AWS systems-manager documentation change
Summary
Restructured documentation with new sections, added details about Default Host Management Configuration (DHMC), inventory metadata collection, and automatic SSM Agent updates during setup
Security assessment
The change introduces documentation for security-enhancing features: DHMC automates IAM role configuration to ensure EC2 instances have required permissions (reducing misconfiguration risks), while automatic SSM Agent updates ensure nodes run the latest secure versions. These are proactive security controls but do not address a specific disclosed vulnerability.
Diff
diff --git a/systems-manager/latest/userguide/systems-manager-setting-up-organizations.md b/systems-manager/latest/userguide/systems-manager-setting-up-organizations.md index 46826fe56..63869258b 100644 --- a//systems-manager/latest/userguide/systems-manager-setting-up-organizations.md +++ b//systems-manager/latest/userguide/systems-manager-setting-up-organizations.md @@ -4,0 +5,2 @@ +PrerequisitesUnified console resourcesSet up the unified console + @@ -7 +9,5 @@ -The setup process for the Systems Manager unified console experience is completed from the AWS Management Console with just a few clicks. To set up Systems Manager for an AWS Organizations organization, you must have access to the management account for your organization and another account in your organization to use as a delegated administrator. Access to the management account is only required to enable or disable Systems Manager. To manage your nodes, you'll use the delegated administrator account. When managing nodes across an organization, Systems Manager uses various dependent services to set up and enhance the functionality of the unified console. As a result, Systems Manager must enable trusted access and register a delegated administrator account for the following services: +The setup process for the Systems Manager unified console experience is completed from the AWS Management Console with just a few clicks. To set up Systems Manager for an AWS Organizations organization, you must have access to the management account for your organization and another account in your organization to use as a delegated administrator. Access to the management account is only required to enable or disable Systems Manager. To manage your nodes, you'll use the delegated administrator account. + +## Prerequisites + +When managing nodes across an organization, Systems Manager uses various dependent services to set up and enhance the functionality of the unified console. As a result, Systems Manager must enable trusted access and register a delegated administrator account for the following services: @@ -20,3 +26 @@ The setup process for the Systems Manager unified console experience is complete -Before you begin setting up Systems Manager for an organization, make sure you're not already over the quota for delegated administrators for any of these dependent services. Otherwise, you won't be able to register the delegated administrator accounts necessary to enable Systems Manager. When you enable Systems Manager for an organization, every account in your organization is included. At this time, there is no provision for excluding accounts from the setting up process. When you enable Systems Manager, you can choose the AWS Regions you want to include. Only Regions that currently support the unified console experience for Systems Manager can be selected. To learn more about the Regions where the console experience is available, see [Supported AWS Regions](https://docs.aws.amazon.com/systems-manager/latest/userguide/what-is-systems-manager.html#regions). - -###### Note +Before you begin, make sure you're not already over the quota for delegated administrators for any of these dependent services. Otherwise, you won't be able to register the delegated administrator accounts necessary to enable Systems Manager. When you enable Systems Manager for an organization, every account in your organization is included. At this time, there is no provision for excluding accounts from the setting up process. When you enable Systems Manager, you can choose the AWS Regions you want to include. Only Regions that currently support the Systems Manager unified console can be selected. To learn more about the Regions where the console experience is available, see [Supported AWS Regions](https://docs.aws.amazon.com/systems-manager/latest/userguide/what-is-systems-manager.html#regions). @@ -24 +28 @@ Before you begin setting up Systems Manager for an organization, make sure you'r -If you've created an aggregator index for Resource Explorer in a Region different than your home Region, Systems Manager demotes the current index. Then, Systems Manager promotes the local index in your home Region as the new aggregator index. During this time, only nodes for your home Region are displayed. This process can take up to 24 hours to complete. +## Unified console resources @@ -26 +30 @@ If you've created an aggregator index for Resource Explorer in a Region differen -The setup process for the Systems Manager console experience completes many prerequisite tasks for you. This includes creating and attaching instance profiles with the required IAM permissions to your nodes and more. The following is a detailed list of the resources created by Systems Manager for the unified console. +The setup process for the Systems Manager unified console completes many prerequisite tasks for you. Depending on the features you choose to configure, this includes enabling Default Host Management Configuration to provide the required IAM permissions to your nodes and more. The following is a detailed list of the resources created by Systems Manager for the unified console. Depending on the features you choose to configure, some resources might not be created. @@ -28 +32 @@ The setup process for the Systems Manager console experience completes many prer -Resource Explorer managed views +AWS Resource Explorer managed views @@ -31,0 +36,4 @@ Resource Explorer managed views +###### Note + +If you've created an aggregator index for Resource Explorer in a Region different than your home Region, Systems Manager demotes the current index. Then, Systems Manager promotes the local index in your home Region as the new aggregator index. During this time, only nodes for your home Region are displayed. This process can take up to 24 hours to complete. + @@ -60,12 +67,0 @@ State Manager associations - * `SystemAssociationForManagingInstances` – Runs at minimum every 30 days and each time a new instance is launched. Ensures the `AmazonSSMManagedInstanceCore ` policy is applied to instance profiles attached to your nodes. If there's not at instance profile attached to the node, Systems Manager creates an instance profile with the `AmazonSSMManagedInstanceCore ` policy and attaches it to the node. If your nodes already have an instance profile attached, the policy is appended to the instance profile. If the instance profile already contains the necessary permissions, no changes are made. - -If a node was launched by AWS CloudFormation, the changes Systems Manager makes to the instance profile might cause AWS CloudFormation to detect the resource as drifted. - -###### Important - -Each time a new instance is launched, this `SystemAssociationForManagingInstances` association runs. If your organization routinely launches a high number of instances, this can lead to elevated costs being incurred if you surpass Automation's free tier maximum for Automation executions. - -For information about Automation pricing and free tier maximums, see [Pricing for Automation](https://aws.amazon.com/systems-manager/pricing/#Automation). - -For information about targeting frequency for State Manager associations, see [About target updates with Automation runbooks](./state-manager-about.html#runbook-target-updates). - @@ -99 +95,3 @@ Lambda functions -Additionally, after the setup process completes you can select the **Diagnose and remediate** node task to automatically apply fixes to nodes that aren't reporting as managed by Systems Manager. This can include identifying issues such as network connectivity issues to the Systems Manager endpoints, and more. +Additionally, after the setup process completes you can select the **Diagnose and remediate** node task to automatically apply fixes to nodes that aren't reporting as managed by Systems Manager. This can include identifying issues such as network connectivity issues to the Systems Manager endpoints, and more. For more information, see [Diagnosing and remediating](./diagnose-and-remediate.html). + +## Set up the unified console @@ -117 +115,38 @@ Additionally, after the setup process completes you can select the **Diagnose an - 8. Choose **Submit**. + 8. In the **Feature configurations** section, choose the options that you want to enable for your configuration: + +**Enable Default Host Management Configuration (DHMC)** + + +Allows Systems Manager to configure DHMC. This feature allows Systems Manager to use an IAM role to ensure that all Amazon EC2 instances in the account and Region have the permissions necessary to be managed by Systems Manager. You can also specify the frequency of drift remediation. Configuration drift occurs whenever a user makes any change to a service or feature that conflicts with the selections made through your configuration. Systems Manager checks for configuration drift and attempts to remediate it based on the frequency you specify. You must specify a value between 1 and 31 days. If you've already configured DHMC in a Region, Systems Manager doesn't change the IAM role you previously selected. For more information about DHMC, see [Managing EC2 instances automatically with Default Host Management Configuration](./fleet-manager-default-host-management-configuration.html). + +DHMC makes it possible to manage Amazon EC2 instances without your having to manually create an AWS Identity and Access Management (IAM) instance profile. We encourage you to choose this option to ensure that your EC2 instances have the permissions necessary to be managed by Systems Manager. + +**Enable inventory metadata collection** + + +Enables Systems Manager to configure collection of the following types of metadata from your nodes: + + * **AWS components** – EC2 driver, agents, versions, and more. + + * **Applications** – Application names, publishers, versions, and more. + + * **Node details** – System name, operating system (OS) name, OS version, last boot, DNS, domain, work group, OS architecture, and more. + + * **Network configuration** – IP address, MAC address, DNS, gateway, subnet mask, and more. + + * **Services** – Name, display name, status, dependent services, service type, start type, and more (Windows Server nodes only). + + * **Windows roles** – Name, display name, path, feature type, installed state, and more (Windows Server nodes only). + + * **Windows updates** – Hotfix ID, installed by, installed date, and more (Windows Server nodes only). + +Specify the frequency at which inventory is collected. You must specify a value between 1 and 744 hours. For more information about Inventory, a tool in AWS Systems Manager, see [AWS Systems Manager Inventory](./systems-manager-inventory.html). + +**Enable automatic Systems Manager (SSM) Agent updates** + + +Enables Systems Manager to check for a new version of the agent at the frequency you specify. The value for the frequency must be between 1 and 31 days. If there is a new version, then Systems Manager automatically updates the agent on your managed node to the latest released version. Systems Manager doesn't install the agent on instances where it's not already present. For information about which AMIs have SSM Agent preinstalled, see [ Find AMIs with the SSM Agent preinstalled](./ami-preinstalled-agent.html). + +We encourage you to choose this option to ensure that your nodes are always running the most up-to-date version of SSM Agent. For more information about SSM Agent, including information about how to manually install the agent, see [Working with SSM Agent](./ssm-agent.html). + + 9. Choose **Submit**.