AWS Systems Manager
User Guide

Step 7: (Optional) Enable the Advanced-Instances Tier

AWS Systems Manager offers a standard-instances tier and an advanced-instances tier for servers and VMs in your hybrid environment. The standard-instances tier enables you to register a maximum of 1,000 on-premises servers or VMs per AWS account per AWS Region. If you need to register more than 1,000 on-premises servers or VMs in a single account and Region, then use the advanced-instances tier. You can activate as many managed instances in a hybrid environment as you like in the advanced-instances tier. However, all instances configured for Systems Manager using the managed-instance activation process described earlier in Step 4: Create a Managed-Instance Activation for a Hybrid Environment are made available on a pay-per-use basis. This also applies to Amazon EC2 instances that use a Systems Manager on-premises activation (which is not a common scenario).

Note

  • Advanced instances also enable you to connect to your hybrid machines by using AWS Systems Manager Session Manager. Session Manager provides interactive shell access to your instances. For more information, see AWS Systems Manager Session Manager.

  • The standard-instances limit also applies to Amazon EC2 instances that use a Systems Manager on-premises activation (which is not a common scenario).

  • Microsoft application patching is only available on Amazon EC2 instances and in the advanced-instances tier. To patch Microsoft applications on on-premises servers and VMs, you must enable the advanced-instances tier. For more information, see About Patching Applications on Windows Server.

This section describes how to configure your hybrid environment to use the advanced-instances tier.

Before You Begin

Review pricing details for advanced instances. Advanced instances are an account-level feature and all on-premises servers and VMs in the account and AWS Region that were added using managed-instance activation are made available on a per-use-basis. For more information see, AWS Systems Manager Pricing.

Configuring Permissions to Enable the Advanced-Instances Tier

Verify that you have permission in AWS Identity and Access Management (IAM) to change your environment from the standard-instances tier to the advanced-instances tier. You must either have the AdministratorAccess policy attached to your IAM user, group, or role. Or, you must have permission to change the Systems Manager activation-tier service setting. The activation-tier setting uses the following API actions:

Use the following procedure to add an inline IAM policy to a user account. This policy enables a user to view the current managed-instance tier setting. This policy also enables the user to change or reset the current setting in the specified AWS account and Region.

  1. Sign in to the AWS Management Console and open the IAM console at https://console.aws.amazon.com/iam/.

  2. In the navigation pane, choose Users.

  3. In the list, choose the name of the user to embed a policy in.

  4. Choose the Permissions tab.

  5. On the right side of the page, under Permission policies, choose Add inline policy.

  6. Choose the JSON tab.

  7. Replace the default content with the following:

    { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ssm:GetServiceSetting", ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:ResetServiceSetting", "ssm:UpdateServiceSetting" ], "Resource": "arn:aws:ssm:AWS_Region:AWS_account_ID:servicesetting/ssm/managed-instance/activation-tier" } ] }
  8. Choose Review policy.

  9. On the Review policy page, for Name, enter a name for the inline policy. For example: Managed-Instances-Tier.

  10. Choose Create policy.

Administrators can specify read-only permission by assigning the following inline policy to the user's account.

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ssm:GetServiceSetting" ], "Resource": "*" }, { "Effect": "Deny", "Action": [ "ssm:ResetServiceSetting", "ssm:UpdateServiceSetting" ], "Resource": "*" } ] }

For more information about creating and editing IAM policies, see Creating IAM Policies in the IAM User Guide.

Enabling the Advanced-Instances Tier (Console)

The following procedure shows you how to use the Systems Manager console to change all on-premises servers and VMs that were added using managed-instance activation, in the specified AWS account and Region, to use the advanced-instances tier.

Important

The following procedure describes how to change an account-level setting. This change results in charges being billed to your account. If you want to change back to the standard-instances tier, then you must contact AWS Support.

To enable the advanced-instances tier (console)

  1. Open the AWS Systems Manager console at https://console.aws.amazon.com/systems-manager/.

  2. In the navigation pane, choose Managed instances.

  3. Choose the Settings tab.

  4. Choose Change account settings.

  5. Review the information in the pop-up about changing account settings, and then, if you approve, choose the option to accept and continue.

The system can take several minutes to complete the process of moving all instances from the standard-instances tier to the advanced-instances tier.

Enabling the Advanced-Instances Tier (AWS CLI)

The following procedure shows you how to use the AWS CLI to change all on-premises servers and VMs that were added using managed-instance activation, in the specified AWS account and Region, to use the advanced-instances tier.

Important

The following procedure describes how to change an account-level setting. This change results in charges being billed to your account. If you want to change back to the standard-instances tier, then you must contact AWS Support.

To enable the advanced-instances tier using the AWS CLI

  1. Open the AWS CLI and run the following command to change all managed instances in the current AWS account and Region to use the advanced-instances tier.

    aws ssm update-service-setting --setting-id arn:aws:ssm:us-east-1:123456789012:servicesetting/ssm/managed-instance/activation-tier --setting-value advanced

    There is no output if the command succeeds.

  2. Run the following command to view the current service settings for managed instances in the current AWS account and Region.

    aws ssm get-service-setting --setting-id arn:aws:ssm:us-east-1:123456789012:servicesetting/ssm/managed-instance/activation-tier
    {
        "ServiceSetting": {
            "SettingId": "/ssm/managed-instance/activation-tier",
            "SettingValue": "advanced",
            "LastModifiedDate": 1555603376.138,
            "LastModifiedUser": "arn:aws:sts::123456789012:assumed-role/Administrator/Jasper",
            "ARN": "arn:aws:ssm:us-east-1:123456789012:servicesetting/ssm/managed-instance/activation-tier",
            "Status": "PendingUpdate"
        }
    }

The system can take several minutes to complete the process of moving all instances from the standard-instances tier to the advanced-instances tier.

Enabling the Advanced-Instances Tier (PowerShell)

The following procedure shows you how to use the AWS Tools for Windows PowerShell to change all on-premises servers and VMs that were added using managed-instance activation, in the specified AWS account and Region, to use the advanced-instances tier.

Important

The following procedure describes how to change an account-level setting. This change results in charges being billed to your account. If you want to change back to the standard-instances tier, then you must contact AWS Support.

To enable the advanced-instances tier using PowerShell

  1. Change all managed instances in the current AWS account and Region to use the advanced-instances tier using the AWS Tools for Windows PowerShell.

    Update-SSMServiceSetting -SettingId "arn:aws:ssm:us-east-1:123456789012:servicesetting/ssm/managed-instance/activation-tier" -SettingValue "advanced"

    There is no output if the command succeeds.

  2. Run the following command to view the current service settings for managed instances in the current AWS account and Region.

    Get-SSMServiceSetting -SettingId "arn:aws:ssm:us-east-1:123456789012:servicesetting/ssm/managed-instance/activation-tier"
    ARN              : arn:aws:ssm:us-east-1:123456789012:servicesetting/ssm/managed-instance/activation-tier
    LastModifiedDate : 4/18/2019 4:02:56 PM
    LastModifiedUser : arn:aws:sts::123456789012:assumed-role/Administrator/Jasper
    SettingId        : /ssm/managed-instance/activation-tier
    SettingValue     : advanced
    Status           : PendingUpdate
    

The system can take several minutes to complete the process of moving all instances from the standard-instances tier to the advanced-instances tier.