Ensuring Rule Compliance: EC2 Instances Managed by AWS Systems Manager

Rule Description

Troubleshooting Steps (if applicable)

2. 1.

   Validate that the EC2 instances in question are not already managed by AWS Systems Manager by checking the Systems Manager console or by using AWS CLI commands.

4. 2.

   Ensure that the EC2 instances have the necessary IAM roles and permissions to be managed by AWS Systems Manager. This includes allowing the EC2 instances to communicate with the Systems Manager service and access the required resources.

6. 3.

   Verify that the Systems Manager Agent is installed and running on each EC2 instance. The agent is responsible for enabling communication between the EC2 instance and AWS Systems Manager.

Remediation Steps

2. 1.

   Create an IAM Role for Systems Manager:

   • Log in to the AWS Management Console.
   • Navigate to the IAM service.
   • Click on "Roles" in the left sidebar.
   • Click on "Create role".
   • Select "AWS service" as the type of trusted entity.
   • Choose "Systems Manager" as the service that will use this role.
   • Proceed with the role creation, ensuring that the required policies and permissions are attached to the role.
4. 2.

   Attach the IAM Role to EC2 Instances:

   • In the AWS Management Console, navigate to the EC2 service.
   • Select the EC2 instances that you want to manage with Systems Manager.
   • Right-click on the instances and choose "Instance Settings".
   • Select "Attach/Replace IAM Role" from the dropdown menu.
   • Choose the IAM role created in step 1 and click on "Apply".
6. 3.

   Install and Configure Systems Manager Agent:

   • Connect to the EC2 instances that you want to manage using SSH or other remote access methods.
   • Execute the following commands to download and install the Systems Manager Agent:

     wget https://s3.amazonaws.com/ec2-downloads-windows/SSMAgent/latest/linux_amd64/amazon-ssm-agent.rpm
     sudo yum install -y amazon-ssm-agent.rpm
     

   • Edit the Systems Manager Agent configuration file at

     /etc/amazon/ssm/amazon-ssm-agent.json

     to ensure it includes the necessary configuration settings.
8. 4.

   Verify and Monitor Systems Manager Agent:

   • Run the following command to start the Systems Manager Agent:

     sudo systemctl start amazon-ssm-agent
     

   • Monitor the Systems Manager Agent logs at

     /var/log/amazon/ssm/amazon-ssm-agent.log

     to ensure successful communication with AWS Systems Manager.