Hybrid Environments and AWS Systems Manager Overview
This section introduces the concept of hybrid environments and outlines the core capabilities of AWS Systems Manager in such setups, including supported and unsupported external resource types.
A hybrid environment involves managing compute resources both within AWS (e.g., EC2 instances) and outside of AWS (e.g., on-premise data centers or other cloud providers). AWS Systems Manager provides a centralized management console for these diverse compute nodes.
AWS Systems Manager offers a suite of tools for automated management of instances across various environments.
Technical Specs: Automations: Enables automated tasks and processes.
Maintenance Windows: Facilitates scheduled maintenance operations.
Patch Management: Automates patching of virtual machines and EC2 instances via Patch Manager.
State Manager: Manages the desired state of managed instances.
Parameter Store: Securely stores configuration data and secrets.
Inventory: Collects and displays inventory data from managed instances.
Run Command: Executes commands remotely on managed instances.
Session Manager: Provides secure, browser-based shell access to managed instances without requiring open inbound ports.
AWS Systems Manager can extend its management capabilities to various external compute resources.
Technical Specs: On-Premise Servers: Includes both virtual machines and physical servers.
Edge Devices: Encompasses AWS IoT devices and other IoT devices.
Virtual Machines in Other Cloud Providers: Supports management of VMs in environments like Azure and Google Cloud.
There are specific environments that are not supported for hybrid management via AWS Systems Manager.
Technical Specs: macOS environments are not supported for hybrid SSM management.
Configuring AWS Systems Manager for Hybrid Environments
procedure
The process of integrating external servers and virtual machines with AWS Systems Manager involves several key configuration steps, from setting up IAM users to installing the SSM Agent.
Detailed steps for configuring AWS Systems Manager to manage resources located outside of the AWS cloud.
Prerequisites
- AWS Account with appropriate permissions to create IAM users, groups, roles, and Systems Manager activations.
1
Create a Non-Admin IAM User and Group for Systems Manager: For on-premise or other cloud VMs, create a non-IAM user with programmatic access. Create a group and attach the following policies: Resource Group and Tag Editor read-only access, Amazon SSM full access, AWS Health full access, CloudWatch read-only access, and AWS Config user access. Add the created user to this group to inherit permissions. Securely store the generated access keys and secret access keys as they are required for agent installation.
A non-IAM user with programmatic access is required for on-premise or other cloud VMs, unlike EC2 instances which use IAM roles, to provide the necessary permissions for the SSM Agent.
2
Create a Managed Node Activation for Hybrid Environment: In the Systems Manager console, create an activation. Define an Activation Description (e.g., 'on-premise Windows VM activation'), set an Instance Limit (up to 1000 instances), select an appropriate IAM Role (e.g., an IAM role named SSM instance profile role created specifically for Systems Manager, not for EC2), and set an Activation Expiry Date. The process will output an Activation Code and Activation ID.
This activation registers hybrid resources (on-premise VMs, other cloud VMs) with Systems Manager, providing the necessary credentials and configuration for the SSM Agent.
3
Install the SSM Agent on the Hybrid Resource: The SSM Agent must be installed on the on-premise VMs or VMs in other cloud providers. Note that latest EC2 AMIs typically have it pre-installed. Use the Activation Code and Activation ID obtained in the previous step during the installation and registration process. For example, a Windows PowerShell command structure is: `powershell & "C:\Program Files\Amazon\SSM\amazonaws.com" /register-instance --register-with-amazon --region "us-east-1" --private-key "C:\Program Files\Amazon\SSM\etc\amazon-ssm-agent.pem" --activation-key "YOUR_ACTIVATION_CODE" --expected-container-path "C:\Program Files\Amazon\SSM" --installer-type "msi" --target-instance-id "i-0123456789abcdef0"` (The actual command in the demo involved downloading the agent and then registering with the activation code and ID). Key parameters for registration are `-region`, `-activation-code`, and `-activation-id`.
Installation and registration of the SSM Agent enable the hybrid resource to communicate with and be managed by AWS Systems Manager.
powershell & "C:\Program Files\Amazon\SSM\amazonaws.com" /register-instance --register-with-amazon --region "us-east-1" --private-key "C:\Program Files\Amazon\SSM\etc\amazon-ssm-agent.pem" --activation-key "YOUR_ACTIVATION_CODE" --expected-container-path "C:\Program Files\Amazon\SSM" --installer-type "msi" --target-instance-id "i-0123456789abcdef0"
4
Optional: Configure VPC Endpoint: This step is optional and was not part of the core demonstration. It involves setting up a VPC endpoint.
To prevent traffic from going to the public internet when connecting to AWS services, routing traffic through the AWS backbone network.
5
Optional: Set Up Private Key Auto-Rotation: To configure automatic rotation of the private keys used by the SSM agent, edit the `AmazonSSMagent.json` configuration file (found in `C:\Program Files\Amazon\SSM` on Windows, or `/etc/amazon/ssm/` on Linux). Within the profile section, set the `key_rotation` value to the desired number of days (e.g., 30). After making changes, restart the SSM Agent service for the new setting to take effect.
To enhance security by automatically rotating the private keys used by the SSM agent.
6
Enable Advanced Instance Tier (for Session Manager): To use Session Manager with on-premise instances, navigate to Account Management > Instance Tier Setting in the Systems Manager console and change the setting to “Advanced”. Agent Auto-Update can also be enabled here.
The 'Advanced' instance tier is required to utilize Session Manager's capabilities for managing instances outside of AWS.