Hello and welcome back.
Let's not talk about a very important feature for monitoring patching connecting to your infrastructure
whether it is on premise or in it oblivious.
And that is database systems manager used to be called different names.
Simple system manager and this is where the acronym comes or the abbreviation SS M that we are going
to use extensively throughout the lectures.
But the current name is system of manager until further notice by us.
So what are we going to learn during this lecture.
It is going.
We are going to learn what it is.
What is systems manager.
We will learn how it works.
We will learn about the SSA agent and will know about the capabilities what can I do with systems managers
why it is important we learn also about what is a managed instance.
Basically when system manager starts controlling or managing an instance it becomes a managed instance
and we learn how that happens.
We'll also talk about how the managed instances connect to the SS M or the systems manager service.
And we'll also learn about the IAM roles or permissions that are required for users or administrators
to access systems managers to do some configurations and also for the managed instances to be accessed
or to access systems manager.
So let's dive in.
So what is it.
It is a collection of capabilities different services bundled into one bigger service.
The systems manager in order to manage your infrastructure beat on premise or on it abuse.
So these are used to configure and manage Amazon easy to instances on premise servers and virtual machines
and other resources at scale.
So now wherever you are going to do you are going to monitor and manage patch and all that an extensive
number of instances and they could be as we mentioned on premise and in Italy as it includes a unified
interface so the console basically that allows to easily centralize operational data and automate tasks
across the client WMC Resources.
As we learn also that could be across different regions.
Systems Manager shortens the time to detect and resolve operational problems.
How by finding out changes in configuration by finding out devices that are not patched are not up to
date in terms of security patches or as patches antivirus is not running stuff like that.
Since a manager gives a complete view of the client's infrastructure performance and configuration simplifies
the resource and application management and it can be used with Windows Linux or SBN instances or virtual
machines case or if in the exam you are given some options and the hotel.
Are told that this is only with Linux doesn't support Windows.
This is not the case.
It allows the systems manager allows for remotely and securely manage on premises servers and virtual
machines both in cloud and on premise and you can also manage virtual machines in other cloud environments
so that's one good thing.
I have a customer who has easy to insist on it yes but it also has Azure instances or virtual machines
on Azure or in Google Cloud.
Can I manage that through that through systems manager.
Yes you can.
Because it's treated as if it is on premise system and hybrid environments.
Why would I use it with hybrid environments.
First of all you are creating a consistent and secure way to remotely manage patch connect to your hybrid
workloads from one location and using the same tools and scripts using I am for centralized exec control
for actions that can be performed on servers and beams.
So you are not only managing centrally but also having access control centrally and you can use it as
cloud trail for centralized auditing so all the logs all the API calls on all that will be on cloud
trail.
Not only that but you can use cloud cloud watch logs to send all your logs and you can use cloud watch
events to turn on or to trigger actions by systems manager.
Here's how it looks.
Here's a typical workflow or a typical setup for systems manager.
So we have a system of manager in the middle inside it obvious cloud.
OK.
It can manage Linux instances when instances on a WS but it also can deal with workloads that are on
premise or in different clouds and they could be virtual machines and they could be servers as well
Linux or Windows so they could be both.
And then it integrates with cloud which it can send logs and command outputs to S3 and it and all the
API calls would be in cloud trail.
And it has built in insight.
How can you trigger manage or configure E.W. a systems manager from the console the systems manager
console through SD case through command line interface and with Windows powerful tools.
Okay so what are the steps.
I'm happy I won't use the servers.
What do I do.
The first thing you do is you need to configure systems manage through one of the tools we talked about
in order to start configuring scheduling automating and executing system manager actions.
And we are going to come to what actions can we do with system managers on database resources.
The ESM agent and configure permission so you need.
Also on the easy two instances and that's how the whole control happens.
You need to have SS agent configure on your easy to instances or your servers.
But for the on premise there is one extra step we'll talk about shortly.
So we did that.
The second is verification and processing.
Now we have done the configuration and automation and setup and all that to a systems manager now system
manager will verify the configuration including the permissions to all try to connect and find out if
the permissions are working and will send the request to the SS agent training on the instances or the
servers in hybrid environments the ones the connectivity between the server systems manager and SSN
is established to secure the permissions are there everything is OK then systems manager starts controlling
or managing your instances through the use of systems manager and then we get to the reporting phase.
Basically I need to find out I need to find out the inventory about everything I need to know about
the configuration complaints I need to know about the status of or dispatching or security patching.
Then SSA agent will give all this information to systems manager that it can show it or it can integrate
with other services.
As we mentioned it can send logs to cloud watch logs where you can start searching these logs using
Athena querying them or you can start visualizing stuff as well using quick site and other case or SSA
Asian reports the status of the configuration changes and actions to systems manager.
So it's not only the status of the instance but also when systems manager is trying to perform something
whether it was successful or not changed or not then that is reported back to systems manager and system
manager can then send the status to the user and various services if configured to do so.
So this is amazing.
Let's talk a little bit more about that.
This is a vision doesn't exist on any NWS or in any operating system.
The answer is no.
So for Windows MDI published before November 16 use the E C to configure Service to process requests
and for Linux.
Am I manually install agent on non base images.
Like what.
Like the all oh yes optimized.
Am I.
So there are some that have it by default.
There are some that don't have it as is a managed instance.
What is that.
So how can I call the instance that it is managed.
When you install SS on the instance and it connects to says the manager or it is able to communicate
with systems manager it becomes a managed instance.
Is that all four on LW as an on premise for on premise you need one extra step.
The next step is to do a verification and you generate what we call a verification code and I.D. the
verification code an idea is very similar to the Access IDEA and secret key that is allowed to connect
to an instance in it abuse.
Okay.
One problem and we'll talk about that later on is if I have an older version of SSN and I'm trying to
run a command or a capability that does not is not support.
But that version of SS and then that process could fail or that action could fail.
So what is database recommendation for this that you have to automate or you need to automate that whenever
there is a new version updated version then it will be installed or updated on your managed instance
connectivity to assess and the systems manager has public endpoints.
So by default if you want your instances to connect to the systems manager they have to go through the
Internet.
So if your instance are on a private subnet you need to do exactly you need another instance on that
gateway to allow that to reach the Internet.
If they are on public subnets you want to make sure that you have an AGW attached and there are tables
are configured to be able to go to the internet from those instances.
OK.
But we know that we have VPC and points right and systems manager supports that.
So why not configure VPN points and allow the easy two instances or the SS and on the easy two instances
that are managed to communicate your system manager through a secure way which is database infrastructure.
So that's much better.
And it is supported in our case so you need to allow the Internet access from the same agent or the
instances into systems manager.
So that is outbound Internet access and not systems manager initiating from the Internet.
What are the required permissions that I need to configure for the users who will be configuring or
the administrator who will be configuring systems manager and also what about the managed instances
that will be used for the user permissions you need it.
You need to configure the right I am permissions in order to allow the user administrator to you to
access SSN if any user has the full administrative access then they will be able to access the system
and then we need instant profiles.
We need roles for I I am roles for the instances basically why.
Because the SSA am Asian that exists on the instances is going to reach the permissions through the
instance profile that has the right I am permissions incase if you have changed the instance profile
you need to restart the SSA manager in order for changes to take effect quickly and then we need an
I am service role for what for.
On premises servers and V EMS and they will assume this role.
All right time to take a break and I'll see you in the next lecture and we'll learn more about systems
manager and the critical actions or the important actions that might feature in the exam.
I'll see you after the break.
Thank you.