Fleet Management with AWS Systems Manager - Automating Patching, Inventory, and Run Command
Patching is automated with Patch Manager, and remote operations are streamlined with Run Command. SSH-free shell access through Session Manager is also introduced.
Key Features of Systems Manager
Systems Manager is a service that unifies the operational management of EC2 instances and on-premises servers. It manages instances with the SSM Agent installed as managed nodes and provides features such as patching, command execution, session connections, inventory collection, and parameter management. The SSM Agent is preinstalled on Amazon Linux 2, Amazon Linux 2023, Ubuntu, and Windows Server AMIs. Using Systems Manager itself is free, and only EC2 instance charges apply.
Patch Management with Patch Manager
Patch Manager automates patching of the OS and applications. A patch baseline defines the classifications (security, bug fixes, enhancements) and severities (Critical, Important, Medium, Low) of the patches to apply, and approval rules (such as automatic approval 7 days after release) are configured. A maintenance window defines the patching schedule (such as every Sunday at 2:00 AM), and patching runs automatically outside business hours. The patch compliance dashboard lets you view the patching status of the entire fleet in a list and identify instances that have not been patched. You can also configure automatic snapshots before patching, which lets you roll back if a problem occurs after patching.
Run Command and Session Manager
Run Command is a feature that remotely runs SSM documents (predefined command sets) on managed nodes. AWS-RunShellScript runs shell commands, and AWS-RunPowerShellScript runs PowerShell commands. Targets can be specified by tags, resource groups, or manual selection, and commands can be sent to thousands of instances simultaneously. Session Manager provides browser-based shell access, removing the need to manage SSH keys or open SSH ports in security groups. Session logs are automatically recorded to S3 or CloudWatch Logs, so you can audit who ran which command and when.
Systems Manager Pricing
The main features of Systems Manager (Patch Manager, Run Command, Session Manager, Inventory) can be used free of charge. No additional charges apply for installing and running the SSM Agent either. Costs arise only for advanced features such as Advanced parameters (Parameter Store parameters over 8 KB, about $0.05/parameter per month) (as of August 2026). OpsCenter OpsItems (about $2.97 per 1,000 items) and Change Manager change requests (about $0.326 per 1,000 requests) are also among these advanced features (as of August 2026). There is no reason not to enable the free basic features in every environment that runs EC2.
Automation with State Manager and Automation
Whereas Run Command executes one-off commands, State Manager is a feature that keeps nodes in a "desired state". If you define the agent configuration and the installation state of software in advance, it periodically returns nodes to the desired state even when the configuration changes. Automation automatically runs AMI creation, instance restarts, and operational tasks spanning multiple steps according to procedure documents called runbooks. Because approval steps can be inserted, you can mechanize routine tasks while building human checks into operations in production environments.
Inventory and Compliance
Inventory collects information such as installed software, OS configuration, network settings, and running services from managed nodes. The collected data is aggregated in S3 and queried with Athena or visualized with Amazon Quick Sight (formerly Amazon QuickSight), which lets you understand the configuration of the entire fleet across the board. The compliance feature aggregates patching status and State Manager association results and lists the nodes that do not meet the criteria. This lets you continuously track which servers deviate from the requirements and decide remediation priorities.
Managing Hybrid and On-Premises Environments
Systems Manager can centrally manage not only EC2 on AWS but also servers on premises and in other environments. If you install the SSM Agent using the registration information issued by a hybrid activation, those servers can also be handled as managed nodes. Because features such as patching, command execution, and session connections can be used with the same operating model in the cloud and on premises, you can lower the operational load during migration periods and in mixed environments. Being able to manage servers that span multiple sites from a single console is a major advantage.
Adoption Best Practices and Security
With Session Manager, you can eliminate SSH ports and bastion servers and connect to shells securely while keeping all inbound ports closed. Connection permissions are controlled with IAM, and session logs are recorded to CloudWatch Logs or S3 to audit operations. Instances are given an instance profile with least privilege that allows only the necessary APIs. For nodes in private subnets that are not exposed to the internet, a configuration in which they reach Systems Manager through VPC endpoints is secure. Combining these results in an operations foundation with a minimized attack surface.
Summary
Systems Manager is a service that unifies and automates the operational management of EC2 fleets. Patch Manager automates patching, Run Command streamlines remote operations, and Session Manager provides secure shell access. It can be used free of charge, and its adoption is recommended in every environment that runs EC2.
References (Official AWS Resources)
The primary sources for this page are the official AWS website and documentation. Check the official pages below for the latest specifications and pricing.
- AWS Systems Manager official page
- Amazon EC2 official page
- Amazon CloudWatch official page
- AWS Documentation (official)
If this page and the official documentation disagree, treat the official documentation as authoritative.