Mastering Automated System Inventory, Configuration, and Patching

This guide explores the tools and strategies for maintaining a secure, compliant, and up-to-date server fleet using AWS Systems Manager (SSM) and AWS Config.

Learning Objectives

After studying this module, you should be able to:

• Differentiate between SSM Patch Manager and State Manager use cases.
• Configure Inventory collection to track software metadata across hybrid environments.
• Implement automated remediation for non-compliant resources using AWS Config.
• Design maintenance windows to minimize operational impact during patching.
• Manage secrets and configuration data securely using SSM Parameter Store.

Key Terms & Glossary

• SSM Agent: Software installed on EC2 instances or on-premises servers that allows them to communicate with the Systems Manager service.
• Managed Node: Any machine (EC2 or on-premises) configured for use with Systems Manager.
• Patch Baseline: A set of rules that defines which patches are approved for installation on managed nodes.
• Maintenance Window: A defined schedule for when disruptive administrative tasks (like patching) can occur.
• State Manager: A service that automates the process of keeping managed nodes in a defined state (e.g., ensuring specific software is always installed).

The "Big Idea"

In modern DevOps, managing a fleet of one hundred or ten thousand servers must be identical in effort. Automated Fleet Management moves away from manual "SSH-and-fix" mentalities toward a Desired State model. By using Systems Manager and AWS Config, you treat your infrastructure as a living system that automatically reports its status, fixes its own drift, and schedules its own maintenance.

Formula / Concept Box

[!IMPORTANT] For security, always store sensitive data in Parameter Store as a SecureString to trigger automatic KMS encryption.

Hierarchical Outline

1. AWS Systems Manager (SSM) Suite
   • Inventory Management: Collects metadata (OS, apps, IP) from nodes on a schedule.
   • Run Command: Executes scripts/commands across targets without SSH keys.
   • Session Manager: Secure, auditable browser-based shell access.
2. Configuration & State Management
   • State Manager: Enforces "Desired State" (e.g., "Windows Firewall must be ON").
   • Distributor: Packages and distributes software (e.g., CloudWatch Agent).
3. Patching & Maintenance
   • Patch Manager: Scans/installs missing patches based on Patch Baselines.
   • Maintenance Windows: Schedules tasks to prevent downtime during peak hours.
4. Compliance & Auditing
   • AWS Config: Tracks configuration history and remediates non-compliant resources.
   • Amazon Inspector: Automated security assessments for CVEs and network reachability.

Visual Anchors

The Patching Lifecycle

Hybrid Management Architecture

Definition-Example Pairs

• Automation Document: A playbook used to automate common IT tasks.
  • Example: An Automation Document that stops an EC2 instance, creates an AMI, and restarts the instance every Sunday.
• Resource Group: A collection of resources in one region that match a specific tag query.
  • Example: Grouping all instances with the tag Project: WebApp to perform a bulk update via Run Command.
• CVE (Common Vulnerabilities and Exposures): A list of publicly disclosed computer security flaws.
  • Example: Amazon Inspector identifies a specific CVE for an outdated version of OpenSSL on your web server.

Worked Examples

Example 1: Creating a Custom Patch Baseline

1. Define Rules: Set a rule to auto-approve all "Security" patches for Amazon Linux 2 with a 7-day delay.
2. Identify Exceptions: Manually reject a specific kernel update known to break your proprietary application.
3. Targeting: Use Tags (Environment: Production) to ensure this baseline only applies to prod servers.

Example 2: Remediation with AWS Config

1. Rule: Create a Config rule restricted-common-ports to check if Security Groups allow port 22 (SSH) from 0.0.0.0/0.
2. Non-Compliance: Config detects a developer opened port 22 for testing.
3. Remediation: Trigger an SSM Automation Document to remove the rule from the Security Group automatically.

Checkpoint Questions

1. What is the difference between an instance ID starting with i- and one starting with mi-?
2. Which SSM feature would you use to store a database password so it is encrypted at rest?
3. True or False: Session Manager requires you to open port 22 in your Security Group.
4. How does a "Policy Document" differ from a "Command Document" in SSM?

▶Click to see answers

1. i- is for EC2 instances; mi- is for managed instances (on-premises/hybrid).
2. SSM Parameter Store using the SecureString data type.
3. False. Session Manager communicates over a secure tunnel via the SSM Agent; no inbound ports are required.
4. Policy documents enforce a state via State Manager; Command documents execute one-time actions via Run Command.

Muddy Points & Cross-Refs

• Run Command vs. State Manager: Use Run Command for ad-hoc tasks (e.g., "Restart this service now"). Use State Manager for persistence (e.g., "Ensure this service is always running every 30 minutes").
• Parameter Store vs. Secrets Manager: Both store data. Use Parameter Store for general configuration (it's often free/cheaper). Use Secrets Manager for secrets requiring automatic rotation (e.g., RDS passwords).

Comparison Tables

SSM Patch Manager vs. SSM State Manager

AWS Config vs. Amazon Inspector