Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Amazon Systems Manager in Amazon Web Services in China

Amazon Systems Manager (formerly Amazon EC2 Systems Manager) is a unified interface that allows you to easily centralize operational data and automate tasks across your Amazon resources. Systems Manager shortens the time to detect and resolve operational problems in your infrastructure. Systems Manager gives you a complete view of your infrastructure performance and configuration, simplifies resource and application management, and makes it easy to operate and manage your infrastructure at scale.

Region availability

Amazon Systems Manager is available in the following Regions in China:

How Amazon Systems Manager differs

The following differences apply to Amazon Systems Manager:

SSM Agent installation files in the Beijing and Ningxia Regions

To install SSM Agent on Amazon Elastic Compute Cloud (Amazon EC2) instances, choose the appropriate installation file URL for your Amazon Web Services Region and operating system.

Amazon Linux

Use the following files when installing SSM Agent on Amazon Linux Amazon EC2 instances. For full instructions, see Manually installing SSM Agent on Amazon Linux instances.

Amazon Linux 2

Use the following files when installing SSM Agent on Amazon Linux 2 Amazon EC2 instances. For full instructions, see Manually installing SSM Agent on Amazon Linux 2 instances.

CentOS

Use the following files when installing SSM Agent on CentOS Amazon EC2 instances. For full instructions, see Manually installing SSM Agent on CentOS instances

CentOS 8

CentOS 7

CentOS 6

CentOS Stream 8

Use the following files when installing SSM Agent on CentOS Stream Amazon EC2 instances. For full instructions, see Manually installing SSM Agent on CentOS Stream instances

Debian Server

Use the following files when installing SSM Agent on Debian Server Amazon EC2 instances. For full instructions, see Manually installing SSM Agent on Debian Server instances

Oracle Linux

Use the following files when installing SSM Agent on Oracle Linux Amazon EC2 instances. For full instructions, see Manually installing SSM Agent on Oracle Linux instances

Red Hat Enterprise Linux (RHEL)

Use the following files when installing SSM Agent on RHEL Amazon EC2 instances. For full instructions, see Manually installing SSM Agent on RHEL instances

RHEL 8

RHEL 7

RHEL 6

Rocky Linux

Use the following files when installing SSM Agent on Rocky Linux Amazon EC2 instances. For full instructions, see Manually installing SSM Agent on Rocky Linux instances

SUSE Enterprise Linux Server (SLES)

Use the following files when installing SSM Agent on SLES Amazon EC2 instances. For full instructions, see Manually installing SSM Agent on SLES instances

Ubuntu Server

Use the following files when installing SSM Agent on Ubuntu Server Amazon EC2 instances. For full instructions, see Manually installing SSM Agent on Ubuntu Server instances.

Ubuntu Server 20.10 STR & 20.04, 18.04, and 16.04 LTS 64-bit (Snap)

Installation on these versions of Ubuntu Server uses the Snap format instead of installation commands with URLs for installation files. For instructions, see Install SSM Agent on Ubuntu Server 20.10 STR & 20.04, 18.04, and 16.04 LTS 64-bit (Snap).

Ubuntu Server 16.04 and 14.04 64-bit (deb)

Ubuntu Server 16.04 and 14.04 32-bit

Windows Server

Use the following files when installing SSM Agent on Windows Server Amazon EC2 instances. For full instructions, see Manually installing SSM Agent on Windows Server instances

IAM permission policies for Fleet Manager Remote Desktop connections

The following are example IAM policies that you can attach to a user or role to allow different types of interaction with Remote Desktop in the Beijing and Ningxia Regions. Replace each example resource placeholder with your own information.

Standard policy for connecting to EC2 instances

{
"Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "EC2",
            "Effect": "Allow",
            "Action": [
                "ec2:DescribeInstances",
                "ec2:GetPasswordData"
            ],
            "Resource": "*"
        },
        {
            "Sid": "SSM",
            "Effect": "Allow",
            "Action": [
                "ssm:DescribeInstanceProperties",
                "ssm:GetCommandInvocation",
                "ssm:GetInventorySchema"
            ],
            "Resource": "*"
        },
        {
            "Sid": "TerminateSession",
            "Effect": "Allow",
            "Action": [
                "ssm:TerminateSession"
            ],
            "Resource": "*",
            "Condition": {
                "StringLike": {
                    "ssm:resourceTag/aws:ssmmessages:session-id": [
                        "${aws:userid}"
                    ]
                }
            }
        },
        {
            "Sid": "SSMStartSession",
            "Effect": "Allow",
            "Action": [
                "ssm:StartSession"
            ],
            "Resource": [
                "arn:aws-cn:ec2:*:111122223333:instance/*",
                "arn:aws-cn:ssm:*:111122223333:managed-instance/*",
                "arn:aws-cn:ssm:*::document/AWS-StartPortForwardingSession"
            ],
            "Condition": {
                "ForAnyValue:StringEquals": {
                    "aws:CalledVia": "ssm-guiconnect.amazonaws.com"
                }
            }
        },
        {
            "Sid": "GuiConnect",
            "Effect": "Allow",
            "Action": [
                "ssm-guiconnect:CancelConnection",
                "ssm-guiconnect:GetConnection",
                "ssm-guiconnect:StartConnection",
                "ssm-guiconnect:ListConnections"
            ],
            "Resource": "*"
        }
    ]
}

Policy for connecting to EC2 instances with specific tags

{
"Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "EC2",
            "Effect": "Allow",
            "Action": [
                "ec2:DescribeInstances",
                "ec2:GetPasswordData"
            ],
            "Resource": "*"
        },
        {
            "Sid": "SSM",
            "Effect": "Allow",
            "Action": [
                "ssm:DescribeInstanceProperties",
                "ssm:GetCommandInvocation",
                "ssm:GetInventorySchema"
            ],
            "Resource": "*"
        },
        {
            "Sid": "SSMStartSession",
            "Effect": "Allow",
            "Action": [
                "ssm:StartSession"
            ],
            "Resource": [
                "arn:aws-cn:ssm:*::document/AWS-StartPortForwardingSession"
            ],
            "Condition": {
                "ForAnyValue:StringEquals": {
                    "aws:CalledVia": "ssm-guiconnect.amazonaws.com"
                }
            }
        },
        {
            "Sid": "AccessTaggedInstances",
            "Effect": "Allow",
            "Action": [
                "ssm:StartSession"
            ],
            "Resource": [
                "arn:aws-cn:ec2:*:111122223333:instance/*",
                "arn:aws-cn:ssm:*:111122223333:managed-instance/*"
            ],
            "Condition": {
                "StringLike": {
                    "ssm:resourceTag/tag key": [
                        "tag value"
                    ]
                }
            }
        },
        {
            "Sid": "GuiConnect",
            "Effect": "Allow",
            "Action": [
                "ssm-guiconnect:CancelConnection",
                "ssm-guiconnect:GetConnection",
                "ssm-guiconnect:StartConnection",
                "ssm-guiconnect:ListConnections"
            ],
            "Resource": "*"
        }
    ]
}

Policy for Amazon IAM Identity Center users to connect to EC2 instances

{
"Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "SSO",
            "Effect": "Allow",
            "Action": [
                "sso:ListDirectoryAssociations*",
                "identitystore:DescribeUser"
            ],
            "Resource": "*"
        },
        {
            "Sid": "EC2",
            "Effect": "Allow",
            "Action": [
                "ec2:DescribeInstances",
                "ec2:GetPasswordData"
            ],
            "Resource": "*"
        },
        {
            "Sid": "SSM",
            "Effect": "Allow",
            "Action": [
                "ssm:DescribeInstanceInformation",
                "ssm:DescribeInstanceProperties",
                "ssm:GetCommandInvocation",
                "ssm:GetInventorySchema"
            ],
            "Resource": "*"
        },
        {
            "Sid": "TerminateSession",
            "Effect": "Allow",
            "Action": [
                "ssm:TerminateSession"
            ],
            "Resource": "*",
            "Condition": {
                "StringLike": {
                    "ssm:resourceTag/aws:ssmmessages:session-id": [
                        "${aws:userName}"
                    ]
                }
            }
        },
        {
            "Sid": "SSMStartSession",
            "Effect": "Allow",
            "Action": [
                "ssm:StartSession"
            ],
            "Resource": [
                "arn:aws-cn:ec2:*:*:instance/*",
                "arn:aws-cn:ssm:*:*:managed-instance/*",
                "arn:aws-cn:ssm:*:*:document/AWS-StartPortForwardingSession"
            ],
            "Condition": {
                "ForAnyValue:StringEquals": {
                    "aws:CalledVia": "ssm-guiconnect.amazonaws.com"
                }
            }
        },
        {
            "Sid": "SSMSendCommand",
            "Effect": "Allow",
            "Action": [
                "ssm:SendCommand"
            ],
            "Resource": [
                "arn:aws-cn:ec2:*:*:instance/*",
                "arn:aws-cn:ssm:*:*:managed-instance/*",
                "arn:aws-cn:ssm:*:*:document/AWSSSO-CreateSSOUser"
            ]
        },
        {
            "Sid": "GuiConnect",
            "Effect": "Allow",
            "Action": [
                "ssm-guiconnect:CancelConnection",
                "ssm-guiconnect:GetConnection",
                "ssm-guiconnect:StartConnection",
                "ssm-guiconnect:ListConnections"
            ],
            "Resource": "*"
        }
    ]
}

Documentation