Rule: EC2 Instances Should be Managed by AWS Systems Manager

Rule Description

Troubleshooting Steps

Troubleshooting Step 1: Verify Systems Manager Agent (SSM Agent) Installation

2. 1.
   Log in to the AWS Management Console.
4. 2.
   Navigate to the EC2 dashboard.
6. 3.
   Select the desired EC2 instance.
8. 4.
   Check the "Status Checks" tab.
10. 5.
    If the SSM Agent status is not "Ok," the agent might not be installed correctly.
12. 6.
    Install the SSM Agent by following the AWS Systems Manager documentation.

Troubleshooting Step 2: Verify IAM Role and Permissions

2. 1.
   Confirm that the EC2 instance has an IAM role attached.
4. 2.
   Ensure that the IAM role has the necessary permissions for Systems Manager.
6. 3.
   Grant permissions such as "ssm:UpdateInstanceInformation" and "ssm:ListAssociations" to the role.
8. 4.
   In the IAM console, search for the IAM role attached to the EC2 instance.
10. 5.
    Select the role and add the required permissions.

Troubleshooting Step 3: Check Security Group Rules

2. 1.
   Verify that the security group associated with the EC2 instance allows outbound traffic to the Systems Manager service endpoints.
4. 2.
   Open the EC2 dashboard.
6. 3.
   Select the desired EC2 instance and note the associated security group.
8. 4.
   Navigate to the EC2 dashboard's "Security Group" section.
10. 5.
    Select the security group associated with the EC2 instance.
12. 6.
    Add an outbound rule to allow traffic to the Systems Manager service endpoints on port 443.

Necessary Codes

Step-by-Step Guide for Remediation

2. 1.
   Log in to the AWS Management Console.
4. 2.
   Navigate to the EC2 dashboard.
6. 3.
   Select the desired EC2 instance.
8. 4.
   Check the "Status Checks" tab. If the SSM Agent status is not "Ok," proceed to Step 5. Otherwise, jump to Step 8.
10. 5.
    Install the SSM Agent by following the AWS Systems Manager documentation. Once installed, proceed to Step 6.
12. 6.
    Verify the SSM Agent status again to ensure it is now "Ok."
14. 7.
    If the SSM Agent status is still not "Ok," contact AWS support for further assistance.
16. 8.
    Check if the EC2 instance has an IAM role attached. If not, proceed to Step 9. Otherwise, jump to Step 12.
18. 9.
    In the EC2 dashboard, select the EC2 instance and navigate to the "Actions" dropdown menu.
20. 10.
    Choose "Instance Settings" and then click on "Attach/Replace IAM Role."
22. 11.
    Create a new IAM role or select an existing one and attach it to the EC2 instance. Proceed to Step 12.
24. 12.
    Verify that the IAM role attached to the EC2 instance has the necessary permissions for Systems Manager. If not, proceed to Step 13. Otherwise, the remediation is complete.
26. 13.
    In the IAM console, search for the IAM role attached to the EC2 instance.
28. 14.
    Select the role and click on the "Attach policies" button.
30. 15.
    Search for policies such as "AmazonSSMManagedInstanceCore" and attach them to the role.
32. 16.
    Additionally, add any other required permissions like "s3:GetObject" or "ssm:ListAssociations" as per your specific use case.
34. 17.
    Save the changes, and the EC2 instances will now be managed by AWS Systems Manager.