aws-ssm

List managed instances

$ aws ssm describe-instance-information

$ aws ssm start-session --target [i-xxxxxxxxxxxxxxxx]

$ aws ssm send-command --document-name "AWS-RunShellScript" --targets Key=instanceids,Values=[i-xxxxxxxx] --parameters commands=["echo hello"]

$ aws ssm get-parameter --name [/path/to/parameter]

$ aws ssm get-parameter --name [/path/to/secret] --with-decryption

$ aws ssm put-parameter --name [/path/to/parameter] --value "[value]" --type String

$ aws ssm get-parameters-by-path --path [/path/prefix/] --recursive

$ aws ssm list-command-invocations --command-id [command-id] --details

aws ssm subcommand [options]

aws ssm is a subcommand of the AWS CLI that manages AWS Systems Manager, a service for operational management of AWS resources. SSM provides capabilities for instance management, configuration, patching, and secure parameter storage.
Session Manager enables secure shell access to EC2 instances without SSH keys or open inbound ports. It logs sessions and supports IAM-based access control.
Run Command executes scripts and commands across fleets of instances without SSH. Parameter Store provides hierarchical storage for configuration data and secrets with optional encryption.
The SSM Agent must be installed on instances for most operations. It comes pre-installed on many AWS AMIs.

describe-instance-information

List instances managed by SSM.

Start interactive Session Manager session.

Execute a command on targets.

List command history.

Get command execution results.

Retrieve a parameter value.

Create or update a parameter.

List parameters under a path.

Remove a parameter.

Get SSM document details.

List available SSM documents.

Target instance for session.

SSM document to execute.

Target instances for commands.

Document parameters.

Parameter name (hierarchical path).

Parameter value.

Parameter type: String, StringList, SecureString.

Decrypt SecureString parameters.

Session Manager requires the SSM Agent and proper IAM instance profile. Parameter names are case-sensitive and hierarchical (use /path/format). SecureString parameters use KMS and may incur charges. Run Command output truncates at 48000 characters; use S3 for large outputs. Default parameter quota is 10,000 standard parameters per account.

AWS Systems Manager evolved from EC2 Run Command which launched in October 2015. It was unified under the Systems Manager brand in 2017. Session Manager was introduced at re:Invent 2018 as a secure alternative to SSH. Parameter Store expanded to include advanced parameters and higher throughput tiers. The service has grown to include Patch Manager, State Manager, OpsCenter, and Change Manager for comprehensive operations.

aws(1), aws-ec2(1), ssh(1), aws-secretsmanager(1)