[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"cheat-sheet---en":3,"domain-info---en":3,"topic-info----en":3,"lesson-aws-certified-cloudops-engineer-associate-deployment-provisioning-automation-operational-automation-systems-manager-fleet-management-en":4,"prev-aws-certified-cloudops-engineer-associate-deployment-provisioning-automation-operational-automation-systems-manager-fleet-management-en":994,"next-aws-certified-cloudops-engineer-associate-deployment-provisioning-automation-operational-automation-systems-manager-fleet-management-en":1010},null,{"locked":5,"reason":3,"meta":6,"item":19},false,{"title":7,"description":8,"isFree":9,"estimatedMinutes":10,"difficulty":11,"learningObjectives":12},"Systems Manager Fleet Management","Manage a fleet through Systems Manager instead of SSH: the three conditions that make a node manageable, instance profiles versus Default Host Management Configuration, Session Manager, Run Command targeting and rate control, Fleet Manager and Inventory, and the diagnostic order for a node that never appears.",true,26,"intermediate",[13,14,15,16,17,18],"Name the three conditions a node must meet to appear as a Systems Manager managed node","Choose between an IAM instance profile and Default Host Management Configuration, and identify the setting that makes one override the other","Explain how Session Manager replaces SSH and bastion hosts, and where its session logging does not reach","Target a Run Command operation by instance ID, tag, or resource group, and predict its behavior from the concurrency and error threshold defaults","Describe what Fleet Manager and Inventory give you that the EC2 console does not","Diagnose a running instance that never appears in the managed node list, in the order that finds the cause fastest",{"id":20,"title":7,"body":21,"description":8,"difficulty":11,"estimatedMinutes":10,"extension":905,"infographics":906,"isFree":9,"learningObjectives":923,"meta":924,"navigation":9,"path":925,"quiz":926,"seo":991,"stem":992,"__hash__":993},"courses/courses/aws-certified-cloudops-engineer-associate/en/domains/03-deployment-provisioning-automation/05-operational-automation/01-systems-manager-fleet-management.md",{"type":22,"value":23,"toc":896},"minimark",[24,28,31,36,44,50,56,66,71,78,82,94,107,187,190,204,214,220,224,231,242,245,255,261,272,279,283,290,304,307,394,412,415,443,462,574,585,589,595,605,608,615,619,622,625,644,655,658,735,746,749,833,846,850,889,892],[25,26,27],"p",{},"You have 400 EC2 instances and a question that takes 10 seconds to answer on any one of them: which version of the agent is installed? The SSH answer costs you a bastion host, a key distribution problem, an inbound port on every security group, and a shell script wrapped around 400 hostnames with no record of what ran where. Systems Manager exists so that question costs one API call and produces an audit trail.",[25,29,30],{},"The previous topic ended with shipping a new version of your software. This topic is about the software already running: reaching it, keeping it consistent, and automating the parts of your week that are the same every week.",[32,33,35],"h2",{"id":34},"the-three-conditions-that-make-a-node-manageable","The three conditions that make a node manageable",[25,37,38,39,43],{},"Every Systems Manager tool in this domain (Session Manager, Run Command, Patch Manager, State Manager) works on ",[40,41,42],"strong",{},"managed nodes",", and nothing works until an instance becomes one. Three conditions must all hold.",[25,45,46,49],{},[40,47,48],{},"SSM Agent must be installed and running"," on a supported operating system. Most AWS-provided AMIs ship with it preinstalled, which is why this condition usually passes without you doing anything and why it is easy to forget when someone brings a custom image.",[25,51,52,55],{},[40,53,54],{},"The node must have credentials"," that let it call the Systems Manager API. On EC2 that means an IAM instance profile or the account-level alternative covered in the next section. On an on-premises server or VM it means an IAM service role and a hybrid activation.",[25,57,58,61,62,65],{},[40,59,60],{},"The agent must be able to reach a Systems Manager endpoint"," on port 443 to register itself. After registration, the service checks the node's health with a signal ",[40,63,64],{},"every 5 minutes",".",[67,68],"infographic",{"alt":69,"slug":70},"Three sequential gates show that a node becomes a managed node only after the agent, its credentials, and its endpoint connectivity all pass, with the failure symptom listed under each gate.","ssm-managed-node-three-gates",[25,72,73,74,77],{},"Hold onto the order, because it is also the diagnostic order later in this lesson. Note the direction of the connection too: ",[40,75,76],{},"SSM Agent initiates every connection outbound."," You never open an inbound port for Systems Manager, which is the single fact that makes this whole toolset a security improvement over SSH rather than a convenience layer on top of it.",[32,79,81],{"id":80},"two-ways-to-give-an-instance-credentials","Two ways to give an instance credentials",[25,83,84,85,88,89,93],{},"The classic approach is an ",[40,86,87],{},"IAM instance profile"," carrying the ",[90,91,92],"code",{},"AmazonSSMManagedInstanceCore"," managed policy. It is per instance, it is explicit, and it is what a question about a single misconfigured node almost always turns on.",[25,95,96,99,100,88,103,106],{},[40,97,98],{},"Default Host Management Configuration"," is the account-level alternative, and AWS recommends it where the use case allows. Turn it on and every instance in that account and Region that runs Instance Metadata Service Version 2 with SSM Agent 3.2.582.0 or later becomes a managed instance automatically, with no instance profile at all. It uses a service role named ",[90,101,102],{},"AWSSystemsManagerDefaultEC2InstanceManagementRole",[90,104,105],{},"AmazonSSMManagedEC2InstanceDefaultPolicy"," policy.",[108,109,110,124],"table",{},[111,112,113],"thead",{},[114,115,116,119,122],"tr",{},[117,118],"th",{},[117,120,121],{},"Instance profile",[117,123,98],{},[125,126,127,139,152,165,176],"tbody",{},[114,128,129,133,136],{},[130,131,132],"td",{},"Scope",[130,134,135],{},"One instance at a time",[130,137,138],{},"Every eligible instance in the account and Region",[114,140,141,144,147],{},[130,142,143],{},"Identity",[130,145,146],{},"A role you attach",[130,148,149,151],{},[90,150,102],{}," by default",[114,153,154,157,161],{},[130,155,156],{},"Policy",[130,158,159],{},[90,160,92],{},[130,162,163],{},[90,164,105],{},[114,166,167,170,173],{},[130,168,169],{},"IMDS requirement",[130,171,172],{},"None",[130,174,175],{},"IMDSv2 only, IMDSv1 is not supported",[114,177,178,181,184],{},[130,179,180],{},"Turn on where",[130,182,183],{},"Per instance",[130,185,186],{},"Per Region, in each Region you want covered",[25,188,189],{},"Three details decide questions here.",[25,191,192,195,196,199,200,203],{},[40,193,194],{},"It is per Region."," Turning it on in ",[90,197,198],{},"eu-west-1"," does nothing for ",[90,201,202],{},"us-east-1",". Teams discover this when half their fleet is managed and half is not.",[25,205,206,209,210,213],{},[40,207,208],{},"An instance profile wins."," SSM Agent tries instance profile permissions before Default Host Management Configuration permissions, so an old instance profile that allows ",[90,211,212],{},"ssm:UpdateInstanceInformation"," keeps that instance on the old path and the account-level role never gets used. Before you turn the feature on, remove that permission from existing instance profiles.",[25,215,216,219],{},[40,217,218],{},"Propagation is not instant."," After you turn it on, instances can take up to 30 minutes to pick up the new role's credentials.",[32,221,223],{"id":222},"session-manager-a-shell-with-no-inbound-port","Session Manager: a shell with no inbound port",[25,225,226,227,230],{},"You need a shell on a production instance at 2 in the morning. ",[40,228,229],{},"Session Manager"," gives you one from the console or the CLI, with no open inbound port, no SSH key, and no bastion host.",[25,232,233,234,237,238,241],{},"The connection is a bidirectional channel between your client and SSM Agent. Traffic is encrypted with ",[40,235,236],{},"TLS 1.2",", requests to open the channel are signed with ",[40,239,240],{},"Sigv4",", and you can layer a KMS key on top to encrypt the session data beyond the default TLS encryption. Access is granted entirely through IAM policy, which is what makes \"give the on-call engineer production access for the length of their rotation\" a policy change rather than a key rotation exercise.",[25,243,244],{},"Two capabilities beyond an interactive shell are worth naming:",[25,246,247,250,251,254],{},[40,248,249],{},"Port forwarding"," redirects a port inside the node to a local port on your machine. A database listening on 5432 inside a private subnet becomes ",[90,252,253],{},"localhost:9999"," on your laptop, with no VPN and no public IP.",[25,256,257,260],{},[40,258,259],{},"Configurable shell profiles"," let you set the shell, environment variables, working directory, and startup commands for every session, which is how you make sessions land somewhere predictable.",[25,262,263,264,267,268,271],{},"For auditing, sessions can stream to a ",[40,265,266],{},"CloudWatch Logs log group"," or an ",[40,269,270],{},"S3 bucket",", with or without your own KMS key, and CloudTrail records the API calls that started them. An EventBridge rule on session start and end can push a notification to SNS.",[25,273,274,275,278],{},"Here is the misconception that survives most first readings of this feature. ",[40,276,277],{},"Session logging does not cover port forwarding or SSH sessions."," In those modes Session Manager is only a tunnel; SSH encrypts everything inside the TLS connection, so the service has nothing to record. If a scenario requires a transcript of commands, the answer involves interactive shell sessions, not port forwarding.",[32,280,282],{"id":281},"run-command-one-action-across-the-fleet","Run Command: one action across the fleet",[25,284,285,286,289],{},"Session Manager is for one node and a human. ",[40,287,288],{},"Run Command"," is for many nodes and one document, and it costs nothing extra.",[25,291,292,293,296,297,296,300,303],{},"You pick a Command-type SSM document (",[90,294,295],{},"AWS-RunShellScript",", ",[90,298,299],{},"AWS-RunPowerShellScript",[90,301,302],{},"AWS-RunPatchBaseline",", and so on), pick targets, and set the rate controls.",[25,305,306],{},"Targets come in four forms:",[308,309,314],"pre",{"className":310,"code":311,"language":312,"meta":313,"style":313},"language-bash shiki shiki-themes material-theme-lighter github-light github-dark","# by instance ID\n--targets Key=instanceids,Values=i-02573cafcfEXAMPLE,i-0471e04240EXAMPLE\n\n# by tag\n--targets Key=tag:Environment,Values=Production\n\n# by resource group name (maximum one per command)\n--targets Key=resource-groups:Name,Values=web-tier\n\n# by resource type inside resource groups (maximum five types)\n--targets Key=resource-groups:ResourceTypeFilters,Values=AWS::EC2::Instance\n","bash","",[90,315,316,325,336,342,348,356,361,367,375,380,386],{"__ignoreMap":313},[317,318,321],"span",{"class":319,"line":320},"line",1,[317,322,324],{"class":323},"sutJx","# by instance ID\n",[317,326,328,332],{"class":319,"line":327},2,[317,329,331],{"class":330},"sbgvK","--targets",[317,333,335],{"class":334},"s_sjI"," Key=instanceids,Values=i-02573cafcfEXAMPLE,i-0471e04240EXAMPLE\n",[317,337,339],{"class":319,"line":338},3,[317,340,341],{"emptyLinePlaceholder":9},"\n",[317,343,345],{"class":319,"line":344},4,[317,346,347],{"class":323},"# by tag\n",[317,349,351,353],{"class":319,"line":350},5,[317,352,331],{"class":330},[317,354,355],{"class":334}," Key=tag:Environment,Values=Production\n",[317,357,359],{"class":319,"line":358},6,[317,360,341],{"emptyLinePlaceholder":9},[317,362,364],{"class":319,"line":363},7,[317,365,366],{"class":323},"# by resource group name (maximum one per command)\n",[317,368,370,372],{"class":319,"line":369},8,[317,371,331],{"class":330},[317,373,374],{"class":334}," Key=resource-groups:Name,Values=web-tier\n",[317,376,378],{"class":319,"line":377},9,[317,379,341],{"emptyLinePlaceholder":9},[317,381,383],{"class":319,"line":382},10,[317,384,385],{"class":323},"# by resource type inside resource groups (maximum five types)\n",[317,387,389,391],{"class":319,"line":388},11,[317,390,331],{"class":330},[317,392,393],{"class":334}," Key=resource-groups:ResourceTypeFilters,Values=AWS::EC2::Instance\n",[25,395,396,397,404,405,408,409,65],{},"Two rules about tag targeting decide questions. ",[40,398,399,400,403],{},"Multiple ",[90,401,402],{},"Key"," criteria are combined with AND",", so ",[90,406,407],{},"Key=tag:Department,Values=Finance Key=tag:ServerRole,Values=Database"," hits only nodes carrying both. And an array of targets holds ",[40,410,411],{},"a maximum of 5 keys with 5 values each",[25,413,414],{},"Now the rate controls, which are the same pair you met on Automation runbooks:",[416,417,418,431],"ul",{},[419,420,421,426,427,430],"li",{},[40,422,423],{},[90,424,425],{},"--max-concurrency"," is how many nodes run the command at once, as a number or a percentage. ",[40,428,429],{},"The default is 50."," Delivery ramps up: the command goes to one node, waits for acknowledgement, then two more, then grows exponentially until it reaches the limit.",[419,432,433,438,439,442],{},[40,434,435],{},[90,436,437],{},"--max-errors"," is how many failures are tolerated before Systems Manager stops sending to more nodes. ",[40,440,441],{},"The default is 0",", which means the first failure stops further dispatch.",[25,444,445,446,449,450,453,454,457,458,461],{},"Walk the arithmetic AWS gives for this. Send a command to 50 nodes with ",[90,447,448],{},"--max-errors 10%",": the threshold is 5, so the system stops sending when the ",[40,451,452],{},"sixth"," error arrives. Invocations already in flight are allowed to finish, and some of them may fail too. If a scenario demands that no more than N nodes ever fail, ",[90,455,456],{},"--max-errors N"," alone is not enough; you also need ",[90,459,460],{},"--max-concurrency 1"," so invocations proceed one at a time.",[308,463,465],{"className":310,"code":464,"language":312,"meta":313,"style":313},"aws ssm send-command \\\n  --document-name \"AWS-RunShellScript\" \\\n  --targets Key=tag:Environment,Values=Production \\\n  --parameters 'commands=[\"systemctl restart nginx\"]' \\\n  --max-concurrency 10 \\\n  --max-errors 1 \\\n  --output-s3-bucket-name ops-command-output \\\n  --service-role-arn arn:aws:iam::111122223333:role/SSMRunCommandNotifications \\\n  --notification-config NotificationArn=arn:aws:sns:eu-west-1:111122223333:ops-alerts,NotificationEvents=Failed,NotificationType=Command\n",[90,466,467,482,499,509,525,536,546,556,566],{"__ignoreMap":313},[317,468,469,472,475,478],{"class":319,"line":320},[317,470,471],{"class":330},"aws",[317,473,474],{"class":334}," ssm",[317,476,477],{"class":334}," send-command",[317,479,481],{"class":480},"s_hVV"," \\\n",[317,483,484,488,492,494,497],{"class":319,"line":327},[317,485,487],{"class":486},"stzsN","  --document-name",[317,489,491],{"class":490},"sjJ54"," \"",[317,493,295],{"class":334},[317,495,496],{"class":490},"\"",[317,498,481],{"class":480},[317,500,501,504,507],{"class":319,"line":338},[317,502,503],{"class":486},"  --targets",[317,505,506],{"class":334}," Key=tag:Environment,Values=Production",[317,508,481],{"class":480},[317,510,511,514,517,520,523],{"class":319,"line":344},[317,512,513],{"class":486},"  --parameters",[317,515,516],{"class":490}," '",[317,518,519],{"class":334},"commands=[\"systemctl restart nginx\"]",[317,521,522],{"class":490},"'",[317,524,481],{"class":480},[317,526,527,530,534],{"class":319,"line":350},[317,528,529],{"class":486},"  --max-concurrency",[317,531,533],{"class":532},"srdBf"," 10",[317,535,481],{"class":480},[317,537,538,541,544],{"class":319,"line":358},[317,539,540],{"class":486},"  --max-errors",[317,542,543],{"class":532}," 1",[317,545,481],{"class":480},[317,547,548,551,554],{"class":319,"line":363},[317,549,550],{"class":486},"  --output-s3-bucket-name",[317,552,553],{"class":334}," ops-command-output",[317,555,481],{"class":480},[317,557,558,561,564],{"class":319,"line":369},[317,559,560],{"class":486},"  --service-role-arn",[317,562,563],{"class":334}," arn:aws:iam::111122223333:role/SSMRunCommandNotifications",[317,565,481],{"class":480},[317,567,568,571],{"class":319,"line":377},[317,569,570],{"class":486},"  --notification-config",[317,572,573],{"class":334}," NotificationArn=arn:aws:sns:eu-west-1:111122223333:ops-alerts,NotificationEvents=Failed,NotificationType=Command\n",[25,575,576,577,580,581,584],{},"Two operational notes on output. ",[40,578,579],{},"Command history is available for up to 30 days",", so anything you need to keep longer goes to S3 or CloudWatch Logs, which is also how you get past the console's truncated view of long output. And never pass a secret in a command's plaintext parameters: all Systems Manager API activity is logged, so anyone with access to those logs can read it. Use a ",[90,582,583],{},"SecureString"," parameter instead, which is the subject of a later lesson in this topic.",[32,586,588],{"id":587},"fleet-manager-and-inventory-seeing-what-you-have","Fleet Manager and Inventory: seeing what you have",[25,590,591,594],{},[40,592,593],{},"Fleet Manager"," is the console over all of this. It shows which managed nodes are running or stopped, and it lets you do systems administration work without opening a session at all: browse the file system and read file contents, manage the Windows registry, manage operating system user accounts and groups, view running processes, view log files on the node, connect to a Windows instance over RDP, and manage the EBS volumes attached to an instance. Every one of those actions is gated by IAM, so you can grant a support team log reading without granting them a shell.",[25,596,597,600,601,604],{},[40,598,599],{},"Inventory"," answers the fleet-wide questions. It collects metadata on a schedule: applications and versions, AWS components, files, network configuration, Windows updates, instance details, services, tags, Windows registry keys, Windows roles, and any custom inventory you drop on the node as a JSON file. The shortest collection interval is ",[40,602,603],{},"every 30 minutes",", so treat it as a periodic snapshot rather than a live feed.",[25,606,607],{},"Inventory only collects metadata. It does not read your data.",[25,609,610,611,614],{},"The piece that turns Inventory into a real reporting tool is a ",[40,612,613],{},"resource data sync",": point every account and Region at one S3 bucket, then query the aggregated data with Athena. That is the difference between \"which nodes in this Region run OpenSSL 1.0\" and \"which nodes anywhere in the organization run OpenSSL 1.0.\"",[32,616,618],{"id":617},"when-a-node-does-not-appear-in-the-list","When a node does not appear in the list",[25,620,621],{},"You confirmed the instance is running. It is not in the managed node list. Work the three conditions in order, because that order finds the cause with the least work.",[25,623,624],{},"Start with the fast check from the node itself. SSM Agent 3.1.501.0 and later ships a standalone tool:",[308,626,628],{"className":310,"code":627,"language":312,"meta":313,"style":313},"ssm-cli get-diagnostics --output table\n",[90,629,630],{"__ignoreMap":313},[317,631,632,635,638,641],{"class":319,"line":320},[317,633,634],{"class":330},"ssm-cli",[317,636,637],{"class":334}," get-diagnostics",[317,639,640],{"class":486}," --output",[317,642,643],{"class":334}," table\n",[25,645,646,647,650,651,654],{},"On Windows Server, run ",[90,648,649],{},"ssm-cli.exe get-diagnostics --output table"," from ",[90,652,653],{},"C:\\Program Files\\Amazon\\SSM",". It returns one row per check with a Success, Failed, or Skipped status, and the failing row names the condition.",[25,656,657],{},"Map the rows to causes:",[108,659,660,670],{},[111,661,662],{},[114,663,664,667],{},[117,665,666],{},"Diagnostic row",[117,668,669],{},"What a failure means",[125,671,672,680,688,700,708,716,727],{},[114,673,674,677],{},[130,675,676],{},"Agent service",[130,678,679],{},"The agent is not running, or not running as root (Linux) or SYSTEM (Windows)",[114,681,682,685],{},[130,683,684],{},"AWS Credentials",[130,686,687],{},"No instance profile or service role attached, or it lacks the Systems Manager permissions",[114,689,690,693],{},[130,691,692],{},"EC2 IMDS",[130,694,695,696,699],{},"The agent cannot reach ",[90,697,698],{},"http://169.254.169.254",", usually a local route, firewall, or proxy problem",[114,701,702,705],{},[130,703,704],{},"Connectivity to ssm, ec2messages, ssmmessages",[130,706,707],{},"Security groups, network ACLs, route tables, OS firewall, or a missing VPC endpoint",[114,709,710,713],{},[130,711,712],{},"Proxy configuration",[130,714,715],{},"The agent's proxy settings are wrong, which can also make Systems Manager misidentify the operating system",[114,717,718,721],{},[130,719,720],{},"Sysprep image state (Windows)",[130,722,723,724],{},"The agent will not start unless the state is ",[90,725,726],{},"IMAGE_STATE_COMPLETE",[114,728,729,732],{},[130,730,731],{},"SSM Agent version",[130,733,734],{},"An old agent, which matters for features with a minimum version",[25,736,737,738,741,742,745],{},"From the API side, ",[90,739,740],{},"aws ssm describe-instance-associations-status --instance-id i-02573cafcfEXAMPLE"," returns an empty ",[90,743,744],{},"InstanceAssociationStatusInfos"," array until registration succeeds, so an empty result after 5 minutes is itself the signal.",[25,747,748],{},"For the connectivity condition, an instance either reaches the public endpoints over an outbound HTTPS route or reaches interface VPC endpoints instead:",[108,750,751,761],{},[111,752,753],{},[114,754,755,758],{},[117,756,757],{},"Endpoint",[117,759,760],{},"Why",[125,762,763,773,783,793,803,813,823],{},[114,764,765,770],{},[130,766,767],{},[90,768,769],{},"com.amazonaws.region.ssm",[130,771,772],{},"The Systems Manager service endpoint",[114,774,775,780],{},[130,776,777],{},[90,778,779],{},"com.amazonaws.region.ssmmessages",[130,781,782],{},"Required for the agent's data channel and for Session Manager",[114,784,785,790],{},[130,786,787],{},[90,788,789],{},"com.amazonaws.region.ec2messages",[130,791,792],{},"The older agent-to-service call path, still used by older agents",[114,794,795,800],{},[130,796,797],{},[90,798,799],{},"com.amazonaws.region.s3",[130,801,802],{},"Agent updates, and any script or output stored in a bucket",[114,804,805,810],{},[130,806,807],{},[90,808,809],{},"com.amazonaws.region.ec2",[130,811,812],{},"Only for VSS-enabled snapshots",[114,814,815,820],{},[130,816,817],{},[90,818,819],{},"com.amazonaws.region.kms",[130,821,822],{},"Optional, for KMS encryption in Session Manager or Parameter Store",[114,824,825,830],{},[130,826,827],{},[90,828,829],{},"com.amazonaws.region.logs",[130,831,832],{},"Optional, for CloudWatch Logs output",[25,834,835,836,839,840,650,843,65],{},"Two more causes worth carrying, because they look like bugs. A node whose status has been ",[40,837,838],{},"Connection Lost for at least 30 days"," may drop off the Fleet Manager list entirely until the underlying problem is fixed. And every managed node needs a TLS certificate from Amazon Trust Services in its trust store; a custom or on-premises image without one fails with an SSL error where you would expect an ",[90,841,842],{},"UnknownOperationException",[90,844,845],{},"curl -L https://ssm.region.amazonaws.com",[32,847,849],{"id":848},"exam-tips","Exam tips",[416,851,852,855,862,867,870,875,883,886],{},[419,853,854],{},"Any \"the instance is running but does not appear in Systems Manager\" question is testing the three conditions. Read the stem for which one it removed: no agent, no instance profile, or no route to the endpoints.",[419,856,857,858,861],{},"A private subnet with no NAT gateway plus a Session Manager requirement means interface VPC endpoints, and ",[90,859,860],{},"ssmmessages"," is the one that carries the session.",[419,863,864,865,65],{},"Default Host Management Configuration is per account and per Region, needs IMDSv2, and loses to an instance profile that allows ",[90,866,212],{},[419,868,869],{},"\"No inbound ports, no bastion host, no SSH keys, and an audit trail\" is the phrase that points at Session Manager. If the same question also demands a command transcript, remember that port forwarding and SSH sessions are not logged.",[419,871,872,873,65],{},"Run Command defaults: concurrency 50, error threshold 0. A question where a single failure stopped a fleet-wide command has not set ",[90,874,437],{},[419,876,877,878,880,881,65],{},"To bound total failures rather than just stop dispatch, pair ",[90,879,437],{}," with ",[90,882,460],{},[419,884,885],{},"Command history lasts 30 days. Any requirement to retain output longer means S3 or CloudWatch Logs.",[419,887,888],{},"Inventory is metadata on a schedule with a 30-minute floor, and a resource data sync into S3 is what makes it queryable across accounts and Regions with Athena.",[25,890,891],{},"The rule to carry out of this lesson: on AWS, fleet access is an IAM problem, not a network problem. Once the three conditions hold, granting or revoking access to a server is a policy edit rather than a key rotation, and every action leaves a record. The next lesson uses that same managed node foundation to keep those servers patched and their configuration from drifting.",[893,894,895],"style",{},"html pre.shiki code .sutJx, html code.shiki .sutJx{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#6A737D;--shiki-default-font-style:inherit;--shiki-dark:#6A737D;--shiki-dark-font-style:inherit}html pre.shiki code .sbgvK, html code.shiki .sbgvK{--shiki-light:#E2931D;--shiki-default:#6F42C1;--shiki-dark:#B392F0}html pre.shiki code .s_sjI, html code.shiki .s_sjI{--shiki-light:#91B859;--shiki-default:#032F62;--shiki-dark:#9ECBFF}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .s_hVV, html code.shiki .s_hVV{--shiki-light:#90A4AE;--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .stzsN, html code.shiki .stzsN{--shiki-light:#91B859;--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .sjJ54, html code.shiki .sjJ54{--shiki-light:#39ADB5;--shiki-default:#032F62;--shiki-dark:#9ECBFF}html pre.shiki code .srdBf, html code.shiki .srdBf{--shiki-light:#F76D47;--shiki-default:#005CC5;--shiki-dark:#79B8FF}",{"title":313,"searchDepth":338,"depth":338,"links":897},[898,899,900,901,902,903,904],{"id":34,"depth":327,"text":35},{"id":80,"depth":327,"text":81},{"id":222,"depth":327,"text":223},{"id":281,"depth":327,"text":282},{"id":587,"depth":327,"text":588},{"id":617,"depth":327,"text":618},{"id":848,"depth":327,"text":849},"md",[907],{"slug":70,"concept":908,"style":909,"aspectRatio":910,"labels":911},"A left-to-right flow showing the three conditions an EC2 instance must pass before it is listed as a Systems Manager managed node. Three gate boxes sit in sequence: SSM Agent running, credentials attached, and endpoint reachability. Each gate has a pass arrow continuing right and a downward branch labelled with the symptom that gate produces when it fails and the ssm-cli check that reveals it. The final box on the right is the managed node list, with a note that the service confirms health every 5 minutes. The emphasis is that all three must pass and that the failing gate is identifiable from the symptom alone.","diagram","16:9",[912,913,914,915,916,917,918,919,920,921,922],"Gate 1: SSM Agent installed and running on a supported OS","Fails: no agent process, or the service is not running as root or SYSTEM","ssm-cli check: Agent service","Gate 2: credentials attached, an instance profile or Default Host Management Configuration","Fails: the agent runs but never registers","ssm-cli check: AWS Credentials","Gate 3: the agent can reach the Systems Manager endpoints on port 443","Fails: no outbound route, no VPC endpoints, or a bad proxy","ssm-cli check: Connectivity to ssm, ec2messages, ssmmessages","Managed node list: health confirmed every 5 minutes","All three gates must pass, so the symptom tells you which gate broke before you touch anything.",[13,14,15,16,17,18],{},"/courses/aws-certified-cloudops-engineer-associate/en/domains/03-deployment-provisioning-automation/05-operational-automation/01-systems-manager-fleet-management",{"passingScore":927,"questions":928},70,[929,938,946,954,959,967,977,983],{"question":930,"type":931,"options":932,"correctAnswer":934,"explanation":937},"An administrator turns on Default Host Management Configuration in a Region. Instances there still use instance profiles that grant ssm:UpdateInstanceInformation. Which credentials does SSM Agent use?","single",[933,934,935,936],"It alternates between the two and uses whichever answers first","The instance profile, because SSM Agent tries instance profile permissions before Default Host Management Configuration permissions","The Default Host Management Configuration role, because account-level settings take precedence","Neither, because the two configurations conflict and registration fails","SSM Agent attempts instance profile permissions first, so an instance profile that allows ssm:UpdateInstanceInformation keeps the instance on the old path and the account-level role is never used. This is why the setup instructions tell you to remove that permission from existing instance profiles before turning the feature on.",{"question":939,"type":931,"options":940,"correctAnswer":942,"explanation":945},"You run aws ssm send-command against 200 tagged nodes without specifying --max-concurrency or --max-errors. What happens?",[941,942,943,944],"All 200 nodes run the command at once, and the command completes regardless of failures","50 nodes run at a time, and Systems Manager stops sending the command after the first error","50 nodes run at a time, and the command continues through all 200 no matter how many fail","The command fails validation, because both parameters are required for tag targeting","The default for max-concurrency is 50 and the default for max-errors is 0, and a max-errors of 0 means the system stops sending the command to more nodes after the first error result comes back. Invocations already running are allowed to finish, so a run can still end with more failures than the threshold unless you also set max-concurrency to 1.",{"question":947,"type":931,"options":948,"correctAnswer":951,"explanation":953},"A security team needs a recorded transcript of everything engineers type on production instances. Engineers currently connect through Session Manager port forwarding to reach a local database client. What is the problem?",[949,950,951,952],"Port forwarding sessions cannot be started by IAM principals, only by the root user","Port forwarding requires an inbound security group rule, which the team has closed","Session logging is not available for sessions that connect through port forwarding or SSH","Session logs for port forwarding are written only to CloudTrail and never to S3","Session Manager only tunnels those connections, and SSH encrypts everything inside the TLS channel between the CLI and the Session Manager endpoint, so there is nothing for the service to record. Interactive shell sessions can still stream to CloudWatch Logs or S3, which is where a transcript requirement has to be satisfied.",{"question":955,"type":931,"options":956,"correctAnswer":779,"explanation":958},"Instances in a private subnet with no internet route must support Session Manager. Which interface VPC endpoint is required for the secure data channel?",[779,809,829,957],"com.amazonaws.region.monitoring","The ssmmessages endpoint carries the data channel that SSM Agent uses to talk to the service, and it is the one Session Manager depends on. The logs endpoint is optional and only needed if you stream session output to CloudWatch Logs, and the ec2 endpoint matters for VSS-enabled snapshots, not for connecting.",{"question":960,"type":931,"options":961,"correctAnswer":965,"explanation":966},"ssm-cli get-diagnostics on a running instance returns Success for every connectivity check but Failed for AWS Credentials. What is the cause?",[962,963,964,965],"The SSM Agent version is older than the minimum supported release","The instance metadata service is unreachable from the agent","A proxy is configured incorrectly for the agent","No instance profile is attached, or the attached one lacks the Systems Manager permissions","The AWS Credentials check reports whether the agent can obtain credentials from the attached instance profile or service role and whether those credentials carry the required permissions. Connectivity passing rules out the network, and the metadata service and proxy each have their own separate rows in the same table.",{"question":968,"type":969,"options":970,"correctAnswers":975,"explanation":976},"Which two statements about Default Host Management Configuration are correct? (Choose 2.)","multiple",[971,972,973,974],"It must be turned on separately in each AWS Region you want it to cover","It supports both Instance Metadata Service Version 1 and Version 2","It requires instances to use Instance Metadata Service Version 2","It replaces the need for SSM Agent on the instance",[971,973],"The setting is per account and per Region, and it covers only instances running IMDSv2 with SSM Agent 3.2.582.0 or later. It replaces the instance profile, not the agent, which still has to be installed and running for any Systems Manager tool to work.",{"question":978,"type":931,"options":979,"correctAnswer":980,"explanation":982},"True or False: the execution history of a Run Command invocation is available in Systems Manager for up to 30 days.",[980,981],"True","False","Command history is retained for up to 30 days, which is why any output you need to keep beyond that has to be sent to an S3 bucket or a CloudWatch Logs log group when you run the command. CloudTrail keeps the record of the API call itself, but not the command output.",{"question":984,"type":931,"options":985,"correctAnswer":988,"explanation":990},"A team wants software inventory from every managed node refreshed as often as Systems Manager Inventory allows. What is the shortest collection interval they can configure?",[986,987,988,989],"Every 5 minutes","Every 15 minutes","Every 30 minutes","Every hour","Inventory collection intervals are specified in minutes, hours, or days, and the shortest supported interval is 30 minutes. Inventory is a periodic metadata snapshot rather than a live feed, so a scenario that demands second-by-second visibility is asking for CloudWatch, not Inventory.",{"title":7,"description":8},"courses/aws-certified-cloudops-engineer-associate/en/domains/03-deployment-provisioning-automation/05-operational-automation/01-systems-manager-fleet-management","8l5ONxVxA9PW5pFQgxh7PQ3RYyqaaHAuUa1jie1oxVI",{"locked":9,"reason":995,"meta":996,"item":3},"paywall",{"title":997,"description":998,"isFree":5,"estimatedMinutes":999,"difficulty":1000,"learningObjectives":1001},"Deploying Updates to Live Workloads","The AWS settings that produce each deployment strategy: Auto Scaling instance refresh percentages and rollback, the three CloudFormation update policies for an Auto Scaling group, ECS rolling and blue/green deployments with bake time and circuit breakers, Lambda weighted aliases, and managed RDS blue/green switchover.",32,"advanced",[1002,1003,1004,1005,1006,1007,1008,1009],"Predict how many instances an instance refresh replaces at a time from the minimum and maximum healthy percentages","Configure checkpoints, skip matching, and auto rollback on an instance refresh, and name the conditions that make rollback unavailable","Choose between the AutoScalingRollingUpdate, AutoScalingReplacingUpdate, and AutoScalingInstanceRefresh update policies","Calculate ECS rolling deployment task counts from minimumHealthyPercent and maximumPercent, and diagnose a deployment that cannot start or stop tasks","Explain how the ECS deployment circuit breaker counts failures and which deployment it rolls back to","Set up an ECS blue/green, linear, or canary deployment with bake time and lifecycle hooks","Shift Lambda traffic between versions with a weighted alias, and identify which version served a request","Describe an RDS blue/green switchover and what happens to the old environment",{"locked":9,"reason":995,"meta":1011,"item":3},{"title":1012,"description":1013,"isFree":5,"estimatedMinutes":999,"difficulty":1000,"learningObjectives":1014},"Patch and State Management","Keep a fleet patched and stop it drifting: Scan versus Install, patch baseline approval rules and their 7-day default, how patch groups pick a baseline, the compliance states and the reboot option that produces them, maintenance windows with duration and cutoff, patch policies, and State Manager associations.",[1015,1016,1017,1018,1019,1020,1021],"Distinguish a Scan operation from an Install operation and predict the compliance data each produces","Read a patch baseline's approval rules, including auto-approval delay, approve-until date, and the two rejected patches actions","Trace which patch baseline a node uses from its Patch Group tag, including the two cases that fall back to the default baseline","Map each patch compliance state to its cause, and explain how the RebootOption parameter produces InstalledPendingReboot","Configure a maintenance window with a duration, a cutoff, task priorities, and rate control, and predict what happens at cutoff","Choose between a patch policy, a maintenance window, and a State Manager association for a given patching or configuration requirement","Explain what a State Manager association enforces and why it applies itself to newly launched instances"]