AWS Systems Manager
Manage servers & config
An operations toolkit: patching, running commands remotely, logging in without SSH (Session Manager), storing configuration (Parameter Store).
- Cost$ Low
- Difficulty●●●●●
- Costs money when idle?No
- Managed by AWS
- In examsSAA · DVA · SOA
Think of it asLike an IT department remotely controlling every machine in the company.
Where does Systems Manager fit?
Calls Systems Manager
Systems ManagerSystems Manager calls
A real example, step by step
- You have 200 EC2 instances in private subnets and a critical vulnerability has just been announced.
- Every instance already has the SSM agent and a suitable IAM role, so they all appear in Systems Manager as managed nodes.
- You use Run Command to run the update on all 200 instances at once and see the result for each one.
- To inspect one instance, you open Session Manager in the browser: no port 22, no bastion, no SSH keys.
- Patch Manager is scheduled to patch weekly, and app configuration lives in Parameter Store.
When to use it
✓ Use it when
Managing many EC2/on-prem machines, storing application configuration.
Common uses
- Log in to EC2 without SSH or a bastion (Session Manager)
- Patch at scale (Patch Manager)
- Store application configuration (Parameter Store)
- Run commands across many machines (Run Command)
Systems Manager, Secrets Manager or CloudFormation?
| Systems Manager |  Secrets Manager |  CloudFormation | |
|---|---|---|---|
| What it does | Operates machines and stores configuration | Stores and rotates secrets | Builds infrastructure from templates |
| Instance access | Session Manager, no SSH needed | No | No |
| Configuration storage | Parameter Store (standard tier free) | Yes, charged per secret | Stack parameters |
| Automation | Run Command, Automation, Patch Manager | Password rotation | Create, update, delete resources |
What does it cost?
- Pricing model: Most features are free. Charged: advanced parameters (~$0.05/parameter/month), Parameter Store higher throughput, OpsCenter, some features for on-prem machines.
- Free tier: Session Manager, Run Command, Parameter Store standard: free.
Accidentally enabling advanced parameters; Session Manager session logs flowing into CloudWatch Logs.
Reach instances in private subnets without opening SSH or a bastion → Session Manager. Run an urgent command or patch across many instances → Run Command; regular patching → Patch Manager + maintenance windows. An instance missing from Systems Manager → check the agent, IAM role and route to the endpoints.
Try real exam questions
1A company has a production workload that runs on 1,000 Amazon EC2 Linux instances. The workload is powered by third-party software. The company needs to patch the third-party software on all EC2 instances as quickly as possible to remediate a critical security vulnerability. What should a solutions architect do to meet these requirements?
- ACreate an AWS Lambda function to apply the patch to all EC2 instances.
- BConfigure AWS Systems Manager Patch Manager to apply the patch to all EC2 instances.
- CSchedule an AWS Systems Manager maintenance window to apply the patch to all EC2 instances.
- DUse AWS Systems Manager Run Command to run a custom command that applies the patch to all EC2 instances.
Show answer
Correct answer: D
Systems Manager Run Command runs a custom command on all 1,000 instances at once, right away. Patch Manager and maintenance windows suit scheduled patching, not an urgent fix to third-party software.
2A company recently launched a variety of new workloads on Amazon EC2 instances in its AWS account. The company needs to create a strategy to access and administer the instances remotely and securely. The company needs to implement a repeatable process that works with native AWS services and follows the AWS Well-Architected Framework. Which solution will meet these requirements with the LEAST operational overhead?
- AUse the EC2 serial console to directly access the terminal interface of each instance for administration.
- BAttach the appropriate IAM role to each existing instance and new instance. Use AWS Systems Manager Session Manager to establish a remote SSH session.
- CCreate an administrative SSH key pair. Load the public key into each EC2 instance. Deploy a bastion host in a public subnet to provide a tunnel for administration of each instance.
- DEstablish an AWS Site-to-Site VPN connection. Instruct administrators to use their local on-premises machines to connect directly to the instances by using SSH keys across the VPN tunnel.
Show answer
Correct answer: B
Attach an IAM role to the instances and use Session Manager: no SSH port to open, no bastion or keys to manage, and every session is controlled by IAM. Bastions and VPNs take far more work to operate.
Frequently asked questions
How is Session Manager different from SSH through a bastion host?
Session Manager opens a shell on the instance through an agent, with no port 22 to open, no bastion and no SSH keys; access is controlled with IAM and whole sessions can be logged. A bastion requires open ports and key management.
What does Systems Manager include?
Many operations tools: Session Manager (instance access), Run Command (commands at scale), Patch Manager (patching), Parameter Store (configuration and secrets), Automation (runbooks), Inventory, State Manager and more.
Does Systems Manager cost anything?
Most core features are free, including Session Manager, Run Command, Patch Manager and the standard tier of Parameter Store. You pay for advanced Parameter Store parameters, advanced on-premises instance management and some features such as Automation beyond the free allowance.
What do AWS exams ask about Systems Manager?
Accessing instances in private subnets without SSH, scheduled patching at scale, Parameter Store versus Secrets Manager, and what makes an instance managed: the SSM agent, a suitable IAM role and connectivity to the Systems Manager endpoints.