Systems Manager and Workflow Automation

What it is

AWS Systems Manager is a set of operations tools for managing fleets of EC2 instances, on premises servers and other resources without logging in to each one. Each capability solves a different problem, and the exam expects you to match the problem to the capability.

For work that spans many steps or services, AWS Step Functions orchestrates the flow with branching, retries and waiting.

How it works

The agent and the role

Managed instances run the SSM Agent and have an instance profile with the AmazonSSMManagedInstanceCore policy. The instance needs a network path to the Systems Manager endpoints, either through the internet or through VPC endpoints. Servers outside AWS register with a hybrid activation.

The main capabilities

Run Command

Run Command targets instances by ID or by tag. Rate controls limit the blast radius.

aws ssm send-command --document-name "AWS-RunShellScript" \
  --targets "Key=tag:Environment,Values=prod" \
  --parameters 'commands=["systemctl restart app"]' \
  --max-concurrency "10%" --max-errors "1"

max-concurrency caps how many targets run at once and max-errors stops the run after that many failures. Output can go to S3 or CloudWatch Logs.

Automation runbooks

An Automation runbook is a document with steps such as aws:executeAwsApi, aws:runCommand, aws:approve, aws:branch, aws:waitForAwsResourceProperty and aws:executeScript. AWS provides many ready made runbooks, and you can write your own in YAML.

aws ssm start-automation-execution --document-name AWS-RestartEC2Instance \
  --parameters "InstanceId=i-0123456789abcdef0"

Automation can run across several accounts and Regions with rate control, which suits fleet wide fixes. A runbook runs with an assume role, so it can act on resources the caller cannot touch directly, and an approval step can hold it for a human.

State Manager and Patch Manager

State Manager associations apply a document to targets on a schedule, for example to keep the CloudWatch agent installed and configured. If someone removes it, the next run puts it back.

Patch Manager uses a patch baseline to define which patches are approved. Instances join a patch group by tag, and the AWS-RunPatchBaseline document either scans or installs. Run it inside a maintenance window for controlled timing.

Parameter Store

Parameters use a path hierarchy such as /myapp/prod/db-url. Types are String, StringList and SecureString, which is encrypted with KMS.

Parameters are versioned, and the advanced tier adds policies such as expiration. Use Secrets Manager instead when you need built in rotation.

Orchestration with Step Functions

Step Functions runs state machines defined in the Amazon States Language. Each state can invoke Lambda, start a build, call another AWS service directly, wait, branch or run work in parallel, and the service handles Retry and Catch for errors.

Pick Step Functions over chained Lambda functions when a process has many steps, needs waits for human approval, or needs durable state and error handling. Pick EventBridge Scheduler or a rule on a schedule to start recurring workflows.

Large scale thinking

At scale, target by tag or resource group, never by a hand maintained list of IDs. Roll out in stages with rate controls, log every run, and make each step safe to run twice. Wrap repeatable work in runbooks or state machines so it can be triggered by an event, by a schedule or by a person.