Mastering Fleet Management: AWS Systems Manager & Auto Scaling

This study guide covers the essential tools and strategies for managing a fleet of AWS resources at scale, specifically focusing on AWS Systems Manager (SSM) and AWS Auto Scaling. These services form the backbone of Domain 5 (Incident and Event Response) for the AWS Certified DevOps Engineer Professional (DOP-C02) exam.

---

Learning Objectives

After studying this guide, you should be able to:

• Configure and deploy SSM Agents across hybrid environments.
• Implement State Manager and Patch Manager to maintain fleet compliance.
• Design automated remediation workflows using AWS Config and Systems Manager Automation.
• Configure Auto Scaling across diverse services including EC2, DynamoDB, and ECS.
• Orchestrate event-driven responses to fleet-wide incidents using EventBridge.

---

Key Terms & Glossary

• Managed Instance: Any EC2 instance or on-premises server/VM configured for Systems Manager via the SSM Agent.
• SSM Document: A JSON or YAML file that defines the actions Systems Manager performs on your managed instances.
• Hydration/Activation: The process of registering a non-AWS server (on-premises) with Systems Manager.
• Target Group: A logical grouping of instances for Auto Scaling or Load Balancing based on tags or specific IDs.
• Cooldown Period: A configurable setting in Auto Scaling that prevents the group from launching or terminating additional instances before the previous scaling activity takes effect.

---

The "Big Idea"

Fleet management is the shift from managing "Pets" (individual servers with unique names) to "Cattle" (interchangeable resources defined by code). The goal is to achieve Zero-Touch Operations: where patches, configurations, and scaling happen automatically based on telemetry, ensuring the environment is always in the "Desired State" without manual SSH/RDP access.

---

Formula / Concept Box

---

Hierarchical Outline

• I. AWS Systems Manager (SSM) Foundation
  • SSM Agent: Must be installed/running; enables communication with the SSM service.
  • Inventory: Automates metadata collection (OS versions, installed apps, network config).
  • Session Manager: Secure, auditable shell access without SSH keys or Bastion hosts.
• II. Fleet Configuration & Compliance
  • State Manager: Maintains a defined configuration (e.g., "Telnet must be disabled").
  • Patch Manager: Scans and installs missing patches based on user-defined baselines.
  • Distributor: Packages and distributes software (e.g., security agents, custom tools).
• III. Advanced Auto Scaling
  • EC2 Auto Scaling: Horizontal scaling using Launch Templates and scaling policies.
  • DynamoDB Scaling: Adjusts Read/Write Capacity Units (RCUs/WCUs) based on usage.
  • ECS/EKS Scaling: Capacity providers and Cluster Autoscalers for containerized workloads.
  • RDS Storage Auto Scaling: Automatically increases storage size when free space is low.
• IV. Event-Driven Remediation
  • EventBridge: Captures state changes (e.g., "Instance Terminated") to trigger Lambda or SSM Automation.
  • AWS Config Rules: Detects non-compliance (e.g., "Unencrypted S3 Bucket") and triggers remediation.

---

Visual Anchors

Systems Manager Interaction Flow

Scaling Life Cycle

---

Definition-Example Pairs

• Remediation: The act of correcting a system that has deviated from its intended state.
  • Example: An AWS Config rule detects an open Security Group (Port 22 to 0.0.0.0/0) and automatically triggers an SSM Document to close the port.
• Maintenance Window: A defined schedule for potentially disruptive tasks.
  • Example: Setting a window for Sunday at 2 AM to apply OS kernel updates to 100 EC2 instances without impacting peak business hours.
• Predictive Scaling: Using machine learning to forecast traffic patterns and scale in advance.
  • Example: An e-commerce site scaling up EC2 capacity two hours before a scheduled "Flash Sale" starts based on last year's traffic data.

---

Worked Examples

Scenario: Fleet-wide Vulnerability Patching

Problem: A critical security vulnerability is discovered in openssl. You need to patch 450 EC2 instances across 3 Regions immediately without logging into them individually.

Solution Step-by-Step:

1. Define a Patch Baseline: Create a baseline in Systems Manager Patch Manager that selects all security updates with a "Critical" severity level.
2. Group Instances: Ensure all instances have a tag like Environment: Production. Create a Resource Group based on this tag.
3. Configure Maintenance Window: Create a window with a 2-hour duration. Register the Resource Group as the target.
4. Register Task: Add the AWS-RunPatchBaseline task to the window with the action set to Install.
5. Execution: SSM Agent on each instance pulls the instructions, installs the patch, and reboots if necessary.
6. Verification: Check the Compliance dashboard in SSM to identify any instances where the patch failed.

---

Checkpoint Questions

1. What is the minimum requirement for an EC2 instance to be managed by Systems Manager?
2. How does Session Manager improve security compared to traditional SSH?
3. Which AWS service would you use to automatically increase the number of DynamoDB RCUs during a traffic spike?
4. What is the difference between SSM State Manager and SSM Patch Manager?

▶Click to see answers

1. The SSM Agent must be installed and running, and the instance must have an IAM role with AmazonSSMManagedInstanceCore permissions.
2. Session Manager requires no inbound ports (like 22) to be open, doesn't require SSH keys, and provides full logging of commands via CloudWatch or S3.
3. AWS Auto Scaling (specifically DynamoDB Auto Scaling).
4. State Manager handles general configuration (e.g., scripts, software installs) to prevent drift; Patch Manager is specifically optimized for OS-level security updates and patches.

---

Muddy Points & Cross-Refs

• SSM vs. AWS Config: People often confuse these. AWS Config is for auditing and recording resource configurations. SSM is for taking action and managing the internal state of the OS.
• Scaling Types: Remember that Step Scaling is more responsive than Simple Scaling because it allows for multiple steps (e.g., "If CPU > 70 add 1, if CPU > 90 add 3").
• Hybrid Management: You can manage on-premises servers by creating an Activation Code and Activation ID, then installing the SSM Agent on the local server.

---

Comparison Tables

Auto Scaling Capabilities

[!IMPORTANT] For the DOP-C02 exam, focus on how EventBridge connects these services. For instance, an EventBridge rule can detect a "non-compliant" status from AWS Config and trigger an SSM Automation document to fix the issue automatically.