AWS systems-manager documentation change
Summary
Added detailed explanation of unmanaged instance status and troubleshooting guidance
Security assessment
Changes focus on operational clarification and status reporting rather than addressing security vulnerabilities or documenting security features
Diff
diff --git a/systems-manager/latest/userguide/review-node-insights.md index be4cfc752..0f28ad77a 100644 --- a/systems-manager/latest/userguide/review-node-insights.md +++ b/systems-manager/latest/userguide/review-node-insights.md @@ -29,0 +30,23 @@ Indicates how many EC2 instances in your organization or account aren't currentl +###### What is an unmanaged instance? + +When you stop a managed EC2 instance, it is reported as "Unmanaged" in the Systems Manager console. This is expected behavior because SSM Agent doesn't have an active connection to the service. + +###### Note + +This is different from how AWS Config defines an instance as unmanaged. If an instance is currently stopped, AWS Config reports what the status of the instance was the last time a "heartbeat" connection was made between SSM Agent on the instance and the Systems Manager service. + +When the instance restarts, it automatically reconnects to the Systems Manager service, and its status in the unified console is restored to "Managed" within five minutes. No manual intervention is required, and all Systems Manager configurations for the instance are preserved during the Stop/Start cycle. + +However, if the instance is still not reported as "Managed" several minutes after starting, the instance is likely not properly configured for Systems Manager management. In this case, we recommend running a diagnosis to identify why the instance remains in an unmanaged state. For more information, see [Diagnosing and remediating unmanaged Amazon EC2 instances in Systems Manager](./remediating-unmanaged-instances.html). + +If the diagnostic scan is not able to determine the issue, refer to the following topics to verify that the requirements for SSM Agent, AWS Identity and Access Management (IAM) roles, and Systems Manager prerequisites have all been met: + + * [Troubleshooting SSM Agent](./troubleshooting-ssm-agent.html) + + * [Configure instance permissions required for Systems Manager](./setup-instance-permissions.html) + + * [Troubleshooting managed node availability](./fleet-manager-troubleshooting-managed-nodes.html) + + + +