AWS systems-manager documentation change
Summary
Updated State Manager association frequency to include new instance launches and added cost warning
Security assessment
Changes focus on operational frequency (triggering on instance launch) and cost implications of Automation executions. No security vulnerabilities or explicit security features addressed.
Diff
diff --git a/systems-manager/latest/userguide/systems-manager-setting-up-organizations.md b/systems-manager/latest/userguide/systems-manager-setting-up-organizations.md index 73a656bff..46826fe56 100644 --- a//systems-manager/latest/userguide/systems-manager-setting-up-organizations.md +++ b//systems-manager/latest/userguide/systems-manager-setting-up-organizations.md @@ -60,3 +60 @@ State Manager associations - * `SystemAssociationForManagingInstances` – Runs every 30 days and ensures the `AmazonSSMManagedInstanceCore ` policy is applied to instance profiles attached to your nodes. If there's not at instance profile attached to the node, Systems Manager creates an instance profile with the `AmazonSSMManagedInstanceCore ` policy and attaches it to the node. If your nodes already have an instance profile attached, the policy is appended to the instance profile. If the instance profile already contains the necessary permissions, no changes are made. - -###### Note + * `SystemAssociationForManagingInstances` – Runs at minimum every 30 days and each time a new instance is launched. Ensures the `AmazonSSMManagedInstanceCore ` policy is applied to instance profiles attached to your nodes. If there's not at instance profile attached to the node, Systems Manager creates an instance profile with the `AmazonSSMManagedInstanceCore ` policy and attaches it to the node. If your nodes already have an instance profile attached, the policy is appended to the instance profile. If the instance profile already contains the necessary permissions, no changes are made. @@ -65,0 +64,8 @@ If a node was launched by AWS CloudFormation, the changes Systems Manager makes +###### Important + +Each time a new instance is launched, this `SystemAssociationForManagingInstances` association runs. If your organization routinely launches a high number of instances, this can lead to elevated costs being incurred if you surpass Automation's free tier maximum for Automation executions. + +For information about Automation pricing and free tier maximums, see [Pricing for Automation](https://aws.amazon.com/systems-manager/pricing/#Automation). + +For information about targeting frequency for State Manager associations, see [About target updates with Automation runbooks](./state-manager-about.html#runbook-target-updates). +