Hello and welcome back.
Now with more capabilities of IT OBVIOUS systems manager or assess them.
And in this lecture we're going to look at the automation capability automating actions on you manage
instances.
And also we'll look at the assets and capabilities that run command which is very important as well
in systems manager.
So let's start with the automation so automation action in systems manager refer to what systems manager
can do to the unmanaged instances at scale one or more individually or in groups.
Of course in groups is the main strength or the point of strength of systems manager.
What that commission does it simplifies common maintenance and deployment tasks for Amazon easy to instances
and an example of what it can do.
Can Build automation workflows to configure and manage instances and NWS resources create custom Workflows
or use the predefined ones receive notifications about automated automation tasks and workflows by Amazon
Cloud watch events.
You can monitor the progress and execution details and if there are areas that are pertaining you can
even cancel the tasks that you are trying to do.
Examples of this specific tasks that you can do using the automation so I can use it to create a demise
or update existing earmarks and you can apply drivers to the instances and assess same agent update
you can reset passwords for Windows instances and you also you can reset the SSL keys on Linux instances
and you can apply OS patches or application updates.
I use case for automation.
You can when you are doing the workflow you can request that this change will not be a done unless if
one or more IAM users will approve it.
So now we are building a change management or a service management kind of services one use case that
you can do.
Am using my instances to do our task and the task only runs from Monday through Friday.
But then I don't need it over the weekend.
I need to stop the instances.
I don't have to run it and waste money on using these instances over the weekend so you can build an
automation task or commission action in systems manager that will start the instances at a specific
time on Monday and then it will end on Friday.
And for that you can use the Amazon cloud or watch events or you can use the maintenance window task
or action in or capability in systems manage.
You can also update resources that were deployed by cloud formation template.
But in this case automation will create a new template for that.
And also you can have an approval done first by an IAM user before the template is changed and you can
the automation can target a large number of easy two instances target groups of instances basically
not not the individual ones.
And that could be based on easy to tax create golden air miles from source a source EMI on one of the
instances and you can run custom scripts before and after updates are applied and you can of course
include or exclude specific patches from being installed on specific instances using automation as well.
You can also recover impaired instances.
So if an instance was connected to a system and becomes unreachable you can use automation to recover
that instance and reconnect to it again run command.
The next one the next capability the next action.
The wrong command is used to remotely and securely manage the configuration of the Managed instances
at scale could be tens could be hundreds of instances and still the right command can can do that.
So now when I'm saying that on command is that a command.
I am running.
No.
It is called the wrong command capability but it is used to run or documents or commanding documents
in systems manager.
So it is a facility or a feature called run command.
That's the name of it.
And it is used to execute commands on your manage these two instances.
And why would you use it.
Use it to automate common administrative tasks and perform ad hoc configuration changes at scale.
Use the wrong command from the console.
You can access it from the console from the Seelye from the database tools for Windows power shell and
from Italy as is the case as well.
And there is no additional cost for running these comments.
What are example tasks I can do with our increment updating applications you can do that you can run
linux shell scripts and Windows power shell the Linux shell scripts will be used with a document it
yes hyphen run shell script the windows if you will use database run power shell document for Windows
instances you can use it to install or bootstrap applications you can use it to build a deployment pipeline
you can capture log files when an instance is terminated from an auto Skilling group and you can join
instances go into.
This is also very important and it's a potential scenario in the example auto scaling when a cloud watch
event that an instance is going to be terminated on an auto scaling decides to terminate an instance
OK unhealthy whatever reason and you would like to get the logs from the instance before it terminate
so run command will help you do that and of course this can be automated how when cloud.
Events finds out that there's going to be terminated.
You can configure that cloud launch event that the target or when that happens execute the file the
following document.
Using that on command to collect the logs from the instance and you can use it to join instances to
own this domain.
So now you can automate joining instances to a Microsoft domain.
Let's look at run command and cloud watch.
How do they closely integrate when you are running comments you'd like to probably have the output just
in case if it goes wrong and if the command is the wrong command was configured to cancel after three
errors then you would like to find the output and troubleshoot.
Now by default does the systems manager contain or include that output.
It only gets out part of that 1200 bytes in that case then you can configure that and command to through
the command output or one executes the command it will take the output and put it in send it to cloud
watch logs you can do that at the same time you can use run command with the cloud to watch events where
the wrong command will be the target.
As we mentioned just a few seconds ago that when an instance is about to be terminated what I'd like
to maintain the logs.
What do I do.
Make the run command to be the target and pass the instance or the event will know and it will run the
command on that instance in order to capture the logs before it is terminated.
So with cloud watch logs if the full details of the command output are required you need an S three
bucket can be specified and or Amazon Cloud watch logs to send the output to.
So you have two options.
Send it on your bucket or to Amazon Cloud watch logs if you choose the Amazon cloud watch logs then
it will then command will periodically send all the command output an error logs to cloud watch logs
I am permissions for the instance to send output to us 3 or cloud watch logs must be granted.
So here is just heads up that you need the AC two instances or the managed instances to have that kind
of permission in their roles because the SSA agent is the one that will collect that and will send it
to the S3 bucket or the cloud which looks for cloud watch events.
Cloud measurements can be used to log command execution status messages.
That's one thing or are uncommon can be specified as the target.
As we mentioned before selecting instances for the wrong comment.
Let's say when you are about to run and run command you're expecting a few instances to to show in the
list of instances when you are selecting them.
But some of them they don't show up then what is the problem.
How can we troubleshoot it.
What to look for.
What is suspect.
A user selected the SSN document to run.
So now when you are running are uncommon the first thing you will you will choose is which document
you want to run.
The document would have as we'll see later on we'll have the instructions or the actions that will be
performed on these instances.
Then under that uncommon page you can't see or the user can't see the instances he wants to select to
run the command on.
So let's look at some possibilities.
One of the possibilities is check your SSN agent on these instances.
Why.
Because you want to make sure that the latest version of this as invasion is installed on the instance
such that you are sure that it supports all the features and the different documents and on that and
only Amazon easy to win does air miles.
And some links in my eyes are pre configured within the system.
As we mentioned before the second thing to suspect is look at the IAM instance.
Verify that the instance is configured with an A.M. roll that enables the instance to communicate with
the systems manager.
Maybe the instance is not communicating with the SSA is not going to hit him with a systems manager.
Also make sure that your account the user account that is using this feature has the right to run commands
on these instances.
And last thing is make sure that the SSN document that supports the type of instances you want to update
some some documents are only for windows some are only for Linux.
Not all of them support both the instance.
All right so time for a break.
I'll see you after the break with more.
Systems Manager lectures.
Thank you.