SSM Agent automatic installation - AMS Accelerate User Guide
PrerequisitesRequest automatic installation of SSM AgentHow SSM Agent automatic installation works

SSM Agent automatic installation

To have AMS manage your Amazon Elastic Compute Cloud (Amazon EC2) instances, you must install AWS Systems Manager SSM Agent on each instance. If your instances don't have SSM Agent installed, then you can use the AMS SSM Agent auto-installation feature.

Note

  • If your account is onboarded to AMS Accelerate after 6/03/2024, then this feature is enabled by default. To turn off this feature, contact your CA or CSDM.

  • To turn on this feature in accounts onboarded before 6/03/2024, contact your CA or CSDM.

  • This feature is only available for EC2 instances that aren't in an Auto Scaling group and that run Linux operating systems supported by AMS.

Prerequisites for SSM Agent use

  • Make sure the instance profile associated with the target instances has one of the following policies (or equivalent permissions as allowlisted in them):

    • AmazonSSMManagedEC2InstanceDefaultPolicy

    • AmazonSSMManagedInstanceCore

  • Make sure that there isn't a Service Control Policy at the AWS Organizations level that explicitly denies the permissions listed in the preceding policies.

    For more information, see Configure instance permissions required for Systems Manager.

  • If outbound traffic make sure that all of the following interface endpoints are enabled on the VPC where the target instances resides if you want to block outbound traffic:

    • ssm.region.amazonaws.com

    • ssmmessages.region.amazonaws.com

    • ec2messages.region.amazonaws.com

    For more information, see Improve the security of EC2 instances by using VPC endpoints for Systems Manager.

For general tips on enabling or troubleshooting managed node availability, see Solution 2: Verify that an IAM instance profile has been specified for the instance (EC2 instances only).

Note

AMS stops and starts each instance as part of the auto-installation process. When an instance is stopped, data stored in instance store volumes and data stored on the RAM is lost. For more information, see What happens when you stop an instance.

Request automatic installation of SSM Agent on your instances

If your accounts are onboarded to AMS Accelerate Patch Add-On, then configure a patch maintenance window (MW) for the instances. A working SSM Agent is required to complete the patch process. If SSM Agent is missing on an instance, then AMS tries to automatically install it during the patch maintenance window.

Note

AMS stops and starts each instance as part of the auto-installation process. When an instance is stopped, data stored in instance store volumes and data stored on the RAM is lost. For more information, see What happens when you stop an instance.

How SSM Agent automatic installation works

AMS uses EC2 user data to run the installation script on your instances. To add the user data script and run it on your instances, AMS must stop and start each instance.

If your instance already has an existing user data script, then AMS completes the following steps during the auto installation process:

  1. Creates a backup of the existing user data script.

  2. Replaces the existing user data script with the SSM Agent installation script.

  3. Restarts the instance to install SSM Agent.

  4. Stops the instance and restores the original script.

  5. Restarts the instance with the original script.