Skip to content
  • 1. The Golden Rule of SSM (Prerequisites)

Before SSM can work on an EC2 instance, two things must exist. If an exam scenario says "SSM is not working," check these first:

  1. SSM Agent: Must be installed and running on the EC2 instance (it is pre-installed on Amazon Linux 2 and Amazon Linux 2023 AMIs).
  2. IAM Role: The EC2 instance must have an IAM role attached with the correct permissions policy (usually AmazonSSMManagedInstanceCore).
  • 2. Top 3 "Exam Star" Features

These three features appear most often in SAA-C03 questions.

- A. SSM Session Manager

  • What it is: Allows you to SSH (Linux) or RDP (Windows) into instances directly from the AWS Console or CLI.
  • The "Killer" Exam Scenario: "A company requires secure access to EC2 instances without opening inbound ports (like port 22 or 3389) and without managing SSH keys."
  • Why it’s the answer:
  • Traffic flows over HTTPS (TLS 1.2) via the SSM Agent.
  • No need for a Bastion Host (Jump Box).
  • Access is controlled via IAM Policies, not network rules.
  • Every command typed is logged to S3 or CloudWatch Logs for auditing (Compliance).

- B. SSM Parameter Store

  • The SSM Parameter store is a service which is part of Systems Manager which allows the storage and retrieval of parameters - string, stringlist or secure string.

  • The service supports encryption which integrates with KMS, versioning and can be secured using IAM.

  • The service integrates natively with many AWS services - and can be accessed using the CLI/APIs from anywhere with access to the AWS Public Space Endpoints.

alt text

alt text

  • What it is: Storage for configuration data (database strings, license codes) and secrets (passwords).
  • Exam Scenario: "You need a central location to store configuration variables for a Lambda function and EC2 fleet. The solution must be low cost."
  • Key Concepts:
  • SecureString: Encrypts sensitive data using a KMS key.
  • Hierarchical Storage: Organize parameters like /dev/db/password or /prod/app/limit.
  • Standard vs. Advanced:
  • Standard: Free (up to 10k params), 4KB size limit.

  • Advanced: Costs money, 8KB size limit, supports "Parameter Policies" (e.g., password expiration).

  • VS Secrets Manager (Crucial Distinction):

  • Use Parameter Store for configuration and simple secrets (Standard is free!).
  • Use Secrets Manager if you need automatic rotation of secrets (e.g., automatically changing an RDS database password every 30 days). Parameter Store cannot do this natively without custom Lambda scripts.

- C. SSM Patch Manager

  • What it is: Automates the process of patching managed instances with security updates.
  • Exam Scenario: "You need to ensure a fleet of 50 Linux servers is patched with the latest critical security updates every Saturday at 2 AM."
  • Key Concepts:
  • Patch Baseline: Defines which patches are approved (e.g., "Critical updates released > 7 days ago").
  • Maintenance Windows: Defines when the patching occurs to avoid disrupting production traffic.
  • 3. Other Key SSM Capabilities

- D. SSM Run Command

  • Concept: Execute a script/command on one or hundreds of instances simultaneously.
  • Exam Scenario: "You need to update a configuration file on 1,000 EC2 instances immediately."
  • Benefit: No need to SSH into each machine individually. Results are reported centrally.

- E. SSM Automation

  • Concept: Automates complex maintenance tasks using "Runbooks."
  • Exam Scenario: "You need to create a hardened AMI (Amazon Machine Image) every month that includes the latest OS patches."
  • Mechanism: SSM Automation can launch an instance -> patch it -> create an image -> terminate the instance.

- F. SSM Inventory

  • Concept: Collects metadata from your instances.
  • Exam Scenario: "You need to generate a report of all software installed on your EC2 fleet to check for unlicensed software."
  • 4. Cheat Sheet: Comparison for Exam
Feature Primary Exam Use Case "Trigger" Keywords
Session Manager Secure remote access No port 22/3389, No Bastion, Audit logs, IAM auth.
Parameter Store Config/Secret storage Hierarchical, Free (Standard), Config data, KMS encryption.
Secrets Manager Database password storage Automatic Rotation, RDS integration, Cross-account access.
Patch Manager OS Updates Compliance, Maintenance Window, Patch Baseline, CVE fixes.
Run Command Bulk actions "Across fleet of instances," "No SSH needed," "Execute script."
  • 5. A Typical Exam Question Walkthrough

Question: A company has an application running on private EC2 instances. A Solutions Architect needs to securely access these instances for troubleshooting. The solution must minimize operational overhead and avoid opening inbound ports to the internet. Which solution should they choose?

A. Configure a Bastion Host in a public subnet and restrict Security Group access to the admin's IP. B. Use AWS Systems Manager Session Manager to access the instances. C. Use EC2 Instance Connect with a public IP address. D. Set up a Site-to-Site VPN to the VPC.

Analysis:

  • Option A: Requires managing an extra EC2 (overhead) and opening ports.
  • Option B: Correct. No ports needed, no extra infrastructure (low overhead), highly secure.
  • Option C: Requires a public IP (security risk for private instances).
  • Option D: Valid connectivity, but high overhead (setup time/cost) just for troubleshooting access.

Answer: B