AWS Systems Manager: Fleet Operations

Systems Manager centralizes day-to-day node and resource operations

AWS Systems Manager is a collection of operational capabilities for viewing, managing and operating nodes at scale across AWS and supported hybrid or multicloud environments. A managed node is a machine that has been configured for Systems Manager management. For EC2 and non-EC2 nodes, successful management depends on the appropriate SSM Agent or supported agentless capability, IAM permissions and network access to the required Systems Manager endpoints according to the feature being used.

The service is best understood as a toolbox rather than one monolithic workflow. Session Manager provides controlled interactive access; Run Command executes remote commands; State Manager maintains a desired configuration through associations; Patch Manager handles patching workflows; Maintenance Windows provide scheduled operational windows; and Parameter Store stores named configuration values. Choosing the correct tool is usually more important than memorizing the Systems Manager brand name.

Session Manager and Run Command reduce direct server administration exposure

Session Manager provides browser- or CLI-based access to managed nodes without requiring administrators to open inbound SSH/RDP management ports, maintain bastion hosts, or distribute SSH keys for the standard session pattern. Access is controlled through IAM and the Systems Manager control plane. Session preferences can direct supported session logs to CloudWatch Logs or Amazon S3, although AWS documents important exceptions: the content of SSH and port-forwarding sessions is encrypted inside the tunnel and is not available for Session Manager session logging.

Run Command is designed for noninteractive, one-time administrative actions at scale. It executes an SSM Command document against selected managed nodes and can target fleets by tags, resource groups or node identifiers. This makes it useful for installing software, collecting diagnostics or applying a one-off configuration change without logging into every server. IAM policy, document selection, targets and failure thresholds should all be treated as safety controls because a broad command can affect a large fleet quickly.

Desired state, patching and parameters cover different operational concerns

State Manager uses associations to keep nodes or supported resources in a defined configuration over time. That differs from Run Command's one-time intent. Maintenance Windows coordinate when operational tasks run, while Patch Manager applies patch policies or baselines to managed nodes. These mechanisms can be combined—for example, an organization can define patch policy centrally while limiting disruptive work to an approved maintenance period.

Parameter Store is Systems Manager's hierarchical configuration store for named values. Parameters can hold plain strings, string lists or SecureString values; SecureString integrates with AWS KMS for encryption. Parameter Store is useful for runtime configuration such as AMI IDs, endpoints or application settings and can reduce hard-coded environment-specific values. It should not be confused with a node-management action: storing a parameter does nothing to a server until an application, automation or deployment consumes that value.

• Session Manager is interactive access; Run Command is remote command execution; State Manager is desired-state configuration.
• Patch Manager and Maintenance Windows address patch selection/execution and scheduling concerns respectively.
• Parameter Store separates configuration values from code and supports KMS-protected SecureString parameters.