</>Học Dev
Bài học

Tuần 8 - Ngày 3: AWS Systems Manager (SSM)

Tuần 8 – Ngày 3

Tuần 8 - Ngày 3: AWS Systems Manager (SSM)

Mục tiêu học tập

  • Hiểu SSM ecosystem
  • Nắm Session Manager, Patch Manager, Run Command, Parameter Store
  • Áp dụng SSM cho EC2 + on-prem management

1. Tổng quan Systems Manager

AWS Systems Manager (SSM) = unified interface to manage AWS + on-prem infrastructure.

Đặc điểm

  • Manage EC2 + on-prem servers
  • No SSH keys needed (Session Manager)
  • Centralized patch management
  • Configuration as data (Parameter Store)
  • Compliance scanning
  • Operational insights

Requirements

  • SSM Agent installed (preinstalled on Amazon Linux, Windows Server AMIs)
  • IAM role attached (AmazonSSMManagedInstanceCore policy)
  • Network connectivity to SSM endpoints (VPC Endpoint optional)

2. Key Capabilities

Session Manager

  • Browser-based shell to EC2 + on-prem
  • No SSH, no bastion host, no open ports
  • Audit log of sessions to S3/CloudWatch
  • IAM-controlled access

Benefits

  • Security: no port 22 open
  • Audit: every session logged
  • Cross-OS: Linux SSH + Windows RDP

Run Command

  • Execute commands on multiple instances without SSH
  • Pre-defined documents (e.g., AWS-RunShellScript)
  • Targets: instance IDs, tags, resource groups
  • Audit log via CloudTrail

Use cases

  • Install software across fleet
  • Apply patches
  • Run scripts on Auto Scaling groups

Patch Manager

  • Automated patching of OS + applications
  • Patch baselines: rules for which patches to apply
  • Patch groups: target instances by tag
  • Maintenance windows: when to patch (off-hours)
  • Cross-OS support

State Manager

  • Maintain desired state of instances
  • E.g., always ensure CloudWatch Agent installed
  • Run on schedule (cron)

Inventory

  • Collect software + config inventory from instances
  • Centralized view of installed software, network config, files
  • Use case: license tracking, compliance

Maintenance Windows

  • Schedule maintenance tasks (patching, runbook)
  • Cron-based
  • Avoid disrupting production

Parameter Store

  • Store configuration + secrets
  • Already covered in Tuần 6 Day 2

3. SSM Session Manager Setup

Basic setup

  1. Attach IAM role with AmazonSSMManagedInstanceCore to EC2
  2. SSM Agent running (default for AL2, Windows Server)
  3. Open AWS Console → SSM → Session Manager → Start session

Advantages over SSH

  • No SSH key management
  • No port 22 in Security Group
  • No bastion host needed
  • Audit trail
  • Works with private subnet instances (no internet needed if VPC Endpoint configured)

Logging

  • Configure to log session to CloudWatch Logs or S3
  • Capture all commands + output
  • Use case: compliance, forensics

4. Patch Manager

Patch Baselines

  • AWS-managed baselines: per OS
  • Custom baselines: customer-defined rules
  • Approval rules: auto-approve critical patches after N days

Workflow

  1. Configure patch baseline
  2. Tag instances with Patch Group
  3. Define maintenance window (e.g., Sunday 2 AM)
  4. SSM applies patches during window
  5. Compliance report

Patch Compliance

  • Compliance dashboard shows % patched
  • Identify non-compliant instances

5. Run Command

Example: Install Apache on all EC2 with tag Role=web

aws ssm send-command \
  --document-name "AWS-RunShellScript" \
  --targets "Key=tag:Role,Values=web" \
  --parameters 'commands=["yum install -y httpd","systemctl start httpd"]'

Built-in documents

  • AWS-RunShellScript (Linux)
  • AWS-RunPowerShellScript (Windows)
  • AWS-UpdateSSMAgent
  • AWS-ConfigureAWSPackage (install AWS-distributed packages)

Custom documents

  • YAML/JSON
  • Reusable runbooks

6. Automation Documents

Định nghĩa

Automation documents = scripts orchestrate AWS actions (similar to Step Functions but simpler).

Use cases

  • Patch + reboot fleet
  • Snapshot all RDS at end of day
  • Update AMI in Launch Templates
  • Compliance remediation (via Config integration)

Trigger sources

  • Manual execution
  • Maintenance Windows
  • EventBridge (event-driven automation)
  • Config rules (remediation)

7. SSM Inventory

Collected data

  • AWS components, applications, files, network config, services, Windows updates, Windows registry, Windows roles

Storage

  • Aggregate to S3 via Resource Data Sync
  • Query với Athena, visualize với QuickSight

Use case

  • Software license tracking
  • Vulnerability patching priority
  • Compliance audit

8. AppConfig

Định nghĩa

AppConfig = manage application configuration changes (feature flags, gradual rollout).

Đặc điểm

  • Validation before deploy
  • Gradual rollout (10%, 50%, 100%)
  • Rollback if errors
  • A/B testing
  • Integrate với Lambda, ECS, EC2

Use case

  • Feature flags
  • Configuration changes without redeploy
  • Canary config rollout

9. OpsCenter

Định nghĩa

OpsCenter = central place to view + investigate operational issues.

Aggregates

  • Config compliance violations
  • CloudWatch alarms
  • AWS Health events
  • Trusted Advisor recommendations

Use case

  • Single pane of glass for ops team

10. Common Patterns

Pattern 1: SSH-less infrastructure

  • No bastion host
  • All access via Session Manager
  • IAM-controlled per user

Pattern 2: Automated patching

  • Tag instances by environment
  • Patch Manager applies based on tags + baseline
  • Maintenance window during off-hours
  • Compliance dashboard tracks

Pattern 3: Config drift detection + auto-fix

  • AWS Config rule "ssm-agent-installed"
  • Non-compliant → trigger SSM Automation document
  • Document installs SSM Agent

Pattern 4: Centralized configuration

  • Parameter Store hierarchy: /myapp/{env}/{component}/...
  • Apps fetch at runtime
  • Update without redeploy

11. Multi-Account, Hybrid

Hybrid (on-prem)

  • Install SSM Agent on-prem
  • Register as managed instance (with activation code)
  • Treat on-prem servers like EC2 in SSM

Multi-account

  • IAM cross-account roles
  • Run Command from management account to member accounts
  • Resource Groups for grouping

Câu hỏi ôn tập

  1. SSM Session Manager khác SSH ở điểm gì?

    Xem đáp án

    Session Manager: (1) Không cần port 22 mở, không cần key pairs, (2) Không cần bastion host, (3) Toàn bộ session được log (CloudWatch, S3), (4) Access kiểm soát qua IAM (không phải SSH keys), (5) Hoạt động cho instances trong private subnet không có public IP (qua SSM endpoints). SSH truyền thống cần inbound port 22, key management phức tạp, ít audit. Session Manager là zero-trust access approach.

  2. Patch Manager dùng để làm gì?

    Xem đáp án

    Tự động patch OS và software trên EC2 instances (và on-premises servers). Define Patch Baseline (danh sách patches approved/rejected theo severity). Maintenance Window schedule khi patch được apply. Compliance report cho biết instances nào đã patch, còn thiếu patches gì. Hỗ trợ Windows, Amazon Linux, Ubuntu, RHEL, SUSE. Giảm manual effort patch management across fleet của instances.

  3. Run Command có thể target instances bằng cách nào?

    Xem đáp án

    Run Command target instances theo: (1) Instance IDs cụ thể, (2) Resource Group tags (ví dụ: Environment=Production), (3) Tag key-value (ví dụ: Patch=true), (4) All managed instances trong account. Chạy cùng command trên hàng nghìn instances song song (controlled by rate) mà không cần SSH từng cái. Output lưu vào S3 hoặc CloudWatch Logs.

  4. Parameter Store khác AppConfig ở điểm gì?

    Xem đáp án

    Parameter Store: key-value storage cho config và secrets, giá trị là strings, SecureString (KMS-encrypted), StringList. Simple retrieval. AWS AppConfig: designed cho feature flags và application configuration với deployment strategies (canary, linear rollout), validation (JSON schema, Lambda validator), rollback nếu CloudWatch alarm trigger. AppConfig không crash apps với bad config; Parameter Store là simple key-value without deployment safety.

  5. SSM Agent có preinstalled trên AMIs nào?

    Xem đáp án

    SSM Agent preinstalled trên: Amazon Linux 2, Amazon Linux 2023, Windows Server 2008-2022 AMIs from AWS. Cũng có trên Ubuntu 16.04+ và RHEL 7.4+ AWS AMIs từ 2017. Với AMIs khác hoặc on-premises servers cần cài thủ công. Instance cũng cần IAM role với AmazonSSMManagedInstanceCore policy và network access đến SSM endpoints (qua internet hoặc VPC Interface Endpoints).

Bài tập thực hành

  • Attach IAM role với SSM policy vào EC2
  • Connect via Session Manager (no SSH key needed)
  • Run Command: install package trên 3 instances
  • Setup Patch Manager baseline + maintenance window
  • Tạo Parameter Store hierarchy cho app config
  • (Optional) Register on-prem server với SSM

Tài liệu tham khảo chính thức

Tiếp theo: Trusted Advisor