AWS Systems Manager

What it is

AWS Systems Manager is a set of tools to view, manage, and operate nodes at scale: EC2 instances, On-premisesIn data centers or offices that you run yourself, rather than in the cloud. Hybrid architectures connect on-premises systems to AWS, for example through AWS Direct Connect or a VPN.Glossary entry servers, and VM (Virtual machine)A software computer that runs its own operating system on shared physical hardware, kept apart from other VMs by a hypervisor. An EC2 instance is a VM, except bare metal instances.Glossary entry in other clouds. It gives safe, secure remote management without logging in to servers, so you no longer need Bastion hostA hardened server in a public subnet that administrators connect to first, and from there to instances in private subnets. Session Manager in AWS Systems Manager can replace it without any open inbound ports.Glossary entry, SSH (Secure Shell)A protocol for secure remote logins and commands over an encrypted connection, usually on TCP port 22. Session Manager in AWS Systems Manager gives shell access to instances without opening that port.Glossary entry, or remote PowerShell, and it automates common operations such as patching and configuration.

Choose Systems Manager when a question asks to patch many instances, run a command on a fleet, connect to an instance without opening port 22, store configuration values, or automate operational fixes.

How nodes are managed

A managed node runs the SSM Agent (preinstalled on many AWS AMI (Amazon Machine Image)A template for launching EC2 instances: the operating system, software, and settings to copy onto the new instance's volumes, plus who may launch it. AMIs come from AWS, AWS Marketplace, or the community, or you create your own from an instance.Glossary entry) and has permission to talk to Systems Manager.
For EC2, attach an instance profile with the AmazonSSMManagedInstanceCore policy, or turn on Default Host Management Configuration to manage all EC2 instances in a AWS RegionA separate geographic area where AWS runs its services, such as us-east-1 in Northern Virginia, made up of several Availability Zones. Most resources live in one Region; you choose Regions for latency, data residency, and the services you need.Glossary entry automatically.
Hybrid nodes (on premises or other clouds) register through hybrid activations.
Instances in SubnetA range of IP addresses in a VPC, inside one Availability Zone. A subnet is public when its route table sends internet traffic to an internet gateway, and private when it does not.Glossary entry need a route to Systems Manager: a NAT gatewayA managed VPC component that lets instances in private subnets start connections to the internet or other networks, while blocking connections started from outside. It is billed per hour and per gigabyte processed.Glossary entry, or interface VPC endpointA private connection from a VPC to an AWS service or another endpoint service without crossing the internet. Gateway endpoints, for Amazon S3 and DynamoDB, are route table targets; interface endpoints are network interfaces that use AWS PrivateLink.Glossary entry for Systems Manager.

Key tools

Tool	What it does
Session Manager	Interactive shell access from the browser or CLI without inbound ports, bastion hosts, or SSH keys. Access is controlled with IAM, and sessions can be logged to S3 or CloudWatch Logs
Run Command	Run commands or scripts on many nodes at once, selected by tags
Patch Manager	Scan for and install OS and application patches using patch baselines, often scheduled with Maintenance Windows
Maintenance Windows	Schedule disruptive tasks, such as patching, for a set time
Parameter Store	Store configuration data and SecureString values encrypted with KMS. Standard parameters hold up to 4 KB (10,000 per Region, no charge); advanced parameters hold up to 8 KB and support parameter policies such as expiration
Automation	Run runbooks that automate tasks across resources, accounts, and Regions, such as restarting instances or remediating AWS Config findings
State Manager	Keep nodes in a state you define, such as required software installed or settings applied
Inventory	Collect software and configuration data from nodes
Fleet Manager	Manage nodes from the console: files, processes, users, and logs
OpsCenter	View, investigate, and resolve operational issues as OpsItems, for example from CloudWatch alarms

Parameter Store vs Secrets Manager: for secrets such as database credentials, API (Application programming interface)A defined way for one program to ask another for data or actions, such as a set of HTTPS requests and responses. Every AWS service is controlled through its API, which the console, the CLI, and the SDKs call for you.Glossary entry keys, or tokens, AWS recommends Secrets Manager, which adds automatic rotation and cross-Region replication. Parameter Store suits configuration values and simpler secrets.

Session Manager port forwarding tunnels a local port on your computer through a managed node. With port forwarding to a remote host, the node forwards traffic to a host it can reach, such as an RDS DB instance in a private subnet, which doesn't need to be a managed node itself. You use a desktop client against localhost, with no inbound ports, no bastion host, and access controlled through IAM.

CloudWatch agent at scale: store the CloudWatch agent configuration as a Parameter Store parameter, then install and configure the agent on the whole fleet with Run Command or a State Manager association. Every node loads the same central configuration, and you change it in one place without logging in to instances.

Availability changes

Incident Manager is no longer open to new customers.
Change Manager has been closed to new customers since November 7, 2025.
Existing customers can keep using both.
On June 30, 2026, the paid advanced-instances tier for hybrid nodes was removed. There is no longer a 1,000-node limit, and Session Manager works on non-EC2 machines without it. Since September 30, 2026, Session Manager and Run Command on hybrid nodes use pay-as-you-go pricing.

Security, resilience, performance, and cost

Security

Session Manager removes SSH keys and open inbound ports, uses IAM for access, and logs every session for auditing; CloudTrail records who started each session.
Use SecureString parameters (KMS) and IAM policies on parameter paths.
Use VPC endpoints so private instances never need internet access to be managed.

Resilience

Automation and State Manager fix drift and common failures automatically; Patch Manager with maintenance windows keeps fleets patched without manual work.

Cost

Core tools such as Patch Manager on EC2 instances and standard parameters have no additional charge.
Advanced parameters, OpsCenter API calls, and Session Manager and Run Command on hybrid nodes (from September 30, 2026) are charged. Check the pricing page for each tool you use.

Monitoring

Command output and session logs go to S3 or CloudWatch Logs; Inventory and compliance data show patch and configuration status across the fleet.

Systems Manager or another option?

If the requirement is	Choose
Shell access to instances without SSH, bastions, or open ports	Systems Manager Session Manager
Connect a desktop SQL (Structured Query Language)The standard language for querying and changing data in relational databases. Analytics services such as Amazon Athena and Amazon Redshift also use SQL.Glossary entry client to a private RDS database without a bastion	Session Manager port forwarding to a remote host
Patch a fleet on a schedule	Patch Manager with Maintenance Windows
Run a script on many instances	Run Command
Store configuration values and simple secrets	Parameter Store
Rotate database credentials automatically	AWS Secrets Manager
Automatically fix a noncompliant resource	AWS Config rule with Systems Manager Automation remediation
Provision infrastructure from templates	AWS CloudFormation

Reverse mindmap: when the question points here

Is it AWS Systems Manager?

Yes, when the question says
- Connect to instances without SSH or a bastion host leads to Session Manager
- No inbound port 22 allowed leads to Session Manager
- Reach a private RDS database from a laptop, no bastion leads to Session Manager port forwarding
- Patch hundreds of instances leads to Patch Manager
- Run a command on a fleet leads to Run Command
- Manage on-premises servers too leads to Hybrid activations
Choose the tool
- Patch only at night on weekends leads to Maintenance Windows
- Store an AMI ID or config value leads to Parameter Store
- Same CloudWatch agent config on every instance leads to Parameter Store plus Run Command or State Manager
- Encrypted configuration value leads to SecureString parameter
- Automate an operational task leads to Automation runbook
- Keep software installed on every node leads to State Manager
- See what software is installed leads to Inventory
Make it work
- Instance not showing as managed leads to SSM Agent and AmazonSSMManagedInstanceCore role
- Private subnet, no internet leads to Interface VPC endpoints
No, when the question says
- Automatic secret rotation leads to Secrets Manager
- Infrastructure as code leads to CloudFormation

Key takeaways

Systems Manager operates EC2 and on-premises nodes at scale; nodes need the SSM Agent and an instance profile such as AmazonSSMManagedInstanceCore.
Session Manager gives shell access without SSH keys, bastion hosts, or inbound ports, with session logging; port forwarding reaches private hosts such as RDS through a managed node.
Run Command runs scripts on fleets; Patch Manager with Maintenance Windows patches them; State Manager keeps them configured.
Parameter Store holds configuration (standard 4 KB, advanced 8 KB); use Secrets Manager when rotation is needed.
Automation runbooks fix problems, including Config remediation.
Incident Manager and Change Manager are closed to new customers; hybrid nodes no longer need the advanced tier.