AWS systems-manager documentation change
Summary
Updated hybrid/multicloud documentation to clarify onboarding methods, added Cloud Connectors for Azure, revised hybrid activation details, removed instance tier limits, and enhanced auditing references.
Security assessment
The change adds documentation about Cloud Connectors' identity federation and hybrid activation security mechanisms, and enhances auditing to include logging. However, there's no evidence of addressing a specific vulnerability or incident.
Diff
diff --git a/systems-manager/latest/userguide/systems-manager-hybrid-multicloud.md b/systems-manager/latest/userguide/systems-manager-hybrid-multicloud.md index 64bd0725e..01d970091 100644 --- a//systems-manager/latest/userguide/systems-manager-hybrid-multicloud.md +++ b//systems-manager/latest/userguide/systems-manager-hybrid-multicloud.md @@ -9 +9,3 @@ -You can use AWS Systems Manager to manage both Amazon Elastic Compute Cloud (EC2) instances and a number of non-EC2 machine types. This section describes the setup tasks that account and system administrators perform to manage non-EC2 machines using Systems Manager in a _[hybrid and multicloud](./operating-systems-and-machine-types.html#supported-machine-types) environment_. After these steps are complete, users who have been granted permissions by the AWS account administrator can use Systems Manager to configure and manage their organization's non-EC2 machines. +You can use AWS Systems Manager to manage Amazon Elastic Compute Cloud (Amazon EC2) instances alongside non-EC2 machines in hybrid and multicloud environments. Systems Manager supports on-premises servers, edge devices, and virtual machines running in other cloud environments, including Microsoft Azure. + +This section describes the setup tasks that account and system administrators perform to configure non-EC2 machines for use with Systems Manager in a [hybrid and multicloud](./operating-systems-and-machine-types.html#supported-machine-types) environment. After these steps are complete, users who have been granted permissions by the AWS account administrator can use Systems Manager to configure and manage their organization's non-EC2 machines. @@ -13 +15,6 @@ Any machine that has been configured for use with Systems Manager is called a _m -###### Note +Systems Manager provides two methods to onboard non-EC2 machines: + + * **Cloud Connectors** – Automatically onboard and manage Azure virtual machines at scale from the AWS Management Console. Cloud Connectors handle identity federation, agent installation, and VM registration without requiring direct access to your Azure VMs. For more information, see [Set up a Cloud Connector for Microsoft Azure in Systems Manager](./systems-manager-cloud-connector.html). + + * **Hybrid activations** – Register individual on-premises servers, edge devices, and VMs from any environment by manually installing SSM Agent and activating each machine. For more information, see [Create a hybrid activation to register nodes with Systems Manager](./hybrid-activation-managed-nodes.html). + @@ -15 +21,0 @@ Any machine that has been configured for use with Systems Manager is called a _m - * You can register edge devices as managed nodes using the same hybrid-activation steps used for other non-EC2 machines. These types of edge devices include both AWS IoT devices and devices other than AWS IoT devices. Use the process described in this section to set up these types of edge devices. @@ -17 +23,4 @@ Any machine that has been configured for use with Systems Manager is called a _m -Systems Manager also supports edge devices that use AWS IoT Greengrass Core software. The setup process and requirements for AWS IoT Greengrass core devices are different from those for AWS IoT and edge devices other than AWS edge devices. For information about registering AWS IoT Greengrass devices for use with Systems Manager, see [Managing edge devices with Systems Manager](./systems-manager-setting-up-edge-devices.html). + +###### Note + + * You can register edge devices as managed nodes using the same hybrid-activation steps used for other non-EC2 machines. These types of edge devices include both AWS IoT devices and devices other than AWS IoT devices. Systems Manager also supports edge devices that use AWS IoT Greengrass Core software. The setup process and requirements for AWS IoT Greengrass core devices are different. For information about registering AWS IoT Greengrass devices for use with Systems Manager, see [Managing edge devices with Systems Manager](./systems-manager-setting-up-edge-devices.html). @@ -38 +47 @@ After configuring your hybrid and multicloud environment for Systems Manager, yo - * Centralize auditing of the operations performed on your machines by viewing the API activity recorded in AWS CloudTrail. + * Centralize auditing and logging of the operations performed on your machines by viewing the API activity recorded in AWS CloudTrail. @@ -48,0 +58,16 @@ For information about using EventBridge to monitor Systems Manager events, see [ +###### Onboarding with Cloud Connectors + +A Cloud Connector is a Systems Manager resource that establishes a trust relationship between your AWS account and a third-party cloud provider. With Cloud Connectors, you can onboard and manage virtual machines from other cloud environments at scale directly from the AWS Management Console without signing in to individual VMs, running scripts, or manually installing agents. + +When you create a Cloud Connector, Systems Manager discovers associated VMs, and installs SSM Agent on each VM. New VMs that come online are enrolled automatically. After onboarding, VMs appear as managed nodes in the unified Systems Manager console alongside your Amazon EC2 instances, and you can manage them using the same Systems Manager capabilities you use for Amazon EC2. + +Cloud Connectors currently support Microsoft Azure. For more information, see [Set up a Cloud Connector for Microsoft Azure in Systems Manager](./systems-manager-cloud-connector.html). + +###### Onboarding with hybrid activations + +A hybrid activation allows you to register individual on-premises servers, edge devices, and VMs from any environment as managed nodes. With hybrid activations, you create an activation in the Systems Manager console, install SSM Agent on each machine manually, and register it using the activation code and ID. + +Hybrid activations give you flexibility to onboard machines from any environment, including on-premises data centers, edge locations, and cloud providers that aren't yet supported by Cloud Connectors. After registration, the machines appear as managed nodes and support the same Systems Manager capabilities as Amazon EC2 instances. + +For more information, see [Create a hybrid activation to register nodes with Systems Manager](./hybrid-activation-managed-nodes.html). + @@ -60,0 +86,6 @@ We strongly recommend that you avoid using OS versions that have reached End-of- +###### About instance tiers + +Effective June 30, 2026, the Advanced Instances Tier has been removed. There is no longer a 1,000-instance limit for hybrid managed nodes, and you no longer need to enable a paid tier to use Session Manager on non-EC2 machines. Instead, Session Manager, Run Command, and Patch Manager use pay-as-you-go pricing when used on hybrid managed nodes. + +For more information about pricing, see [AWS Systems Manager pricing](https://aws.amazon.com/systems-manager/pricing/). + @@ -70,0 +102,2 @@ We strongly recommend that you avoid using OS versions that have reached End-of- + * [Set up Systems Manager for Microsoft Azure virtual machines](./hybrid-multicloud-ssm-agent-install-azure.html) +