SYSTEM Cited by 2 sources

AWS Systems Manager (SSM)

AWS Systems Manager (SSM) is AWS's managed-instance control plane — a family of sub-services sharing the ssm API surface, most of which are orthogonal to this wiki's focus. Two sub-services show up in ingested sources and have their own pages:

• Parameter Store — hierarchical configuration KV store with built-in versioning + EventBridge change events; the canonical managed alternative to DIY config stores.
• Session Manager — IAM-authenticated shell / port-forward tunnel to managed compute without inbound ports or bastion hosts (detailed below).

Stub page: expand as sources cite more SSM subsystems.

Session Manager — why it matters to this wiki

SSM Session Manager is the substrate under the SageMaker AI StartSession API — the "SSH-over-SSM" pattern that lets local IDEs tunnel into otherwise-isolated managed-compute environments. See secure-tunnel-to-managed-compute and sources/2025-08-06-allthingsdistributed-removing-friction-sagemaker-ai-development for the SageMaker application.

The architectural shape is:

• Control plane = SSM service (IAM auth, policy, session orchestration, audit logging).
• Data plane = SSM Agent on the target + outbound WebSocket back to SSM → client streams through SSM as a relay.
• Target never exposes an inbound port. No network ACL changes needed.

This is an instance of concepts/control-plane-data-plane-separation applied to remote access.

Seen in

• sources/2025-08-06-allthingsdistributed-removing-friction-sagemaker-ai-development — SageMaker AI's StartSession API builds SSH-over-SSM tunnels that maintain Studio spaces' security boundaries while giving local VS Code access to SageMaker AI compute.
• sources/2026-04-08-aws-build-a-multi-tenant-configuration-system-with-tagged-storage-patterns — SSM as the parent of Parameter Store, the hierarchical shared- configuration backend on the param_config_* side of tagged-storage-routing. See systems/aws-parameter-store for the sub-service detail.

Related

• systems/aws-parameter-store — SSM's config-store subsystem.
• secure-tunnel-to-managed-compute
• concepts/control-plane-data-plane-separation

Seen in — hybrid cloud orchestration (2026-09-01)

Two SSM capabilities appear in the AWS hybrid-cloud orchestration reference architecture: hybrid activations register on-premises instances so the SSM agent can manage them alongside cloud resources (unified config, patching, command execution); and SSM is used (with AWS Batch) to execute EKS Anywhere cluster commands against on-prem servers. Parameter Store also provides the centralized configuration store in that architecture. (Source: sources/2026-09-01-aws-hybrid-cloud-orchestration-modernizing-on-premises-infrastructure)