Lesson 07 — AWS Systems Manager & Session Manager

Learning Path

☁️ Phase 2 – AWS Cloud Security

📘 Module 05 – Amazon EC2 Security

🎯 Lesson Objective

By the end of this lesson, you will be able to:

Understand AWS Systems Manager (SSM).
Understand Session Manager.
Securely manage EC2 instances without SSH.
Configure Session Manager.
Register EC2 instances with Systems Manager.
Execute remote commands securely.
Apply enterprise administration best practices.

📚 Lesson Information

Estimated Time: 2.5 Hours

Difficulty: Intermediate

Prerequisites: Lesson 06 – Amazon EBS Encryption & AMIs

Hands-on Lab: Yes

💼 Business Scenario

CloudNova Technologies operates over 500 Amazon EC2 instances across multiple AWS Regions.

Previously, administrators connected using:

SSH
RDP
Bastion Hosts

The security review identified several risks:

SSH open to the Internet
Key Pair management challenges
Shared administrator accounts
Difficult audit trails
Increased attack surface

The Security Team decided to replace SSH with AWS Systems Manager Session Manager.

🚨 Traditional Server Administration

Many organisations still manage Linux servers like this:

Administrator

↓

SSH Client

↓

Internet

↓

Public IP

↓

EC2 Instance

Problems:

Public IP required
Port 22 exposed
SSH keys must be protected
Difficult auditing
Increased attack surface

✅ Enterprise Approach

CloudNova uses AWS Systems Manager.

Administrator

↓

AWS Console

↓

Session Manager

↓

AWS Systems Manager

↓

Private EC2 Instance

No:

Public IP
SSH Port
Bastion Host
VPN

is required.

🤔 What is AWS Systems Manager?

AWS Systems Manager is a management service that allows administrators to securely manage AWS resources.

Capabilities include:

Session Manager
Run Command
Patch Manager
Inventory
Automation
Parameter Store
Fleet Manager
State Manager

It provides a central platform for managing EC2 instances.

What is Session Manager?

Session Manager is a Systems Manager feature that enables secure shell access through the AWS Management Console or AWS CLI.

Instead of connecting directly to the server using SSH, the connection is established through AWS Systems Manager.

Benefits:

No inbound SSH port
No SSH keys
Full audit logging
IAM-controlled access
Private connectivity

CloudNova Enterprise Architecture

                 Cloud Engineer

                        │

                AWS Console

                        │

               Session Manager

                        │

            AWS Systems Manager

                        │

               IAM Role (SSM)

                        │

          Private EC2 Instance

──────────────────────────────────────

Supporting Services

CloudWatch

CloudTrail

Amazon S3

VPC Endpoint (Optional)

Systems Manager Components

Component	Purpose
Session Manager	Secure shell access
Run Command	Execute remote commands
Patch Manager	Operating system patching
Inventory	Collect software inventory
Automation	Operational workflows
Parameter Store	Secure configuration storage
Fleet Manager	Manage server fleet
State Manager	Maintain desired configuration

How Systems Manager Works

For Systems Manager to communicate with an EC2 instance, the following are required:

Systems Manager Agent (SSM Agent)
IAM Role
Network connectivity to AWS Systems Manager
EC2 instance in a supported operating system

The communication is initiated from the EC2 instance to AWS.

No inbound connections are required.

Prerequisites

Every EC2 instance should have:

✅ Amazon Linux 2023

✅ IAM Role

AmazonSSMManagedInstanceCore

✅ SSM Agent installed

✅ Internet access or Systems Manager VPC Endpoints

Verify SSM Agent

Connect to your EC2 instance.

Run:

sudo systemctl status amazon-ssm-agent

Expected output:

active (running)

Verify IAM Role

Your EC2 instance should have:

CloudNova-EC2-Role

with:

AmazonSSMManagedInstanceCore

attached.

Verify Instance Registration

Open:

AWS Console

↓

Systems Manager

↓

Managed Nodes

You should see:

CloudNova-App-Server-01

Status

Online

🛠 Lab 01 — Start a Session

Navigate to:

Systems Manager

↓

Session Manager

↓

Start Session

Select:

CloudNova-App-Server-01

Click:

Start Session

A browser-based shell opens.

No SSH client is required.

Verify Session

Run:

hostname

Expected:

CloudNova-App-Server-01

Run:

whoami

Expected:

ssm-user

ec2-user

depending on your configuration.

🛠 Lab 02 — Execute Commands

Run:

pwd

uname -a

df -h

free -h

uptime

Verify that the instance responds correctly.

🛠 Lab 03 — Run Command

Navigate to:

Systems Manager

↓

Run Command

↓

Run Command

Choose:

AWS-RunShellScript

Commands:

hostname

date

uptime

Select:

CloudNova-App-Server-01

Run the command.

Review the output.

🛠 Lab 04 — Inventory

Navigate to:

Systems Manager

↓

Inventory

Review collected information:

Installed applications
Operating system
Network interfaces
Services

Inventory helps administrators understand what software is installed across the environment.

🛠 Lab 05 — Parameter Store

Navigate to:

Systems Manager

↓

Parameter Store

↓

Create Parameter

Create:

Setting	Value
Name	`/cloudnova/application/environment`
Type	String
Value	`Production`

Applications can retrieve configuration values securely from Parameter Store instead of hardcoding them.

💻 AWS CLI Lab

Describe Managed Instances

aws ssm describe-instance-information

Start a Session

aws ssm start-session \
    --target i-xxxxxxxx

Send a Command

aws ssm send-command \
    --document-name AWS-RunShellScript \
    --instance-ids i-xxxxxxxx \
    --parameters commands="hostname"

List Parameters

aws ssm describe-parameters

Get Parameter

aws ssm get-parameter \
    --name "/cloudnova/application/environment"

✅ Verification

Verify:

✔ EC2 instance appears as a Managed Node.

✔ SSM Agent is running.

✔ IAM Role attached.

✔ Session Manager connects successfully.

✔ Run Command executes correctly.

✔ Parameter created successfully.

🔍 Troubleshooting

Problem

Instance does not appear in Systems Manager.

Check:

IAM Role attached.
SSM Agent installed.
Network connectivity.
Region selection.

Problem

Session cannot be started.

Verify:

EC2 instance is running.
Managed Node status is Online.
IAM permissions.
SSM Agent service.

Problem

Run Command fails.

Review:

IAM permissions.
SSM Agent logs.
Command syntax.

Problem

Parameter cannot be retrieved.

Check:

Parameter name.
IAM permissions.
AWS Region.

🏢 Enterprise Best Practices

CloudNova standards:

Disable direct SSH access where operationally appropriate.
Use Session Manager for administration.
Remove unnecessary Public IP addresses.
Enable CloudTrail logging for Systems Manager activities.
Use Parameter Store for configuration values.
Use Secrets Manager for sensitive credentials and secrets.
Restrict Systems Manager access using IAM.
Review Systems Manager logs regularly.

🚫 Common Mistakes

❌ Leaving SSH open to the Internet.

❌ Using shared administrator accounts.

❌ Forgetting to attach the SSM IAM Role.

❌ Ignoring CloudTrail logs.

❌ Hardcoding application configuration.

❌ Using Parameter Store for passwords instead of Secrets Manager.

🧪 DIY Challenge

Configure a second EC2 instance.

Requirements:

Amazon Linux 2023
CloudNova-EC2-Role
SSM Agent running
Private Subnet
No Public IP

Tasks:

Register the instance with Systems Manager.
Connect using Session Manager.
Execute:

hostname

df -h

uptime

Create a new Parameter:

/cloudnova/application/version

Value:

v1.0

Retrieve the parameter using the AWS CLI.

Capture screenshots of:

Managed Nodes
Session Manager
Run Command
Parameter Store
AWS CLI outputs

📊 Knowledge Check

What is AWS Systems Manager?
What problem does Session Manager solve?
Why is Session Manager more secure than SSH?
What IAM policy is required for EC2 Systems Manager access?
What is the purpose of the SSM Agent?
What is Run Command used for?
What information does Inventory collect?
When should you use Parameter Store instead of Secrets Manager?
Which AWS CLI command starts a Session Manager session?
How does Systems Manager reduce the attack surface of EC2 instances?

💡 Key Takeaways

After completing this lesson, you should understand:

AWS Systems Manager provides a central platform for managing EC2 instances securely and at scale.
Session Manager enables browser-based or CLI-based access without exposing SSH or RDP ports.
EC2 instances require the SSM Agent, an IAM Role and network connectivity to register as managed nodes.
Features such as Run Command, Inventory and Parameter Store simplify administration and improve operational consistency.
Replacing traditional SSH access with Systems Manager reduces the attack surface, strengthens auditing and aligns with enterprise security best practices.

🚀 Next Lesson

➡️ Lesson 08 — EC2 Hardening & Patch Management