12. Deployment & Management

AWS Elastic Beanstalk

AWS Systems Manager

AWS Config

AWS Secret Manager

AWS OpsWorks

AWS Resource Access Manager

RPO, RTO, & DR Strategies

Explore

AWS Systems Manager

Systems Manager capabilities

Application Management

Application Management is a suite of capabilities that help you manage your applications running in AWS.

⁠
`AWS Systems Manager Application Manager`⁠
⁠

⁠

Application Manager⁠

helps DevOps engineers investigate and remediate issues with their AWS resources in the context of their applications and clusters. In Application Manager, an application is a logical group of AWS resources that you want to operate as a unit. This logical group can represent different versions of an application, ownership boundaries for operators, or developer environments, to name a few. Application Manager support for container clusters includes both Amazon Elastic Kubernetes Service (Amazon EKS) and Amazon Elastic Container Service (Amazon ECS) clusters. Application Manager aggregates operations information from multiple AWS services and Systems Manager capabilities to a single AWS Management Console.

⁠
`AWS AppConfig`⁠
⁠

⁠

AppConfig⁠

helps you create, manage, and deploy application configurations and feature flags. AppConfig supports controlled deployments to applications of any size. You can use AppConfig with applications hosted on Amazon EC2 instances, AWS Lambda containers, mobile applications, or edge devices. To prevent errors when deploying application configurations, AppConfig includes validators. A validator provides a syntactic or semantic check to verify that the configuration you want to deploy works as intended. During a configuration deployment, AppConfig monitors the application to verify that the deployment is successful. If the system encounters an error or if the deployment invokes an alarm, AppConfig rolls back the change to minimize impact for your application users.

⁠
`AWS Systems Manager Parameter Store`⁠
⁠

Parameter Store, a capability of AWS Systems Manager, provides secure, hierarchical storage for configuration data management and secrets management. You can store data such as passwords, database strings, Amazon Machine Image (AMI) IDs, and license codes as parameter values. You can store values as plain text or encrypted data. You can reference Systems Manager parameters in your scripts, commands, SSM documents, and configuration and automation workflows by using the unique name that you specified when you created the parameter.

Parameter Store is also integrated with Secrets Manager. You can retrieve Secrets Manager secrets when using other AWS services that already support references to Parameter Store parameters. For more information, see

Referencing AWS Secrets Manager secrets from Parameter Store parameters⁠

Note

To implement password rotation lifecycles, use AWS Secrets Manager. You can rotate, manage, and retrieve database credentials, API keys, and other secrets throughout their lifecycle using Secrets Manager. For more information, see

What is AWS Secrets Manager?⁠

in the AWS Secrets Manager User Guide.

⁠

Change Management

AWS Systems Manager provides the following capabilities for making changes to your AWS resources.

⁠
`AWS Systems Manager Change Manager`⁠
⁠

⁠

Change Manager⁠

is an enterprise change management framework for requesting, approving, implementing, and reporting on operational changes to your application configuration and infrastructure. From a single delegated administrator account, if you use AWS Organizations, you can manage changes across multiple AWS accounts in multiple AWS Regions. Alternatively, using a local account, you can manage changes for a single AWS account. Use Change Manager for managing changes to both AWS resources and on-premises resources.

⁠
`AWS Systems Manager Automation`⁠
⁠

Use

Automation⁠

to automate common maintenance and deployment tasks. You can use Automation to create and update Amazon Machine Images (AMIs), apply driver and agent updates, reset passwords on Windows Server instance, reset SSH keys on Linux instances, and apply OS patches or application updates.

⁠
`AWS Systems Manager Change Calendar`⁠
⁠

⁠

Change Calendar⁠

helps you set up date and time ranges when actions you specify (for example, in

Systems Manager Automation⁠

runbooks) can or can't be performed in your AWS account. In Change Calendar, these ranges are called events. When you create a Change Calendar entry, you're creating a

Systems Manager document⁠

of the type ChangeCalendar. In Change Calendar, the document stores

iCalendar 2.0⁠

data in plaintext format. Events that you add to the Change Calendar entry become part of the document. You can add events manually in the Change Calendar interface or import events from a supported third-party calendar using an .ics file.

⁠
`AWS Systems Manager Maintenance Windows`⁠
⁠

Use

Maintenance Windows⁠

to set up recurring schedules for managed instances to run administrative tasks such as installing patches and updates without interrupting business-critical operations.

⁠

Node Management

AWS Systems Manager provides the following capabilities for accessing, managing, and configuring your managed nodes. A managed node is any machine configured for use with Systems Manager in a

hybrid and multicloud⁠

environment.

⁠
`AWS Systems Manager Fleet Manager`⁠
⁠

⁠

Fleet Manager⁠

is a unified user interface (UI) experience that helps you remotely manage your nodes. With Fleet Manager, you can view the health and performance status of your entire fleet from one console. You can also gather data from individual devices and instances to perform common troubleshooting and management tasks from the console. This includes viewing directory and file contents, Windows registry management, operating system user management, and more.

⁠
`AWS Systems Manager Compliance`⁠
⁠

Use

Compliance⁠

to scan your fleet of managed nodes for patch compliance and configuration inconsistencies. You can collect and aggregate data from multiple AWS accounts and AWS Regions, and then drill down into specific resources that aren’t compliant. By default, Compliance displays compliance data about Patch Manager patching and State Manager associations. You can also customize the service and create your own compliance types based on your IT or business requirements.

⁠
`AWS Systems Manager Inventory`⁠
⁠

⁠

Inventory⁠

automates the process of collecting software inventory from your managed nodes. You can use Inventory to gather metadata about applications, files, components, patches, and more.

⁠
`AWS Systems Manager Hybrid Activations`⁠
⁠

To set up non-EC2 machines in your hybrid and multicloud environment as managed nodes, create a

hybrid activation⁠

. After you complete the activation, you receive an activation code and ID. This code and ID combination functions like an Amazon Elastic Compute Cloud (Amazon EC2) access ID and secret key to provide secure access to the Systems Manager service from your managed instances.

You can also create an activation for edge devices if you want to manage them by using Systems Manager.

⁠
`AWS Systems Manager Session Manager`⁠
⁠

Use

Session Manager⁠

to manage your edge devices and Amazon Elastic Compute Cloud (Amazon EC2) instances through an interactive one-click browser-based shell or through the AWS CLI. Session Manager provides secure and auditable edge device and instance management without needing to open inbound ports, maintain bastion hosts, or manage SSH keys. Session Manager also allows you to comply with corporate policies that require controlled access to edge devices and instances, strict security practices, and fully auditable logs with edge device and instance access details, while still providing end users with simple one-click cross-platform access to your edge devices and EC2 instances. To use Session Manager, you must enable the advanced-instances tier. For more information, see

Turning on the advanced-instances tier⁠

What is a session?

A session is a connection made to a managed node using Session Manager. Sessions are based on a secure bi-directional communication channel between the client (you) and the remote managed node that streams inputs and outputs for commands. Traffic between a client and a managed node is encrypted using TLS 1.2, and requests to create the connection are signed using Sigv4. This two-way communication allows interactive bash and PowerShell access to managed nodes. You can also use an AWS Key Management Service (AWS KMS) key to further encrypt data beyond the default TLS encryption.

⁠
`AWS Systems Manager Run Command`⁠
⁠

Use

Run Command⁠

to remotely and securely manage the configuration of your managed nodes at scale. Use Run Command to perform on-demand changes such as updating applications or running Linux shell scripts and Windows PowerShell commands on a target set of dozens or hundreds of managed nodes.

Administrators use Run Command to install or bootstrap applications, build a deployment pipeline, capture log files when an instance is removed from an Auto Scaling group, join instances to a Windows domain, and more.

⁠
`AWS Systems Manager State Manager`⁠
⁠

Use

State Manager⁠

to automate the process of keeping your managed nodes in a defined state. You can use State Manager to guarantee that your managed nodes are bootstrapped with specific software at startup, joined to a Windows domain (Windows Server nodes only), or patched with specific software updates.

⁠
`AWS Systems Manager Patch Manager`⁠
⁠

Use

Patch Manager⁠

to automate the process of patching your managed nodes with both security related and other types of updates. You can use Patch Manager to apply patches for both operating systems and applications. (On Windows Server, application support is limited to updates for applications released by Microsoft.)

This capability allows you to scan managed nodes for missing patches and apply missing patches individually or to large groups of managed nodes by using tags. Patch Manager uses patch baselines, which can include rules for auto-approving patches within days of their release, and a list of approved and rejected patches. You can install security patches on a regular basis by scheduling patching to run as a Systems Manager maintenance window task, or you can patch your managed nodes on demand at any time.

For Linux operating systems, you can define the repositories that should be used for patching operations as part of your patch baseline. This allows you to ensure that updates are installed only from trusted repositories regardless of what repositories are configured on the managed node. For Linux, you also have the ability to update any package on the managed node, not just those that are classified as operating system security updates. You can also generate patch reports that are sent to an S3 bucket of your choice. For a single managed node, reports include details of all patches for the machine. For a report on all managed nodes, only a summary of how many patches are missing is provided.

⁠
`AWS Systems Manager Distributor`⁠
⁠

Use

Distributor⁠

to create and deploy packages to managed nodes. With Distributor, you can package your own software—or find AWS-provided agent software packages, such as AmazonCloudWatchAgent—to install on Systems Manager managed nodes. After you install a package for the first time, you can use Distributor to uninstall and reinstall a new package version, or perform an in-place update that adds new or changed files. Distributor publishes resources, such as software packages, to Systems Manager managed nodes.

⁠

Operations management

Operations Management is a suite of capabilities that help you manage your AWS resources.

⁠
`AWS Systems Manager Incident Manager`⁠
⁠

⁠

Incident Manager⁠

is an incident management console that helps users mitigate and recover from incidents affecting their AWS hosted applications.

Incident Manager increases incident resolution by notifying responders of impact, highlighting relevant troubleshooting data, and providing collaboration tools to get services back up and running. Incident Manager also automates response plans and allows responder team escalation.

⁠
`AWS Systems Manager Explorer`⁠
⁠

⁠

Explorer⁠

is a customizable operations dashboard that reports information about your AWS resources. Explorer displays an aggregated view of operations data (OpsData) for your AWS accounts and across AWS Regions. In Explorer, OpsData includes metadata about your Amazon EC2 instances, patch compliance details, and operational work items (OpsItems). Explorer provides context about how OpsItems are distributed across your business units or applications, how they trend over time, and how they vary by category. You can group and filter information in Explorer to focus on items that are relevant to you and that require action. When you identify high priority issues, you can use OpsCenter, a capability of Systems Manager, to run Automation runbooks and resolve those issues.

⁠
`AWS Systems Manager OpsCenter`⁠
⁠

⁠

OpsCenter⁠

provides a central location where operations engineers and IT professionals can view, investigate, and resolve operational work items (OpsItems) related to AWS resources. OpsCenter is designed to reduce mean time to resolution for issues impacting AWS resources. This Systems Manager capability aggregates and standardizes OpsItems across services while providing contextual investigation data about each OpsItem, related OpsItems, and related resources. OpsCenter also provides Systems Manager Automation runbooks that you can use to resolve issues. You can specify searchable, custom data for each OpsItem. You can also view automatically generated summary reports about OpsItems by status and source.

⁠
`Amazon CloudWatch dashboards hosted by Systems Manager`⁠
⁠

⁠

Amazon CloudWatch Dashboards⁠

are customizable pages in the CloudWatch console that you can use to monitor your resources in a single view, even those resources that are spread across different regions. You can use CloudWatch dashboards to create customized views of the metrics and alarms for your AWS resources.

Want to print your doc?
This is not the way.

Try clicking the ⋯ next to your doc name or using a keyboard shortcut (

CtrlP

) instead.

Systems Manager capabilities

Application Management

⁠AWS Systems Manager Application Manager⁠⁠

⁠AWS AppConfig⁠⁠

⁠AWS Systems Manager Parameter Store⁠⁠

Change Management

⁠AWS Systems Manager Change Manager⁠⁠

⁠AWS Systems Manager Automation⁠⁠

⁠AWS Systems Manager Change Calendar⁠⁠

⁠AWS Systems Manager Maintenance Windows⁠⁠

Node Management

⁠AWS Systems Manager Fleet Manager⁠⁠

⁠AWS Systems Manager Compliance⁠⁠

⁠AWS Systems Manager Inventory⁠⁠

⁠AWS Systems Manager Hybrid Activations⁠⁠

⁠AWS Systems Manager Session Manager⁠⁠

⁠AWS Systems Manager Run Command⁠⁠

⁠AWS Systems Manager State Manager⁠⁠

⁠AWS Systems Manager Patch Manager⁠⁠

⁠AWS Systems Manager Distributor⁠⁠