Menu
Amazon EC2 Systems Manager
User Guide

Configuring Inventory Collection

This section describes how to configure inventory collection on one or more managed instances by using the Amazon EC2 console. This section also describes how to aggregate inventory data from multiple AWS accounts and regions in a single Amazon S3 bucket by using Systems Manager Resource Data Sync. For an example of how to configure inventory collection using the AWS CLI, see Systems Manager Inventory Manager Walkthroughs.

Before you begin

Before you configure inventory collection, complete the following tasks.

Configuring Collection

Use the following procedure to configure inventory collection on a managed instance using the Amazon EC2 console.

Note

When you configure Inventory collection, you start by creating a Systems Manager State Manager association. Systems Manager collects the inventory data when the association is run. If you don't create the association first, and attempt to invoke the aws:softwareInventory plugin by using, for example, Run Command, the system returns the following error:

The aws:softwareInventory plugin can only be invoked via ssm-associate.

Also note that an instance can have only have one Inventory association configured at a time. If you configure an instance with two or more associations, the association doesn't run and no inventory data is collected.

To configure inventory collection

  1. Open the Amazon EC2 console, expand Systems Manager Shared Resources in the navigation pane, and then choose Managed Instances.

  2. Choose Setup Inventory.

  3. In the Targets section, choose Specify a Tag if you want to configure inventory on multiple instances using EC2 tags. Choose Manually Select Instances if you want to individually choose which instances are configured for inventory.

    Note

    If you use tags, any instances created in the future with the same tag will also report inventory.

  4. In the Schedule section, choose how often you want the system to collect inventory metadata from your instances.

  5. In the Parameters section, use the lists to enable or disable different types of inventory collection.

  6. In the Advanced section, choose Write to S3 if you want to store the association execution status in an Amazon S3 bucket.

  7. Choose Setup Inventory and then choose OK.

  8. In the Managed Instances page, choose an instance that you just configured for inventory and choose the Description tab. The Association Status shows Pending until the association is created. If the status is Failed, verify that you have the latest version of the SSM Agent installed on your instances.

  9. After the collection time-frame has passed, choose a managed instance, and then choose the Inventory tab.

  10. Use the Inventory Type list to filter on different types of inventory data.

After you configure Inventory collection, we recommend that you configure Systems Manager Resource Data Sync. Resource Data Sync centralizes all Inventory data in a target Amazon S3 bucket and automatically updates the central storage when new Inventory data is collected. With all Inventory data stored in a target Amazon S3 bucket, you can then use services like Amazon Athena and Amazon QuickSight to query and analyze the aggregated data. Resource Data Sync is described in the next section.

Configuring Resource Data Sync for Inventory

You can use Systems Manager Resource Data Sync to send Inventory data collected from all of your managed instances to a single Amazon S3 bucket. Resource Data Sync then automatically updates the centralized data when new Inventory data is collected. With all Inventory data stored in a target Amazon S3 bucket, you can use services like Amazon Athena and Amazon QuickSight to query and analyze the aggregated data.

For example, say that you've configured Inventory to collect data about the operating system (OS) and applications running on a fleet of 150 managed instances. Some of these instances are located in a hybrid data center, and others are running in Amazon EC2 across multiple AWS Regions. If you have not configured Resource Data Sync for Inventory, you either need to manually gather the collected inventory data for each instance, or you have to create scripts to gather this information. You would then need to port the data into an application so that you can run queries and analyze it.

With Resource Data Sync, you perform a one-time operation that synchronizes all Inventory data from all of your managed instances. When you create the sync, you can specify managed instances from multiple AWS accounts and AWS Regions. After the sync is successfully created, Systems Manager creates a baseline of all Inventory data and saves it in the target Amazon S3 bucket. When new inventory data is collected, Systems Manager automatically updates the data in the Amazon S3 bucket. You can then quickly and cost-effectively port the data to Amazon Athena and Amazon QuickSight.

Diagram 1 shows how Resource Data Sync aggregates inventory data from managed instances in Amazon EC2 and a hybrid environment to a target Amazon S3 bucket. This diagram also shows how Resource Data Sync works with multiple AWS accounts and AWS Regions.

Diagram 1: Resource Data Sync with Multiple AWS Accounts and AWS Regions


                    Systems Manager Resource Data Sync architecture

If you delete a managed instance, Resource Data Sync preserves the Inventory file for the deleted instance. For running instances, however, Resource Data Sync automatically overwrites old inventory files when new files are created and written to the Amazon S3 bucket. If you want to track inventory changes over time, you can use the AWS Config service to track the MangagedInstanceInventory resource type. For more information, see Getting Started with AWS Config.

Related Content

  • Resource Data Sync uses the following API actions: CreateResourceDataSync, ListResourceDataSync, and DeleteResourceDataSync.

  • Amazon QuickSight is a business analytics service that makes it easy to build visualizations so that you can analyze and gather insights from your data. Connecting to Athena from QuickSight is a one-click process. You don't need to provide endpoints or a user name and password. You can simply choose Athena as your data source, choose the database and tables to analyze, and start visualizing the data in QuickSight. For more information, see Amazon QuickSight User Guide.

  • Amazon Athena is an interactive query service that makes it easy to analyze data in Amazon S3 using standard SQL queries. Athena doesn't require an Amazon EC2 instance to run, so there is no infrastructure to manage. You pay only for the queries that you run. For more information, see Amazon Athena User Guide.

Creating a Resource Data Sync for Inventory

Use the following procedure to create a Resource Data Sync for Inventory by using the Amazon EC2 console. For an example of how to create a sync by using the AWS CLI and how to work with the centralized data in Amazon Athena and Amazon QuickSight, see Using Resource Data Sync to Aggregate Inventory Data.

To create a Resource Data Sync for Inventory

  1. Open the Amazon S3 console at https://console.aws.amazon.com/s3/.

  2. Create a bucket to store your aggregated Inventory data. For more information, see Create a Bucket in the Amazon Simple Storage Service Getting Started Guide. Make a note of the bucket name and the AWS Region where you created it.

  3. Choose the Permissions tab, and then choose Bucket Policy.

  4. Copy and paste the following bucket policy into the policy editor. Replace Bucket-Name and Account-ID with the name of the Amazon S3 bucket you created and a valid AWS account ID. Optionally, replace Bucket-Prefix with the name of an Amazon S3 prefix (subdirectory). If you didn't create a prefix, remove Bucket-Prefix/ from the ARN in the policy.

    Copy
    { "Version": "2012-10-17", "Statement": [ { "Sid": "SSMBucketPermissionsCheck", "Effect": "Allow", "Principal": { "Service": "ssm.amazonaws.com" }, "Action": "s3:GetBucketAcl", "Resource": "arn:aws:s3:::Bucket-Name" }, { "Sid": " SSMBucketDelivery", "Effect": "Allow", "Principal": { "Service": "ssm.amazonaws.com" }, "Action": "s3:PutObject", "Resource": ["arn:aws:s3:::Bucket-Name/Bucket-Prefix/*/accountid=Account-ID/*"], "Condition": { "StringEquals": { "s3:x-amz-acl": "bucket-owner-full-control" } } } ] }
  5. Open the Amazon EC2 console, expand Systems Manager Shared Resources in the navigation pane, and choose Managed Instances.

  6. Choose Resource Data Syncs, and then choose Create a Resource Data Sync.

  7. In the Sync Name field, type a name for the sync configuration.

  8. In the Bucket Name field, type the name of the Amazon S3 bucket you created at the start of this procedure.

  9. (Optional) In the Bucket Prefix field, type the name of an Amazon S3 bucket prefix (subdirectory).

  10. In the Bucket Region field, choose This region if the Amazon S3 bucket you created is located in the current AWS Region. If the bucket is located in a different AWS Region, choose Another region, and type the name of the Region.

    Note

    If the sync and the target Amazon S3 bucket are located in different regions, you may be subject to data transfer pricing. For more information, see Amazon S3 Pricing.

  11. Choose Create.