Using AWS Systems Manager in Hybrid Cloud Environments
AWS Architecture BlogUsing AWS Systems Manager in Hybrid Cloud Environmentsby Shivam Patel, Hareesh Singireddy, and Uday Narayanan | on20 JUN 2021| inAmazon CloudWatch,Architecture,AWS CloudTrail,AWS Systems Manager|Permalink|ShareCustomers operating in hybrid environments today face tremendous challenges with regard to operational management, security/compliance, and monitoring. Systems administrators have to connect, monitor, patch, and automate across multiple Operating Systems (OS), applications, cloud, and on-premises infrastructure. Each of these scenarios has its own unique vendor and console purpose-built for a specific use case.UsingHybrid Activations, a capability withinAWS Systems Manager, you can manage resources irrespective of where they are hosted. You can securely initiate remote shell connections, automate patch management, and monitor critical metrics. You’re able to gain visibility into networking information and application installations via a single console.In this post, we’ll discuss how theSession ManagerandPatch Managercapabilities of Systems Manager allow you to securely connect to instances and virtual machines (VMs). You can centrally log session activity for later auditing and automate patch management, across both cloud and on-premises environments, within a single interface.Session ManagerSession Manager is a fully managed feature of AWS Systems Manager. Session Manager provides secure and auditable instance management without the need to open inbound ports, maintain bastion hosts, or manage SSH keys. The centralized session management capability of Session Manager provides administrators the ability to centrally manage access to all compute instances. Irrespective of where your VM is hosted, the Session Manager session can be initiated from the AWS Management Console or from the Command-line interface (CLI). When using the CLI, theSession Manager pluginmust be installed. The screenshot following shows an example of this.Figure 1. Initiating instance management via Session ManagerThe session is launched using the default system generatedssm-useraccount. With this account, the system does not prompt for a password when initiating root level commands. To improve security, OS accounts can be used to launch sessions using theRun Asfeature of Session Manager.A session initiated via Session Manager is secure. The data exchange between the client and a managed instance takes place over a secure channel using TLS 1.2. To further improve your security posture,AWS Key Management Service (KMS)encryption can be used to encrypt the session traffic between a client and a managed instance. Encrypting session data with a customer managed key enables sessions to handle confidential data interactions. For using KMS encryption, both the user who starts sessions and the managed instance that they connect to, must have permission to use the key. Step-by-step instructions on how to set this up can be found in theSession Manager documentation.Session Manager integrates withAWS CloudTrail, and this enables security teams to track when a user starts and shuts down sessions. Session Manager can also centrally log all session activity inAmazon CloudWatchorAmazon Simple Storage Service (S3). This gives system administrators the ability to manage details, such as when the session started, what commands were typed during the session, and when it ended. To configure session manager to send logs to CloudWatch and Amazon S3, the instance profile attached to the instance must have permissions to write to CloudWatch and S3. For theAmazon EC2instance, this will be the IAM role attached to the instance. For VMs running on VMware Cloud on AWS, or on-premises, this is the IAM role from the “Hybrid Activations” page.Following, we show an example of a session run on an on-premises instance via Session Manager and the corresponding logs in CloudWatch. The logs are continuously streamed into CloudWatch.Figure 2. CloudWatch log events for session activity via Session ManagerThe following screenshot displays theipconfig /allcommand being run remotely within PowerShell of an instance running within VMware Cloud on AWS via Session Manager:Figure 3. Remote PowerShell session for on-premises VM via Session ManagerPatch ManagerPatch management is vital in maintaining a secure and compliant environment. Patch Manager, a capability of AWS Systems Manager, helps you monitor, select, and deploy operating system and software patches automatically. This can happen across compute running on Amazon EC2, VMware on-premises, or VMware Cloud on AWS instances.ThePatch Manager dashboardshows details such as number of instances, high-level patch compliance summaries, compliance reporting age, and common causes of noncompliance. As Patch Manager performs patching operations, it updates the dashboard with a summary of recent patching operations and a list of recurring patching tasks. This provides the operations team a single unified view into environments and simplifies their monitoring efforts.Figure 4. Patch Manager dashboardFigure 5. List of all recurring patching tasksApatch baselinein Patch Manager defines which patches are approved for installation on your instances. Patch Manager provides predefined patch baselines for each supported operating system and also lets you create your own custom patch baselines. These patch baselines let you maintain patch consistency across your deployments on Amazon EC2, VMware on-premises, and VMware Cloud on AWS.Custom patch baselines give you greater control over which patches are approved and when they are automatically applied. By using multiple patch baselines with different auto-approval delays or cutoffs, you can test patches in your development environment. Custom patch baselines also let you assign compliance levels to indicate the severity of the compliance violation when a patch is reported as missing.Figure 6. List of Patch baselinesYou can use apatch groupto associate a group of instances with a specific patch baseline in Patch Manager. This ensures that you are deploying the appropriate patches with associated patch baseline rules, to the correct set of instances. These instances can be EC2, VMware on-premises, or VMware Cloud on AWS. You can also use patch groups to schedule patching during a specific maintenance window.Patch Manager also provides the ability to scan your instances and VMs running within VMware on-premises and/or VMware Cloud on AWS. It can report compliance adherence based on pre-defined schedules.Patch compliance reportscan also be saved to an Amazon S3 bucket of your choice and generated as needed. For reports on a single instance/VM, detailed patch data will be included. For reports run on all instances, a summary of missing patch data will be provided.The Patch Manager feature of AWS Systems Manager also integrates withAWS Security Hub, a service providing a comprehensive view of your security alerts. It additionally offers security check automation capabilities. In the following image, we show non-compliant instances and servers being reported within AWS Security Hub across EC2, VMware on-premises, and VMware Cloud on AWS:Figure 7. Non-compliant instances and VMs being reported via AWS Security HubInstallation and deploymentTo ease installation and deployment efforts, the SSM agent is pre-installed on instances created from the followingAmazon Machine Images (AMIs):Amazon LinuxAmazon Linux 2Amazon Linux 2 ECS-Optimized Base AMIsmacOS 10.14.x (Mojave) and 10.15.x (Catalina)Ubuntu Server 16.04, 18.04, and 20.04Windows Server 2008-2012 R2 AMIs published in November 2016 or laterWindows Server 2016 and 2019For other AMI’s and VMs within VMware on-premises and/or VMware Cloud on AWS,manual agent installationmust be performed.Below is an architecture diagram of our solution described in this post:Figure 8. General example of Systems Manager process flowConfigure Systems Manager:Use the Systems Manager console, SDK, AWS Command Line Interface (AWS CLI), or AWS Tools for Windows PowerShell to configure, schedule, automate, and run actions that you want to perform on your AWS resources.Verification and processing:Systems Manager verifies the configurations, including permissions, and sends requests to the AWS Systems Manager SSM Agent running on your instances or servers in your hybrid environment. SSM Agent performs the specified configuration changes.Reporting:SSM Agent reports the status of the configuration changes and actions to Systems Manager in the AWS Cloud. If configured, Systems Manager then sends the status to the user and various AWS services.ConclusionIn this post, we showcase how AWS Systems Manager can yield a unified view within your hybrid environments. It spans native AWS, VMware on-premises, and VMware Cloud on AWS. The Session Manager and Patch Manager features simplify instance connectivity and patch management. Other native capabilities of AWS Systems Manager allow application and change management, software inventory, remote initiation, and monitoring. We encourage you to use the features discussed in this post to maintain your servers across your hybrid environment.Additional links for consideration:Setting up AWS Systems Manager for hybrid environmentsPatching solution design for on-premises instances in a hybrid cloud environmentSession Manager documentationPatch Manager documentationTAGS:Systems Manager,VMware Cloud,VMWare Cloud on AWSShivam PatelShivam Patel is a Solutions Architect at AWS. He helps customers design, deploy, and scale solutions to achieve business outcomes. His core areas of focus are End-User Computing, Media & Entertainment, and VMWare Cloud on AWS. Outside of work, Shivam is an avid food connoisseur, New York Yankees fanatic, and globetrotter (conditions permitting).Hareesh SingireddyHareesh Singireddy is a Solutions Architect at Amazon Web Services. He helps large enterprises design and build Well-Architected solutions on AWS Cloud. Hareesh holds 8 AWS certifications including AWS Certified Solutions Architect Professional.Uday NarayananUday Narayanan is a Sr. Solutions Architect at AWS. He enjoys helping customers find innovative solutions to complex business challenges. His core areas of focus are Data Analytics, Big Data Systems and Machine Learning. In his spare time he enjoys playing sports, binge-watching TV shows, and traveling.
Customers operating in hybrid environments today face tremendous challenges with regard to operational management, security/compliance, and monitoring. Systems administrators have to connect, monitor, patch, and automate across multiple Operating Systems (OS), applications, cloud, and on-premises infrastructure. Each of these scenarios has its own unique vendor and console purpose-built for a specific use case. Using Hybrid […]
Shivam Patel
Amazon CloudWatch Architecture AWS CloudTrail AWS Systems Manager