3.3.2.1. Fleet Management Services (Systems Manager, AWS Auto Scaling)
3.3.2.1. Fleet Management Services (Systems Manager, AWS Auto Scaling)
Managing hundreds of instances individually is impossible. Fleet management treats your entire instance population as a single manageable entity.
Systems Manager fleet capabilities:
| Feature | Purpose | Scope |
|---|---|---|
| Fleet Manager | Visual dashboard of all managed instances | All instances |
| Run Command | Execute commands across the fleet | Tag/instance-based targeting |
| Patch Manager | Automated patching with compliance reporting | Patch group-based |
| State Manager | Enforce desired configuration | Association-based |
| Session Manager | Browser-based shell access (no SSH keys) | Individual instances |
| Inventory | Collect software/hardware metadata | All managed instances |
# Run a command on all instances tagged Environment=Production
aws ssm send-command \
--document-name "AWS-RunShellScript" \
--targets "Key=tag:Environment,Values=Production" \
--parameters 'commands=["df -h","free -m","uptime"]' \
--comment "Health check across production fleet"
Run Command targets instances by instance ID, tag, or resource group. A Delivery timed out status means the command never reached the agent (agent stopped, or no network path/VPC endpoint to SSM); Execution timed out means the script started but ran too long.
Auto Scaling fleet management:
- Mixed instances policy: Combine On-Demand and Spot instances in the same ASG. Spot provides 60-90% cost savings for fault-tolerant workloads.
- Instance refresh: Rolling replacement of all instances in an ASG (for AMI updates). Configure
MinHealthyPercentageto maintain availability during refresh. - Warm pools: Pre-initialized instances in a stopped state, ready to launch in seconds during scale-out.
Exam Trap: SSM Session Manager provides browser-based shell access without opening port 22 or managing SSH keys. Session activity (commands and output) can be logged to S3 and/or CloudWatch Logs once enabled in Session Manager preferences; CloudTrail records only who started the session (StartSession), not what was typed. If the exam asks about secure instance access without SSH, Session Manager is the answer — not a bastion host. This also works in private subnets with VPC endpoints for SSM.
