• The AWS Systems Manager CloudWatch Dashboard will no longer be available after April 30, 2026. Customers can continue to use Amazon CloudWatch console to view, create, and manage their Amazon CloudWatch dashboards, just as they do today. For more information, see [Amazon CloudWatch Dashboard documentation](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch_Dashboards.html). # AWS Systems Manager Fleet Manager Fleet Manager, a tool in AWS Systems Manager, is a unified user interface (UI) experience that helps you remotely manage your nodes running on AWS or on premises. With Fleet Manager, you can view the health and performance status of your entire server fleet from one console. You can also gather data from individual nodes to perform common troubleshooting and management tasks from the console. This includes connecting to Windows instances using the Remote Desktop Protocol (RDP), viewing folder and file contents, Windows registry management, operating system user management, and more. To get started with Fleet Manager, open the [Systems Manager console](https://console.aws.amazon.com/systems-manager/fleet-manager). In the navigation pane, choose **Fleet Manager**. ## Who should use Fleet Manager? Any AWS customer who wants a centralized way to manage their node fleet should use Fleet Manager. ## How can Fleet Manager benefit my organization? Fleet Manager offers these benefits: + Perform a variety of common systems administration tasks without having to manually connect to your managed nodes. + Manage nodes running on multiple platforms from a single unified console. + Manage nodes running different operating systems from a single unified console. + Improve the efficiency of your systems administration. ## What are the features of Fleet Manager? Key features of Fleet Manager include the following: + **Access the Red Hat Knowledgebase Portal** Access binaries, knowledge-shares, and discussion forums on the Red Hat Knowledgebase Portal through your Red Hat Enterprise Linux (RHEL) instances. + **Managed node status** View which managed instances are `running` and which are `stopped`. For more information about stopped instances, see [Stop and start your instance](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Stop_Start.html) in the *Amazon EC2 User Guide*. For AWS IoT Greengrass core devices, you can view which are `online`, `offline`, or show a status of `Connection lost`. **Note** If you stopped your managed instance before July 12, 2021, it won't display the `stopped` marker. To show the marker, start and stop the instance. + **View instance information** View information about the folder and file data stored on the volumes attached to your managed instances, performance data about your instances in real-time, and log data stored on your instances. + **View edge device information** View the AWS IoT Greengrass Thing name for the device, SSM Agent ping status and version, and more. + **Manage accounts and registry** Manage operating system (OS) user accounts on your instances and registry on your Windows instances. + **Control access to features** Control access to Fleet Manager features using AWS Identity and Access Management (IAM) policies. With these policies, you can control which individual users or groups in your organization can use various Fleet Manager features, and which managed nodes they can manage. **Topics** + [ ## Who should use Fleet Manager? ](#fleet-who) + [ ## How can Fleet Manager benefit my organization? ](#fleet-benefits) + [ ## What are the features of Fleet Manager? ](#fleet-features) + [ # Setting up Fleet Manager ](setting-up-fleet-manager.md) + [ # Working with managed nodes ](fleet-manager-managed-nodes.md) + [ # Managing EC2 instances automatically with Default Host Management Configuration ](fleet-manager-default-host-management-configuration.md) + [ # Connecting to a Windows Server managed instance using Remote Desktop ](fleet-manager-remote-desktop-connections.md) + [ # Managing Amazon EBS volumes on managed instances ](fleet-manager-manage-amazon-ebs-volumes.md) + [ # Accessing the Red Hat Knowledge base portal ](fleet-manager-red-hat-knowledge-base-access.md) + [ # Troubleshooting managed node availability ](fleet-manager-troubleshooting-managed-nodes.md) # Setting up Fleet Manager Before users in your AWS account can use Fleet Manager, a tool in AWS Systems Manager, to monitor and manage your managed nodes, they must be granted the necessary permissions. In addition, any Amazon Elastic Compute Cloud (Amazon EC2) instances; AWS IoT Greengrass core devices; and on-premises servers, edge devices, and virtual machines (VMs) to be monitored and managed using Fleet Manager must be Systems Manager* managed nodes*. A managed node is any machine configured for use with Systems Manager in [hybrid and multicloud](operating-systems-and-machine-types.md#supported-machine-types) environments. This means your nodes must meet certain prerequisites and be configured with the AWS Systems Manager Agent (SSM Agent). Depending on the machine type, refer to one of the following topics to ensure your machines meet the requirements for managed nodes. + Amazon EC2 instances: [Managing EC2 instances with Systems Manager](systems-manager-setting-up-ec2.md) **Tip** You can also use Quick Setup, a tool in AWS Systems Manager, to help you quickly configure your Amazon EC2 instances as managed instances in an individual account. If your business or organization uses AWS Organizations, you can also configure instances across multiple organizational units (OUs) and AWS Regions. For more information about using Quick Setup to configure managed instances, see [Set up Amazon EC2 host management using Quick Setup](quick-setup-host-management.md). + On-premises and other server types in the cloud: [Managing nodes in hybrid and multicloud environments with Systems Manager](systems-manager-hybrid-multicloud.md) + AWS IoT Greengrass (edge) devices: [Managing edge devices with Systems Manager](systems-manager-setting-up-edge-devices.md) **Topics** + [ # Controlling access to Fleet Manager ](configuring-fleet-manager-permissions.md) # Controlling access to Fleet Manager To use Fleet Manager, a tool in AWS Systems Manager, your AWS Identity and Access Management (IAM) user or role must have the required permissions. You can create an IAM policy that provides access to all Fleet Manager features, or modify your policy to grant access to the features you choose. You then grant these permissions to users, or identities, in your account. **Task 1: Create IAM policies to define access permissions** Follow one of the methods provided in the followig topic in the *IAM User Guide* to create an IAM to provide identities (users, roles, or user groupss) with access to Fleet Manager: + [Define custom IAM permissions with customer managed policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_create.html) You can use one of the sample policies we provide below, or modify them according to the permissions you want to grant. We provide sample policies for full Fleet Manager access and read-only access. **Task 2: Attach the IAM policies to users to grant permissions** After you have created the IAM policy or policies that define access permissions to Fleet Manager, use one of the following procedures in the *IAM User Guide* to grant these permissions to identities in your account: + [Adding IAM identity permissions (console)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-attach-detach.html#add-policies-console) + [Adding IAM identity permissions (AWS CLI)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-attach-detach.html#add-policy-cli) + [Adding IAM identity permissions (AWS API)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-attach-detach.html#add-policy-api) **Topics** + [ ## Sample policy for Fleet Manager administrator access ](#admin-policy-sample) + [ ## Sample policy for Fleet Manager read-only access ](#read-only-policy-sample) ## Sample policy for Fleet Manager administrator access The following policy provides permissions to all Fleet Manager features. This means a user can create and delete local users and groups, modify group membership for any local group, and modify Windows Server registry keys or values. Replace each *example resource placeholder* with your own information. ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": [ { "Sid": "EC2", "Effect": "Allow", "Action": [ "ec2:CreateTags", "ec2:DeleteTags", "ec2:DescribeInstances", "ec2:DescribeTags" ], "Resource": "*" }, { "Sid": "General", "Effect": "Allow", "Action": [ "ssm:AddTagsToResource", "ssm:DescribeInstanceAssociationsStatus", "ssm:DescribeInstancePatches", "ssm:DescribeInstancePatchStates", "ssm:DescribeInstanceProperties", "ssm:GetCommandInvocation", "ssm:GetServiceSetting", "ssm:GetInventorySchema", "ssm:ListComplianceItems", "ssm:ListInventoryEntries", "ssm:ListTagsForResource", "ssm:ListCommandInvocations", "ssm:ListAssociations", "ssm:RemoveTagsFromResource" ], "Resource": "*" }, { "Sid": "DefaultHostManagement", "Effect": "Allow", "Action": [ "ssm:ResetServiceSetting", "ssm:UpdateServiceSetting" ], "Resource": "arn:aws:ssm:us-east-1:111122223333:servicesetting/ssm/managed-instance/default-ec2-instance-management-role" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::111122223333:role/service-role/AWSSystemsManagerDefaultEC2InstanceManagementRole", "Condition": { "StringEquals": { "iam:PassedToService": [ "ssm.amazonaws.com" ] } } }, { "Sid": "SendCommand", "Effect": "Allow", "Action": [ "ssm:GetDocument", "ssm:SendCommand", "ssm:StartSession" ], "Resource": [ "arn:aws:ec2:*:111122223333:instance/*", "arn:aws:ssm:*:111122223333:managed-instance/*", "arn:aws:ssm:*:111122223333:document/SSM-SessionManagerRunShell", "arn:aws:ssm:*:*:document/AWS-PasswordReset", "arn:aws:ssm:*:*:document/AWSFleetManager-AddUsersToGroups", "arn:aws:ssm:*:*:document/AWSFleetManager-CopyFileSystemItem", "arn:aws:ssm:*:*:document/AWSFleetManager-CreateDirectory", "arn:aws:ssm:*:*:document/AWSFleetManager-CreateGroup", "arn:aws:ssm:*:*:document/AWSFleetManager-CreateUser", "arn:aws:ssm:*:*:document/AWSFleetManager-CreateUserInteractive", "arn:aws:ssm:*:*:document/AWSFleetManager-CreateWindowsRegistryKey", "arn:aws:ssm:*:*:document/AWSFleetManager-DeleteFileSystemItem", "arn:aws:ssm:*:*:document/AWSFleetManager-DeleteGroup", "arn:aws:ssm:*:*:document/AWSFleetManager-DeleteUser", "arn:aws:ssm:*:*:document/AWSFleetManager-DeleteWindowsRegistryKey", "arn:aws:ssm:*:*:document/AWSFleetManager-DeleteWindowsRegistryValue", "arn:aws:ssm:*:*:document/AWSFleetManager-GetDiskInformation", "arn:aws:ssm:*:*:document/AWSFleetManager-GetFileContent", "arn:aws:ssm:*:*:document/AWSFleetManager-GetFileSystemContent", "arn:aws:ssm:*:*:document/AWSFleetManager-GetGroups", "arn:aws:ssm:*:*:document/AWSFleetManager-GetPerformanceCounters", "arn:aws:ssm:*:*:document/AWSFleetManager-GetProcessDetails", "arn:aws:ssm:*:*:document/AWSFleetManager-GetUsers", "arn:aws:ssm:*:*:document/AWSFleetManager-GetWindowsEvents", "arn:aws:ssm:*:*:document/AWSFleetManager-GetWindowsRegistryContent", "arn:aws:ssm:*:*:document/AWSFleetManager-MountVolume", "arn:aws:ssm:*:*:document/AWSFleetManager-MoveFileSystemItem", "arn:aws:ssm:*:*:document/AWSFleetManager-RemoveUsersFromGroups", "arn:aws:ssm:*:*:document/AWSFleetManager-RenameFileSystemItem", "arn:aws:ssm:*:*:document/AWSFleetManager-SetWindowsRegistryValue", "arn:aws:ssm:*:*:document/AWSFleetManager-StartProcess", "arn:aws:ssm:*:*:document/AWSFleetManager-TerminateProcess" ] }, { "Sid": "TerminateSession", "Effect": "Allow", "Action": [ "ssm:TerminateSession" ], "Resource": "*", "Condition": { "StringLike": { "ssm:resourceTag/aws:ssmmessages:session-id": [ "${aws:userid}" ] } } } ] } ``` ------ ## Sample policy for Fleet Manager read-only access The following policy provides permissions to read-only Fleet Manager features. Replace each *example resource placeholder* with your own information. ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": [ { "Sid": "EC2", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:DescribeTags" ], "Resource": "*" }, { "Sid": "General", "Effect": "Allow", "Action": [ "ssm:DescribeInstanceAssociationsStatus", "ssm:DescribeInstancePatches", "ssm:DescribeInstancePatchStates", "ssm:DescribeInstanceProperties", "ssm:GetCommandInvocation", "ssm:GetServiceSetting", "ssm:GetInventorySchema", "ssm:ListComplianceItems", "ssm:ListInventoryEntries", "ssm:ListTagsForResource", "ssm:ListCommandInvocations", "ssm:ListAssociations" ], "Resource": "*" }, { "Sid": "SendCommand", "Effect": "Allow", "Action": [ "ssm:GetDocument", "ssm:SendCommand", "ssm:StartSession" ], "Resource": [ "arn:aws:ec2:*:111122223333:instance/*", "arn:aws:ssm:*:111122223333:managed-instance/*", "arn:aws:ssm:*:111122223333:document/SSM-SessionManagerRunShell", "arn:aws:ssm:*:*:document/AWSFleetManager-GetDiskInformation", "arn:aws:ssm:*:*:document/AWSFleetManager-GetFileContent", "arn:aws:ssm:*:*:document/AWSFleetManager-GetFileSystemContent", "arn:aws:ssm:*:*:document/AWSFleetManager-GetGroups", "arn:aws:ssm:*:*:document/AWSFleetManager-GetPerformanceCounters", "arn:aws:ssm:*:*:document/AWSFleetManager-GetProcessDetails", "arn:aws:ssm:*:*:document/AWSFleetManager-GetUsers", "arn:aws:ssm:*:*:document/AWSFleetManager-GetWindowsEvents", "arn:aws:ssm:*:*:document/AWSFleetManager-GetWindowsRegistryContent" ] }, { "Sid": "TerminateSession", "Effect": "Allow", "Action": [ "ssm:TerminateSession" ], "Resource": "*", "Condition": { "StringLike": { "ssm:resourceTag/aws:ssmmessages:session-id": [ "${aws:userid}" ] } } } ] } ``` ------ # Working with managed nodes A *managed node* is any machine configured for AWS Systems Manager. You can configure the following machine types as managed nodes: + Amazon Elastic Compute Cloud (Amazon EC2) instances + Servers on your own premises (on-premises servers) + AWS IoT Greengrass core devices + AWS IoT and non-AWS edge devices + Virtual machines (VMs), including VMs in other cloud environments In the Systems Manager console, any machine prefixed with "mi-" has been configured as a managed node using a [*hybrid activation*](activations.md). Edge devices display their AWS IoT Thing name. **Note** The only supported feature for macOS instances is viewing the file system. **About Systems Manager instances tiers** AWS Systems Manager offers a standard-instances tier and an advanced-instances tier. Both support managed nodes in your [hybrid and multicloud](operating-systems-and-machine-types.md#supported-machine-types) environment. The standard-instances tier allows you to register a maximum of 1,000 machines per AWS account per AWS Region. If you need to register more than 1,000 machines in a single account and Region, then use the advanced-instances tier. You can create as many managed nodes as you like in the advanced-instances tier. All managed nodes configured for Systems Manager are priced on a pay-per-use basis. For more information about enabling the advanced instances tier, see [Turning on the advanced-instances tier](fleet-manager-enable-advanced-instances-tier.md). For more information about pricing, see [AWS Systems Manager Pricing](https://aws.amazon.com/systems-manager/pricing/). Note the following additional information about the standard-instances tier and advanced-instances tier: + Advanced instances also allow you to connect to your non-EC2 nodes in a [hybrid and multicloud](operating-systems-and-machine-types.md#supported-machine-types) environment by using AWS Systems Manager Session Manager. Session Manager provides interactive shell access to your instances. For more information, see [AWS Systems Manager Session Manager](session-manager.md). + The standard-instances quota also applies to EC2 instances that use a Systems Manager on-premises activation (which isn't a common scenario). + To patch applications released by Microsoft on virtual machines (VMs) on-premises instances, activate the advanced-instances tier. There is a charge to use the advanced-instances tier. There is no additional charge to patch applications released by Microsoft on Amazon Elastic Compute Cloud (Amazon EC2) instances. For more information, see [Patching applications released by Microsoft on Windows Server](patch-manager-patching-windows-applications.md). **Display managed nodes** If you don't see your managed nodes listed in the console, then do the following: 1. Verify that the console is open in the AWS Region where you created your managed nodes. You can switch Regions by using the list in the top, right corner of the console. 1. Verify that the setup steps for your managed nodes meet Systems Manager requirements. For information, see [Setting up managed nodes for AWS Systems Manager](systems-manager-setting-up-nodes.md). 1. For non-EC2 machines, verify that you completed the hybrid activation process. For more information, see [Managing nodes in hybrid and multicloud environments with Systems Manager](systems-manager-hybrid-multicloud.md). Note the following additional information: + The Fleet Manager console does not display Amazon EC2 nodes that have been terminated. + Systems Manager requires accurate time references in order to perform operations on your machines. If the date and time aren't set correctly on your managed nodes, the machines might not match the signature date of your API requests. For more information, see [Use cases and best practices](systems-manager-best-practices.md). + When you create or edit tags, the system can take up to one hour to display changes in the table filter. + After the status of a managed node has been `Connection Lost` for at least 30 days, the node might no longer be listed in the Fleet Manager console. To restore it to the list, the issue that caused the lost connection must be resolved. For troubleshooting tips, see [Troubleshooting managed node availability](fleet-manager-troubleshooting-managed-nodes.md). **Verify Systems Manager support on a managed node** AWS Config provides AWS Managed Rules, which are predefined, customizable rules that AWS Config uses to evaluate whether your AWS resource configurations comply with common best practices. AWS Config Managed Rules include the [ec2-instance-managed-by-systems-manager](https://docs.aws.amazon.com/config/latest/developerguide/ec2-instance-managed-by-systems-manager.html) rule. This rule checks whether the Amazon EC2 instances in your account are managed by Systems Manager. For more information, see [AWS Config Managed Rules](https://docs.aws.amazon.com/config/latest/developerguide/evaluate-config_use-managed-rules.html). **Increase security posture on managed nodes** For information about increasing your security posture against unauthorized root-level commands on your managed nodes, see [Restricting access to root-level commands through SSM Agent](ssm-agent-restrict-root-level-commands.md). **Deregister managed nodes** You can deregister managed nodes at any time. For example, if you're managing multiple nodes with the same AWS Identity and Access Management (IAM) role and you notice any kind of malicious behavior, you can deregister any number of machines at any point. (In order to re-register the same machine, you must use a different hybrid Activation Code and Activation ID than previously used to register it.) For information about deregistering managed nodes, see [Deregistering managed nodes in a hybrid and multicloud environment](fleet-manager-deregister-hybrid-nodes.md). **Topics** + [ # Configuring instance tiers ](fleet-manager-configure-instance-tiers.md) + [ # Resetting passwords on managed nodes ](fleet-manager-reset-password.md) + [ # Deregistering managed nodes in a hybrid and multicloud environment ](fleet-manager-deregister-hybrid-nodes.md) + [ # Working with OS file systems using Fleet Manager ](fleet-manager-file-system-management.md) + [ # Monitoring managed node performance ](fleet-manager-monitoring-node-performance.md) + [ # Working with processes ](fleet-manager-manage-processes.md) + [ # Viewing logs on managed nodes ](fleet-manager-view-node-logs.md) + [ # Managing OS user accounts and groups on managed nodes using Fleet Manager ](fleet-manager-manage-os-user-accounts.md) + [ # Managing the Windows registry on managed nodes ](fleet-manager-manage-windows-registry.md) # Configuring instance tiers This topic describes the scenarios when you must activate the advanced-instanced tier. AWS Systems Manager offers a standard-instances tier and an advanced-instances tier for non-EC2 machines in a [hybrid and multicloud](operating-systems-and-machine-types.md#supported-machine-types) environment. You can register up to 1,000 standard [hybrid-activated nodes](activations.md) per account per AWS Region at no additional cost. However, registering more than 1,000 hybrid nodes requires that you activate the advanced-instances tier. There is a charge to use the advanced-instances tier. For more information, see [AWS Systems Manager Pricing](https://aws.amazon.com/systems-manager/pricing/). Even with fewer than 1,000 registered hybrid-activated nodes, two other scenarios require the advanced-instances tier: + You want to use Session Manager to connect to non-EC2 nodes. + You want to patch applications (not operating systems) released by Microsoft on non-EC2 nodes. **Note** There is no charge to patch applications released by Microsoft on Amazon EC2 instances. ## Advanced-instances tier detailed scenarios The following information provides details on the three scenarios for which you must activate the advanced-instances tier. Scenario 1: You want to register more than 1,000 hybrid-activated nodes Using the standard-instances tier, you can register a maximum of 1,000 non-EC2 nodes in a [hybrid and multicloud](operating-systems-and-machine-types.md#supported-machine-types) environment per AWS Region in a specific account without additional charge. If you need to register more than 1,000 non-EC2 nodes in a Region, you must use the advanced-instances tier. You can then activate as many machines for your hybrid and multicloud environment as you want. Charges for the advanced-instances tier are based on the number of advanced nodes activated as Systems Manager managed nodes and the hours those nodes are running. All Systems Manager managed nodes that use the activation process described in [Create a hybrid activation to register nodes with Systems Manager](hybrid-activation-managed-nodes.md) are then subject to charge if you exceed 1,000 on-premises nodes in a Region in a specific account . You can also activate existing Amazon Elastic Compute Cloud (Amazon EC2) instances using Systems Manager hybrid activations and work with them as non-EC2 instances, such as for testing. These also qualify as hybrid nodes. This isn't a common scenario. Scenario 2: Patching Microsoft-released applications on hybrid-activated nodes The advanced-instances tier is also required if you want to patch Microsoft-released applications on non-EC2 nodes in a hybrid and multicloud environment. If you activate the advanced-instances tier to patch Microsoft applications on non-EC2 nodes, charges are then incurred for all on-premises nodes, even if you have fewer than 1,000. There is no additional charge to patch applications released by Microsoft on Amazon Elastic Compute Cloud (Amazon EC2) instances. For more information, see [Patching applications released by Microsoft on Windows Server](patch-manager-patching-windows-applications.md). Scenario 3: Connecting to hybrid-activated nodes using Session Manager Session Manager provides interactive shell access to your instances. To connect to hybrid-activated managed nodes using Session Manager, you must activate the advanced-instances tier. Charges are then incurred for all hybrid-activated nodes, even if you have fewer than 1,000. **Summary: When do I need the advanced-instances tier?** Use the following table to review when you must use the advanced-instances tier, and for which scenarios additional charges apply. **** | Scenario | Advanced-instances tier required? | Additional charges apply? | | --- | --- | --- | | The number of hybrid-activated nodes in my Region in a specific account is more than 1,000. | Yes | Yes | | I want to use Patch Manager to patch Microsoft-released applications on any number of hybrid-activated nodes, even less than 1,000. | Yes | Yes | | I want to use Session Manager to connect to any number of hybrid-activated nodes, even less than 1,000. | Yes | Yes | | [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/systems-manager/latest/userguide/fleet-manager-configure-instance-tiers.html) | No | No | **Topics** + [ ## Advanced-instances tier detailed scenarios ](#systems-manager-managed-instances-tier-scenarios) + [ # Turning on the advanced-instances tier ](fleet-manager-enable-advanced-instances-tier.md) + [ # Reverting from the advanced-instances tier to the standard-instances tier ](fleet-manager-revert-to-standard-tier.md) # Turning on the advanced-instances tier AWS Systems Manager offers a standard-instances tier and an advanced-instances tier for non-EC2 machines in a [hybrid and multicloud](operating-systems-and-machine-types.md#supported-machine-types) environment. The standard-instances tier lets you register a maximum of 1,000 hybrid-activated machines per AWS account per AWS Region. The advanced-instances tier is also required to use Patch Manager to patch Microsoft-released applications on non-EC2 nodes, and to connect to non-EC2 nodes using Session Manager. For more information, see [Turning on the advanced-instances tier](#fleet-manager-enable-advanced-instances-tier). This section describes how to configure your hybrid and multicloud environment to use the advanced-instances tier. **Before you begin** Review pricing details for advanced instances. Advanced instances are available on a per-use-basis. For more information see, [AWS Systems Manager Pricing](https://aws.amazon.com/systems-manager/pricing/). ## Configuring permissions to turn on the advanced-instances tier Verify that you have permission in AWS Identity and Access Management (IAM) to change your environment from the standard-instances tier to the advanced-instances tier. You must either have the `AdministratorAccess` IAM policy attached to your user, group, or role, or you must have permission to change the Systems Manager activation-tier service setting. The activation-tier setting uses the following API operations: + [GetServiceSetting](https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_GetServiceSetting.html) + [UpdateServiceSetting](https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_UpdateServiceSetting.html) + [ResetServiceSetting](https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_ResetServiceSetting.html) Use the following procedure to add an inline IAM policy to a user account. This policy allows a user to view the current managed-instance tier setting. This policy also allows the user to change or reset the current setting in the specified AWS account and AWS Region. 1. Sign in to the AWS Management Console and open the IAM console at [https://console.aws.amazon.com/iam/](https://console.aws.amazon.com/iam/). 1. In the navigation pane, choose **Users**. 1. In the list, choose the name of the user to embed a policy in. 1. Choose the **Permissions** tab. 1. On the right side of the page, under **Permission policies**, choose **Add inline policy**. 1. Choose the **JSON** tab. 1. Replace the default content with the following: ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ssm:GetServiceSetting" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:ResetServiceSetting", "ssm:UpdateServiceSetting" ], "Resource": "arn:aws:ssm:us-east-1:111122223333:servicesetting/ssm/managed-instance/activation-tier" } ] } ``` ------ 1. Choose **Review policy**. 1. On the **Review policy** page, for **Name**, enter a name for the inline policy. For example: **Managed-Instances-Tier**. 1. Choose **Create policy**. Administrators can specify read-only permission by assigning the following inline policy to the user. ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ssm:GetServiceSetting" ], "Resource": "*" }, { "Effect": "Deny", "Action": [ "ssm:ResetServiceSetting", "ssm:UpdateServiceSetting" ], "Resource": "*" } ] } ``` ------ For more information about creating and editing IAM policies, see [Creating IAM Policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_create.html) in the *IAM User Guide*. ## Turning on the advanced-instances tier (console) The following procedure shows you how to use the Systems Manager console to change *all* non-EC2 nodes that were added using managed-instance activation, in the specified AWS account and AWS Region, to use the advanced-instances tier. **Before you begin** Verify that the console is open in the AWS Region where you created your managed instances. You can switch Regions by using the list in the top, right corner of the console. Verify that you have completed the setup requirements for your Amazon Elastic Compute Cloud (Amazon EC2) instances and non-EC2 machines in a [hybrid and multicloud](operating-systems-and-machine-types.md#supported-machine-types) environment. For information, see [Setting up managed nodes for AWS Systems Manager](systems-manager-setting-up-nodes.md). **Important** The following procedure describes how to change an account-level setting. This change results in charges being billed to your account. **To turn on the advanced-instances tier (console)** 1. Open the AWS Systems Manager console at [https://console.aws.amazon.com/systems-manager/](https://console.aws.amazon.com/systems-manager/). 1. In the navigation pane, choose **Fleet Manager**. 1. Choose **Settings**, and then choose **Change instance tier settings**. 1. Review the information in the dialog box about changing account settings. 1. If you approve, choose the option to accept, and then choose **Change setting**. The system can take several minutes to complete the process of moving all instances from the standard-instances tier to the advanced-instances tier. **Note** For information about changing back to the standard-instances tier, see [Reverting from the advanced-instances tier to the standard-instances tier](fleet-manager-revert-to-standard-tier.md). ## Turning on the advanced-instances tier (AWS CLI) The following procedure shows you how to use the AWS Command Line Interface to change *all* on-premises servers and VMs that were added using managed-instance activation, in the specified AWS account and AWS Region, to use the advanced-instances tier. **Important** The following procedure describes how to change an account-level setting. This change results in charges being billed to your account. **To turn on the advanced-instances tier using the AWS CLI** 1. Open the AWS CLI and run the following command. Replace each *example resource placeholder* with your own information. ------ #### [ Linux & macOS ] ``` aws ssm update-service-setting \ --setting-id arn:aws:ssm:region:aws-account-id:servicesetting/ssm/managed-instance/activation-tier \ --setting-value advanced ``` ------ #### [ Windows ] ``` aws ssm update-service-setting ^ --setting-id arn:aws:ssm:region:aws-account-id:servicesetting/ssm/managed-instance/activation-tier ^ --setting-value advanced ``` ------ There is no output if the command succeeds. 1. Run the following command to view the current service settings for managed nodes in the current AWS account and AWS Region. ------ #### [ Linux & macOS ] ``` aws ssm get-service-setting \ --setting-id arn:aws:ssm:region:aws-account-id:servicesetting/ssm/managed-instance/activation-tier ``` ------ #### [ Windows ] ``` aws ssm get-service-setting ^ --setting-id arn:aws:ssm:region:aws-account-id:servicesetting/ssm/managed-instance/activation-tier ``` ------ The command returns information like the following. ``` { "ServiceSetting": { "SettingId": "/ssm/managed-instance/activation-tier", "SettingValue": "advanced", "LastModifiedDate": 1555603376.138, "LastModifiedUser": "arn:aws:sts::123456789012:assumed-role/Administrator/User_1", "ARN": "arn:aws:ssm:us-east-2:123456789012:servicesetting/ssm/managed-instance/activation-tier", "Status": "PendingUpdate" } } ``` ## Turning on the advanced-instances tier (PowerShell) The following procedure shows you how to use the AWS Tools for Windows PowerShell to change *all* on-premises servers and VMs that were added using managed-instance activation, in the specified AWS account and AWS Region, to use the advanced-instances tier. **Important** The following procedure describes how to change an account-level setting. This change results in charges being billed to your account. **To turn on the advanced-instances tier using PowerShell** 1. Open AWS Tools for Windows PowerShell and run the following command. Replace each *example resource placeholder* with your own information. ``` Update-SSMServiceSetting ` -SettingId "arn:aws:ssm:region:aws-account-id:servicesetting/ssm/managed-instance/activation-tier" ` -SettingValue "advanced" ``` There is no output if the command succeeds. 1. Run the following command to view the current service settings for managed nodes in the current AWS account and AWS Region. ``` Get-SSMServiceSetting ` -SettingId "arn:aws:ssm:region:aws-account-id:servicesetting/ssm/managed-instance/activation-tier" ``` The command returns information like the following. ``` ARN:arn:aws:ssm:us-east-2:123456789012:servicesetting/ssm/managed-instance/activation-tier LastModifiedDate : 4/18/2019 4:02:56 PM LastModifiedUser : arn:aws:sts::123456789012:assumed-role/Administrator/User_1 SettingId : /ssm/managed-instance/activation-tier SettingValue : advanced Status : PendingUpdate ``` The system can take several minutes to complete the process of moving all nodes from the standard-instances tier to the advanced-instances tier. **Note** For information about changing back to the standard-instances tier, see [Reverting from the advanced-instances tier to the standard-instances tier](fleet-manager-revert-to-standard-tier.md). # Reverting from the advanced-instances tier to the standard-instances tier This section describes how to change hybrid-activated nodes running in the advanced-instances tier back to the standard-instances tier. This configuration applies to all hybrid-activated nodes in an AWS account and a single AWS Region. **Before you begin** Review the following important details. **Note** You can't revert back to the standard-instance tier if you're running more than 1,000 hybrid-activated nodes in the account and Region. You must first deregister nodes until you have 1,000 or fewer. This also applies to Amazon Elastic Compute Cloud (Amazon EC2) instances that use a Systems Manager hybrid activation (which isn't a common scenario). For more information, see [Deregistering managed nodes in a hybrid and multicloud environment](fleet-manager-deregister-hybrid-nodes.md). After you revert, you won't be able to use Session Manager, a tool in AWS Systems Manager, to interactively access your hybrid-activated nodes. After you revert, you won't be able to use Patch Manager, a tool in AWS Systems Manager, to patch applications released by Microsoft on hybrid-activated nodes. The process of reverting all hybrid-activated nodes back to the standard-instance tier can take 30 minutes or more to complete. This section describes how to revert all hybrid-activated nodes in an AWS account and AWS Region from the advanced-instances tier to the standard-instances tier. ## Reverting to the standard-instances tier (console) The following procedure shows you how to use the Systems Manager console to change all hybrid-activated nodes in your [hybrid and multicloud](operating-systems-and-machine-types.md#supported-machine-types) environment to use the standard-instances tier in the specified AWS account and AWS Region. **To revert to the standard-instances tier (console)** 1. Open the AWS Systems Manager console at [https://console.aws.amazon.com/systems-manager/](https://console.aws.amazon.com/systems-manager/). 1. In the navigation pane, choose **Fleet Manager**. 1. Select the **Account settings** dropdown and choose **Instance tier settings**. 1. Choose **Change account setting**. 1. Review the information in the pop-up about changing account settings, and then if you approve, choose the option to accept and continue. ## Reverting to the standard-instances tier (AWS CLI) The following procedure shows you how to use the AWS Command Line Interface to change all hybrid-activated nodes in your [hybrid and multicloud](operating-systems-and-machine-types.md#supported-machine-types) environment to use the standard-instances tier in the specified AWS account and AWS Region. **To revert to the standard-instances tier using the AWS CLI** 1. Open the AWS CLI and run the following command. Replace each *example resource placeholder* with your own information. ------ #### [ Linux & macOS ] ``` aws ssm update-service-setting \ --setting-id arn:aws:ssm:region:aws-account-id:servicesetting/ssm/managed-instance/activation-tier \ --setting-value standard ``` ------ #### [ Windows ] ``` aws ssm update-service-setting ^ --setting-id arn:aws:ssm:region:aws-account-id:servicesetting/ssm/managed-instance/activation-tier ^ --setting-value standard ``` ------ There is no output if the command succeeds. 1. Run the following command 30 minutes later to view the settings for managed instances in the current AWS account and AWS Region. ------ #### [ Linux & macOS ] ``` aws ssm get-service-setting \ --setting-id arn:aws:ssm:region:aws-account-id:servicesetting/ssm/managed-instance/activation-tier ``` ------ #### [ Windows ] ``` aws ssm get-service-setting ^ --setting-id arn:aws:ssm:region:aws-account-id:servicesetting/ssm/managed-instance/activation-tier ``` ------ The command returns information like the following. ``` { "ServiceSetting": { "SettingId": "/ssm/managed-instance/activation-tier", "SettingValue": "standard", "LastModifiedDate": 1555603376.138, "LastModifiedUser": "System", "ARN": "arn:aws:ssm:us-east-2:123456789012:servicesetting/ssm/managed-instance/activation-tier", "Status": "Default" } } ``` The status changes to *Default* after the request has been approved. ## Reverting to the standard-instances tier (PowerShell) The following procedure shows you how to use AWS Tools for Windows PowerShell to change hybrid-activated nodes in your hybrid and multicloud environment to use the standard-instances tier in the specified AWS account and AWS Region. **To revert to the standard-instances tier using PowerShell** 1. Open AWS Tools for Windows PowerShell and run the following command. ``` Update-SSMServiceSetting ` -SettingId "arn:aws:ssm:region:aws-account-id:servicesetting/ssm/managed-instance/activation-tier" ` -SettingValue "standard" ``` There is no output if the command succeeds. 1. Run the following command 30 minutes later to view the settings for managed instances in the current AWS account and AWS Region. ``` Get-SSMServiceSetting ` -SettingId "arn:aws:ssm:region:aws-account-id:servicesetting/ssm/managed-instance/activation-tier" ``` The command returns information like the following. ``` ARN: arn:aws:ssm:us-east-2:123456789012:servicesetting/ssm/managed-instance/activation-tier LastModifiedDate : 4/18/2019 4:02:56 PM LastModifiedUser : System SettingId : /ssm/managed-instance/activation-tier SettingValue : standard Status : Default ``` The status changes to *Default* after the request has been approved. # Resetting passwords on managed nodes You can reset the password for any user on a managed node. This includes Amazon Elastic Compute Cloud (Amazon EC2) instances; AWS IoT Greengrass core devices; and on-premises servers, edge devices, and virtual machines (VMs) that are managed by AWS Systems Manager. The password reset functionality is built on Session Manager, a tool in AWS Systems Manager. You can use this functionality to connect to managed nodes without opening inbound ports, maintaining bastion hosts, or managing SSH keys. Password reset is useful when a user has forgotten a password, or when you want to quickly update a password without making an RDP or SSH connection to a managed node. **Prerequisites** Before you can reset the password on a managed node, the following requirements must be met: + The managed node on which you want to change a password must be a Systems Manager managed node. Also, SSM Agent version 2.3.668.0 or later must be installed on the managed node.) For information about installing or updating SSM Agent, see [Working with SSM Agent](ssm-agent.md). + The password reset functionality uses the Session Manager configuration that is set up for your account to connect to the managed node. Therefore, the prerequisites for using Session Manager must have been completed for your account in the current AWS Region. For more information, see [Setting up Session Manager](session-manager-getting-started.md). **Note** Session Manager support for on-premises nodes is provided for the advanced-instances tier only. For more information, see [Turning on the advanced-instances tier](fleet-manager-enable-advanced-instances-tier.md). + The AWS user who is changing the password must have the `ssm:SendCommand` permission for the managed node. For more information, see [Restricting Run Command access based on tags](run-command-setting-up.md#tag-based-access). **Restricting access** You can limit a user's ability to reset passwords to specific managed nodes. This is done by using identity-based policies for the Session Manager `ssm:StartSession` operation with the `AWS-PasswordReset` SSM document. For more information, see [Control user session access to instances](session-manager-getting-started-restrict-access.md). **Encrypting data** Turn on AWS Key Management Service (AWS KMS) complete encryption for Session Manager data to use the password reset option for managed nodes. For more information, see [Turn on KMS key encryption of session data (console)](session-preferences-enable-encryption.md). ## Reset a password on a managed node You can reset a password on a Systems Manager managed node using the Systems Manager **Fleet Manager** console or the AWS Command Line Interface (AWS CLI). **To change the password on a managed node (console)** 1. Open the AWS Systems Manager console at [https://console.aws.amazon.com/systems-manager/](https://console.aws.amazon.com/systems-manager/). 1. In the navigation pane, choose **Fleet Manager**. 1. Choose the button next to the node that needs a new password. 1. Choose **Instance actions, Reset password**. 1. For **User name**, enter the name of the user for which you're changing the password. This can be any user name that has an account on the node. 1. Choose **Submit**. 1. Follow the prompts in the **Enter new password** command window to specify the new password. **Note** If the version of SSM Agent on the managed node doesn't support password resets, you're prompted to install a supported version using Run Command, a tool in AWS Systems Manager. **To reset the password on a managed node (AWS CLI)** 1. To reset the password for a user on a managed node, run the following command. Replace each *example resource placeholder* with your own information. **Note** To use the AWS CLI to reset a password, the Session Manager plugin must be installed on your local machine. For information, see [Install the Session Manager plugin for the AWS CLI](session-manager-working-with-install-plugin.md). ------ #### [ Linux & macOS ] ``` aws ssm start-session \ --target instance-id \ --document-name "AWS-PasswordReset" \ --parameters '{"username": ["user-name"]}' ``` ------ #### [ Windows ] ``` aws ssm start-session ^ --target instance-id ^ --document-name "AWS-PasswordReset" ^ --parameters username="user-name" ``` ------ 1. Follow the prompts in the **Enter new password** command window to specify the new password. ## Troubleshoot password resets on managed nodes Many password reset issues can be resolved by ensuring that you have completed the [password reset prerequisites](#pw-reset-prereqs). For other problems, use the following information to help you troubleshoot password reset issues. **Topics** + [ ### Managed node not available ](#password-reset-troubleshooting-instances) + [ ### SSM Agent not up-to-date (console) ](#password-reset-troubleshooting-ssmagent-console) + [ ### Password reset options aren't provided (AWS CLI) ](#password-reset-troubleshooting-ssmagent-cli) + [ ### No authorization to run `ssm:SendCommand` ](#password-reset-troubleshooting-sendcommand) + [ ### Session Manager error message ](#password-reset-troubleshooting-session-manager) ### Managed node not available **Problem**: You want to reset the password for a managed node on the **Managed instances** console page, but the node isn't in the list. + **Solution**: The managed node you want to connect to might not be configured for Systems Manager. To use an EC2 instance with Systems Manager, an AWS Identity and Access Management (IAM) instance profile that gives Systems Manager permission to perform actions on your instances must be attached to the instance. For information, see [Configure instance permissions required for Systems Manager](setup-instance-permissions.md). To use a non-EC2 machine with Systems Manager, create an IAM service role that gives Systems Manager permission to perform actions on your managed nodes. For more information, see [Create the IAM service role required for Systems Manager in hybrid and multicloud environments](hybrid-multicloud-service-role.md). (Session Manager support for on-premises servers and VMs is provided for the advanced-instances tier only. For more information, see [Turning on the advanced-instances tier](fleet-manager-enable-advanced-instances-tier.md).) ### SSM Agent not up-to-date (console) **Problem**: A message reports that the version of SSM Agent doesn't support password reset functionality. + **Solution**: Version 2.3.668.0 or later of SSM Agent is required to perform password resets. In the console, you can update the agent on the managed node by choosing **Update SSM Agent**. An updated version of SSM Agent is released whenever new tools are added to Systems Manager or updates are made to existing tools. Failing to use the latest version of the agent can prevent your managed node from using various Systems Manager tools and features. For that reason, we recommend that you automate the process of keeping SSM Agent up to date on your machines. For information, see [Automating updates to SSM Agent](ssm-agent-automatic-updates.md). Subscribe to the [SSM Agent Release Notes](https://github.com/aws/amazon-ssm-agent/blob/mainline/RELEASENOTES.md) page on GitHub to get notifications about SSM Agent updates. ### Password reset options aren't provided (AWS CLI) **Problem**: You connect successfully to a managed node using the AWS CLI `[https://docs.aws.amazon.com/cli/latest/reference/ssm/start-session.html](https://docs.aws.amazon.com/cli/latest/reference/ssm/start-session.html)` command. You specified the SSM Document `AWS-PasswordReset` and provided a valid user name, but prompts to change the password aren't displayed. + **Solution**: The version of SSM Agent on the managed node isn't up-to-date. Version 2.3.668.0 or later is required to perform password resets. An updated version of SSM Agent is released whenever new tools are added to Systems Manager or updates are made to existing tools. Failing to use the latest version of the agent can prevent your managed node from using various Systems Manager tools and features. For that reason, we recommend that you automate the process of keeping SSM Agent up to date on your machines. For information, see [Automating updates to SSM Agent](ssm-agent-automatic-updates.md). Subscribe to the [SSM Agent Release Notes](https://github.com/aws/amazon-ssm-agent/blob/mainline/RELEASENOTES.md) page on GitHub to get notifications about SSM Agent updates. ### No authorization to run `ssm:SendCommand` **Problem**: You attempt to connect to a managed node to change the password but receive an error message saying that you aren't authorized to run `ssm:SendCommand` on the managed node. + **Solution**: Your IAM policy must include permission to run the `ssm:SendCommand` command. For information, see [Restricting Run Command access based on tags](run-command-setting-up.md#tag-based-access). ### Session Manager error message **Problem**: You receive an error message related to Session Manager. + **Solution**: Password reset support requires that Session Manager is configured correctly. For information, see [Setting up Session Manager](session-manager-getting-started.md) and [Troubleshooting Session Manager](session-manager-troubleshooting.md). # Deregistering managed nodes in a hybrid and multicloud environment If you no longer want to manage an on-premises server, edge device, or virtual machine (VM) by using AWS Systems Manager, then you can deregister it. Deregistering a hybrid-activated node removes it from the list of managed nodes in Systems Manager. AWS Systems Manager Agent (SSM Agent) running on the hybrid-activated node won't be able to refresh its authorization token because it's no longer registered. SSM Agent hibernates and reduce its ping frequency to Systems Manager in the cloud to once per hour. Systems Manager stores the command history for a deregistered managed node for 30 days. **Note** You can reregister an on-premises server, edge device, or VM using the same activation code and ID as long as you haven't reached the instance limit for the designated activation code and ID. You can verify the instance limit in the console by choosing **Node tools**, and then choose **Hybrid activations**. If the value of **Registered instances** is less than **Registration limit**, you can reregister a machine using the same activation code and ID. If it's greater, you must use a different activation code and ID. The following procedure describes how to deregister a hybrid-activated node by using the Systems Manager console. For information about how to do this by using the AWS Command Line Interface, see [deregister-managed-instance](https://docs.aws.amazon.com/cli/latest/reference/ssm/deregister-managed-instance.html). For related information, see the following topics: + [Deregister and reregister a managed node (Linux)](hybrid-multicloud-ssm-agent-install-linux.md#systems-manager-install-managed-linux-deregister-reregister) (Linux) + [Deregister and reregister a managed node (Windows Server)](hybrid-multicloud-ssm-agent-install-windows.md#systems-manager-install-managed-win-deregister-reregister) (Windows Server) **To deregister a hybrid-activated node (console)** 1. Open the AWS Systems Manager console at [https://console.aws.amazon.com/systems-manager/](https://console.aws.amazon.com/systems-manager/). 1. In the navigation pane, choose **Fleet Manager**. 1. Select the checkbox next to the managed node that you want to deregister. 1. Choose **Node actions, Tools, Deregister this managed node**. 1. Review the information in the **Deregister this managed node** dialog box. If you approve, choose **Deregister**. # Working with OS file systems using Fleet Manager You can use Fleet Manager, a tool in AWS Systems Manager, to work with the file system on your managed nodes. Using Fleet Manager, you can view information about the directory and file data stored on the volumes attached to your managed nodes. For example, you can view the name, size, extension, owner, and permissions for your directories and files. Up to 10,000 lines of file data can be previewed as text from the Fleet Manager console. You can also use this feature to `tail` files. When using `tail` to view file data, the last 10 lines of the file are displayed initially. As new lines of data are written to the file, the view is updated in real time. As a result, you can review log data from the console, which can improve the efficiency of your troubleshooting and systems administration. Additionally, you can create directories and copy, cut, paste, rename, or delete files and directories. We recommend creating regular backups, or taking snapshots of the Amazon Elastic Block Store (Amazon EBS) volumes attached to your managed nodes. When copying, or cutting and pasting files, existing files and directories in the destination path with the same name as the new files or directories are replaced. Serious problems can occur if you replace or modify system files and directories. AWS doesn't guarantee that these problems can be solved. Modify system files at your own risk. You're responsible for all file and directory changes, and ensuring you have backups. Deleting or replacing files and directories can't be undone. **Note** Fleet Manager uses Session Manager, a tool in AWS Systems Manager, to view text previews and `tail` files. For Amazon Elastic Compute Cloud (Amazon EC2) instances, the instance profile attached to your managed instances must provide permissions for Session Manager to use this feature. For more information about adding Session Manager permissions to an instance profile, see [Add Session Manager permissions to an existing IAM role](getting-started-add-permissions-to-existing-profile.md). **Topics** + [ # Viewing the OS file system using Fleet Manager ](fleet-manager-viewing-file-system.md) + [ # Previewing OS files using Fleet Manager ](fleet-manager-preview-os-files.md) + [ # Tailing OS files using Fleet Manager ](fleet-manager-tailing-os-files.md) + [ # Copying, cutting, and pasting OS files or directories using Fleet Manager ](fleet-manager-move-files-or-directories.md) + [ # Renaming OS files and directories using Fleet Manager ](fleet-manager-renaming-files-and-directories.md) + [ # Deleting OS files and directories using Fleet Manager ](fleet-manager-deleting-files-and-directories.md) + [ # Creating OS directories using Fleet Manager ](fleet-manager-creating-directories.md) + [ # Cutting, copying, and pasting OS directories using Fleet Manager ](fleet-manager-managing-directories.md) # Viewing the OS file system using Fleet Manager You can use Fleet Manager to view the OS file system on a Systems Manager managed node. **To view the file OS system using Fleet Manager** 1. Open the AWS Systems Manager console at [https://console.aws.amazon.com/systems-manager/](https://console.aws.amazon.com/systems-manager/). 1. In the navigation pane, choose **Fleet Manager**. 1. Select the link of the managed node with the file system you want to view. 1. Choose **Tools, File system**. # Previewing OS files using Fleet Manager You can use Fleet Manager to preview text files on an OS. **To view text previews of files using Fleet Manager** 1. Open the AWS Systems Manager console at [https://console.aws.amazon.com/systems-manager/](https://console.aws.amazon.com/systems-manager/). 1. In the navigation pane, choose **Fleet Manager**. 1. Select the link of the managed node with the files you want to preview. 1. Choose **Tools, File system**. 1. Select the **File name** of the directory that contains the file you want to preview. 1. Choose the button next to the file whose content you want to preview. 1. Choose **Actions, Preview as text**. # Tailing OS files using Fleet Manager You can use Fleet Manager to tail a file on a managed node. **To tail OS files with Fleet Manager** 1. Open the AWS Systems Manager console at [https://console.aws.amazon.com/systems-manager/](https://console.aws.amazon.com/systems-manager/). 1. In the navigation pane, choose **Fleet Manager**. 1. Select the link of the managed node with the files you want to tail. 1. Choose **Tools, File system**. 1. Select the **File name** of the directory that contains the file you want to tail. 1. Choose the button next to the file whose content you want to tail. 1. Choose **Actions, Tail file**. # Copying, cutting, and pasting OS files or directories using Fleet Manager You can use Fleet Manager to copy, cut, and paste OS files on a managed node. **To copy or cut and paste files or directories using Fleet Manager** 1. Open the AWS Systems Manager console at [https://console.aws.amazon.com/systems-manager/](https://console.aws.amazon.com/systems-manager/). 1. In the navigation pane, choose **Fleet Manager**. 1. Select the link of the managed node with the files you want to copy, or cut and paste. 1. Choose **Tools, File system**. 1. To copy or cut a file, select the **File name** of the directory that contains the file you want to copy or cut. To copy or cut a directory, choose the button next to the directory that you want to copy or cut and then proceed to step 8. 1. Choose the button next to the file you want to copy or cut. 1. In the **Actions** menu, choose **Copy** or **Cut**. 1. In the **File system** view, choose the button next to the directory you want to paste the file in. 1. In the **Actions** menu, choose **Paste**. # Renaming OS files and directories using Fleet Manager You can use Fleet Manager to rename files and directories on a managed node in your account. **To rename files or directories with Fleet Manager** 1. Open the AWS Systems Manager console at [https://console.aws.amazon.com/systems-manager/](https://console.aws.amazon.com/systems-manager/). 1. In the navigation pane, choose **Fleet Manager**. 1. Select the link of the managed node with the files or directories you want to rename. 1. Choose **Tools, File system**. 1. To rename a file, select the **File name** of the directory that contains the file you want to rename. To rename a directory, choose the button next to the directory that you want to rename and then proceed to step 8. 1. Choose the button next to the file whose content you want to rename. 1. Choose **Actions, Rename**. 1. For **File name**, enter the new name for the file and select **Rename**. # Deleting OS files and directories using Fleet Manager You can use Fleet Manager to delete files and directories on a managed node in your account. **To delete files or directories using Fleet Manager** 1. Open the AWS Systems Manager console at [https://console.aws.amazon.com/systems-manager/](https://console.aws.amazon.com/systems-manager/). 1. In the navigation pane, choose **Fleet Manager**. 1. Select the link of the managed node with the files or directories you want to delete. 1. Choose **Tools, File system**. 1. To delete a file, select the **File name** of the directory that contains the file you want to delete. To delete a directory, choose the button next to the directory that you want to delete and then proceed to step 7. 1. Choose the button next to the file with the content you want to delete. 1. Choose **Actions, Delete**. # Creating OS directories using Fleet Manager You can use Fleet Manager to create directories on a managed node in your account. **To create a directory using Fleet Manager** 1. Open the AWS Systems Manager console at [https://console.aws.amazon.com/systems-manager/](https://console.aws.amazon.com/systems-manager/). 1. In the navigation pane, choose **Fleet Manager**. 1. Select the link of the managed node you want to create a directory in. 1. Choose **Tools, File system**. 1. Select the **File name** of the directory where you want to create a new directory. 1. Select **Create directory**. 1. For **Directory name**, enter the name for the new directory, and then select **Create directory**. # Cutting, copying, and pasting OS directories using Fleet Manager You can use Fleet Manager to cut, copy, and paste directories on a managed node in your account. **To copy or cut and paste directories with Fleet Manager** 1. Open the AWS Systems Manager console at [https://console.aws.amazon.com/systems-manager/](https://console.aws.amazon.com/systems-manager/). 1. In the navigation pane, choose **Fleet Manager**. 1. Select the link of the managed node with the files you want to copy, or cut and paste. 1. Choose **Tools, File system**. 1. Choose the button next to the directory that you want to copy or cut and then proceed to step 8. 1. In the **Actions** menu, choose **Copy** or **Cut**. 1. In the **File system** view, choose the button next to the directory you want to paste the file in. 1. In the **Actions** menu, choose **Paste**. # Monitoring managed node performance You can use Fleet Manager, a tool in AWS Systems Manager, to view performance data about your managed nodes in real time. The performance data is retrieved from performance counters. The following performance counters are available in Fleet Manager: + CPU utilization + Disk input/output (I/O) utilization + Network traffic + Memory usage **Note** Fleet Manager uses Session Manager, a tool in AWS Systems Manager, to retrieve performance data. For Amazon Elastic Compute Cloud (Amazon EC2) instances, the instance profile attached to your managed instances must provide permissions for Session Manager to use this feature. For more information about adding Session Manager permissions to an instance profile, see [Add Session Manager permissions to an existing IAM role](getting-started-add-permissions-to-existing-profile.md). **To view performance data with Fleet Manager** 1. Open the AWS Systems Manager console at [https://console.aws.amazon.com/systems-manager/](https://console.aws.amazon.com/systems-manager/). 1. In the navigation pane, choose **Fleet Manager**. 1. Choose the button next to the managed node whose performance you want to monitor. 1. Choose **View details**. 1. Choose **Tools, Performance counters**. # Working with processes You can use Fleet Manager, a tool in AWS Systems Manager, to work with processes on your managed nodes. Using Fleet Manager, you can view information about processes. For example, you can see the CPU utilization and memory usage of processes in addition to their handles and threads. With Fleet Manager, you can start and terminate processes from the console. **Note** Fleet Manager uses Session Manager, a tool in AWS Systems Manager, to retrieve process data. For Amazon Elastic Compute Cloud (Amazon EC2) instances, the instance profile attached to your managed instances must provide permissions for Session Manager to use this feature. For more information about adding Session Manager permissions to an instance profile, see [Add Session Manager permissions to an existing IAM role](getting-started-add-permissions-to-existing-profile.md). **Topics** + [ # Viewing details about OS processes using Fleet Manager ](fleet-manager-view-process-details.md) + [ # Starting an OS process on a managed node using Fleet Manager ](fleet-manager-start-process.md) + [ # Terminating an OS process using Fleet Manager ](fleet-manager-terminate-process.md) # Viewing details about OS processes using Fleet Manager You can use Fleet Manager view details about processes on your managed nodes. **To view details about processes with Fleet Manager** 1. Open the AWS Systems Manager console at [https://console.aws.amazon.com/systems-manager/](https://console.aws.amazon.com/systems-manager/). 1. In the navigation pane, choose **Fleet Manager**. 1. Select the link of the node whose processes you want to view. 1. Choose **Tools, Processes**. # Starting an OS process on a managed node using Fleet Manager You can use Fleet Manager to start a process on a managed node. **To start a process with Fleet Manager** 1. Open the AWS Systems Manager console at [https://console.aws.amazon.com/systems-manager/](https://console.aws.amazon.com/systems-manager/). 1. In the navigation pane, choose **Fleet Manager**. 1. Select the link of the managed node you want to start a process on. 1. Choose **Tools, Processes**. 1. Select **Start new process**. 1. For **Process name or full path**, enter the name of the process or the full path to the executable. 1. (Optional) For **Working directory**, enter the directory path where you want the process to run. # Terminating an OS process using Fleet Manager **To terminate an OS process using Fleet Manager** 1. Open the AWS Systems Manager console at [https://console.aws.amazon.com/systems-manager/](https://console.aws.amazon.com/systems-manager/). 1. In the navigation pane, choose **Fleet Manager**. 1. Select the link of the managed node you want to start a process on. 1. Choose **Tools, Processes**. 1. Choose the button next to the process you want to terminate. 1. Choose **Actions, Terminate process** or **Actions, Terminate process tree**. **Note** Terminating a process tree also terminates all processes and applications using that process. # Viewing logs on managed nodes You can use Fleet Manager, a tool in AWS Systems Manager, to view log data stored on your managed nodes. For Windows managed nodes, you can view Windows event logs and copy their details from the console. To help you search events, filter Windows event logs by **Event level**, **Event ID**, **Event source**, and **Time created**. You can also view other log data using the procedure to view the file system. For more information about viewing the file system with Fleet Manager, see [Working with OS file systems using Fleet Manager](fleet-manager-file-system-management.md). **To view Windows event logs with Fleet Manager** 1. Open the AWS Systems Manager console at [https://console.aws.amazon.com/systems-manager/](https://console.aws.amazon.com/systems-manager/). 1. In the navigation pane, choose **Fleet Manager**. 1. Choose the button next to the managed node whose event logs you want to view. 1. Choose **View details**. 1. Choose **Tools, Windows event logs**. 1. Choose the **Log name** that contains the events you want to view. 1. Choose the button next to the **Log name** you want to view, and then select **View events**. 1. Choose the button next to the event you want to view, and then select **View event details**. 1. (Optional) Select **Copy as JSON** to copy the event details to your clipboard. # Managing OS user accounts and groups on managed nodes using Fleet Manager You can use Fleet Manager, a tool in AWS Systems Manager, to manage operating system (OS) user accounts and groups on your managed nodes. For example, you can create and delete users and groups. Additionally, you can view details like group membership, user roles, and status. **Important** Fleet Manager uses Run Command and Session Manager, tools in AWS Systems Manager, for various user management operations. As a result, a user could grant permissions to an operating system user account that they would otherwise be unable to. This is because AWS Systems Manager Agent (SSM Agent) runs on Amazon Elastic Compute Cloud (Amazon EC2) instances using root permissions (Linux) or SYSTEM permissions (Windows Server). For more information about restricting access to root-level commands through SSM Agent, see [Restricting access to root-level commands through SSM Agent](ssm-agent-restrict-root-level-commands.md). To restrict access to this feature, we recommend creating AWS Identity and Access Management (IAM) policies for your users that only allow access to the actions you define. For more information about creating IAM policies for Fleet Manager, see [Controlling access to Fleet Manager](configuring-fleet-manager-permissions.md). **Topics** + [ # Creating an OS user or group using Fleet Manager ](manage-os-user-accounts-create.md) + [ # Updating user or group membership using Fleet Manager ](manage-os-user-accounts-update.md) + [ # Deleting an OS user or group using Fleet Manager ](manage-os-user-accounts-delete.md) # Creating an OS user or group using Fleet Manager **Note** Fleet Manager uses Session Manager to set passwords for new users. For Amazon EC2 instances, the instance profile attached to your managed instances must provide permissions for Session Manager to use this feature. For more information about adding Session Manager permissions to an instance profile, see [Add Session Manager permissions to an existing IAM role](getting-started-add-permissions-to-existing-profile.md). Instead of logging on directly to a server to create a user account or group, you can use the Fleet Manager console to perform the same tasks. **To create an OS user account using Fleet Manager** 1. Open the AWS Systems Manager console at [https://console.aws.amazon.com/systems-manager/](https://console.aws.amazon.com/systems-manager/). 1. In the navigation pane, choose **Fleet Manager**. 1. Choose the button next to the managed node you want to create a new user on. 1. Choose **View details**. 1. Choose **Tools, Users and groups**. 1. Choose the **Users** tab, and then choose **Create user**. 1. Enter a value for the **Name** of the new user. 1. (Recommended) Select the check box next to **Set password**. You will be prompted to provide a password for the new user at the end of the procedure. 1. Select **Create user**. If you selected the check box to create a password for the new user, you will be prompted to enter a value for the password and select **Done**. If the password you specify doesn't meet the requirements specified by your managed node's local or domain policies, an error is returned. **To create an OS group using Fleet Manager** 1. Open the AWS Systems Manager console at [https://console.aws.amazon.com/systems-manager/](https://console.aws.amazon.com/systems-manager/). 1. In the navigation pane, choose **Fleet Manager**. 1. Choose the button next to the managed node you want to create a group in. 1. Choose **View details**. 1. Choose **Tools, Users and groups**. 1. Choose the **Groups** tab, and then choose **Create group**. 1. Enter a value for the **Name** of the new group. 1. (Optional) Enter a value for the **Description** of the new group. 1. (Optional) Select users to add to the **Group members** for the new group. 1. Select **Create group**. # Updating user or group membership using Fleet Manager Instead of logging on directly to a server to update a user account or group, you can use the Fleet Manager console to perform the same tasks. **To add an OS user account to a new group using Fleet Manager** 1. Open the AWS Systems Manager console at [https://console.aws.amazon.com/systems-manager/](https://console.aws.amazon.com/systems-manager/). 1. In the navigation pane, choose **Fleet Manager**. 1. Choose the button next to the managed node where the user account exists that you want to update. 1. Choose **View details**. 1. Choose **Tools, Users and groups**. 1. Choose the **Users** tab. 1. Choose the button next to the user you want to update. 1. Choose **Actions, Add user to group**. 1. Choose the group you want to add the user to under **Add to group**. 1. Select **Add user to group**. **To edit an OS group's membership using Fleet Manager** 1. Open the AWS Systems Manager console at [https://console.aws.amazon.com/systems-manager/](https://console.aws.amazon.com/systems-manager/). 1. In the navigation pane, choose **Fleet Manager**. 1. Choose the button next to the managed node where the group exists that you want to update. 1. Choose **View details**. 1. Choose **Tools, Users and groups**. 1. Choose the **Groups** tab. 1. Choose the button next to the group you want to update. 1. Choose **Actions, Modify group**. 1. Choose the users you want to add or remove under **Group members**. 1. Select **Modify group**. # Deleting an OS user or group using Fleet Manager Instead of logging on directly to a server to delete a user account or group, you can use the Fleet Manager console to perform the same tasks. **To delete an OS user account using Fleet Manager** 1. Open the AWS Systems Manager console at [https://console.aws.amazon.com/systems-manager/](https://console.aws.amazon.com/systems-manager/). 1. In the navigation pane, choose **Fleet Manager**. 1. Choose the button next to the managed node where the user account exists that you want to delete. 1. Choose **View details**. 1. Choose **Users and groups**. 1. Choose the **Users** tab. 1. Choose the button next to the user you want to delete. 1. Choose **Actions, Delete local user**. **To delete an OS group using Fleet Manager** 1. Open the AWS Systems Manager console at [https://console.aws.amazon.com/systems-manager/](https://console.aws.amazon.com/systems-manager/). 1. In the navigation pane, choose **Fleet Manager**. 1. Choose the button next to the managed node where the group exists that you want to delete. 1. Choose **View details**. 1. Choose **Tools, Users and groups**. 1. Choose the **Group** tab. 1. Choose the button next to the group you want to update. 1. Choose **Actions, Delete local group**. # Managing the Windows registry on managed nodes You can use Fleet Manager, a tool in AWS Systems Manager, to manage the registry on your Windows Server managed nodes. From the Fleet Manager console you can create, copy, update, and delete registry entries and values. **Important** We recommend creating a backup of the registry, or taking a snapshot of the root Amazon Elastic Block Store (Amazon EBS) volume attached to your managed node, before you modify the registry. Serious problems can occur if you modify the registry incorrectly. These problems might require you to reinstall the operating system, or restore the root volume of your node from a snapshot. AWS doesn't guarantee that these problems can be solved. Modify the registry at your own risk. You're responsible for all registry changes, and ensuring you have backups. ## Create a Windows registry key or entry **To create a Windows registry key with Fleet Manager** 1. Open the AWS Systems Manager console at [https://console.aws.amazon.com/systems-manager/](https://console.aws.amazon.com/systems-manager/). 1. In the navigation pane, choose **Fleet Manager**. 1. Choose the button next to the managed node you want to create a registry key on. 1. Choose **View details**. 1. Choose **Tools, Windows registry**. 1. Choose the hive you want to create a new registry key in by selecting the **Registry name**. 1. Choose **Create, Create registry key**. 1. Choose the button next to the registry entry you want to create a new key in. 1. Choose **Create registry key**. 1. Enter a value for the **Name** of the new registry key, and select **Submit**. **To create a Windows registry entry with Fleet Manager** 1. Open the AWS Systems Manager console at [https://console.aws.amazon.com/systems-manager/](https://console.aws.amazon.com/systems-manager/). 1. In the navigation pane, choose **Fleet Manager**. 1. Choose the button next to the instance you want to create a registry entry on. 1. Choose **View details**. 1. Choose **Tools, Windows registry**. 1. Choose the hive, and subsequent registry key you want to create a new registry entry in by selecting the **Registry name**. 1. Choose **Create, Create registry entry**. 1. Enter a value for the **Name** of the new registry entry. 1. Choose the **Type** of value you want to create for the registry entry. For more information about registry value types, see [Registry value types](https://docs.microsoft.com/en-us/windows/win32/sysinfo/registry-value-types). 1. Enter a value for the **Value** of the new registry entry. ## Update a Windows registry entry **To update a Windows registry entry with Fleet Manager** 1. Open the AWS Systems Manager console at [https://console.aws.amazon.com/systems-manager/](https://console.aws.amazon.com/systems-manager/). 1. In the navigation pane, choose **Fleet Manager**. 1. Choose the button next to the managed node you want to update a registry entry on. 1. Choose **View details**. 1. Choose **Tools, Windows registry**. 1. Choose the hive, and subsequent registry key you want to update by selecting the **Registry name**. 1. Choose the button next to the registry entry you want to update. 1. Choose **Actions, Update registry entry**. 1. Enter the new value for the **Value** of the registry entry. 1. Choose **Update**. ## Delete a Windows registry entry or key **To delete a Windows registry key with Fleet Manager** 1. Open the AWS Systems Manager console at [https://console.aws.amazon.com/systems-manager/](https://console.aws.amazon.com/systems-manager/). 1. In the navigation pane, choose **Fleet Manager**. 1. Choose the button next to the managed node you want to delete a registry key on. 1. Choose **Tools, Windows registry**. 1. Choose the hive, and subsequent registry key you want to delete by selecting the **Registry name**. 1. Choose the button next to the registry key you want to delete. 1. Choose **Actions, Delete registry key**. **To delete a Windows registry entry with Fleet Manager** 1. Open the AWS Systems Manager console at [https://console.aws.amazon.com/systems-manager/](https://console.aws.amazon.com/systems-manager/). 1. In the navigation pane, choose **Fleet Manager**. 1. Choose the button next to the managed node you want to delete a registry entry on. 1. Choose **View details**. 1. Choose **Tools, Windows registry**. 1. Choose the hive, and subsequent registry key containing the entry you want to delete by selecting the **Registry name**. 1. Choose the button next to the registry entry you want to delete. 1. Choose **Actions, Delete registry entry**. # Managing EC2 instances automatically with Default Host Management Configuration The Default Host Management Configuration setting allows AWS Systems Manager to manage your Amazon EC2 instances automatically as *managed instances*. A managed instance is an EC2 instance that is configured for use with Systems Manager. The benefits of managing your instances with Systems Manager include the following: + Connect to your EC2 instances securely using Session Manager. + Perform automated patch scans using Patch Manager. + View detailed information about your instances using Systems Manager Inventory. + Track and manage instances using Fleet Manager. + Keep SSM Agent up to date automatically. *Fleet Manager, Inventory, Patch Manager, and Session Manager are tools in Systems Manager.* Using Default Host Management Configuration, you can manage EC2 instances without having to manually create an AWS Identity and Access Management (IAM) instance profile. Instead, Default Host Management Configuration creates and applies a default IAM role to ensure that Systems Manager has permissions to manage all instances in the AWS account and AWS Region where it's activated. If the permissions provided aren't sufficient for your use case, you can also add policies to the default IAM role created by the Default Host Management Configuration. Alternatively, if you don't need permissions for all of the capabilities provided by the default IAM role, you can create your own custom role and policies. Any changes made to the IAM role you choose for Default Host Management Configuration applies to all managed Amazon EC2 instances in the Region and account. For more information about the policy used by Default Host Management Configuration, see [AWS managed policy: AmazonSSMManagedEC2InstanceDefaultPolicy](security-iam-awsmanpol.md#security-iam-awsmanpol-AmazonSSMManagedEC2InstanceDefaultPolicy). **Implement least privilege access** The procedures in this topic are intended to be performed only by administrators. Therefore, we recommend implementing *least privilege access* in order to prevent non-administrative users from configuring or modifying the Default Host Management Configuration. To view example policies that restrict access to the Default Host Management Configuration, see [Least privilege policy examples for Default Host Management Configuration](#least-privilege-examples) later in this topic. **Important** Registration information for instances registered using Default Host Management Configuration is stored locally in the `var/lib/amazon/ssm` or `C:\ProgramData\Amazon` directories. Removing these directories or their files will prevent the instance from acquiring the necessary credentials to connect to Systems Manager using Default Host Management Configuration. In these cases, you must use an IAM instance profile to provide the required permissions to your instance, or recreate the instance. **Topics** + [ ## Prerequisites ](#dhmc-prerequisites) + [ ## Activating the Default Host Management Configuration setting ](#dhmc-activate) + [ ## Deactivating the Default Host Management Configuration setting ](#dhmc-deactivate) + [ ## Least privilege policy examples for Default Host Management Configuration ](#least-privilege-examples) ## Prerequisites In order to use Default Host Management Configuration in the AWS Region and AWS account where you activate the setting, the following requirements must be met. + An instance to be managed must use Instance Metadata Service Version 2 (IMDSv2). Default Host Management Configuration doesn't support Instance Metadata Service Version 1. For information about transitioning to IMDSv2, see [Transition to using Instance Metadata Service Version 2](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-metadata-transition-to-version-2.html) in the *Amazon EC2 User Guide* + SSM Agent version 3.2.582.0 or later must be installed on the instance to be managed. For information about checking the version of SSM Agent installed on your instance, see [Checking the SSM Agent version number](ssm-agent-get-version.md). For information about updating SSM Agent, see [Automatically updating SSM Agent](ssm-agent-automatic-updates.md#ssm-agent-automatic-updates-console). + You, as the administrator performing the tasks in this topic, must have permissions for the [GetServiceSetting](https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_GetServiceSetting.html), [ResetServiceSetting](https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_ResetServiceSetting.html), and [UpdateServiceSetting](https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_UpdateServiceSetting.html) API operations. Additionally, you must have permissions for the `iam:PassRole` permission for the `AWSSystemsManagerDefaultEC2InstanceManagementRole` IAM role. The following is an example policy providing these permissions. Replace each *example resource placeholder* with your own information. ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ssm:GetServiceSetting", "ssm:ResetServiceSetting", "ssm:UpdateServiceSetting" ], "Resource": "arn:aws:ssm:us-east-1:111122223333:servicesetting/ssm/managed-instance/default-ec2-instance-management-role" }, { "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::111122223333:role/service-role/AWSSystemsManagerDefaultEC2InstanceManagementRole", "Condition": { "StringEquals": { "iam:PassedToService": [ "ssm.amazonaws.com" ] } } } ] } ``` ------ + If an IAM instance profile is already attached to an EC2 instance that is to be managed using Systems Manager, you must remove any permissions from it that allow the `ssm:UpdateInstanceInformation` operation. SSM Agent attempts to use instance profile permissions before using the Default Host Management Configuration permissions. If you allow the `ssm:UpdateInstanceInformation` operation in your own IAM instance profile, the instance will not use the Default Host Management Configuration permissions. ## Activating the Default Host Management Configuration setting You can activate Default Host Management Configuration from the Fleet Manager console, or by using the AWS Command Line Interface or AWS Tools for Windows PowerShell. You must turn on the Default Host Management Configuration one by one in each Region you where you want your Amazon EC2 instances managed by this setting. After turning on Default Host Management Configuration, it might take up to 30 minutes for your instances to use the credentials of the role you choose in step 5 in the following procedure. **To activate Default Host Management Configuration (console)** 1. Open the AWS Systems Manager console at [https://console.aws.amazon.com/systems-manager/](https://console.aws.amazon.com/systems-manager/). 1. In the navigation pane, choose **Fleet Manager**. 1. Choose **Account management, Configure Default Host Management Configuration**. 1. Turn on **Enable Default Host Management Configuration**. 1. Choose the AWS Identity and Access Management (IAM) role used to enable Systems Manager tools for your instances. We recommend using the default role provided by Default Host Management Configuration. It contains the minimum set of permissions necessary to manage your Amazon EC2 instances using Systems Manager. If you prefer to use a custom role, the role's trust policy must allow Systems Manager as a trusted entity. 1. Choose **Configure** to complete setup. **To activate Default Host Management Configuration (command line)** 1. Create a JSON file on your local machine containing the following trust relationship policy. ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement":[ { "Sid":"", "Effect":"Allow", "Principal":{ "Service":"ssm.amazonaws.com" }, "Action":"sts:AssumeRole" } ] } ``` ------ 1. Open the AWS CLI or Tools for Windows PowerShell and run one of the following commands, depending on the operating system type of your local machine, to create a service role in your account. Replace each *example resource placeholder* with your own information. ------ #### [ Linux & macOS ] ``` aws iam create-role \ --role-name AWSSystemsManagerDefaultEC2InstanceManagementRole \ --path /service-role/ \ --assume-role-policy-document file://trust-policy.json ``` ------ #### [ Windows ] ``` aws iam create-role ^ --role-name AWSSystemsManagerDefaultEC2InstanceManagementRole ^ --path /service-role/ ^ --assume-role-policy-document file://trust-policy.json ``` ------ #### [ PowerShell ] ``` New-IAMRole ` -RoleName "AWSSystemsManagerDefaultEC2InstanceManagementRole" ` -Path "/service-role/" ` -AssumeRolePolicyDocument "file://trust-policy.json" ``` ------ 1. Run the following command to attach the `AmazonSSMManagedEC2InstanceDefaultPolicy` managed policy to your newly created role. Replace each *example resource placeholder* with your own information. ------ #### [ Linux & macOS ] ``` aws iam attach-role-policy \ --policy-arn arn:aws:iam::aws:policy/AmazonSSMManagedEC2InstanceDefaultPolicy \ --role-name AWSSystemsManagerDefaultEC2InstanceManagementRole ``` ------ #### [ Windows ] ``` aws iam attach-role-policy ^ --policy-arn arn:aws:iam::aws:policy/AmazonSSMManagedEC2InstanceDefaultPolicy ^ --role-name AWSSystemsManagerDefaultEC2InstanceManagementRole ``` ------ #### [ PowerShell ] ``` Register-IAMRolePolicy ` -PolicyArn "arn:aws:iam::aws:policy/AmazonSSMManagedEC2InstanceDefaultPolicy" ` -RoleName "AWSSystemsManagerDefaultEC2InstanceManagementRole" ``` ------ 1. Open the AWS CLI or Tools for Windows PowerShell and run the following command. Replace each *example resource placeholder* with your own information. ------ #### [ Linux & macOS ] ``` aws ssm update-service-setting \ --setting-id arn:aws:ssm:region:account-id:servicesetting/ssm/managed-instance/default-ec2-instance-management-role \ --setting-value service-role/AWSSystemsManagerDefaultEC2InstanceManagementRole ``` ------ #### [ Windows ] ``` aws ssm update-service-setting ^ --setting-id arn:aws:ssm:region:account-id:servicesetting/ssm/managed-instance/default-ec2-instance-management-role ^ --setting-value service-role/AWSSystemsManagerDefaultEC2InstanceManagementRole ``` ------ #### [ PowerShell ] ``` Update-SSMServiceSetting ` -SettingId "arn:aws:ssm:region:account-id:servicesetting/ssm/managed-instance/default-ec2-instance-management-role" ` -SettingValue "service-role/AWSSystemsManagerDefaultEC2InstanceManagementRole" ``` ------ There is no output if the command succeeds. 1. Run the following command to view the current service settings for Default Host Management Configuration in the current AWS account and AWS Region. ------ #### [ Linux & macOS ] ``` aws ssm get-service-setting \ --setting-id arn:aws:ssm:region:account-id:servicesetting/ssm/managed-instance/default-ec2-instance-management-role ``` ------ #### [ Windows ] ``` aws ssm get-service-setting ^ --setting-id arn:aws:ssm:region:account-id:servicesetting/ssm/managed-instance/default-ec2-instance-management-role ``` ------ #### [ PowerShell ] ``` Get-SSMServiceSetting ` -SettingId "arn:aws:ssm:region:account-id:servicesetting/ssm/managed-instance/default-ec2-instance-management-role" ``` ------ The command returns information like the following. ``` { "ServiceSetting": { "SettingId": "/ssm/managed-instance/default-ec2-instance-management-role", "SettingValue": "service-role/AWSSystemsManagerDefaultEC2InstanceManagementRole", "LastModifiedDate": "2022-11-28T08:21:03.576000-08:00", "LastModifiedUser": "System", "ARN": "arn:aws:ssm:us-east-2:-123456789012:servicesetting/ssm/managed-instance/default-ec2-instance-management-role", "Status": "Custom" } } ``` ## Deactivating the Default Host Management Configuration setting You can deactivate Default Host Management Configuration from the Fleet Manager console, or by using the AWS Command Line Interface or AWS Tools for Windows PowerShell. You must turn off the Default Host Management Configuration setting one by one in each Region where you no longer want your your Amazon EC2 instances managed by this configuration. Deactivating it in one Region doesn't deactivate it in all Regions. If you deactivate Default Host Management Configuration, and you have not attached an instance profile to your Amazon EC2 instances that allows access to Systems Manager, they will no longer be managed by Systems Manager. **To deactivate Default Host Management Configuration (console)** 1. Open the AWS Systems Manager console at [https://console.aws.amazon.com/systems-manager/](https://console.aws.amazon.com/systems-manager/). 1. In the navigation pane, choose **Fleet Manager**. 1. Choose **Account management, Default Host Management Configuration**. 1. Turn off **Enable Default Host Management Configuration**. 1. Choose **Configure** to disable Default Host Management Configuration. **To deactivate Default Host Management Configuration (command line)** + Open the AWS CLI or Tools for Windows PowerShell and run the following command. Replace each *example resource placeholder* with your own information. ------ #### [ Linux & macOS ] ``` aws ssm reset-service-setting \ --setting-id arn:aws:ssm:region:account-id:servicesetting/ssm/managed-instance/default-ec2-instance-management-role ``` ------ #### [ Windows ] ``` aws ssm reset-service-setting ^ --setting-id arn:aws:ssm:region:account-id:servicesetting/ssm/managed-instance/default-ec2-instance-management-role ``` ------ #### [ PowerShell ] ``` Reset-SSMServiceSetting ` -SettingId "arn:aws:ssm:region:account-id:servicesetting/ssm/managed-instance/default-ec2-instance-management-role" ``` ------ ## Least privilege policy examples for Default Host Management Configuration The following sample policies demonstrate how to prevent members of your organization from making changes to the Default Host Management Configuration setting in your account. ### Service control policy for AWS Organizations The following policy demonstrates how to prevent non-administrative members in your AWS Organizations from updating your Default Host Management Configuration setting. Replace each *example resource placeholder* with your own information. ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": [{ "Effect": "Deny", "Action": [ "ssm:UpdateServiceSetting", "ssm:ResetServiceSetting" ], "Resource": "arn:aws:ssm:*:*:servicesetting/ssm/managed-instance/default-ec2-instance-management-role", "Condition": { "StringNotEqualsIgnoreCase": { "aws:PrincipalTag/job-function": [ "administrator" ] } } }, { "Effect": "Deny", "Action": [ "iam:PassRole" ], "Resource": "arn:aws:iam::*:role/service-role/AWSSystemsManagerDefaultEC2InstanceManagementRole", "Condition": { "StringEquals": { "iam:PassedToService": "ssm.amazonaws.com" }, "StringNotEqualsIgnoreCase": { "aws:PrincipalTag/job-function": [ "administrator" ] } } }, { "Effect": "Deny", "Resource": "arn:aws:iam::*:role/service-role/AWSSystemsManagerDefaultEC2InstanceManagementRole", "Action": [ "iam:AttachRolePolicy", "iam:DeleteRole" ], "Condition": { "StringNotEqualsIgnoreCase": { "aws:PrincipalTag/job-function": [ "administrator" ] } } } ] } ``` ------ ### Policy for IAM principals The following policy demonstrates how to prevent IAM groups, roles, or users in your AWS Organizations from updating your Default Host Management Configuration setting. Replace each *example resource placeholder* with your own information. ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": [ { "Effect": "Deny", "Action": [ "ssm:UpdateServiceSetting", "ssm:ResetServiceSetting" ], "Resource": "arn:aws:ssm:us-east-1:111122223333:servicesetting/ssm/managed-instance/default-ec2-instance-management-role" }, { "Effect": "Deny", "Action": [ "iam:AttachRolePolicy", "iam:DeleteRole", "iam:PassRole" ], "Resource": "arn:aws:iam::111122223333:role/service-role/AWSSystemsManagerDefaultEC2InstanceManagementRole" } ] } ``` ------ # Connecting to a Windows Server managed instance using Remote Desktop You can use Fleet Manager, a tool in AWS Systems Manager, to connect to your Windows Server Amazon Elastic Compute Cloud (Amazon EC2) instances using the Remote Desktop Protocol (RDP). Fleet Manager Remote Desktop, which is powered by [Amazon DCV](https://docs.aws.amazon.com/dcv/latest/adminguide/what-is-dcv.html), provides you with secure connectivity to your Windows Server instances directly from the Systems Manager console. You can have up to four simultaneous connections in a single browser window. The Fleet Manager Remote Desktop API is named AWS Systems Manager GUI Connect. For information about using the Systems Manager GUI Connect API, see the *[AWS Systems Manager GUI Connect API Reference](https://docs.aws.amazon.com/ssm-guiconnect/latest/APIReference)*. Currently, you can only use Remote Desktop with instances that are running Windows Server 2012 RTM or higher. Remote Desktop supports only English language inputs. Fleet Manager Remote Desktop is a console-only service and doesn't support command-line connections to your managed instances. To connect to a Windows Server managed instance through a shell, you can use Session Manager, another tool in AWS Systems Manager. For more information, see [AWS Systems Manager Session Manager](session-manager.md). **Note** The duration of an RDP connection is not determined by the duration of your AWS Identity and Access Management (IAM) credentials. Instead, the connection persists until the maximum connection duration or idle time limit is met, whichever comes first. For more information, see [Remote connection duration and concurrency](#rdp-duration-concurrency). For information about configuring AWS Identity and Access Management (IAM) permissions to allow your instances to interact with Systems Manager, see [Configure instance permissions for Systems Manager](setup-instance-permissions.md). **Topics** + [ ## Setting up your environment ](#rdp-prerequisites) + [ ## Configuring IAM permissions for Remote Desktop ](#rdp-iam-policy-examples) + [ ## Authenticating Remote Desktop connections ](#rdp-authentication) + [ ## Remote connection duration and concurrency ](#rdp-duration-concurrency) + [ ## Systems Manager GUI Connect handling of AWS IAM Identity Center attributes ](#iam-identity-center-attribute-handling) + [ ## Connect to a managed node using Remote Desktop ](#rdp-connect-to-node) + [ ## Viewing information about current and completed connections ](#list-connections) ## Setting up your environment Before using Remote Desktop, verify that your environment meets the following requirements: + **Managed node configuration** Make sure that your Amazon EC2 instances are configured as [managed nodes](fleet-manager-managed-nodes.md) in Systems Manager. + **SSM Agent minimum version** Verify that nodes are running SSM Agent version 3.0.222.0 or higher. For information about how to check which agent version is running on a node, see [Checking the SSM Agent version number](ssm-agent-get-version.md). For information about installing or updating SSM Agent, see [Working with SSM Agent](ssm-agent.md). + **RDP port configuration** To accept remote connections, the Remote Desktop Services service on your Windows Server nodes must use default RDP port 3389. This is the default configuration on Amazon Machine Images (AMIs) provided by AWS. You are not explicitly required to open any inbound ports to use Remote Desktop. + **PSReadLine module version for keyboard functionality** To ensure that your keyboard functions properly in PowerShell, verify that nodes running Windows Server 2022 have PSReadLine module version 2.2.2 or higher installed. If they are running an older version, you can install the required version using the following commands. ``` Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force ``` After the NuGet package provider is installed, run the following command. ``` Install-Module ` -Name PSReadLine ` -Repository PSGallery ` -MinimumVersion 2.2.2 -Force ``` + **Session Manager configuration** Before you can use Remote Desktop, you must complete the prerequisites for Session Manager setup. When you connect to an instance using Remote Desktop, any session preferences defined for your AWS account and AWS Region are applied. For more information, see [Setting up Session Manager](session-manager-getting-started.md). **Note** If you log Session Manager activity using Amazon Simple Storage Service (Amazon S3), then your Remote Desktop connections will generate the following error in `bucket_name/Port/stderr`. This error is expected behavior and can be safely ignored. ``` Setting up data channel with id SESSION_ID failed: failed to create websocket for datachannel with error: CreateDataChannel failed with no output or error: createDataChannel request failed: unexpected response from the service Session is already terminated ``` ## Configuring IAM permissions for Remote Desktop In addition to the required IAM permissions for Systems Manager and Session Manager, the user or role you use must be allowed permissions for initiating connections. **Permissions for initiating connections** To make RDP connections to EC2 instances in the console, the following permissions are required: + `ssm-guiconnect:CancelConnection` + `ssm-guiconnect:GetConnection` + `ssm-guiconnect:StartConnection` **Permissions for listing connections** In order to view lists of connections in the console, the following permission is required: `ssm-guiconnect:ListConnections` The following are example IAM policies that you can attach to a user or role to allow different types of interaction with Remote Desktop. Replace each *example resource placeholder* with your own information. ### Standard policy for connecting to EC2 instances ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": [ { "Sid": "EC2", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:GetPasswordData" ], "Resource": "*" }, { "Sid": "SSM", "Effect": "Allow", "Action": [ "ssm:DescribeInstanceProperties", "ssm:GetCommandInvocation", "ssm:GetInventorySchema" ], "Resource": "*" }, { "Sid": "TerminateSession", "Effect": "Allow", "Action": [ "ssm:TerminateSession" ], "Resource": "*", "Condition": { "StringLike": { "ssm:resourceTag/aws:ssmmessages:session-id": [ "${aws:userid}" ] } } }, { "Sid": "SSMStartSession", "Effect": "Allow", "Action": [ "ssm:StartSession" ], "Resource": [ "arn:aws:ec2:*:111122223333:instance/*", "arn:aws:ssm:*:111122223333:managed-instance/*", "arn:aws:ssm:*::document/AWS-StartPortForwardingSession" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "ssm-guiconnect.amazonaws.com" } } }, { "Sid": "SSMMessages", "Effect": "Allow", "Action": [ "ssmmessages:OpenDataChannel" ], "Resource": [ "arn:aws:ssm:*:111122223333:session/*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "ssm-guiconnect.amazonaws.com" } } }, { "Sid": "GuiConnect", "Effect": "Allow", "Action": [ "ssm-guiconnect:CancelConnection", "ssm-guiconnect:GetConnection", "ssm-guiconnect:StartConnection", "ssm-guiconnect:ListConnections" ], "Resource": "*" } ] } ``` ------ ### Policy for connecting to EC2 instances with specific tags **Note** In the following IAM policy, the `SSMStartSession` section requires an Amazon Resource Name (ARN) for the `ssm:StartSession` action. As shown, the ARN you specify does *not* require an AWS account ID. If you specify an account ID, Fleet Manager returns an `AccessDeniedException`. The `AccessTaggedInstances` section, which is located lower in the example policy, also requires ARNs for `ssm:StartSession`. For those ARNs, you do specify AWS account IDs. ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": [ { "Sid": "EC2", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:GetPasswordData" ], "Resource": "*" }, { "Sid": "SSM", "Effect": "Allow", "Action": [ "ssm:DescribeInstanceProperties", "ssm:GetCommandInvocation", "ssm:GetInventorySchema" ], "Resource": "*" }, { "Sid": "SSMStartSession", "Effect": "Allow", "Action": [ "ssm:StartSession" ], "Resource": [ "arn:aws:ssm:*::document/AWS-StartPortForwardingSession" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "ssm-guiconnect.amazonaws.com" } } }, { "Sid": "AccessTaggedInstances", "Effect": "Allow", "Action": [ "ssm:StartSession" ], "Resource": [ "arn:aws:ec2:*:111122223333:instance/*", "arn:aws:ssm:*:111122223333:managed-instance/*" ], "Condition": { "StringLike": { "ssm:resourceTag/tag key": [ "tag value" ] } } }, { "Sid": "SSMMessages", "Effect": "Allow", "Action": [ "ssmmessages:OpenDataChannel" ], "Resource": [ "arn:aws:ssm:*:111122223333:session/*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "ssm-guiconnect.amazonaws.com" } } }, { "Sid": "GuiConnect", "Effect": "Allow", "Action": [ "ssm-guiconnect:CancelConnection", "ssm-guiconnect:GetConnection", "ssm-guiconnect:StartConnection", "ssm-guiconnect:ListConnections" ], "Resource": "*" } ] } ``` ------ ### Policy for AWS IAM Identity Center users to connect to EC2 instances ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": [ { "Sid": "SSO", "Effect": "Allow", "Action": [ "sso:ListDirectoryAssociations*", "identitystore:DescribeUser" ], "Resource": "*" }, { "Sid": "EC2", "Effect": "Allow", "Action": [ "ec2:DescribeInstances", "ec2:GetPasswordData" ], "Resource": "*" }, { "Sid": "SSM", "Effect": "Allow", "Action": [ "ssm:DescribeInstanceProperties", "ssm:GetCommandInvocation", "ssm:GetInventorySchema" ], "Resource": "*" }, { "Sid": "TerminateSession", "Effect": "Allow", "Action": [ "ssm:TerminateSession" ], "Resource": "*", "Condition": { "StringLike": { "ssm:resourceTag/aws:ssmmessages:session-id": [ "${aws:userName}" ] } } }, { "Sid": "SSMStartSession", "Effect": "Allow", "Action": [ "ssm:StartSession" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ssm:*:*:managed-instance/*", "arn:aws:ssm:*:*:document/AWS-StartPortForwardingSession" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "ssm-guiconnect.amazonaws.com" } } }, { "Sid": "SSMSendCommand", "Effect": "Allow", "Action": [ "ssm:SendCommand" ], "Resource": [ "arn:aws:ec2:*:*:instance/*", "arn:aws:ssm:*:*:managed-instance/*", "arn:aws:ssm:*:*:document/AWSSSO-CreateSSOUser" ] }, { "Sid": "SSMMessages", "Effect": "Allow", "Action": [ "ssmmessages:OpenDataChannel" ], "Resource": [ "arn:aws:ssm:*:111122223333:session/*" ], "Condition": { "ForAnyValue:StringEquals": { "aws:CalledVia": "ssm-guiconnect.amazonaws.com" } } }, { "Sid": "GuiConnect", "Effect": "Allow", "Action": [ "ssm-guiconnect:CancelConnection", "ssm-guiconnect:GetConnection", "ssm-guiconnect:StartConnection", "ssm-guiconnect:ListConnections" ], "Resource": "*" } ] } ``` ------ ## Authenticating Remote Desktop connections When establishing a remote connection, you can authenticate using Windows credentials or the Amazon EC2 key pair (`.pem` file) that is associated with the instance. For information about using key pairs, see [Amazon EC2 key pairs and Windows instances](https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/ec2-key-pairs.html) in the *Amazon EC2 User Guide*. Alternatively, if you're authenticated to the AWS Management Console using AWS IAM Identity Center, you can connect to your instances without providing additional credentials. For an example of a policy to allow remote connection authentication using IAM Identity Center, see [Configuring IAM permissions for Remote Desktop](#rdp-iam-policy-examples). Remote Desktop connections using IAM Identity Center authentication are available in all AWS Regions where IAM Identity Center is supported. **Before you begin** Note the following conditions for using IAM Identity Center authentication before you begin connecting using Remote Desktop. + Remote Desktop supports IAM Identity Center authentication for nodes in the same AWS Region where you enabled IAM Identity Center. + Remote Desktop supports IAM Identity Center user names of up to 16 characters. + Remote Desktop supports IAM Identity Center user names consisting of alphanumeric characters and the following special characters: `.` `-` `_` **Important** Connections won't succeed for IAM Identity Center user names that contain the following characters: `+` `=` `,` IAM Identity Center supports these characters in user names, but Fleet Manager RDP connections do not. In addition, if an IAM Identity Center user name contains one or more `@` symbols, Fleet Manager disregards the first `@` symbol and all characters that follow it, whether or not the `@` introduces the domain portion of an email address. For instance, for the IAM Identity Center user name `diego_ramirez@example.com`, the `@example.com` portion is ignored and the user name for Fleet Manager becomes `diego_ramirez`. For `diego_r@mirez@example.com`, Fleet Manager disregards `@mirez@example.com`, and the username for Fleet Manager becomes `diego_r`. + When a connection is authenticated using IAM Identity Center, Remote Desktop creates a local Windows user in the instance’s Local Administrators group. This user persists after the remote connection has ended. + Remote Desktop does not allow IAM Identity Center authentication for nodes that are Microsoft Active Directory domain controllers. + Although Remote Desktop allows you to use IAM Identity Center authentication for nodes *joined* to an Active Directory domain, we do not recommend doing so. This authentication method grants administrative permissions to users which might override more restrictive permissions granted by the domain. ## Remote connection duration and concurrency The following conditions apply to active Remote Desktop connections: + **Connection duration** By default, a Remote Desktop connection is disconnected after 60 minutes. To prevent a connection from being disconnected, you can choose **Renew session** before being disconnected to reset the duration timer. + **Connection timeout** A Remote Desktop connection disconnects after it has been idle for more than 10 minutes. + **Connection persistence** After you connect to a Windows Server using Remote Desktop, the connection persists until the maximum connection duration (60 minutes) or idle timeout limit (10 minutes) is met. Connection duration is not determined by the duration of your AWS Identity and Access Management (IAM) credentials. The connection persists after IAM credentials expire if the connection duration limits are not met. When using Remote Desktop, you should terminate your connection after your IAM credentials expire by leaving the browser page. + **Concurrent connections** By default, you can have a maximum of 5 active Remote Desktop connections at one time for the same AWS account and AWS Region. To request a service quota increase of up to 50 concurrent connections, see [Requesting a quota increase ](https://docs.aws.amazon.com/servicequotas/latest/userguide/request-quota-increase.html)in the *Service Quotas User Guide*. **Note** The standard license for Windows Server allows for two concurrent RDP connections. To support more connections, you must purchase additional Client Access Licenses (CALs) from Microsoft or Microsoft Remote Desktop Services licenses from AWS. For more information on supplemental licensing, see the following topics: [Client Access Licenses and Management Licenses](https://www.microsoft.com/en-us/licensing/product-licensing/client-access-license) on the Microsoft website [Use License Manager user-based subscriptions for supported software products](https://docs.aws.amazon.com/license-manager/latest/userguide/user-based-subscriptions.html) in the *License Manager User Guide* ## Systems Manager GUI Connect handling of AWS IAM Identity Center attributes Systems Manager GUI Connect is the API that supports Fleet Manager connections to EC2 instances using RDP. The following IAM Identity Center user data is retained after a connection is closed: + `username` Systems Manager GUI Connect encrypts this identity attribute at rest using an AWS managed key by default. Customer managed keys are not supported for encrypting this attribute in Systems Manager GUI Connect. If you delete a user in your IAM Identity Center instance, Systems Manager GUI Connect continues to retain the `username` attribute associated with that user for 7 years, after which it is deleted. This data is retained to support auditing events, such as listing Systems Manager GUI Connect connection history. The data can't be deleted manually. ## Connect to a managed node using Remote Desktop **Browser copy/paste support for text** Using the Google Chrome and Microsoft Edge browsers, you can copy and paste text from a managed node to your local machine, and from your local machine to a managed node that you are connected to. Using the Mozilla Firefox browser, you can copy and paste text from a managed node to your local machine only. Copying from your local machine to the managed node is not supported. **To connect to a managed node using Fleet Manager Remote Desktop** 1. Open the AWS Systems Manager console at [https://console.aws.amazon.com/systems-manager/](https://console.aws.amazon.com/systems-manager/). 1. In the navigation pane, choose **Fleet Manager**. 1. Choose the node that you want to connect to. You can select either the check box or the node name. 1. On the **Node actions** menu, choose **Connect with Remote Desktop**. 1. Choose your preferred **Authentication type**. If you choose **User credentials**, enter the user name and password for a Windows user account on the node that you're connecting to. If you choose **Key pair**, you can provide authentication using one of the following methods: 1. Choose **Browse local machine** if you want to select the PEM key associated with your instance from your local file system. - or - 1. Choose **Paste key pair content** if you want to copy the contents of the PEM file and paste them in to the provided field. 1. Select **Connect**. 1. To choose your preferred display resolution, in the **Actions** menu, choose **Resolutions**, and then select from the following: + **Adapt Automatically** + **1920 x 1080** + **1400 x 900** + **1366 x 768** + **800 x 600** The **Adapt Automatically** option sets the resolution based on your detected screen size. ## Viewing information about current and completed connections You can use the Fleet Manager section of the Systems Manager console to view information about RDP connections that have been made in your account. Using a set of filters, you can limit the list of connections displayed to a time range, a specific instance, the user who made the connections, and connections of a specific status. The console also provides tabs that show information about all currently active connections, and all past connections. **To view information about current and completed connections** 1. Open the AWS Systems Manager console at [https://console.aws.amazon.com/systems-manager/](https://console.aws.amazon.com/systems-manager/). 1. In the navigation pane, choose **Fleet Manager**. 1. Choose **Account management, Connect with Remote Desktop**. 1. Choose one of the following tabs: + **Active connections** + **Connection history** 1. To further narrow the list of connection results displayed, specify one or more filters in the search (![\[\]](http://docs.aws.amazon.com/systems-manager/latest/userguide/images/search-icon.png)) box. You can also enter a free-text search term. # Managing Amazon EBS volumes on managed instances [Amazon Elastic Block Store](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/AmazonEBS.html) (Amazon EBS) provides block level storage volumes for use with Amazon Elastic Compute Cloud (EC2) instances. EBS volumes behave like raw, unformatted block devices. You can mount these volumes as devices on your instances. You can use Fleet Manager, a tool in AWS Systems Manager, to manage Amazon EBS volumes on your managed instances. For example, you can initialize an EBS volume, format a partition, and mount the volume to make it available for use. **Note** Fleet Manager currently supports Amazon EBS volume management for Windows Server instances only. ## View EBS volume details **To view details for an EBS volume with Fleet Manager** 1. Open the AWS Systems Manager console at [https://console.aws.amazon.com/systems-manager/](https://console.aws.amazon.com/systems-manager/). 1. In the navigation pane, choose **Fleet Manager**. 1. Choose the button next to the managed instance for which you want to view EBS volume details. 1. Choose **View details**. 1. Choose **Tools, EBS volumes**. 1. To view details for an EBS volume, choose its ID in the **Volume ID ** column. ## Initialize and format an EBS volume **To initialize and format an EBS volume with Fleet Manager** 1. Open the AWS Systems Manager console at [https://console.aws.amazon.com/systems-manager/](https://console.aws.amazon.com/systems-manager/). 1. In the navigation pane, choose **Fleet Manager**. 1. Choose the button next to the managed instance for which you want to initialize, format, and mount an EBS volume. You can only initialize an EBS volume if its disk is empty. 1. Choose **View details**. 1. In the **Tools** menu, choose **EBS volumes**. 1. Choose the button next to the EBS volume you want to initialize and format. 1. Choose **Initialize and format**. 1. In **Partition style**, choose the partition style you want to use for the EBS volume. 1. (Optional) Choose a **Drive letter** for the partition. 1. (Optional) Enter a **Partition name** to identify the partition. 1. Choose the **File system** to use to organize files and data stored in the partition. 1. Choose **Confirm** to make the EBS volume available for use. You can't change the partition configuration from the AWS Management Console after confirming, however, you can use SSH or RDP to log into the instance to change the partition configuration. # Accessing the Red Hat Knowledge base portal You can use Fleet Manager, a tool in AWS Systems Manager, to access the Knowledge base portal if you are a Red Hat customer. You are considered a Red Hat customer if you run Red Hat Enterprise Linux (RHEL) instances or use RHEL services on AWS. The Knowledge base portal includes binaries, and knowledge-share and discussion forums for community support that are available only to Red Hat licensed customers. In addition to the required AWS Identity and Access Management (IAM) permissions for Systems Manager and Fleet Manager, the user or role you use to access the console must allow the `rhelkb:GetRhelURL` action to access the Knowledge base portal. **To access the Red Hat Knowledgebase Portal** 1. Open the AWS Systems Manager console at [https://console.aws.amazon.com/systems-manager/](https://console.aws.amazon.com/systems-manager/). 1. In the navigation pane, choose **Fleet Manager**. 1. Choose the RHEL instance you want to use to connect to the Red Hat Knowledgebase Portal. 1. Choose **Account management**, **Access Red Hat Knowledgebase** to open the Red Hat Knowledge base page. If you use RHEL on AWS to run fully supported RHEL workloads, you can also access the Red Hat Knowledge base through Red Hat's website by using your AWS credentials. # Troubleshooting managed node availability For several AWS Systems Manager tools like Run Command, Distributor, and Session Manager, you can choose to manually select the managed nodes on which you want to run an operation. In cases like these, after you specify that you want to choose nodes manually, the system displays a list of managed nodes where you can run the operation. This topic provides information to help you diagnose why a managed node *that you have confirmed is running* isn't included in your lists of managed nodes in Systems Manager. In order for a node to be managed by Systems Manager and available in lists of managed nodes, it must meet three requirements: + SSM Agent must be installed and running on the node with a supported operating system. **Note** Some AWS managed Amazon Machine Images (AMIs) are configured to launch instances with [SSM Agent](ssm-agent.md) preinstalled. (You can also configure a custom AMI to preinstall SSM Agent.) For more information, see [Find AMIs with the SSM Agent preinstalled](ami-preinstalled-agent.md). + For Amazon Elastic Compute Cloud (Amazon EC2) instances, you must attach an AWS Identity and Access Management (IAM) instance profile to the instance. The instance profile enables the instance to communicate with the Systems Manager service. If you don't assign an instance profile to the instance, you register it using a [hybrid activation](activations.md), which is not a common scenario. + SSM Agent must be able to connect to a Systems Manager endpoint in order to register itself with the service. Thereafter, the managed node must be available to the service, which is confirmed by the service sending a signal every five minutes to check the instance's health. + After the status of a managed node has been `Connection Lost` for at least 30 days, the node might no longer be listed in the Fleet Manager console. To restore it to the list, the issue that caused the lost connection must be resolved. After you verify that a managed node is running, you can use the following command to check whether SSM Agent successfully registered with the Systems Manager service. This command doesn't return results until a successful registration has taken place. ------ #### [ Linux & macOS ] ``` aws ssm describe-instance-associations-status \ --instance-id instance-id ``` ------ #### [ Windows ] ``` aws ssm describe-instance-associations-status ^ --instance-id instance-id ``` ------ #### [ PowerShell ] ``` Get-SSMInstanceAssociationsStatus ` -InstanceId instance-id ``` ------ If registration was successful and the managed node is now available for Systems Manager operations, the command returns results similar to the following. ``` { "InstanceAssociationStatusInfos": [ { "AssociationId": "fa262de1-6150-4a90-8f53-d7eb5EXAMPLE", "Name": "AWS-GatherSoftwareInventory", "DocumentVersion": "1", "AssociationVersion": "1", "InstanceId": "i-02573cafcfEXAMPLE", "Status": "Pending", "DetailedStatus": "Associated" }, { "AssociationId": "f9ec7a0f-6104-4273-8975-82e34EXAMPLE", "Name": "AWS-RunPatchBaseline", "DocumentVersion": "1", "AssociationVersion": "1", "InstanceId": "i-02573cafcfEXAMPLE", "Status": "Queued", "AssociationName": "SystemAssociationForScanningPatches" } ] } ``` If registration hasn't completed yet or was unsuccessful, the command returns results similar to the following: ``` { "InstanceAssociationStatusInfos": [] } ``` If the command doesn't return results after 5 minutes or so, use the following information to help you troubleshoot problems with your managed nodes. **Topics** + [ ## Solution 1: Verify that SSM Agent is installed and running on the managed node ](#instances-missing-solution-1) + [ ## Solution 2: Verify that an IAM instance profile has been specified for the instance (EC2 instances only) ](#instances-missing-solution-2) + [ ## Solution 3: Verify service endpoint connectivity ](#instances-missing-solution-3) + [ ## Solution 4: Verify target operating system support ](#instances-missing-solution-4) + [ ## Solution 5: Verify you're working in the same AWS Region as the Amazon EC2 instance ](#instances-missing-solution-5) + [ ## Solution 6: Verify the proxy configuration you applied to SSM Agent on your managed node ](#instances-missing-solution-6) + [ ## Solution 7: Install a TLS certificate on managed instances ](#hybrid-tls-certificate) + [ # Troubleshooting managed node availability using `ssm-cli` ](troubleshooting-managed-nodes-using-ssm-cli.md) ## Solution 1: Verify that SSM Agent is installed and running on the managed node Make sure the latest version of SSM Agent is installed and running on the managed node. To determine whether SSM Agent is installed and running on a managed node, see [Checking SSM Agent status and starting the agent](ssm-agent-status-and-restart.md). To install or reinstall SSM Agent on a managed node, see the following topics: + [Manually installing and uninstalling SSM Agent on EC2 instances for Linux](manually-install-ssm-agent-linux.md) + [How to install the SSM Agent on hybrid Linux nodes](hybrid-multicloud-ssm-agent-install-linux.md) + [Manually installing and uninstalling SSM Agent on EC2 instances for Windows Server](manually-install-ssm-agent-windows.md) + [How to install the SSM Agent on hybrid Windows nodes ](hybrid-multicloud-ssm-agent-install-windows.md) ## Solution 2: Verify that an IAM instance profile has been specified for the instance (EC2 instances only) For Amazon Elastic Compute Cloud (Amazon EC2) instances, verify that the instance is configured with an AWS Identity and Access Management (IAM) instance profile that allows the instance to communicate with the Systems Manager API. Also verify that your user has an IAM trust policy that allows your user to communicate with the Systems Manager API. **Note** On-premises servers, edge devices, and virtual machines (VMs) use an IAM service role instead of an instance profile. For more information, see [Create the IAM service role required for Systems Manager in hybrid and multicloud environments](hybrid-multicloud-service-role.md). **To determine whether an instance profile with the necessary permissions is attached to an EC2 instance** 1. Open the Amazon EC2 console at [https://console.aws.amazon.com/ec2/](https://console.aws.amazon.com/ec2/). 1. In the navigation pane, choose **Instances**. 1. Choose the instance to check for an instance profile. 1. On the **Description** tab in the bottom pane, locate **IAM role** and choose the name of the role. 1. On the role **Summary** page for the instance profile, on the **Permissions** tab, ensure that `AmazonSSMManagedInstanceCore` is listed under **Permissions policies**. If a custom policy is used instead, ensure that it provides the same permissions as `AmazonSSMManagedInstanceCore`. [Open `AmazonSSMManagedInstanceCore` in the console](https://console.aws.amazon.com/iam/home#/policies/arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore$jsonEditor) For information about other policies that can be attached to an instance profile for Systems Manager, see [Configure instance permissions required for Systems Manager](setup-instance-permissions.md). ## Solution 3: Verify service endpoint connectivity Verify that the instance has connectivity to the Systems Manager service endpoints. This connectivity is provided by creating and configuring VPC endpoints for Systems Manager, or by allowing HTTPS (port 443) outbound traffic to the service endpoints. For Amazon EC2 instances, the Systems Manager service endpoint for the AWS Region is used to register the instance if your virtual private cloud (VPC) configuration allows outbound traffic. However, if the VPC configuration the instance was launched in does not allow outbound traffic and you can't change this configuration to allow connectivity to the public service endpoints, you must configure interface endpoints for your VPC instead. For more information, see [Improve the security of EC2 instances by using VPC endpoints for Systems Manager](setup-create-vpc.md). ## Solution 4: Verify target operating system support Verify that the operation you have chosen can be run on the type of managed node you expect to see listed. Some Systems Manager operations can target only Windows instances or only Linux instances. For example, the Systems Manager (SSM) documents `AWS-InstallPowerShellModule` and `AWS-ConfigureCloudWatch` can be run only on Windows instances. In the **Run a command** page, if you choose either of these documents and select **Choose instances manually**, only your Windows instances are listed and available for selection. ## Solution 5: Verify you're working in the same AWS Region as the Amazon EC2 instance Amazon EC2 instances are created and available in specific AWS Regions, such as the US East (Ohio) Region (us-east-2) or Europe (Ireland) Region (eu-west-1). Ensure that you're working in the same AWS Region as the Amazon EC2 instance that you want to work with. For more information, see [Choosing a Region](https://docs.aws.amazon.com/awsconsolehelpdocs/latest/gsg/getting-started.html#select-region) in *Getting Started with the AWS Management Console*. ## Solution 6: Verify the proxy configuration you applied to SSM Agent on your managed node Verify that the proxy configuration you applied to SSM Agent on your managed node is correct. If the proxy configuration is incorrect, the node can't connect to the required service endpoints, or Systems Manager might identify the operating system of the managed node incorrectly. For more information, see [Configuring SSM Agent to use a proxy on Linux nodes](configure-proxy-ssm-agent.md) and [Configure SSM Agent to use a proxy for Windows Server instances](configure-proxy-ssm-agent-windows.md). ## Solution 7: Install a TLS certificate on managed instances A Transport Layer Security (TLS) certificate must be installed on each managed instance you use with AWS Systems Manager. AWS services use these certificates to encrypt calls to other AWS services. A TLS certificate is already installed by default on each Amazon EC2 instance created from any Amazon Machine Image (AMI). Most modern operating systems include the required TLS certificate from Amazon Trust Services CAs in their trust store. To verify whether the required certificate is installed on your instance run the following command based on the operating system of your instance. Be sure to replace the *region* portion of the URL with the AWS Region where your managed instance is located. ------ #### [ Linux & macOS ] ``` curl -L https://ssm.region.amazonaws.com ``` ------ #### [ Windows ] ``` Invoke-WebRequest -Uri https://ssm.region.amazonaws.com ``` ------ The command should return an `UnknownOperationException` error. If you receive an SSL/TLS error message instead then the required certificate might not be installed. If you find the required Amazon Trust Services CA certificates aren't installed on your base operating systems, on instances created from AMIs that aren't supplied by Amazon, or on your own on-premises servers and VMs, you must install and allow a certificate from [Amazon Trust Services](https://www.amazontrust.com/repository/), or use AWS Certificate Manager (ACM) to create and manage certificates for a supported integrated service. Each of your managed instances must have one of the following Transport Layer Security (TLS) certificates installed. + Amazon Root CA 1 + Starfield Services Root Certificate Authority - G2 + Starfield Class 2 Certificate Authority For information about using ACM, see the *[AWS Certificate Manager User Guide](https://docs.aws.amazon.com/acm/latest/userguide/)*. If certificates in your computing environment are managed by a Group Policy Object (GPO), then you might need to configure Group Policy to include one of these certificates. For more information about the Amazon Root and Starfield certificates, see the blog post [How to Prepare for AWS’s Move to Its Own Certificate Authority](https://aws.amazon.com/blogs/security/how-to-prepare-for-aws-move-to-its-own-certificate-authority/). # Troubleshooting managed node availability using `ssm-cli` The `ssm-cli` is a standalone command line tool included in the SSM Agent installation. When you install SSM Agent 3.1.501.0 or later on a machine, you can run `ssm-cli` commands on that machine. The output of those commands helps you determine whether the machine meets the minimum requirements for an Amazon EC2 instance or non-EC2 machine to be managed by AWS Systems Manager, and therefore added to lists of managed nodes in Systems Manager. (SSM Agent version 3.1.501.0 was released in November, 2021.) **Minimum requirements** For an Amazon EC2 instance or non-EC2 machine to be managed by AWS Systems Manager, and available in lists of managed nodes, it must meet three primary requirements: + SSM Agent must be installed and running on a machine with a [supported operating system](operating-systems-and-machine-types.md#prereqs-operating-systems). Some AWS managed Amazon Machine Images (AMIs) for EC2 are configured to launch instances with [SSM Agent](ssm-agent.md) preinstalled. (You can also configure a custom AMI to preinstall SSM Agent.) For more information, see [Find AMIs with the SSM Agent preinstalled](ami-preinstalled-agent.md). + An AWS Identity and Access Management (IAM) instance profile (for EC2 instances) or IAM service role (for non-EC2 machines) that supplies the required permissions to communicate with the Systems Manager service must be attached to the machine. + SSM Agent must be able to connect to a Systems Manager endpoint to register itself with the service. Thereafter, the managed node must be available to the service, which is confirmed by the service sending a signal every five minutes to check the managed node's health. **Preconfigured commands in `ssm-cli`** Preconfigured commands are included that gather the required information to help you diagnose why a machine that you have confirmed is running isn't included in your lists of managed nodes in Systems Manager. These commands are run when you specify the `get-diagnostics` option. On the machine, run the following command to use `ssm-cli` to help you troubleshoot managed node availability. ------ #### [ Linux & macOS ] ``` ssm-cli get-diagnostics --output table ``` ------ #### [ Windows ] On Windows Server machines, you must navigate to the `C:\Program Files\Amazon\SSM` directory before running the command. ``` ssm-cli.exe get-diagnostics --output table ``` ------ #### [ PowerShell ] On Windows Server machines, you must navigate to the `C:\Program Files\Amazon\SSM` directory before running the command. ``` .\ssm-cli.exe get-diagnostics --output table ``` ------ The command returns output as a table similar to the following. **Note** Connectivity checks to the `ssmmessages`, `s3`, `kms`, `logs`, and `monitoring` endpoints are for additional optional features such as Session Manager that can log to Amazon Simple Storage Service (Amazon S3) or Amazon CloudWatch Logs, and use AWS Key Management Service (AWS KMS) encryption. ------ #### [ Linux & macOS ] ``` [root@instance]# ssm-cli get-diagnostics --output table ┌───────────────────────────────────────┬─────────┬───────────────────────────────────────────────────────────────────────┐ │ Check │ Status │ Note │ ├───────────────────────────────────────┼─────────┼───────────────────────────────────────────────────────────────────────┤ │ EC2 IMDS │ Success │ IMDS is accessible and has instance id i-0123456789abcdefa in Region │ │ │ │ us-east-2 │ ├───────────────────────────────────────┼─────────┼───────────────────────────────────────────────────────────────────────┤ │ Hybrid instance registration │ Skipped │ Instance does not have hybrid registration │ ├───────────────────────────────────────┼─────────┼───────────────────────────────────────────────────────────────────────┤ │ Connectivity to ssm endpoint │ Success │ ssm.us-east-2.amazonaws.com is reachable │ ├───────────────────────────────────────┼─────────┼───────────────────────────────────────────────────────────────────────┤ │ Connectivity to ec2messages endpoint │ Success │ ec2messages.us-east-2.amazonaws.com is reachable │ ├───────────────────────────────────────┼─────────┼───────────────────────────────────────────────────────────────────────┤ │ Connectivity to ssmmessages endpoint │ Success │ ssmmessages.us-east-2.amazonaws.com is reachable │ ├───────────────────────────────────────┼─────────┼───────────────────────────────────────────────────────────────────────┤ │ Connectivity to s3 endpoint │ Success │ s3.us-east-2.amazonaws.com is reachable │ ├───────────────────────────────────────┼─────────┼───────────────────────────────────────────────────────────────────────┤ │ Connectivity to kms endpoint │ Success │ kms.us-east-2.amazonaws.com is reachable │ ├───────────────────────────────────────┼─────────┼───────────────────────────────────────────────────────────────────────┤ │ Connectivity to logs endpoint │ Success │ logs.us-east-2.amazonaws.com is reachable │ ├───────────────────────────────────────┼─────────┼───────────────────────────────────────────────────────────────────────┤ │ Connectivity to monitoring endpoint │ Success │ monitoring.us-east-2.amazonaws.com is reachable │ ├───────────────────────────────────────┼─────────┼───────────────────────────────────────────────────────────────────────┤ │ AWS Credentials │ Success │ Credentials are for │ │ │ │ arn:aws:sts::123456789012:assumed-role/Fullaccess/i-0123456789abcdefa │ │ │ │ and will expire at 2021-08-17 18:47:49 +0000 UTC │ ├───────────────────────────────────────┼─────────┼───────────────────────────────────────────────────────────────────────┤ │ Agent service │ Success │ Agent service is running and is running as expected user │ ├───────────────────────────────────────┼─────────┼───────────────────────────────────────────────────────────────────────┤ │ Proxy configuration │ Skipped │ No proxy configuration detected │ ├───────────────────────────────────────┼─────────┼───────────────────────────────────────────────────────────────────────┤ │ SSM Agent version │ Success │ SSM Agent version is 3.0.1209.0, latest available agent version is │ │ │ │ 3.1.192.0 │ └───────────────────────────────────────┴─────────┴───────────────────────────────────────────────────────────────────────┘ ``` ------ #### [ Windows Server and PowerShell ] ``` PS C:\Program Files\Amazon\SSM> .\ssm-cli.exe get-diagnostics --output table ┌───────────────────────────────────────┬─────────┬─────────────────────────────────────────────────────────────────────┐ │ Check │ Status │ Note │ ├───────────────────────────────────────┼─────────┼─────────────────────────────────────────────────────────────────────┤ │ EC2 IMDS │ Success │ IMDS is accessible and has instance id i-0123456789EXAMPLE in │ │ │ │ Region us-east-2 │ ├───────────────────────────────────────┼─────────┼─────────────────────────────────────────────────────────────────────┤ │ Hybrid instance registration │ Skipped │ Instance does not have hybrid registration │ ├───────────────────────────────────────┼─────────┼─────────────────────────────────────────────────────────────────────┤ │ Connectivity to ssm endpoint │ Success │ ssm.us-east-2.amazonaws.com is reachable │ ├───────────────────────────────────────┼─────────┼─────────────────────────────────────────────────────────────────────┤ │ Connectivity to ec2messages endpoint │ Success │ ec2messages.us-east-2.amazonaws.com is reachable │ ├───────────────────────────────────────┼─────────┼─────────────────────────────────────────────────────────────────────┤ │ Connectivity to ssmmessages endpoint │ Success │ ssmmessages.us-east-2.amazonaws.com is reachable │ ├───────────────────────────────────────┼─────────┼─────────────────────────────────────────────────────────────────────┤ │ Connectivity to s3 endpoint │ Success │ s3.us-east-2.amazonaws.com is reachable │ ├───────────────────────────────────────┼─────────┼─────────────────────────────────────────────────────────────────────┤ │ Connectivity to kms endpoint │ Success │ kms.us-east-2.amazonaws.com is reachable │ ├───────────────────────────────────────┼─────────┼─────────────────────────────────────────────────────────────────────┤ │ Connectivity to logs endpoint │ Success │ logs.us-east-2.amazonaws.com is reachable │ ├───────────────────────────────────────┼─────────┼─────────────────────────────────────────────────────────────────────┤ │ Connectivity to monitoring endpoint │ Success │ monitoring.us-east-2.amazonaws.com is reachable │ ├───────────────────────────────────────┼─────────┼─────────────────────────────────────────────────────────────────────┤ │ AWS Credentials │ Success │ Credentials are for │ │ │ │ arn:aws:sts::123456789012:assumed-role/SSM-Role/i-123abc45EXAMPLE │ │ │ │ and will expire at 2021-09-02 13:24:42 +0000 UTC │ ├───────────────────────────────────────┼─────────┼─────────────────────────────────────────────────────────────────────┤ │ Agent service │ Success │ Agent service is running and is running as expected user │ ├───────────────────────────────────────┼─────────┼─────────────────────────────────────────────────────────────────────┤ │ Proxy configuration │ Skipped │ No proxy configuration detected │ ├───────────────────────────────────────┼─────────┼─────────────────────────────────────────────────────────────────────┤ │ Windows sysprep image state │ Success │ Windows image state value is at desired value IMAGE_STATE_COMPLETE │ ├───────────────────────────────────────┼─────────┼─────────────────────────────────────────────────────────────────────┤ │ SSM Agent version │ Success │ SSM Agent version is 3.2.815.0, latest agent version in us-east-2 │ │ │ │ is 3.2.985.0 │ └───────────────────────────────────────┴─────────┴─────────────────────────────────────────────────────────────────────┘ ``` ------ The following table provides additional details for each of the checks performed by `ssm-cli`. **`ssm-cli` diagnostic checks** | Check | Details | | --- | --- | | Amazon EC2 instance metadata service | Indicates whether the managed node is able to reach the metadata service. A failed test indicates a connectivity issue to http://169.254.169.254 which can be caused by local route, proxy, or operating system (OS) firewall and proxy configurations. | | Hybrid instance registration | Indicates whether SSM Agent is registered using a hybrid activation. | | Connectivity to ssm endpoint | Indicates whether the node is able to reach the service endpoints for Systems Manager on TCP port 443. A failed test indicates connectivity issues to https://ssm.region.amazonaws.com depending on the AWS Region where the node is located. Connectivity issues can be caused by the VPC configuration including security groups, network access control lists, route tables, or OS firewalls and proxies. | | Connectivity to ec2messages endpoint | Indicates whether the node is able to reach the service endpoints for Systems Manager on TCP port 443. A failed test indicates connectivity issues to https://ec2messages.region.amazonaws.com depending on the AWS Region where the node is located. Connectivity issues can be caused by the VPC configuration including security groups, network access control lists, route tables, or OS firewalls and proxies. | | Connectivity to ssmmessages endpoint | Indicates whether the node is able to reach the service endpoints for Systems Manager on TCP port 443. A failed test indicates connectivity issues to https://ssmmessages.region.amazonaws.com depending on the AWS Region where the node is located. Connectivity issues can be caused by the VPC configuration including security groups, network access control lists, route tables, or OS firewalls and proxies. | | Connectivity to s3 endpoint | Indicates whether the node is able to reach the service endpoint for Amazon Simple Storage Service on TCP port 443. A failed test indicates connectivity issues to https://s3.region.amazonaws.com depending on the AWS Region where the node is located. Connectivity to this endpoint is not required for a node to appear in your managed nodes list. | | Connectivity to kms endpoint | Indicates whether the node is able to reach the service endpoint for AWS Key Management Service on TCP port 443. A failed test indicates connectivity issues to `https://kms.region.amazonaws.com` depending on the AWS Region where the node is located. Connectivity to this endpoint is not required for a node to appear in your managed nodes list. | | Connectivity to logs endpoint | Indicates whether the node is able to reach the service endpoint for Amazon CloudWatch Logs on TCP port 443. A failed test indicates connectivity issues to https://logs.region.amazonaws.com depending on the AWS Region where the node is located. Connectivity to this endpoint is not required for a node to appear in your managed nodes list. | | Connectivity to monitoring endpoint | Indicates whether the node is able to reach the service endpoint for Amazon CloudWatch on TCP port 443. A failed test indicates connectivity issues to https://monitoring.region.amazonaws.com depending on the AWS Region where the node is located. Connectivity to this endpoint is not required for a node to appear in your managed nodes list. | | AWS Credentials | Indicates whether SSM Agent has the required credentials based on the IAM instance profile (for EC2 instances) or IAM service role (for non-EC2 machines) attached to the machine. A failed test indicates that no IAM instance profile or IAM service role is attached to the machine, or it does not contain the required permissions for Systems Manager. | | Agent service | Indicates whether SSM Agent service is running, and whether the service is running as root for Linux or macOS, or SYSTEM for Windows Server. A failed test indicates SSM Agent service is not running or is not running as root or SYSTEM. | | Proxy configuration | Indicates whether SSM Agent is configured to use a proxy. | | Sysprep image state (Windows only) | Indicates the state of Sysprep on the node. SSM Agent will not start on the node if the Sysprep state is a value other than IMAGE\$1STATE\$1COMPLETE. | | SSM Agent version | Indicates whether the latest available version of SSM Agent is installed. |