SSM Agent installieren und konfigurieren
# EC2 IAM-Rolle benötigt: AmazonSSMManagedInstanceCore
# (oder per Instanzprofil)
# SSM Agent manuell installieren (Ubuntu)
sudo snap install amazon-ssm-agent --classic
sudo systemctl enable --now snap.amazon-ssm-agent.amazon-ssm-agent
# Status prüfen
sudo systemctl status snap.amazon-ssm-agent.amazon-ssm-agent
# Im SSM registrierte Instanzen anzeigen
aws ssm describe-instance-information --query 'InstanceInformationList[].{ID:InstanceId,Status:PingStatus,Platform:PlatformType}'
Session Manager (SSH-freier Shell-Zugriff)
# Session starten (kein SSH-Port nötig!)
aws ssm start-session --target i-1234567890abcdef0
# Port-Forwarding (lokaler Port zu Remote-Service)
aws ssm start-session --target i-1234567890abcdef0 --document-name AWS-StartPortForwardingSession --parameters portNumber=5432,localPortNumber=5432
# Dann: psql -h localhost -p 5432 -U dbuser appdb
Run Command (Remote-Befehle)
# Update auf allen Linux-Instanzen
aws ssm send-command --targets Key=tag:OS,Values=Linux --document-name AWS-RunShellScript --parameters commands='["apt update && apt upgrade -y"]' --comment "Monatlicher Update" --timeout-seconds 600
# Befehl-Status überwachen
aws ssm list-command-invocations --command-id <COMMAND_ID> --details --query 'CommandInvocations[].{Instance:InstanceId,Status:Status}'
Patch Manager
# Patch Baseline erstellen
aws ssm create-patch-baseline --name "Ubuntu-CriticalAndSecurity" --operating-system UBUNTU --approval-rules '{"PatchRules":[{"PatchFilterGroup":{"PatchFilters":[{"Key":"SECTION","Values":["Security"]},{"Key":"PRIORITY","Values":["Critical","High"]}]},"ApproveAfterDays":7,"EnableNonSecurity":false}]}'
# Maintenance Window erstellen
WINDOW_ID=$(aws ssm create-maintenance-window --name "monthly-patching" --schedule "cron(0 2 ? * SUN#1 *)" --duration 4 --cutoff 1 --allow-unassociated-targets --query 'WindowId' --output text)
Parameter Store (Secrets Management)
# Parameter speichern (String)
aws ssm put-parameter --name "/firma/app/db-host" --value "rds-endpoint.xxx.eu-central-1.rds.amazonaws.com" --type String
# SecureString (KMS-verschlüsselt)
aws ssm put-parameter --name "/firma/app/db-password" --value "sicheres-passwort-hier" --type SecureString --key-id alias/aws/ssm
# Parameter abrufen (in EC2/Lambda)
aws ssm get-parameter --name "/firma/app/db-password" --with-decryption --query 'Parameter.Value' --output text
# In Python-Code:
# import boto3
# ssm = boto3.client('ssm')
# param = ssm.get_parameter(Name='/firma/app/db-password', WithDecryption=True)
# password = param['Parameter']['Value']
FAQ
Kann SSM Session Manager SSH komplett ersetzen?
Ja. Session Manager bietet Shell-Zugriff, Port-Forwarding und Logging ohne offene SSH-Ports – sicherer als SSH.
Fazit
AWS Systems Manager ersetzt SSH-Bastion-Hosts, vereinfacht Patch-Management und bietet sicheres Secrets-Management.
AWS Systems Manager für KMU in Heidelberg, Mannheim und der Rhein-Neckar-Region. Anfragen.