This session will discuss how government organizations can employ AWS Systems Manager to gain insights into their environments and simplify operational tasks such as patching the OS or loading applications, for both on-premises instances as well as those within AWS. We will also look into how SSM can simplify governance and compliance from Central IT perspective by demonstrating how Systems Manager can automate credential rotation on servers in order to maintain compliance for various regulatory or compliance workloads.

1. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Sohaib Tahir
Solutions Architect
Brian Tracy
Sr. Solutions Architect
Simplify Operations, Compliance and
Governance using AWS Systems
Manager

2. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
What is AWS Systems Manager?
• Formerly known as "Amazon EC2
Systems Manager" and "Amazon Simple
Systems Manager” (SSM).
• Collection of capabilities for configuring
and managing your Amazon EC2
instances, on-premises servers and virtual
machines, and other AWS resources at
scale.

3. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS Systems Manager helps you shorten the mean
time to detect problems, maintain security and
compliance.

4. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS Systems Manager – Components
State Manager Inventory Maintenance Window
Patch Manager Automation Parameter Store Documents
Run Command

5. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS Systems Manager Features
Service Description
Run Command Safely automate common administrative tasks on your instances at scale without SSH
or RDP access
Inventory Collect and query software inventory
Patch Manager Select and deploy OS patches automatically
State Manager Define and maintain consistent OS configurations such as firewall settings and anti-
malware definitions to comply with policies
Maintenance
Windows
Create recurring time windows to run administrative or any disruptive tasks
Automation Create streamlined workflows to update Amazon Machine Images (AMI) for example
Parameter Store Centralized location to store, control access, and easily reference configuration data
and secrets
Insights Dashboard Automatically aggregates and displays operational data for each resource group
through a dashboard
Resource Groups Resource groups are a way to create a logical group of resources e.g. prod
environment

6. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Let’s dive deep into some of these
features

7. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
AWS Resource Groups – Group Resources
Define the building blocks of your application
• AWS Resource Groups v2 launched last year
• Search AWS resources based on tags using a
simple query
• Save a search as a heterogeneous group of
(dynamic) resources

8. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Built-In (Cross-Service) Insights
Gain operational insights
• View recent API calls through AWS CloudTrail
• View recent configuration changes through AWS Config
• View recent events through AWS Personal Health Dashboard
• View recommendations through AWS Trusted Advisor

9. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Build your own operational dashboards
Set up CloudWatch dashboards
• Build your and customize your own ops-
dashboards
• Leverage your existing CloudWatch
dashboards
• Leverage your existing CloudWatch
metrics
• Visualize your application’s metrics

10. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Track Software Inventory and Compliance

11. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Resource Data Sync

12. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Reactive Action – Mitigate Ongoing Issues
• Reduce the mean time to resolution of operational issues
• React from within the same console experience
• Interact with resource groups directly

13. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Automation
Use AWS vetted documents or create your own
 Use community-generated documents
 Automate repeatable manual tasks
 Open Source Github document repo
Trigger documents based on changes to resources
 CloudWatch Events or Maintenance Windows as a trigger
 Execute on step at a time
 Delegated execution to authorized users only
Perform bulk operations with built-in safeties
 Velocity controls and error thresholds
 Run documents on resource groups, tags, or Instance IDs

14. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Proactive Action – Day-to-Day Operations
• Execute commands on any instance or on-premises host
• Manage your configuration to mitigate drifts
• Set up maintenance windows for common operations
• Manage software patches across your fleets
• Store your secrets and configuration data

15. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Patch Manager
• Select and deploy OS and software patches.
• Patch Baselines include rules for auto-
approval of selected patches
• List of approved or rejected patches

16. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
How it works?

17. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
State Manager
• Define and maintain consistent OS configurations.
• Specify a configuration policy for your servers.
• Automatically applies your configurations
• Monitor configuration status of a large set of servers.

18. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Here are few use-cases

19. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Running Ansible Playbooks through Run Command and
State Manager

20. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Overview
• Config Management using Ansible on your EC2 and Hybrid environments
• Execute AWS-RunAnsiblePlaybook Document across various Linux distributions
running SSM Agent to install an Apache server.
• Configure State Manager to enforce configuration and remediate drifts.

21. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Let’s see how it works through a demo

22. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Demo Video

23. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Summary
• Native integration with tools like Ansible.
• Easy to setup and scale.
• Velocity and error control.
• Multiple accounts and Hybrid architecture
• There is no additional charge for using Systems Manager

24. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Central IT Governance Model

25. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Overview
• Central IT agency account
• Agency accounts or on-premises
resources
• Automatically apply patches or maintain
consistent configurations based on tags
and custom schedules across all
environments
• Execute remote commands.

26. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Password Rotation forWindows on Amazon EC2 Made
Easy with EC2Rescue

27. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Overview
• EC2Rescue is Run Command document called AWSSupport-
RunEC2RescueForWindowsTool
• Option to reset the local administrator password allows to specify which
KMS key to use to encrypt the randomly generated password
• No downtime EC2 Windows instances already enabled with Systems
Manager for password resets
• Configure a Systems Manager Maintenance Window to run
AWSSupport-RunEC2RescueForWindowsTool on a schedule

28. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Let’s see it in action through a demo

29. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Demo Video

30. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Wrapping Automated Password Rotation up
• Total time to setup this automation?
~ 1 hour
• Estimated costs for solution?
- $0 There is no additional charge for Systems Manager
- (2) KMS keys $1ea/mo
- KMS API requests $0.03 per 10,000
(after 20,000 API requests as part of Free Tier)

31. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
What we covered today
• Overview of Systems Manager service
• How Systems Manager can simplify operations, compliance
and governance
• Efficiencies and ease-of-use through automation
• Fleetwide visibility and management

32. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Additional Info
• Many other potential use cases not mentioned today
• System inventory
• Patch management
• Management of hybrid environments
• Install/remove software
• Systems Manager is OpenSource and available on GitHub
• https://github.com/awslabs/aws-systems-manager

33. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Questions?

34. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Solutions Architect, AWS
sohaibt@amazon.com
Sohaib Tahir
Solutions Architect Manager, AWS
trabrian@amazon.com
Brian Tracy

35. © 2018, Amazon Web Services, Inc. or its affiliates. All rights reserved.
Thank You and Build On!!
Please don’t forget to complete your surveys.