01 By default, AWS Systems Manager (SSM) doesn't have permission to communicate with or perform actions on your Amazon EC2 instances, therefore you must grant access by using an Identity and Access Management (IAM) instance profile and an IAM service role (or assume role). You can start by creating the trust relationship policy for the required IAM service role. To create the required trust relationship policy for the new role, save the following policy document to a JSON file named cc-iam-trust-policy.json
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "ec2.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}
02 Run create-role command (OSX/Linux/UNIX) to create the necessary Amazon IAM role using the trust relationship policy defined at the previous step:
aws iam create-role
--role-name cc-ssm-role-for-managed-instances
--assume-role-policy-document file://cc-iam-trust-policy.json
03 The command output should return the metadata available for the new IAM role:
{
"Role": {
"AssumeRolePolicyDocument": {
"Version": "2012-10-17",
"Statement": [
{
"Action": "sts:AssumeRole",
"Effect": "Allow",
"Principal": {
"Service": "ec2.amazonaws.com"
}
}
]
},
"RoleId": "AAAABBBBCCCCDDDDEEEE",
"CreateDate": "2020-12-21T10:00:00Z",
"RoleName": "cc-ssm-role-for-managed-instances",
"Path": "/",
"Arn": "arn:aws:iam::123456789012:role/cc-ssm-role-for-managed-instances"
}
}
04 Run attach-role-policy command (OSX/Linux/UNIX) to attach the specified AWS-managed policy to the newly created IAM role. The "AmazonSSMManagedInstanceCore" managed policy is required to enable AWS Systems Manager service core functionality on target EC2 instances (the command does not produce an output):
aws iam attach-role-policy
--role-name cc-ssm-role-for-managed-instances
--policy-arn arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore
05 Create the instance profile that needs to integrate the new IAM role. Run create-instance-profile command (OSX/Linux/UNIX) to create the required IAM instance profile:
aws iam create-instance-profile
--region us-east-1
--instance-profile-name cc-ssm-core-instance-profile
06 The command output should return the metadata for the newly created instance profile:
{
"InstanceProfile": {
"InstanceProfileId": "ABCDABCDABCDABCDABCDA",
"Roles": [],
"CreateDate": "2020-12-21T10:00:00Z",
"InstanceProfileName": "cc-ssm-core-instance-profile",
"Path": "/",
"Arn": "arn:aws:iam::123456789012:instance-profile/cc-ssm-core-instance-profile"
}
}
07 Run add-role-to-instance-profile command (OSX/Linux/UNIX) to integrate the IAM role created at step no. 2 with the instance profile created at step no. 5 (the command does not produce an output):
aws iam add-role-to-instance-profile
--role-name cc-ssm-role-for-managed-instances
--instance-profile-name cc-ssm-core-instance-profile
08 Run associate-iam-instance-profile command (OSX/Linux/UNIX) to associate the new IAM instance profile with the running Amazon EC2 instance that you want to manage with AWS Systems Manager (see Audit section part I to identify the right instance). You might need to reboot your EC2 to apply the change after this step:
aws ec2 associate-iam-instance-profile
--region us-east-1
--iam-instance-profile Name=cc-ssm-core-instance-profile
--instance-id i-01234abcd1234abcd
09 The output should return the associate-iam-instance-profile command request metadata:
{
"IamInstanceProfileAssociation": {
"InstanceId": "i-01234abcd1234abcd",
"AssociationId": "iip-assoc-01234abcd1234abcd",
"IamInstanceProfile": {
"Id": "ABCDABCDABCDABCDABCDA",
"Arn": "arn:aws:iam::123456789012:instance-profile/cc-ssm-core-instance-profile"
}
}
}
10 Now that AWS Systems Manager has permission to communicate with or perform actions on your target EC2 instance, you can implement the Systems Manager core capabilities for managing Amazon EC2 instances. To enable the commonly used Systems Manager capabilities that allows you to securely manage your Amazon EC2 instances, perform the following commands:
- Run create-association command (OSX/Linux/UNIX) to create an association that automatically updates the SSM Agent according to a schedule that you specify, for the Amazon EC2 instance that you want to manage with AWS Systems Manager (see Audit section part I to identify the right instance). By default, once the association is successfully implemented, the system runs it immediately after it is created and then according to the specified schedule. For example, the --schedule-expression parameter sets a schedule to run the association every Sunday morning at 5:00 AM (UTC):
aws ssm create-association
--region us-east-1
--name "AWS-UpdateSSMAgent"
--targets "Key=instanceids,Values=i-01234abcd1234abcd"
--schedule-expression "cron(0 5 ? * SUN *)"
- The command output should return the "AWS-UpdateSSMAgent" association metadata:
{
"AssociationDescription": {
"ScheduleExpression": "cron(0 5 ? * SUN *)",
"Name": "AWS-UpdateSSMAgent",
"Overview": {
"Status": "Pending",
"DetailedStatus": "Creating"
},
"AssociationId": "abcdabcd-1234-abcd-1234-abcd1234abcd",
"DocumentVersion": "$DEFAULT",
"LastUpdateAssociationDate": 1608654996.549,
"Date": 1608654996.549,
"AssociationVersion": "1",
"Targets": [
{
"Values": [
"i-01234abcd1234abcd"
],
"Key": "instanceids"
}
],
"ApplyOnlyAtCronInterval": false
}
}
- Run create-association command (OSX/Linux/UNIX) to create a Systems Manager (SSM) Inventory association for the specified Amazon EC2 instance. The system collects metadata from your EC2 instance according to the schedule configured for the association:
aws ssm create-association
--region us-east-1
--name "AWS-GatherSoftwareInventory"
--targets "Key=instanceids,Values=i-01234abcd1234abcd"
--schedule-expression "rate(1 day)"
--parameters applications=Enabled,awsComponents=Enabled,customInventory=Enabled,instanceDetailedInformation=Enabled,networkConfig=Enabled,services=Enabled,windowsRoles=Enabled,windowsUpdates=Enabled
- The command output should return the "AWS-GatherSoftwareInventory" association configuration metadata:
{
"AssociationDescription": {
"ScheduleExpression": "rate(1 day)",
"Name": "AWS-GatherSoftwareInventory",
"Parameters": {
"windowsUpdates": [
"Enabled"
],
"awsComponents": [
"Enabled"
],
"customInventory": [
"Enabled"
],
"networkConfig": [
"Enabled"
],
"applications": [
"Enabled"
],
"instanceDetailedInformation": [
"Enabled"
],
"services": [
"Enabled"
],
"windowsRoles": [
"Enabled"
]
},
"Overview": {
"Status": "Pending",
"DetailedStatus": "Creating"
},
"AssociationId": "1234abcd-1234-abcd-1234-abcd1234abcd",
"DocumentVersion": "$DEFAULT",
"LastUpdateAssociationDate": 1608654988.126,
"Date": 1608654988.126,
"AssociationVersion": "1",
"Targets": [
{
"Values": [
"i-01234abcd1234abcd"
],
"Key": "instanceids"
}
],
"ApplyOnlyAtCronInterval": false
}
}
- Run create-association command (OSX/Linux/UNIX) to create an SSM association that scans the specified Amazon EC2 instance for missing patch updates by using the "AWS-RunPatchBaseline" document. "AWS-RunPatchBaseline" performs patching operations on EC2 instances for security related and other types of updates:
aws ssm create-association
--region us-east-1
--name "AWS-RunPatchBaseline"
--targets "Key=instanceids,Values=i-01234abcd1234abcd"
--parameters "Operation=Scan,RebootOption=NoReboot"
- The command output should return the "AWS-RunPatchBaseline" association metadata:
{
"AssociationDescription": {
"Name": "AWS-RunPatchBaseline",
"Parameters": {
"Operation": [
"Scan"
],
"RebootOption": [
"NoReboot"
]
},
"Overview": {
"Status": "Pending",
"DetailedStatus": "Creating"
},
"AssociationId": "abcd1234-abcd-1234-abcd-abcd1234abcd",
"DocumentVersion": "$DEFAULT",
"LastUpdateAssociationDate": 1608654998.845,
"Date": 1608654998.845,
"AssociationVersion": "1",
"Targets": [
{
"Values": [
"i-01234abcd1234abcd"
],
"Key": "instanceids"
}
],
"ApplyOnlyAtCronInterval": false
}
}
11 Change the AWS region by updating the --region command parameter value and repeat steps no. 8 – 10 to perform the remediation/resolution process for other cloud regions.
Security 
Operational