Prerequisites Activating the Default Host Management Configuration setting Deactivating the Default Host Management Configuration setting Least privilege policy examples for Default Host Management Configuration

Using the Default Host Management Configuration setting

The Default Host Management Configuration setting allows Amazon Systems Manager to manage your Amazon EC2 instances automatically as managed instances. A managed instance is an EC2 instance that is configured for use with Systems Manager.

The benefits of managing your instances with Systems Manager include the following:

Connect to your EC2 instances securely using Session Manager.
Perform automated patch scans using Patch Manager.
View detailed information about your instances using Systems Manager Inventory.
Track and manage instances using Fleet Manager.
Keep SSM Agent up to date automatically.

Fleet Manager, Inventory, Patch Manager, and Session Manager are capabilities of Systems Manager.

Default Host Management Configuration makes it possible to manage EC2 instances without your having to manually create an Amazon Identity and Access Management (IAM) instance profile. Instead, Default Host Management Configuration creates and applies a default IAM role to ensure that Systems Manager has permissions to manage all instances in the Amazon Web Services account and Amazon Web Services Region where it's activated.

If the permissions provided aren't sufficient for your use case, you can also add policies to the default IAM role created by the Default Host Management Configuration. Alternatively, if you don't need permissions for all of the capabilities provided by the default IAM role, you can create your own custom role and policies. Any changes made to the IAM role you choose for Default Host Management Configuration applies to all managed Amazon EC2 instances in the Region and account.

For more information about the policy used by Default Host Management Configuration, see Amazon managed policy: AmazonSSMManagedEC2InstanceDefaultPolicy.

Implement least privilege access

This procedures in this topic are intended to be performed only by administrators. Therefore, we recommend implementing least privilege access in order to prevent non-administrative users from configuring or modifying the Default Host Management Configuration. To view example policies that restrict access to the Default Host Management Configuration, see Least privilege policy examples for Default Host Management Configuration later in this topic.

Important

Registration information for instances registered using Default Host Management Configuration is stored locally in the var/lib/amazon/ssm or C:\ProgramData\Amazon directories. Removing these directories or their files will prevent the instance from acquiring the necessary credentials to connect to Systems Manager using Default Host Management Configuration. In these cases, you must use an IAM instance profile to provide the required permissions to your instance, or recreate the instance.

Topics

Prerequisites
Activating the Default Host Management Configuration setting
Deactivating the Default Host Management Configuration setting
Least privilege policy examples for Default Host Management Configuration

Prerequisites

In order to use Default Host Management Configuration in the Amazon Web Services Region and Amazon Web Services account where you activate the setting, the following requirements must be met.

An instance to be managed must use Instance Metadata Service Version 2 (IMDSv2).

Default Host Management Configuration doesn't support Instance Metadata Service Version 1. For information about transitioning to IMDSv2, see Transition to using Instance Metadata Service Version 2 in the Amazon EC2 User Guide for Linux Instances
SSM Agent version 3.2.582.0 or later must be installed on the instance to be managed.

For information about checking the version of SSM Agent installed on your instance, see Checking the SSM Agent version number.

For information about updating SSM Agent, see Automatically updating SSM Agent.

You, as the administrator performing the tasks in this topic, must have permissions for the GetServiceSetting, ResetServiceSetting, and UpdateServiceSetting API operations. Additionally, you must have permissions for the iam:PassRole permission for the AWSSystemsManagerDefaultEC2InstanceManagementRole IAM role. The following is an example policy providing these permissions. Replace each example resource placeholder with your own information.


{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "ssm:GetServiceSetting",
                "ssm:ResetServiceSetting",
                "ssm:UpdateServiceSetting"
            ],
            "Resource": "arn:aws-cn:ssm:region:account-id:servicesetting/ssm/managed-instance/default-ec2-instance-management-role"
        },
        {
            "Effect": "Allow",
            "Action": [
                "iam:PassRole"
            ],
            "Resource": "arn:aws-cn:iam::account-id:role/service-role/AWSSystemsManagerDefaultEC2InstanceManagementRole",
            "Condition": {
                "StringEquals": {
                    "iam:PassedToService": [
                        "ssm.amazonaws.com.cn"
                    ]
                }
            }
        }
    ]
}

If an IAM instance profile is already attached to an EC2 instance that is to be managed using Systems Manager, you must remove any permissions from it that allow the ssm:UpdateInstanceInformation operation. SSM Agent attempts to use instance profile permissions before using the Default Host Management Configuration permissions. If you allow the ssm:UpdateInstanceInformation operation in your own IAM instance profile, the instance will not use the Default Host Management Configuration permissions.

Activating the Default Host Management Configuration setting

You can activate Default Host Management Configuration from the Fleet Manager console, or by using the Amazon Command Line Interface or Amazon Tools for Windows PowerShell.

You must turn on the Default Host Management Configuration one by one in each Region you where you want your Amazon EC2 instances managed by this setting.

After turning on Default Host Management Configuration, it might take up to 30 minutes for your instances to use the credentials of the role you choose in step 5 in the following procedure.

To activate Default Host Management Configuration (console)

Open the Amazon Systems Manager console at https://console.amazonaws.cn/systems-manager/.
In the navigation pane, choose Fleet Manager.

-or-

If the Amazon Systems Manager home page opens first, choose the menu icon ( ) to open the navigation pane, and then choose Fleet Manager in the navigation pane.
Choose Account management, Configure Default Host Management Configuration.
Turn on Enable Default Host Management Configuration.
Choose the Amazon Identity and Access Management (IAM) role used to enable Systems Manager capabilities for your instances. We recommend using the default role provided by Default Host Management Configuration. It contains the minimum set of permissions necessary to manage your Amazon EC2 instances using Systems Manager. If you prefer to use a custom role, the role's trust policy must allow Systems Manager as a trusted entity.
Choose Configure to complete setup.

To activate Default Host Management Configuration (command line)

Create a JSON file on your local machine containing the following trust relationship policy.


{
    "Version":"2012-10-17",
    "Statement":[
        {
            "Sid":"",
            "Effect":"Allow",
            "Principal":{
                "Service":"ssm.amazonaws.com.cn"
            },
            "Action":"sts:AssumeRole"
        }
    ]
}

Open the Amazon CLI or Tools for Windows PowerShell and run one of the following commands, depending on the operating system type of your local machine, to create a service role in your account. Replace each example resource placeholder with your own information.

Run the following command to attach the AmazonSSMManagedEC2InstanceDefaultPolicy managed policy to your newly created role. Replace each example resource placeholder with your own information.

Open the Amazon CLI or Tools for Windows PowerShell and run the following command. Replace each example resource placeholder with your own information.

There is no output if the command succeeds.

Run the following command to view the current service settings for Default Host Management Configuration in the current Amazon Web Services account and Amazon Web Services Region.

The command returns information like the following.

{
    "ServiceSetting": {
        "SettingId": "/ssm/managed-instance/default-ec2-instance-management-role",
        "SettingValue": "service-role/AWSSystemsManagerDefaultEC2InstanceManagementRole",
        "LastModifiedDate": "2022-11-28T08:21:03.576000-08:00",
        "LastModifiedUser": "System",
        "ARN": "arn:aws:ssm:us-east-2:-123456789012:servicesetting/ssm/managed-instance/default-ec2-instance-management-role",
        "Status": "Custom"
    }
}

Deactivating the Default Host Management Configuration setting

You can deactivate Default Host Management Configuration from the Fleet Manager console, or by using the Amazon Command Line Interface or Amazon Tools for Windows PowerShell.

You must turn off the Default Host Management Configuration setting one by one in each Region where you no longer want your your Amazon EC2 instances managed by this configuration. Deactivating it in one Region doesn't deactivate it in all Regions.

If you deactivate Default Host Management Configuration, and you have not attached an instance profile to your Amazon EC2 instances that allows access to Systems Manager, they will no longer be managed by Systems Manager.

To deactivate Default Host Management Configuration (console)

Open the Amazon Systems Manager console at https://console.amazonaws.cn/systems-manager/.
In the navigation pane, choose Fleet Manager.

-or-

If the Amazon Systems Manager home page opens first, choose the menu icon ( ) to open the navigation pane, and then choose Fleet Manager in the navigation pane.
Choose Account management, Default Host Management Configuration.
Turn off Enable Default Host Management Configuration.
Choose Configure to disable Default Host Management Configuration.

To deactivate Default Host Management Configuration (command line)

Open the Amazon CLI or Tools for Windows PowerShell and run the following command. Replace each example resource placeholder with your own information.

Least privilege policy examples for Default Host Management Configuration

The following sample policies demonstrate how to prevent members of your organization from making changes to the Default Host Management Configuration setting in your account.

Service control policy for Amazon Organizations

The following policy demonstrates how to prevent non-administrative members in your Amazon Organizations from updating your Default Host Management Configuration setting. Replace each example resource placeholder with your own information.


{
    "Version":"2012-10-17",
    "Statement":[
        {
            "Effect":"Deny",
            "Action":[
                "ssm:UpdateServiceSetting",
                "ssm:ResetServiceSetting"
            ],
            "Resource":"arn:aws-cn:ssm:*:*:servicesetting/ssm/managed-instance/default-ec2-instance-management-role",
            "Condition":{
                "StringNotEqualsIgnoreCase":{
                "aws:PrincipalTag/job-function":[
                    "administrator"
                ]
                }
            }
        },
        {
            "Effect":"Deny",
            "Action":[
                "iam:PassRole"
            ],
            "Resource":"arn:aws-cn:iam::*:role/service-role/AWSSystemsManagerDefaultEC2InstanceManagementRole",
            "Condition":{
                "StringEquals":{
                "iam:PassedToService":"ssm.amazonaws.com.cn"
                },
                "StringNotEqualsIgnoreCase":{
                "aws:PrincipalTag/job-function":[
                    "administrator"
                ]
                }
            }
        },
        {
            "Effect":"Deny",
            "Resource":"arn:aws-cn:iam::*:role/service-role/AWSSystemsManagerDefaultEC2InstanceManagementRole",
            "Action":[
                "iam:AttachRolePolicy",
                "iam:DeleteRole"
            ],
            "Condition":{
                "StringNotEqualsIgnoreCase":{
                "aws:PrincipalTag/job-function":[
                    "administrator"
                ]
                }
            }
        }
    ]
}

Policy for IAM principals

The following policy demonstrates how to prevent IAM groups, roles, or users in your Amazon Organizations from updating your Default Host Management Configuration setting. Replace each example resource placeholder with your own information.


{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Deny",
            "Action": [
                "ssm:UpdateServiceSetting",
                "ssm:ResetServiceSetting"
            ],
            "Resource": "arn:aws-cn:ssm:region:account-id:servicesetting/ssm/managed-instance/default-ec2-instance-management-role"
        },
        {
            "Effect": "Deny",
            "Action": [
                "iam:AttachRolePolicy",
                "iam:DeleteRole",
                "iam:PassRole"
            ],
            "Resource": "arn:aws-cn:iam::account-id:role/service-role/AWSSystemsManagerDefaultEC2InstanceManagementRole"
        }
    ]
}

Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Deregistering managed nodes in a hybrid and multicloud environment

Connecting to a managed instance using Remote Desktop