AWS Systems Manager

AWS Systems Manager Skill

Analyze AWS Systems Manager resources with parallel execution and anti-hallucination guardrails.

Relationship to other AWS skills:

• aws-systems-manager/ → SSM-specific analysis (parameters, sessions, patches, commands)
• aws/ → "How to execute" (parallel patterns, throttling, output format)

CRITICAL: Parallel Execution Requirement

ALL independent operations MUST run in parallel using background jobs (&) and wait.

#!/bin/bash
export AWS_PAGER=""

for instance in $instances; do
  get_patch_compliance "$instance" &
done
wait

Helper Functions

#!/bin/bash
export AWS_PAGER=""

# List parameters (paginated)
list_parameters() {
  aws ssm describe-parameters --max-results 50 \
    --output text \
    --query 'Parameters[].[Name,Type,LastModifiedDate,Version]'
}

# Get parameter value
get_parameter() {
  local name=$1
  aws ssm get-parameter --name "$name" --with-decryption \
    --output text \
    --query 'Parameter.[Name,Type,Value,Version,LastModifiedDate]'
}

# List parameters by path
get_parameters_by_path() {
  local path=$1
  aws ssm get-parameters-by-path --path "$path" --recursive \
    --output text \
    --query 'Parameters[].[Name,Type,Version,LastModifiedDate]'
}

# List managed instances
list_managed_instances() {
  aws ssm describe-instance-information \
    --output text \
    --query 'InstanceInformationList[].[InstanceId,PingStatus,PlatformType,PlatformName,AgentVersion,IsLatestVersion]'
}

# Get patch compliance for an instance
get_patch_compliance() {
  local instance_id=$1
  aws ssm describe-instance-patch-states --instance-ids "$instance_id" \
    --output text \
    --query 'InstancePatchStates[].[InstanceId,PatchGroup,InstalledCount,MissingCount,FailedCount,InstalledRejectedCount,OperationEndTime]'
}

# List recent command invocations
list_commands() {
  aws ssm list-commands --max-results 20 \
    --output text \
    --query 'Commands[].[CommandId,DocumentName,Status,InstanceIds[0],RequestedDateTime]'
}

Common Operations

1. Parameter Store Inventory

#!/bin/bash
export AWS_PAGER=""
aws ssm describe-parameters --max-results 50 \
  --output text \
  --query 'Parameters[].[Name,Type,LastModifiedDate,Version,Tier]' | sort -k1

2. Managed Instance Health

#!/bin/bash
export AWS_PAGER=""
aws ssm describe-instance-information \
  --output text \
  --query 'InstanceInformationList[].[InstanceId,PingStatus,PlatformType,PlatformName,AgentVersion,IsLatestVersion,LastPingDateTime]' \
  | sort -k2

3. Patch Compliance Summary

#!/bin/bash
export AWS_PAGER=""
INSTANCES=$(aws ssm describe-instance-information --output text --query 'InstanceInformationList[].InstanceId')
for inst in $INSTANCES; do
  aws ssm describe-instance-patch-states --instance-ids "$inst" \
    --output text \
    --query 'InstancePatchStates[].[InstanceId,InstalledCount,MissingCount,FailedCount,NotApplicableCount,OperationEndTime]' &
done
wait

4. Run Command History

#!/bin/bash
export AWS_PAGER=""
aws ssm list-commands --max-results 20 \
  --output text \
  --query 'Commands[].[CommandId,DocumentName,Status,StatusDetails,TargetCount,CompletedCount,ErrorCount,RequestedDateTime]' | sort -k8 -r

5. Session Manager Activity

#!/bin/bash
export AWS_PAGER=""
aws ssm describe-sessions --state Active \
  --output text \
  --query 'Sessions[].[SessionId,Target,Status,StartDate,Owner]' &

aws ssm describe-sessions --state History --max-results 20 \
  --output text \
  --query 'Sessions[].[SessionId,Target,Status,StartDate,EndDate,Owner]' &
wait

Anti-Hallucination Rules

1. SecureString parameters are encrypted - get-parameter without --with-decryption returns encrypted values for SecureString. Always use --with-decryption for readable values.
2. PingStatus reflects SSM agent - PingStatus "Online" means the SSM agent is responding, not that the instance is healthy. "ConnectionLost" means no agent response in 5+ minutes.
3. Parameter tiers - Standard (free, 4KB, 10K max), Advanced ($0.05/month, 8KB, 100K max), Intelligent-Tiering (auto). Tier affects cost.
4. Patch baselines are OS-specific - Each OS has a separate default patch baseline. Custom baselines must match the target OS.
5. Run Command != SSH - Run Command executes documents via SSM agent, not SSH. No SSH keys or open ports required.

Output Format

Present results as a structured report:

Aws Systems Manager Report
══════════════════════════
Resources discovered: [count]

Resource       Status    Key Metric    Issues
──────────────────────────────────────────────
[name]         [ok/warn] [value]       [findings]

Summary: [total] resources | [ok] healthy | [warn] warnings | [crit] critical
Action Items: [list of prioritized findings]

Target ≤50 lines of output. Use tables for multi-resource comparisons.

Counter-Rationalizations

Common Pitfalls

• Parameter path hierarchy: Parameters use / path separators. get-parameters-by-path with --recursive fetches all under a path prefix.
• Parameter versions: Each update creates a new version. Use :version suffix to reference specific versions (e.g., /app/config:3).
• Patch group assignment: Instances must have a Patch Group tag to be associated with a patch baseline. Untagged instances use the default baseline.
• CloudWatch statistics syntax: Use spaces not commas: --statistics Average Maximum.
• Document permissions: SSM documents can be shared with specific accounts or publicly. Audit with describe-document-permission.