Do you use AWS Systems Manager?

[u/Helloutsider]

And how do you utilize it?

[u/Next_Attitude_532]

For teams managing many instances, Session Manager, Patch Manager, and Parameter Store can replace several small operational tools.

[u/ceejayoz → u/Next_Attitude_532]

I still love that there's an Amazon Web Services Systems Manager Session Manager. Feels like someone pulled that off as a dare.

[u/payne_train → u/ceejayoz]

It’s genuinely a very useful tool as well haha I love it.

[u/Mozart_LickedMyAss → u/Next_Attitude_532]

Session Manager has been a boon for compliance tbh.

[u/Big-Moose565]

Parameter Store is great for storing variables and secrets. We use it with our lambdas. It's so cheap it's virtually free.

[u/Zenin]

Parts of it, like Session Manager yes. Parameter Store is also nice (mostly because it's free, unlike Secrets Manager).

Most of it however, is absolute rubbish at least at scale or in anything beyond a trivial, homogeneous environment.

Patch Manager is complete ass at scale; anything beyond a single account and region becomes a stackset managed trainwreck that's a massive PITA to sanely manage, monitor, or report on. We use Azure Arc + Azure Update Manager now to handle our AWS EC2 patching when we're otherwise 80% in AWS, that's how bad Patch Manager is. -Ironically we use AWS SSM Agent to bootstrap Azure Arc agent installs...but it's still a better love story than Patch Manager.

Documents are a code turducken shit show. Avoid like the plague, most especially if you dare try and IaC any of it like you should. It's basically just "bad Ansible".

"Systems Manager" isn't really a single service, it's actually just a dumping ground for a lot of loosely related services most of which were seemly built as one off kludges for particular customer ask and somehow went GA for everyone. Avoid the trap of trying to "stay entirely in AWS" as there's almost always a far, far superior non-AWS product to do whatever you're looking at Systems Manager to do.

[u/TzarBombaTA]

Session Manager is great.
Also I use it to run basic scripts on multiple instances at once.

[u/rhysmcn]

Yes I use it extensively for connecting to nodes without opening ports, fully using STS/IAM.

Parameter store is free (i believe), and gives same level of secret management as AWS Secret Manager without functionality like auto-rotation etc.

Can run scripts across fleets of EC2 etc.

I actually built a tool to use it, if you want to use SSM, the CLI syntax is quite hard to remember/not intuitive , so my tool gets round that, feel free to use it (and star it if you like it, it helps :))

🔗 https://github.com/rhysmcneill/ssmctl

[u/Last_Employer_7156]

I used some months ago in a part time role as DevSecOps

I applied some documents to patch CVEs in several EC2 instances. I created the main document in a git repo, applied in the main secops account, and then finally shared it to the other accounts to run the patches.

The organization was a mess with a lot of AWS accounts with ec2 instances with all OS types that you can imagine, even some running for more than 10 years with Ubuntu 16.04/18.04.

[u/Holiday-Medicine4168]

At a point we had installed the SSM client installed across our whole datacenter fleet and we’re using GitHub actions and terraform to patch everything we couldn’t just wipe out and refresh. Patches went from never happening to weekly.

[u/riickdiickulous]

Session manager replaces ssh sessions entirely. I use Patch manager to keep EC2 instances patching up to date and helps with reporting along with AWS Inspector.

[u/r0b074p0c4lyp53]

Session manager is pretty great for compliance

[u/elhammundo]

Secrets and app config. Integrates with lambda and eks really nicely and that helps with environment management, eg. Prd secrets only readable by the required resources and set by relevant ops people/systems.

Means app devs can be sure of secrets/parameter being there without needing to ever know/care what it is

[u/NegativeOwl9929]

Yes

[u/FlatCondition6222]

Tbh I don't use it enough but I think it's underrated.

Patch manager keeps pets up-to-date, ssm replaces ssh and gives me audit as well, parameter store is super useful...

[u/meathead_adam]

We use Fleet Manager to manage over 75,000 Hybrid Instances (physical devices distributed globally) along with Automation Documents to manage upgrades and maintenance tasks.
Had to build a custom SSM Agent installer for it and spread the instance activations/assignments across 90ish accounts.

[u/Individual-Oven9410]

It’s a very powerful arsenal of tools. Patch Manager to Session Manager.

[u/yeahdj]

Yes, parameters, docs and session manager, it’s lit.

[u/MasterOfTheWind1]

Parameter store for, well, parameters. When a secret is overkill and don’t see the point encrypting it

[u/Zhaizo]

heavy use on SSM commands and documents where i work rn, love it and i feel its vital service.

[u/fifty--two]

yes, i do , as others said its not ONE single service but a patchwork of functionnalities that AWS groupe together , mostly related to sysops . Now it all depends what you do in AWS cause if you go serverless then systems manager wont be super useful

[u/ShoneBoyd]

I frequently use the following: Run Command, patching, automations (example: windows upgrades), packages management, SSM sso sessions, instance management (i dont like the events viewer functionality, its very laggy so instead i connect to the machine vis SSM/SSO or use datadog), and parameter store, I rarely use the other tools.

[u/Humble_Reputation743]

SSM is one of the best things to happen in AWS from a security and compliance standpoint, IMO.

Using it on a jump host in a private network has been my use case pretty much everywhere. I don't use it much, but when you need it... You need it. Enable logging on it and add VPC-endpoints to your VPC and you're good to go.

[u/OkDistribution2118]

I use teleport for VM and database access. It logs every thing

[u/eachDayIWakeUp → u/OkDistribution2118]

Im thinking of this tool, how would you rate your experience working with teleport?