AWS Systems Manager
AWS Systems Manager is a suite of tools for viewing, controlling and automating managed nodes — EC2 instances, on-premises servers and edge devices — at scale in AWS, on-premises and multicloud environments. It earns its place once a fleet is large enough that logging into individual machines stops being viable, which is usually somewhere in the tens of instances.
The SSM Agent
Section titled “The SSM Agent”Every capability depends on the SSM Agent, which runs on the node and polls the Systems Manager service.
- It is preinstalled on most current AWS AMIs, and can be installed on any supported Linux, Windows or macOS machine, including on-premises servers and edge devices.
- Communication is outbound only. The agent opens the connection to the Systems Manager endpoints; nothing has to be opened inbound, so a managed node needs no SSH port, no RDP port, and no bastion host.
- What is needed instead is an IAM instance profile — usually the AWS-managed
AmazonSSMManagedInstanceCorepolicy — and network egress to the endpoints, either through a NAT gateway or through interface VPC endpoints for a fully private subnet.
A node with the agent running and a valid role appears as a managed node. Systems Manager provides a diagnosis-and-remediation runbook for nodes that do not report as managed, which can be scheduled; the usual causes are a missing instance profile or blocked egress.
The tools
Section titled “The tools”Systems Manager groups its tools into four categories.
Node tools
Section titled “Node tools”Session Manager opens an interactive shell to a node through the browser or the AWS CLI, with no inbound port, no bastion host and no SSH key to distribute or rotate. Access is controlled by IAM, and every session can be logged to CloudWatch Logs or S3 — both the commands issued and the connection metadata — which is what makes it auditable in a way SSH is not. It is the answer to “how do I get onto the box” for almost every case that used to require port 22.
Run Command executes a script or command across many nodes at once, targeted by instance ID, tag or resource group, without connecting to any of them. Bulk administrative tasks — restarting a service across a fleet, collecting a file, applying a one-off fix — are what it is for.
Patch Manager automates operating system and application patching. It works from patch baselines: rules that auto-approve patches by classification and severity after a defined number of days, plus explicit approved and rejected lists. AWS provides predefined baselines for each supported operating system, and custom baselines can be created. For Linux it can also pin the repositories patches are drawn from, so updates come only from trusted sources. Patching is normally scheduled as a maintenance window task, and patch reports can be delivered to S3.
Inventory collects metadata from managed nodes — installed applications and their versions, files, components, network configuration — so a question like “which of these 200 web servers is still running the old Apache” is a query rather than a project.
State Manager keeps nodes in a defined configuration: bootstrapped with specific software at startup, joined to a domain, or holding a particular set of updates. It re-applies the state on a schedule, so drift is corrected rather than merely detected.
Compliance scans the fleet for patch compliance and configuration inconsistency, aggregating across accounts and Regions, and lets you define your own compliance types.
Fleet Manager is the console view over the fleet: health and status for every node, plus remote file, registry and user management without opening a session.
Hybrid Activations register non-EC2 machines — on-premises servers, other clouds, edge devices — as managed nodes.
Change management tools
Section titled “Change management tools”Automation runs runbooks for routine maintenance and deployment tasks: creating and patching AMIs, applying agent updates, resetting credentials, stopping development instances at the weekend and restarting them on Monday. Runbooks can take approval steps, so an automation can pause for a human without a human having to run it.
Documents (SSM documents) define what Systems Manager actually does. They are JSON or YAML, versioned, and shareable across accounts or publicly.
| Type | Used with | Purpose |
|---|---|---|
| Command document | Run Command, State Manager | Commands and configuration to apply to a target, at any point in the node’s lifecycle |
| Policy document | State Manager | A state to enforce on the target; removing the document stops the enforced action, such as inventory collection |
| Automation runbook | Automation | An ordered list of steps for a workflow, such as creating or updating an AMI |
AWS ships dozens of preconfigured documents, which are parameterised and usually enough without writing your own.
Maintenance Windows define recurring schedules during which disruptive tasks may run — typically patching, but any Run Command, Automation, Lambda or Step Functions task can be attached to one.
Change Calendar defines date and time ranges during which specified actions may or may not be performed, which is how a change freeze is expressed as something automation can read.
Change Manager, the enterprise change-request framework, closed to new customers on 7 November 2025. Existing customers can continue to use it.
Application tools
Section titled “Application tools”Parameter Store stores configuration data and secrets hierarchically, with String,
StringList and KMS-encrypted SecureString types. Typical use is holding connection strings
and application settings that an instance or function reads at start-up.
Two points that are often stated wrongly. Standard parameters carry no additional charge, but that applies to the standard tier only: it is capped at 10,000 parameters per account per Region with a 4 KB value limit and no parameter policies. Advanced parameters raise those limits to 100,000 parameters and 8 KB, add parameter policies such as expiry, allow cross-account sharing — and are charged. Parameter Store API interactions are also charged in some configurations; check the Systems Manager pricing page rather than assuming.
Where credentials need automatic rotation, cross-account access or fine-grained audit logging, AWS Secrets Manager is the intended service. See Parameter Store for the full comparison.
AppConfig manages application configuration and feature flags with validated, monitored deployments and automatic rollback on an alarm.
Application Manager groups AWS resources into applications and aggregates their operational data — including ECS and EKS clusters — into one view.
Operations tools
Section titled “Operations tools”Explorer is an aggregated operations dashboard across accounts and Regions: instance metadata, patch compliance and operational work items, grouped and filterable.
OpsCenter is the work-item queue. Operational issues (OpsItems) from across services are collected in one place with contextual data and related Automation runbooks to resolve them.
Incident Manager handles incident response: notifying responders, escalation, response plans and collaboration during an incident.
The Systems Manager CloudWatch Dashboards integration was withdrawn after 30 April 2026; dashboards are created and managed in the CloudWatch console.
Logging
Section titled “Logging”Send node logs to CloudWatch Logs with the unified CloudWatch agent, which collects both logs and system metrics and runs on Linux and Windows. The older CloudWatch Logs agent is deprecated and no longer supported; anything still running it should be migrated. The unified agent can be installed and configured across a fleet with Systems Manager Distributor and State Manager, which is the neat version of the loop: Systems Manager installs the agent that sends the logs that tell you whether Systems Manager worked.
Session Manager session logs are configured separately, and should go to CloudWatch Logs or S3 in any environment where interactive access has to be auditable.
Two things older material gets wrong
Section titled “Two things older material gets wrong”Descriptions of Systems Manager written before its 2024 console consolidation often list an Insights Dashboard offering account-level views of CloudTrail, Config and Trusted Advisor. There is no such capability. Explorer and OpsCenter cover aggregated operational views, and the Config and Trusted Advisor consoles cover their own data.
The same material lists Resource Groups as a Systems Manager capability. AWS Resource Groups is a separate service. It still exists and is still used to group resources by tag, and Systems Manager can target a resource group — but it is not part of Systems Manager.