AWS Systems Manager

Management & Governance

Operations hub for viewing, managing, and automating actions on your fleet — EC2, on-prem, and multicloud nodes — at scale.

Verified against AWS documentation · 2026-08-27

Key facts

  1. 01One service, many tools: Session Manager (shell access), Run Command (execute at scale), Patch Manager, Parameter Store, Automation, Inventory, State Manager
  2. 02Requires the SSM Agent on the node plus an instance profile/IAM role — no agent or no role is the classic 'instance not showing up' cause
  3. 03Session Manager: browser/CLI shell with no SSH keys, no bastion, no inbound ports open — auditable via CloudTrail and session logs
  4. 04Parameter Store: Standard tier free (10,000 params, 4 KB), Advanced paid (100,000 params, 8 KB, parameter policies like expiry/rotation reminders)

Exam triggers

Phrases and scenarios that point here.

  • "Access instances without opening port 22 / without SSH keys / without a bastion" → Session Manager
  • "Run a command/script across hundreds of instances" → Run Command
  • "Automate OS patching on a schedule" → Patch Manager + Maintenance Windows
  • "Store configuration values or license keys centrally, free" → Parameter Store
  • "Manage on-premises servers alongside EC2" → hybrid activation with SSM Agent

Not this service

  • Secrets needing automatic rotation or cross-account sharing → Secrets Manager
  • Provisioning infrastructure from templates → CloudFormation
  • Recording resource configuration history and compliance rules → AWS Config

Use cases

  1. 01Killing the bastion host: a team replaces its jump box and SSH key spreadsheet with Session Manager, and every shell session is now logged to S3 for the auditors
  2. 02Friday-night hotfix across a 300-instance fleet — one Run Command invocation instead of a for-loop over SSH
  3. 03Monthly patching of dev on week 1 and prod on week 2, fully hands-off, via Patch Manager baselines and Maintenance Windows
  4. 04An app reads its DB endpoint and feature flags from Parameter Store at boot, so promoting a build from staging to prod changes zero code
  5. 05Automation runbook that snapshots a volume, swaps an AMI, and notifies the team — the 3 a.m. manual checklist turned into one document

How it's charged

  1. 01Most core tools cost nothing extra: Run Command, State Manager, Inventory, Maintenance Windows, Fleet Manager, and Session Manager on EC2 are free — you pay only for the underlying instances
  2. 02Parameter Store Standard tier is free; Advanced parameters are charged per parameter per month plus per-interaction API pricing when higher throughput is enabled
  3. 03Automation has a free monthly allotment of steps, then charges per step — heavy runbook usage is where bills appear
  4. 04OpsCenter charges per OpsItem created; Distributor charges apply when distributing third-party (non-AWS) packages out of Region or on-prem
  5. 05Registering hybrid/on-prem nodes is free — the paid Advanced Instances Tier was retired mid-2026

Commonly confused with

AWS Secrets ManagerSecurity, Identity & ComplianceAWS CloudFormationManagement & GovernanceAWS ConfigManagement & Governance

References