AWS Systems Manager: Session Manager, Patch and Run Command Explained
Opening port 22 to the world so you can SSH is an old habit — and a gift to scanners. AWS Systems Manager (SSM) lets you start a shell with Session Manager, run commands on fleets, patch on a schedule, and store parameters — without bastion sprawl.
What you'll learn in this chapter
- Why SSM beats open SSH bastions
- What Session Manager, Run Command, Patch, Parameter Store are
- How to enable managed instances safely
- Industries using SSM for ops
- Lab, errors, FAQ, interview
1. Everyday example first
An Indore team manages 40 Amazon Linux boxes. Instead of sharing one PEM file on WhatsApp, instances use an IAM role with AmazonSSMManagedInstanceCore. Ops start Session Manager from the console, run a script with Run Command, and patch on Sundays via Patch Manager.
2. Why Systems Manager?
Why do we need this?
Bastions need patching, keys, and network paths. SSM Agent + IAM gives auditable sessions, API-driven commands, and patch compliance — better for fleets and auditors.
- No inbound 22 required when using Session Manager
- Fleet-wide scripts with Run Command
- Patch baselines and compliance reports
- Parameter Store for config (Secrets Manager for secrets)
3. What is in SSM?
What is it?
Systems Manager is a suite. Session Manager opens an interactive shell or port forward through the SSM API. Run Command executes documents. Patch Manager applies baselines. Parameter Store holds hierarchical config. Inventory and State Manager add desired-state tooling.
| Capability | Plain job |
|---|---|
| Session Manager | Shell/port-forward without SSH keys |
| Run Command | Run a document on many instances |
| Patch Manager | Define baselines and maintenance windows |
| Parameter Store | Config strings/paths; advanced tier available |
| Inventory | Collect OS/app metadata |
4. How to enable a safe managed node
How to do it (step by step)
- Attach AmazonSSMManagedInstanceCore (or tighter clone) to the instance role.
- Ensure agent installed/running (AL2023 usually has it).
- VPC endpoints for SSM if private subnets without NAT (com.amazonaws.region.ssm etc.).
- Start Session Manager; confirm CloudTrail/Session logs to S3/CW if required.
- Create a Run Command doc or use AWS-RunShellScript for a controlled script.
- Define a patch baseline and maintenance window off-peak.
- Store non-secret config in Parameter Store (/app/dev/db_host).
- Use Secrets Manager for DB passwords; reference from apps.
- Least privilege: separate who can StartSession vs SendCommand.
- Remove public :22 from security groups when Session Manager works.
# Mental model
# SSM agent → managed instance
# Session Manager (no SSH inbound)
# Patch Manager baselines + Run Command docs5. Parameter Store vs Secrets Manager
| Store | Use for |
|---|---|
| Parameter Store | Config, feature flags, license paths |
| Secrets Manager | Rotating secrets, RDS integration |
| SSM Advanced tier | Larger params / higher throughput |
6. Multi-industry notes
Factories use Run Command to push agent configs to shop-floor gateways. Banks log every Session Manager start to a central bucket for audit. Startups kill bastion costs by going Session Manager-only in private subnets.
7. Industries and roles
- IT ops: fleet patching weekends
- DevOps: pipeline Run Command smoke tests
- Security: remove SSH keys from laptops
- SaaS: parameterized configs per env
- Healthcare: audited access to clinical jump boxes
8. Lab: Session Manager on a tiny EC2
Do this in ap-south-1 (Mumbai) unless your org forbids it. Set a budget alert first.
How to do it (step by step)
- Launch Amazon Linux 2023 with SSM-capable role; no public SSH rule.
- Confirm Managed Instances shows Online.
- Start Session Manager; run whoami and hostnamectl.
- SendCommand uname -a; view output in console.
- Create parameter /lab/hello = world; read with get-parameter.
Cleanup (stop billing)
- Terminate instance; delete parameter; remove lab role if unused.
- Delete VPC endpoints if you created only for lab.
9. Common errors and fixes
Each row is a real mistake students and juniors hit. Read the fix before you panic.
| Error / symptom | Fix |
|---|---|
| Agent Offline forever | Check role, DNS, endpoints/NAT, agent service. |
| Opened 22 “just in case” | Close when SSM works; reduce attack surface. |
| Shared PEM still in Slack | Rotate; prefer SSM only. |
| Everyone allowed SendCommand | Separate break-glass role. |
| Secrets in Parameter Store Standard as plaintext habit | Use SecureString + KMS or Secrets Manager. |
| Patch without maintenance window | Avoid random reboots at noon. |
| No session logging | Enable to S3/CloudWatch for audit. |
| Wrong region in CLI | Target instance region. |
| SSM on Windows without agent config | Install/configure official agent. |
| Bastion + SSM both unmanaged | Pick one path; document. |
10. Troubleshooting checklist
- TargetNotConnected: agent/IAM/network path.
- AccessDenied StartSession: missing ssm:StartSession + tunnel perms.
- Run Command pending: instance busy or agent stuck — restart agent.
- Patch status NonCompliant: review baseline exclusions.
- Parameter NotFound: path typo or wrong account.
- Private subnet: add interface endpoints for ssm, ssmmessages, ec2messages.
11. FAQ
Q. Is Session Manager free?
No SSM charge for many features; data transfer/logs may cost — check pricing.
Q. Replace bastion fully?
Often yes for EC2; edge cases remain.
Q. Hybrid servers?
SSM hybrid activation for on-prem.
Q. Ansible vs Run Command?
Both ok; Run Command is AWS-native quick fleet ops.
Q. Parameter Store free tier?
Standard parameters have free tier limits.
Q. Port forward?
Session Manager supports port forwarding use cases.
12. Interview Q&A
Q. What is Session Manager?
SSM feature for shell/port-forward without inbound SSH.
Q. Managed instance prerequisites?
Agent + IAM role + network to SSM endpoints.
Q. Run Command vs SSH script?
API-audited fleet execution with documents.
Q. Patch Manager?
Baselines + windows to drive OS patch compliance.
Q. SecureString?
KMS-encrypted parameter value.
Q. Why remove port 22?
Shrink attack surface; rely on IAM + SSM.
13. Tips in English, Marathi and Hindi
Ravindra Bagale's Tip (EN)
If Session Manager works, delete the “temporary” SSH rule the same day. Temporary rules become permanent holes.
Ravindra Bagale's Tip (MR)
Session Manager चाललं की त्याच दिवशी temporary SSH rule काढा.
Tip (HI)
Session Manager चलते ही उसी दिन temporary SSH rule हटाओ — अस्थायी छेद स्थायी हो जाते हैं।
Try at home
- List the three VPC interface endpoints often needed for private SSM.
- Write an IAM bullet: who may StartSession on prod tags only.
- Compare Parameter Store vs Secrets Manager in 3 lines.
In short
- SSM manages instances without open SSH.
- Session Manager + Run Command + Patch cover daily ops.
- Parameters for config; Secrets Manager for secrets.
- Log sessions and least-privilege the verbs.
Revision, interview and comparison cards
Revise this lesson in a few minutes. Save the cards on your phone or download them as PNG files. The QR code on each card opens this lesson.
More cards: Ravi Sir's Cards.
Practice Tasks
London Legal LLP is a law business in London. Oliver Hughes looks after its IT and cloud work. They count money in GBP and run their AWS resources in the eu-west-2 Region. In the tasks below you do real jobs for them using what this lesson teaches. All names, account IDs, IP addresses and numbers are made up for practice.
0 / 16
Easy Describe instance information
Why: See managed nodes.
What to do: Describe instance information.
- Read the task and decide which AWS service it is about.
- Write aws, then the service name, then the operation (the action word).
- Add each needed flag (--name) followed by its value from the task.
- Flags can be in any order. Click Check answer.
Easy Get connection status
Why: Agent online?
What to do: Get connection status for i-0123456789abcdef0.
- Read the task and decide which AWS service it is about.
- Write aws, then the service name, then the operation (the action word).
- Add each needed flag (--name) followed by its value from the task.
- Flags can be in any order. Click Check answer.
Easy List documents
Why: Automation docs.
What to do: List SSM documents.
- Read the task and decide which AWS service it is about.
- Write aws, then the service name, then the operation (the action word).
- Add each needed flag (--name) followed by its value from the task.
- Flags can be in any order. Click Check answer.
Easy Open 22 not required — 1
Why: SSM benefit.
What to do: Enter 1 if Session Manager can avoid inbound SSH.
- Write down the numbers the task gives you.
- Work it out step by step on paper.
- Type only the final answer in the box.
- Click Check answer.
Easy Agent required — 1
Why: Managed node.
What to do: Enter 1 if SSM agent must be healthy.
- Write down the numbers the task gives you.
- Work it out step by step on paper.
- Type only the final answer in the box.
- Click Check answer.
Medium Get parameter
Why: Config values.
What to do: Get parameter /londonlegal/db-host with decryption.
- Read the task and decide which AWS service it is about.
- Write aws, then the service name, then the operation (the action word).
- Add each needed flag (--name) followed by its value from the task.
- Flags can be in any order. Click Check answer.
Medium List commands
Why: Recent Run Command.
What to do: List commands.
- Read the task and decide which AWS service it is about.
- Write aws, then the service name, then the operation (the action word).
- Add each needed flag (--name) followed by its value from the task.
- Flags can be in any order. Click Check answer.
Medium Describe patch baselines
Why: Patch policy.
What to do: Describe patch baselines.
- Read the task and decide which AWS service it is about.
- Write aws, then the service name, then the operation (the action word).
- Add each needed flag (--name) followed by its value from the task.
- Flags can be in any order. Click Check answer.
Medium List inventory entries
Why: Collected facts.
What to do: List inventory entries for i-0123456789abcdef0.
- Read the task and decide which AWS service it is about.
- Write aws, then the service name, then the operation (the action word).
- Add each needed flag (--name) followed by its value from the task.
- Flags can be in any order. Click Check answer.
Medium Allow GetParameter one
Why: App config LP.
What to do: Allow ssm:GetParameter on arn:aws:ssm:eu-west-2:114543297314:parameter/londonlegal/db-host.
- Start with { "Version": "2012-10-17", "Statement": [ ... ] }.
- In each statement write Effect, Action and Resource.
- Give only what the task needs (least privilege).
- Use double quotes and commas correctly. Click Check answer.
Medium Session preference JSON
Why: Prefer SSM over SSH22.
What to do: JSON prefer_session_manager true.
- Start from the top-level keys the task names.
- Indent child keys with 2 spaces (no tabs).
- Fill in each property with the value from the task.
- Click Check answer. Key order does not matter.
Medium Secrets Manager still for app secrets — 1
Why: Choose store.
What to do: Enter 1 if Secrets Manager often fits rotating app secrets.
- Write down the numbers the task gives you.
- Work it out step by step on paper.
- Type only the final answer in the box.
- Click Check answer.
Medium Bastion open 22 bad — 0
Why: Prefer SSM.
What to do: Is permanent open SSH 22 to bastion best practice? Enter 0 for no.
- Write down the numbers the task gives you.
- Work it out step by step on paper.
- Type only the final answer in the box.
- Click Check answer.
Hard Send AWS-RunShellScript
Why: Fleet shell.
What to do: Send command AWS-RunShellScript to i-0123456789abcdef0 with comment lab.
- Read the task and decide which AWS service it is about.
- Write aws, then the service name, then the operation (the action word).
- Add each needed flag (--name) followed by its value from the task.
- Flags can be in any order. Click Check answer.
Hard Allow StartSession
Why: Session LP.
What to do: Allow ssm:StartSession on arn:aws:ec2:eu-west-2:114543297314:instance/i-0123456789abcdef0.
- Start with { "Version": "2012-10-17", "Statement": [ ... ] }.
- In each statement write Effect, Action and Resource.
- Give only what the task needs (least privilege).
- Use double quotes and commas correctly. Click Check answer.
Hard Patch window JSON
Why: Maintenance.
What to do: JSON window cron sun-02:00.
- Start from the top-level keys the task names.
- Indent child keys with 2 spaces (no tabs).
- Fill in each property with the value from the task.
- Click Check answer. Key order does not matter.