On this page
On this page
- What Is DHMC
- IMDSv2 — Instance Metadata Service Version 2
- The IMDSv1 Problem
- How IMDSv2 Blocks SSRF
- Enforcing IMDSv2
- How DHMC Works
- DHMC Setup
- Traditional Instance Profile vs. DHMC Role
- AmazonSSMManagedEC2InstanceDefaultPolicy vs. AmazonSSMManagedInstanceCore
- Credential Precedence
- DHMC Qualifying Conditions
- 1. SSM Agent Installed and Running
- 2. IMDSv2 Enforced (HttpTokens: required)
- 3. No Instance Profile Attached
- 4. DHMC Configured in the Account and Region
- 5. Network Connectivity to SSM Endpoints
- What Can Break DHMC — Summary
- Key Exam Scenarios
- CloudWatch Integration
- Automatically Published
- Requires Setup (via SSM capabilities DHMC enables)
SSM Default Host Management Configuration
Default Host Management Configuration is a Systems Manager feature that automatically enables a core set of SSM capabilities on all EC2 instances in a region — without requiring an IAM instance profile to be manually attached to each instance.
The Problem It Solves
SSM's most valuable features (Session Manager, Run Command, Patch Manager, Fleet Manager) require that an EC2 instance has the SSM Agent installed and has an IAM role that grants SSM permissions. In practice, instances sometimes get launched without the correct instance profile — a new team skips the configuration, an older AMI doesn't have the agent, or someone launches a quick test instance without thinking about it. Those instances fall outside SSM's management reach.
DHMC changes the default. When enabled for a region, AWS automatically creates a service role and associates it with EC2 instances that don't already have an instance profile. The agent is also auto-installed if missing. The result is that every EC2 instance in the region is manageable via SSM out of the box, without anyone needing to remember to configure it.
What It Enables
Once DHMC is active, you get SSM's core capabilities across all instances:
- Session Manager — secure browser-based shell access to any instance, with no port 22 required
- Fleet Manager — a unified inventory view of all managed instances
- Patch Manager — automated OS patching
- Run Command — running scripts and commands across all instances
- State Manager — maintaining desired configuration across the fleet
IAM and Permissions
DHMC creates an AWS-managed IAM role (AmazonSSMRoleForInstancesQuickSetup)
and an instance profile for it. Instances without an existing profile receive
this one. Instances that already have an instance profile are not changed — DHMC
only fills the gap, it doesn't override existing configuration.
Regional Scope
DHMC is configured per region. You enable it region by region, typically through Quick Setup in the Systems Manager console or via an AWS Organizations Quick Setup configuration that rolls it out across all accounts and regions at once.