AWSDOP-C02
On this page
Beginner-friendly overview

Systems Manager

Systems Manager is a collection of tools for managing EC2 instances (and on-premises servers) at scale. It lets you run commands across fleets of servers, manage configuration, patch operating systems, store configuration values, and access servers securely — all without opening inbound ports or managing SSH keys.

The Core Value

Managing one server is easy. Managing hundreds requires automation. SSM provides that automation layer: you can run a shell script on every instance in a fleet simultaneously, check that all instances have the latest security patches applied, or query the current software inventory of every server — all from the AWS console or API, with no SSH access required.

One agent, one control plane, six capabilities Your fleet EC2 instances SSM Agent inside On-prem / other cloud SSM Agent (hybrid, mi-…) agent dials OUT HTTPS 443 only Systems Manager control plane · IAM-gated Capabilities Run Command scripts, fleet-wide Session Manager shell, no port 22 Patch Manager baselines + windows Parameter Store config + secrets Automation runbooks, API-level State Manager enforce desired state One agent, one IAM model, one API — every capability targets instances by tag, ID, or resource group. Nothing ever dials in.

Session Manager

Session Manager is arguably SSM's most impactful feature. It opens a browser- based terminal session to any managed EC2 instance — or on-premises server — without needing port 22 open, a bastion host, or SSH keys. The session goes through AWS's control plane, which means all session activity is logged to CloudTrail and optionally to S3.

This eliminates an entire class of security risk: no inbound SSH means no brute-force attacks on port 22, no key management headaches, and no bastions to patch and maintain.

SSM is SSH turned inside-out: the agent on every server dials OUT over HTTPS 443 — nothing ever dials in. That flips server access from a network problem (open ports, key files, bastions) into an IAM decision, with every session logged. Memory hook: "the server phones home; home never phones the server."

Run Command

Run Command lets you execute shell scripts or pre-built command documents (SSM Documents) across a set of managed instances simultaneously. You can target instances by tag (e.g., all instances tagged Environment=Production), by instance ID, or by resource group. Output is captured and stored in S3 or CloudWatch Logs.

Parameter Store

Parameter Store is a secure key-value store built into SSM. Use it to store configuration values (database connection strings, feature flags, application settings) and retrieve them in your application code at runtime. Parameters can be plain text or SecureString (encrypted with KMS). Parameter Store is free for standard parameters and integrates natively with Lambda, ECS, and EC2 user-data scripts.

Patch Manager

Patch Manager automates the process of patching managed instances. You define a patch baseline (which patches to approve — critical security patches only, all patches, specific patch groups) and a maintenance window (when to apply them). Patch Manager handles the rest and reports compliance back to SSM.