically rotate stored secrets	Secrets Manager rather than Parameter Store	Parameter Store does not automatically rotate keys

Common Traps / Misconceptions

Installing the SSM Agent is sufficient: The node also needs the appropriate permissions. Amazon Linux 2 includes the agent, but its instance profile still matters.
Inventory installs or updates software: Inventory reports installed applications and system information; Patch Manager handles patch management.
Compliance is the patching engine: Patch Manager applies patches. Compliance evaluates patch and configuration status.
Automation and Run Command are interchangeable: Automation is for operational workflows; Run Command is primarily for executing commands or package actions on managed nodes.
Session Manager requires SSH ports: Session Manager is specifically useful because it avoids the need for SSH, remote PowerShell, and bastion hosts.
CloudTrail is the only Session Manager logging destination: Session activity can be recorded with CloudTrail, while session logs or output can also be stored in S3 and CloudWatch Logs.
Parameter Store automatically rotates passwords: The lesson explicitly distinguishes automatic rotation as a Secrets Manager capability.
Hybrid machines use the same onboarding path as EC2 instances: On-premises and other-cloud virtual machines require hybrid activation and an IAM service role.

Real-World Engineer / Analyst Notes

Standardize managed-node onboarding so agent installation, IAM permissions, and hybrid activation are treated as one workflow.
Use maintenance windows to reduce the operational risk of patching production systems at arbitrary times.
Use patch baselines for broad policy and patch overrides for explicit exceptions or urgent decisions.
Separate discovery from remediation: Inventory tells you what is installed, Compliance tells you whether systems meet requirements, and Patch Manager performs patch operations.
Prefer Session Manager when centralized IAM authorization and auditable administrative access are more important than traditional SSH workflows.
Treat Parameter Store values as application dependencies. Applications need permission to retrieve them, and encrypted values require the appropriate access path and permissions.
Plan secret rotation separately when using Parameter Store; storing a secret does not imply that its value will be changed automatically.

Quick Reference Summary

Systems Manager: End-to-end management for AWS, on-premises, and other-cloud resources.
Agent and permissions: Required for managed-node operation; Amazon Linux 2 includes the agent.
Hybrid activation: Required for on-premises and other-cloud managed machines.
Automation: Runs document-defined operational workflows.
Run Command: Executes commands or package actions on managed nodes.
Inventory: Reports operating systems, applications, and system information.
Patch Manager: Approves, rejects, schedules, and installs patches.
Compliance: Evaluates patch and configuration compliance, including custom compliance types.
Session Manager: Provides IAM-controlled command-line access without SSH or bastion hosts.
Parameter Store: Stores hierarchical configuration values and secrets; it does not automatically rotate them.

Flashcards

Q: A company needs to run a repeatable workflow that creates an RDS snapshot on a schedule. Which Systems Manager capability fits best, and why?
A: Use Systems Manager Automation. The workflow is an operational task defined in a YAML or JSON document, rather than merely a command executed on an instance.

Q: When should Run Command be chosen instead of Automation?
A: Choose Run Command when the main requirement is to execute a command or package action on one or more managed instances. Automation is better for orchestrating a broader operational procedure.

Q: An operations team needs a report of operating systems and installed applications across managed servers. Which feature should they use?
A: Use Systems Manager Inventory, which collects system and application information reported by managed nodes.

Q: What is the distinction between Patch Manager and Compliance?
A: Patch Manager controls patch approval, scheduling, and installation. Compliance evaluates whether instances meet patching and configuration requirements.

Q: A production patch must be installed only during an approved maintenance period. Which Patch Manager controls are relevant?
A: Use a patch baseline to define approval behavior and a maintenance window to restrict when the patching operation runs.

Q: A specific patch must be rejected even though normal baseline rules would approve it. What should be configured?
A: Use a patch override that explicitly rejects the patch. Overrides provide an explicit exception to the normal rules.

Q: An administrator needs secure command-line access to an EC2 instance without opening SSH port 22 or deploying a bastion host. Which feature should be selected?
A: Use Session Manager. It provides IAM-controlled sessions without requiring SSH, remote PowerShell, or a bastion host.

Q: How can Session Manager activity and output be audited or retained?
A: Actions can be recorded through CloudTrail, while session logs or output can be stored in S3 or sent to CloudWatch Logs, provided the instance has the necessary permissions.

Q: What two broad prerequisites make an EC2 instance a Systems Manager managed node?
A: The SSM Agent must be installed and the instance must have the required permissions, commonly supplied through an instance profile.

Q: How does onboarding differ for an on-premises server?
A: An on-premises server requires the SSM Agent, an IAM service role, and the hybrid activation process rather than the normal EC2 instance-profile approach.

Q: When would Parameter Store be appropriate for an application?
A: Use it for centrally stored configuration data or secrets, such as database passwords and connection strings, that an application retrieves programmatically by parameter name.

Q: What is the important security and lifecycle limitation of Parameter Store compared with Secrets Manager in this lesson?
A: Parameter Store can store encrypted values, but it does not automatically rotate keys or passwords. Automatic rotation is associated with Secrets Manager.

Practice Questions

Question 1

A company wants to allow engineers to administer EC2 instances from the command line. Security policy prohibits inbound SSH access and does not allow bastion hosts. Which solution best meets the requirement?

A. Run Command with public IP addresses
B. Session Manager with IAM permissions
C. Inventory with CloudTrail enabled
D. Patch Manager with a maintenance window

Correct answer: B. Session Manager with IAM permissions

Session Manager provides secure remote command-line access without SSH or a bastion host and integrates with IAM for granular authorization.

Question 2

An organization wants to apply operating-system patches to a fleet only during scheduled maintenance periods. It also needs rules for automatic patch approval and explicit exceptions. Which capability should it use?

A. Systems Manager Inventory
B. Systems Manager Compliance
C. Systems Manager Patch Manager
D. Systems Manager Parameter Store

Correct answer: C. Systems Manager Patch Manager

Patch Manager supplies patch baselines, approval rules, overrides, and maintenance windows. Compliance evaluates status but does not perform the patch-management workflow.

Question 3

An application on EC2 needs to retrieve an encrypted database password using a hierarchical name such as an application and environment path. The organization does not require automatic rotation. Which service is the best fit from the services discussed?

A. Systems Manager Parameter Store
B. Systems Manager Inventory
C. Systems Manager Run Command
D. Systems Manager Session Manager

Correct answer: A. Systems Manager Parameter Store

Parameter Store supports hierarchical names, encrypted values, and programmatic retrieval. The absence of an automatic-rotation requirement makes its stated limitation acceptable.

Question 4

A newly deployed non-Amazon-Linux instance does not appear as a managed node. The SSM Agent is not installed, and no instance permissions have been configured. What is the most likely remediation?

A. Create a maintenance window only
B. Install the SSM Agent and provide the required instance permissions
C. Enable Inventory without changing the instance
D. Store the instance password in Parameter Store

Correct answer: B. Install the SSM Agent and provide the required instance permissions

Managed-node operation depends on both agent installation and authorization. A maintenance window or Inventory configuration cannot substitute for those prerequisites.

WordPress Metadata

Suggested Slug:
aws-systems-manager-managed-nodes-automation-session-manager-parameter-store

Meta Description:
Study AWS Systems Manager capabilities for managed-node onboarding, automation, patching, compliance, secure access, and hierarchical parameter storage in the SOA-C03 CloudOps context.

Tags:
AWS Systems Manager, SSM Agent, Run Command, Automation, Patch Manager, Session Manager, Parameter Store, AWS CloudOps, EC2 management, Hybrid cloud, AWS IAM, AWS CloudTrail