Amazon EC2 Systems Manager for Hybrid Cloud Management at Scale

Editor's Notes

1. Read Slide – add anecdotes as appropriate
2. Not built for Cloud Scale Hybrid Enterprise Solutions - Cost Open Source - Management overhead 07/11 Note Security Compliance and Auditing Add a slide – Why do I care
3. help gain insights, enable granular control, automated configuration, compliance and ongoing management of your workloads at scale
4. Automated configuration... and Best Practices Managed Service Linux and Windows On prem AWS-optimized - Native integration with AWS services such as IAM, CloudWatch Events etc. It is available in All regions including Gov Cloud Free - It's a complimentary service
5. Systems Manager is Agent based service, and polls the service. Unlike client-server setup. Also this means no inbound ports need to be opened, improving security posture for customers. It’s open source available on GitHub. AWS Optimized. Works with On-prem. It’s written in Go Language. You can install the Agent on: Running Linux, Windows EC2 instances and OnPrem hardware You can also bootstrap the installation while launching the instance through User Data You can bootstrap even with Cloudformation Template 07/11 Note: Technical slide for Systems Manager Agent
6. We’ve thought through the areas that are important for managing instances at scale, from patch management to remote command configuration and management. 7 capabilities Customers come to Systems Manager b/c one of these capabilities addresses a pain point
7. Document takes center stage Document is executable code. Representing set of actions. SSM agent interprets this document.
8. It's an orchestration. Document is where you write stuff like you do in Lambda Format is Json Executes in sequence, in the order that steps are specified. You can literally write Bash and Powershell scripts directly in a Document support editing and versioning (using schema v2.0+) AWS-managed, user created, or shared from other accounts 3 Types of Document Command Policy Automation
9. You have rate control using Systems Manager, for example, 100 instances update at a time out of 10000 instances. Run Command comes with parameters like max-concurrency and max-errors Systems Manager is directly integrated with other AWS services giving you advantages of ecosystem like logging with Cloudtrail You can have more control using IAM You can notify yourself using SNS or S3
10. Remote Administration - Being agent based solution gives you advantage of closing SSH completely and managing infrastructure directly through Systems Manager Frequently, engineers want to perform operational tasks across a group of instances. However, many of these tasks need to be performed at a controlled speed, and return feedback when there is a problem. Furthermore, Administrators want know to when any error occurred.
11. 07/11 Note: Keywords on the slide
12. Show them output of disk space by running command on 2 instances
13. State Manager Define your own schedules for deployment reviews Compare actual deployments against specified configuration policy State Manager reapplies policies if state drift is detected Query State Manager to view status of deployments Gather detail on a variety of attributes, such as: Installed applications & OS details AWS components and agents Network configuration Inventory attributes are stored in AWS Config for auditing Assess compliance of configurations using AWS Config Rules
14. State Manager Control configuration details such as anti-virus settings, iptables, etc. Simplify bootstrapping of varied software / agents Manage local users & permissions Perform operating system changes Use custom images in our environment. How to check the existing version of PV drivers running in my environment (Inventory) and create notifications informing me when the PV drivers are outdated on my machines (New PV Drivers released by AWS).  Reduce Configuration Drift with Autoscaling Service You can use State Manager with Autoscaling Launch Configuration to avoid any change in instances You can also bootstrap Autoscaling Group Instances on launch
15. Gather detail on a variety of attributes, such as: Installed applications & OS details AWS components and agents Network configuration Inventory attributes are stored in AWS Config for auditing Assess compliance of configurations using AWS Config Rules
16. Inventory can look pretty Now you can store all your output to S3. Use S3 as Data Lake to query through Athena and push to Quicksight
17. Show them how to update Systems Manager Agent software and gather inventory of all applications and AWS Config timeline
18. Associate your instances with defined maintenance windows Create different maintenance windows for different groups of servers based on Tags Works with both Amazon EC2 and on-premises infrastructure
19. Maintenance Window Associate your instances with defined maintenance windows Create different maintenance windows for different groups of servers Works with both Amazon EC2 and on-premises infrastructure
20. Lot of Customization Available Select the patches you want to deploy Control timing for patch roll-outs and instance reboots Define auto-approval rules for patches Ability to black-list or white-list specific patches Schedule the automatic roll out through maintenance windows All MS patches are available same day(within 4 hours) speak to the recent ransomware attacks on Windows and how Patch Manager can help speak about pairing with Maintenance Window to do continuous Patch Compliance
21. Due to Lambda, now you can work up to Infrastructure level instead of just OS
22. CI/CD pipeline - Add Automation as a post-build step to pre-install application releases into AMIs. Use Jenkins scheduling feature to call Automation and create your own operating system (OS) patching cadence Using Lambda and Parameter Store, you can simplify your AMI Patching workflow and keep the Latest Version for further use Patch an AMI and Update an Auto Scaling Group Works with Cloudformation Template as well so you can say leverage CloudFormation and Lambda functions, which is created by Systems Manager Automation, to automate the steps like: An impaired instance is found launch a new instance, detach and attach EBS volumes Configure the new instance same as impaired and terminate impaired one
23. Competing Clustered hostsHashi Corp Vault Lyft Confidant Square Keywhiz Built on/Utilizing AWS services Credstash Biscuit Sneaker Create env-specific parameters and reference in workflow Perform config-management at scale without plain-text passwords
24. Deploying and configuring applications often requires accessing secrets and configuration data such as API keys or database passwords in source code. https://aws.amazon.com/blogs/compute/managing-secrets-for-amazon-ecs-applications-using-parameter-store-and-iam-roles-for-tasks/ Parameter store is pretty powerful as it gives you a place to store secret data for each instance. It can be used very well in CI/CD pipeline like Code Deploy or even with other services like ECS/CFN/OpsWorks.
25. Patching with Latest Updates AMI Autoscaling Service
26. Application Configuration - Unauthorized/Missing triggers an SNS alert and Automated Action removes from whole infrastructure
27. CI/CD State Manager: Configuration Policy