General

Q: What is AWS Systems Manager?

AWS Systems Manager is a flexible and easy to use management service that enables enterprises to securely manage and administer their workloads, running on-premises or in AWS, using a single unified AWS experience. Systems Manager is designed to be highly automation-focused to enable configuration and management of instances at a large scale, while making it really simple to write and maintain automation artifacts.

Q: How do I get started with Systems Manager?

The best way to get started is to ensure your instance has met the necessary requirements in our Getting Started Guide. Once you've confirmed the requirements have been met, you can access the various Systems Manager capabilities from the left navigation bar in the EC2 Management Console or use the AWS SDKs and AWS Command Line Interface.

Q: Which operating systems does Systems Manager support?

Systems Manager is optimized to manage both Windows and Linux platforms from a single unified experience. Refer to Supported Operating Systems for more details on managing on-premises systems.

Q: Does Systems Manager manage instances running on-premises?

Yes, Systems Manager supports managing instances that are running on-premises data center. Refer to Systems Manager Prerequisites for more details.

Q: How much does Systems Manager cost?

There is no charge for Systems Manager.

Run Command

Q: What is Run Command?

Run Command is a feature of Systems Manager that provides a simple and secure way to remotely execute commands or run scripts against EC2 instances or on-premises servers, all from the EC2 API, CLI, or console. With Run Command, you can perform commands which make it easy to accomplish common administrative tasks like installing software, executing scripts, making configuration changes, and more.

Q: Who should use Run Command?

Run Command is designed for developers, system administrators, and other IT professionals who need to remotely manage their EC2 instances in a secure, reliable, and scalable way.

Q: Does AWS provide any predefined commands?

Yes. There are predefined commands available which are designed to help with commonly used administrative tasks. For Windows you can run a PowerShell command or script, configure Windows Update settings, deploy an MSI application and more. For Linux you run any Shell command or script, and remotely update the installed agent.

Q: Can I create my own commands?

Yes. Run Command allows you to easily create custom commands to perform common tasks required for your environment.

Q: What other types of commands or script can I run?

You can run any command or script that you can type into a command window on your EC2 instances.

Q: Can I send the same command to multiple EC2 instances at once?

Yes. You can easily issue a command to a fleet of instances by providing a list of instances when issuing a command.

Q: Can I retrieve the history of commands run against my instances?

Yes. Run Command keeps the output for each command for 30 days. In addition, you can have Run Command store a copy of all log files in Amazon S3 or capture the output of your commands using AWS CloudTrail.

Q: Can I control who can execute a command?

Yes. Using the published AWS Identity and Access Management (IAM) permissions and policies, you can control who has access to execute commands or documents on specific instances. For example, you can specify an IAM user who can run PowerShell commands, but not join an instance to a domain. Another IAM user can only be given access to run a very specific command like restarting services, giving you the flexibility to specify how much access any given user can have.

Q: Can I check the status of a running command?

Run Command provides the status of a command for each instance it is running on. All of this can be retrieved from the AWS CLI, SDK, or the EC2 Management Console.

State Manager

Q: What is State Manager?

State Manager automates the process of defining and maintaining a consistent configuration of OS and applications across your entire fleet of systems. For example – configuring and enforcing firewall policies, keeping anti-malware definitions current. Through reapplication of your configuration policies, State Manager ensures that your systems are always compliant with your enterprise policies.

Q: Why should I use State Manager?

Businesses are moving towards automated IT with applications across environments and locations, including on AWS and on-premises data centers. However, ensuring that the infrastructure powering your applications is consistent is a challenge. State Manager allows you create policies, reapply these policies to prevent configuration drift, and monitor the status of your intended state.

Q: How do I create my policies?

Policies can be easily created through Systems Manager Documents. In addition, you also have predefined configurations that you can use for installing applications, joining instances to domain and so on.

Q: What are the targets that can be configured?

You have the flexibility to target instances or tags. This means you have the flexibility to have specific configurations for groups of instances such as webservers.

Patch Manager

Q: What is Patch Manager?

Patch Manager is an automation-focused patching service which makes it easy for customers to keep their Windows instances up to date. Patch Manager helps you streamline your patching process through the implementation of built in best practices, such as maintenance windows and dynamic patch approval policies.

Q: How do I specify when I would like to patch an instance?

You use Maintenance Windows to define when patching occurs. Maintenance Windows are a new feature of EC2 which provide you the ability to define one or more recurring windows of time during which it is acceptable for your own maintenance to occur. By defining these windows and associating your instances with them, it is easier for you to ensure that any maintenance activities you perform on your instances which may impact the availability of a workload is done so during a well-defined window of time. Maintenance windows make it easy to schedule when you would like your own Run Command tasks to occur.

Q: How do I customize the patching process?

Patch Manager leverages Run Command to provide a fully automated patching process. While Patch Manager provides a pre-built Run Command document, you can easily customize the patching process by writing your own Run Command Document. For example, you can stop an NT service before rolling out the patches.

Q: What types of patches can I install with the Patch Manager?

Patch Manager supports the patching of Windows based instances, and provides the ability to select and deploy patches for Windows Server 2008 through Windows Server 2016 and Windows 7 – Windows 10.

Q: How do I pick the patches I want to install?

Patch Manager provides you with the ability to create Patch Baselines, which define the set of patches you have approved or blocked for deployment to your instances. In a Patch Baseline, you can select patches by the products (e.g. Windows Server 2008, Windows Server 2012, etc.), categories (e.g. Critical Updates, Security Updates, etc.) and severities for which you would like to review patches for deployment. For each category selected, you can then define a schedule on which the contained patches will be automatically approved for distribution. In addition to the rules, you can also specify a whitelist and blacklist of patches which indicate patches which are to be installed or blocked respectively. At the time of patching, Patch Manager will assess targeted instances for only the patches that have been approved prior to that point in time.

Q: How do I track the compliance levels of my instances?

With Patch Manager you can view patch compliance information which tells you the detailed results of the patching process. From the EC2 Management Console or API you can easily get aggregate compliance details per instance. In addition, you drill in further and for each instance you can determine which patches are installed, missing, not applicable, and which failed to install.

Inventory

Q: What is Inventory?

The Inventory capability in Systems Manager provides visibility into an instance's software catalog and configuration. You can set up Inventory to gather detail on a variety of instance attributes such as installed applications, AWS components and agents, network configuration, OS details, and more. Then use the powerful query feature to assess compliance and identify instances in need of remediation across your fleet.

Q: Who should use Inventory?

IT administrators and devops professionals will find this capability useful in understanding the configuration and composition of their fleets. Users can quickly determine which instances are missing a patch or are running an outdated application version. Similarly admins can run licensing audits to understand software usage. The net result is that systems administrators are better able to troubleshoot issues and assess security posture.

Q: Can I customize the information gathered by the Inventory?

Yes, you can create your own custom Inventory types and effectively extend Inventory's schema. For example, you can configure your instance to gather additional OS and CIM details, or record items like rack location and in-service date for on-premise servers.

Q: How can I track changes to my configuration over time?

Using AWS Config, you can monitor an instance's compliance with a desired configuration through Config Rules. This capability allows security experts and compliance auditors to have a complete audit trail of instance configuration changes, as well as receive proactive notifications in the event of non-compliance.

Automation

Q: What is Automation?

The Automation capability in Systems Manager simplifies the process of building and maintaining Amazon Machine Images (AMIs). This provides you a repeatable process to apply patches, application updates, and other changes to your AMIs.

Q: What tasks can I automate?

AMI maintenance is greatly simplified by Automation feature of Systems Manager, allowing you to patch, update agents, or bake-in applications using a streamlined, repeatable, and auditable process.

Parameter Store

Q: What is AWS Systems Manager parameter store?

AWS Systems Manager provides a centralized store to manage your configuration data, whether plain-text data such as database strings or secrets such as passwords. This allows you to separate your secrets and configuration data from your code. Parameters can be tagged and organized into hierarchies, helping you manage parameters more easily. For example, you can use the same parameter name, "db-string", with a different hierarchical path, "dev/db-string” or “prod/db-string", to store different values. Systems Manager is integrated with AWS Key Management Service (KMS), allowing you to automatically encrypt the data you store. You can also control user and resource access to parameters using AWS Identity and Access Management (IAM). Parameters can be referenced through other AWS services, such as Amazon Elastic Container Service, AWS Lambda, and AWS CloudFormation.

Q: Why should I use AWS Systems Manager parameter store?

It is a best practice to store configuration data and secrets separately from your code. You can use AWS Systems Manager parameter store to quickly store and reference configuration and sensitive information. Rather than storing data in config files or referencing them in plain text, you can store and obtain this information in your applications or scripts. Additionally, you control who has access to parameters so that only the right set of users has access to the appropriate information.

Q: How do you store sensitive data?

A secure string is any sensitive data that needs to be stored and referenced in a secure manner. If you have data that you do not want users to reference in clear text or have access to data that can be tampered with or misused, you should use secure strings in AWS Systems Manager parameter store. You can encrypt your sensitive data using your own AWS Key Management Service (KMS) key or your user account default key provided by AWS KMS.

Q: What services can I reference my parameters?

You can easily reference your parameters across AWS services such as Amazon Elastic Container Service, AWS Lambda, and AWS Systems Manager, or any service through which you can use the AWS Systems Manager parameter store APIs.

Q: Can I track usage and provide access control to specific parameters?

Yes. You can provide granular access control through customized permissions to users and resources (such as instances) for parameters access using AWS Identity and Access Management (IAM). This means you can control who can access which parameter on what resource. You can also set up Amazon CloudWatch Events rules based on parameter change events. Additionally, you can also track and audit parameter API calls using AWS CloudTrail.

Q: Can I track changes to parameters?

Yes, you can see history of parameter changes. You can also use versions that are automatically incremented upon change to look up specific parameter value bases on its version.

Q: Can I store hierarchical data as parameters?

Yes, you can use a hierarchical structure to store parameters. You can also control and audit access at every level of the hierarchy.

Q: Can I receive notifications upon changes to parameter values?

Yes, you can set up Amazon CloudWatch and Amazon Simple Notification Service (SNS) notifications for individual parameter values, and receive notifications upon change.

Q: What is the difference between Secrets Manager and Parameter Store?

AWS Secrets Manager is a service to manage the lifecycle for the secrets used in your organization centrally including rotation, audit, and access control. Secrets Manager helps you meet your security and compliance requirements by enabling you to rotate secrets automatically. Secrets Manager offers built-in integration for MySQL, PostgreSQL, and Amazon Aurora on Amazon RDS that's extensible to other types of secrets by customizing Lambda functions.
AWS Systems Manager Parameter Store provides secure, hierarchical storage for configuration data management, which can include secrets. Data such as database connection strings, passwords, and license codes can be stored as parameter values and can be audited and access controlled. Values stored can be either plain text or encrypted data. You can then reference values by using the unique name of the parameter. You can reference Systems Manager parameters to build generic configuration and automation scripts for use across AWS services such as Amazon ECS and AWS CloudFormation.
*AWS Secrets Manager is currently available only in global regions

Q: Should I use Parameter Store or Secrets Manager?

If you want a single store for configuration and secrets, you can use Parameter Store. If you want a dedicated secrets store with lifecycle management, use Secrets Manager. Parameter Store is available at no additional charge with limit of 10,000 parameters. Refer to AWS Secrets Manager pricing page for pricing details.
*AWS Secrets Manager is currently available only in global regions

Q: Is there a difference in the security model of Parameter Store and Secrets Manager?

No. Both Secrets Manager and Parameter Store are equally secure. Both services support encryption at rest using customer-owned KMS keys. For more information on how Parameter Store uses KMS, please see the KMS Developer Guide on how Parameter Store uses AWS KMS.
*AWS Secrets Manager is currently available only in global regions

Q: Can I use Secrets Manager with Parameter Store?

No. You cannot reference a Secrets Manager secret with Parameter Store at this time.
*AWS Secrets Manager is currently available only in global regions

Q: What are advanced parameters?

Advanced parameters provide enhanced capabilities such as the ability to store more than 10,000 parameters, larger parameter value size (up to 8 KB) and parameter policies such as expiration and no-change notifications. The expiration policy provides the ability to specify an expiration date and time. The no-change notification policy helps you track parameters that have not changed for a specified period of time. Advanced parameters are priced for storage per month and per API interaction. See the pricing page for details.

Q: Can I convert between standard and advanced parameter types?

A standard parameter may be converted into an advanced parameter at any time. Advanced parameters cannot be converted into standard parameters. If an advanced parameter’s enhanced capabilities are no longer required or you no longer want to incur charges for that parameter, you must delete the advanced parameter and then create a new parameter as a standard parameter.

Q: Can I increase the API throughput for Parameter Store?

Yes, API throughput can be raised to a higher limit through the Parameter Store settings tab. API throughput limits applies per region per account. Increased throughput limit incurs charges. See the pricing page for details. If you no longer need increased throughput, you may reset the limit at any time from the Settings tab.

Maintenance Windows

Q: What is a maintenance window?

Maintenance windows is a feature of Systems Manager which provide you the ability to define one or more recurring windows of time during which it is acceptable for any disruptive operation to occur. By defining these windows and associating your instances with them, it is easier for you to ensure that any maintenance activities you perform on your instances which may impact the availability of a workload is done so during a well-defined window of time.

Q: Why should I use maintenance window?

Maintenance windows help improve availability and reliability of your workloads by automatically performing tasks in a well-defined window of time, significantly reducing the impact of any operational or infrastructure failures.

Q: What types of tasks can I schedule in a maintenance window?

Currently, you can only schedule any Run Command based task in a maintenance window.

Q: What are the types of schedules I can choose for my maintenance windows?

Maintenance windows can be scheduled for a recurring date (e.g. Weekly on Tuesdays at 22:00:00 or 1st Sunday of every month at 22:00:00). You can define your schedule using cron or rate expression.

Distributor

Q: What is AWS Systems Manager Distributor?

Distributor is an AWS Systems Manager feature that enables you to securely store and distribute software packages in your organization. You can use Distributor with existing Systems Manager features like Run Command and State Manager to control the lifecycle of the packages running on your instances.

Q: What are the benefits of using Distributor?

Distributor helps you scale software package rollouts by enabling standardization of package distribution. By using Distributor with AWS Systems Manager Run Command and State Manager, you eliminate the need to build and maintain your own package distribution and installation tooling. Distributor also simplifies software package management by using a centralized repository for all of your packages. Distributor supports the use of IAM policies, providing full control over who can create and update packages. Distributor also helps enable secure software package distribution, because your packages are encrypted in storage and all communication between Distributor and your instance is signed and encrypted.

Q: Who should use Distributor?

Any AWS customer who regularly distributes software packages and wants a secure way to scale package management, a centralized repository for packages, or to eliminate the need for self-maintained distribution tooling should use Distributor. IT professionals who want to control who can create or update software packages and which versions are distributed to each AWS account will benefit from Distributor.

Q: How much does Distributor cost?

Distributor pricing can be found on the Systems Manager Pricing page.

Q: How do I get started?

You can use the AWS Management Console to turn on Distributor in just a few clicks. For more information, see the Getting Started documentation.

Q: Does Distributor require the use of the SSM Agent?

Yes. Getting started with Distributor requires the use of the latest version of the SSM Agent. The SSM Agent is open-sourced and available on GitHub. The SSM Agent is also installed by default on Amazon Linux, Amazon Linux 2, Windows, and Ubuntu AMIs.