AWS Systems Manager (SSM) versus Patch Manager: broad fleet management versus OS/application patching

# The node needs:
# 1. SSM Agent installed (pre-installed on Amazon Linux, Ubuntu AMIs)
# 2. IAM instance profile with AmazonSSMManagedInstanceCore policy
# 3. Outbound HTTPS to SSM endpoints

# Verify the agent is running
sudo systemctl status amazon-ssm-agent

// IAM instance profile policy for SSM
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": [
      "ssm:UpdateInstanceInformation",
      "ssmmessages:CreateControlChannel",
      "ssmmessages:CreateDataChannel",
      "ec2messages:GetMessages"
    ],
    "Resource": "*"
  }]
}

package com.bank.ops;

import software.amazon.awssdk.services.ssm.SsmClient;
import software.amazon.awssdk.services.ssm.model.*;
import java.util.List;
import java.util.Map;

public class FleetCommandRunner {

    private final SsmClient ssmClient;

    public FleetCommandRunner(SsmClient ssmClient) {
        this.ssmClient = ssmClient;
    }

    // Restart bank-api on all production instances
    public String restartService() {
        SendCommandResponse response = ssmClient.sendCommand(
            SendCommandRequest.builder()
                .documentName("AWS-RunShellScript")
                .targets(Target.builder()
                    .key("tag:Environment")
                    .values("prod")
                    .build())
                .parameters(Map.of("commands",
                    List.of("systemctl restart bank-api")))
                .build());
        return response.command().commandId();
    }
}

# Start a session -- no SSH key, no open port 22
aws ssm start-session --target i-0abc123def456

# Session is logged to CloudWatch Logs or S3 for audit
# No bastion host needed, no SSH keys to rotate

package com.bank.config;

import software.amazon.awssdk.services.ssm.SsmClient;
import software.amazon.awssdk.services.ssm.model.GetParameterRequest;

public class SecureConfigReader {

    private final SsmClient ssmClient;

    public SecureConfigReader(SsmClient ssmClient) {
        this.ssmClient = ssmClient;
    }

    // Read database password from Parameter Store instead of hardcoding
    public String getDatabasePassword() {
        return ssmClient.getParameter(
            GetParameterRequest.builder()
                .name("/bank/prod/db-password")
                .withDecryption(true)  // KMS decrypts the SecureString
                .build()
        ).parameter().value();
    }
}

# Store a secret
aws ssm put-parameter \
  --name "/bank/prod/db-password" \
  --type SecureString \
  --value "NBI_prod_secure_2024" \
  --key-id alias/bank-secrets-key

# Read it
aws ssm get-parameter --name "/bank/prod/db-password" --with-decryption

 Patch Manager concepts:

 Patch Baseline:  Rules for which patches are approved
                  (security + critical, 7-day delay)

 Patch Group:     Tag that maps instances to a baseline
                  (tag: PatchGroup=bank-prod)

 Maintenance Window:  Scheduled time when patching runs
                      (Sunday 2:00 AM - 4:00 AM)

# Create a patch baseline for production
aws ssm create-patch-baseline \
  --name "bank-prod-baseline" \
  --operating-system AMAZON_LINUX_2023 \
  --approval-rules '{"PatchRules":[{"PatchFilterGroup":{"PatchFilters":[{"Key":"CLASSIFICATION","Values":["Security","Bugfix"]},{"Key":"SEVERITY","Values":["Critical","Important"]}]},"ApproveAfterDays":7}]}'

# Register a maintenance window
aws ssm create-maintenance-window \
  --name "bank-prod-patch-window" \
  --schedule "cron(0 2 ? * SUN *)" \
  --duration 2 \
  --cutoff 1

# WRONG: trying to use Patch Manager without SSM setup
# Patch Manager depends on the SSM Agent, instance role, and endpoint connectivity
# If SSM is not working, Patch Manager cannot reach the nodes

# CORRECT: verify SSM works first, then configure Patch Manager
aws ssm describe-instance-information  # Confirm nodes are registered
# Then create baselines, patch groups, and maintenance windows

# WRONG: patching production during business hours
# Patch operations can restart services and cause downtime

# CORRECT: schedule patching in maintenance windows during off-hours
# Sunday 2:00 AM - 4:00 AM for production
# Immediate for test environments