AWS Builder Center

Builder Center

Manage on-premises and multicloud hosts from AWS using SSM Hybrid Activations

Manage on-premises and multicloud hosts from AWS using SSM Hybrid Activations

Learn how to register any non-AWS host — on-premises, edge, or another cloud — as an AWS Systems Manager managed node without certificates or identity federation, and use Run Command to automate tasks like uploading data to Amazon S3.

Frank Poma

Senior Technical Account Manager (Sr. TAM) @ Amazon Web Services (AWS)
I've had this conversation more times than I can count. A customer wants to upload data from their on-premises servers to Amazon S3, or run a script on a fleet of VMs sitting in another cloud. The conversation immediately goes to certificates, PKI hierarchies, OIDC endpoints, token rotation, and identity federation. Weeks of planning for what should be a one-afternoon problem.
For a large class of use cases — operational automation, data uploads, configuration pulls — there is a dramatically simpler path:  AWS Systems Manager Hybrid Activations .
In this post, I'll show you exactly how it works by registering two VMs running on Microsoft Azure — one Ubuntu 22.04, one Windows Server 2022 — as SSM managed nodes, and using  Run Command  to upload data from both to  Amazon S3 . No certificates. No federation. No long-lived credentials to manage on the hosts. A single CloudFormation stack handles the entire AWS-side setup.

What is SSM Hybrid Activations?

 AWS Systems Manager  is the service most AWS customers use to manage their EC2 instances — patching, remote command execution, session access, inventory, and more. What is less well known is that SSM can manage any server, anywhere: on-premises, in another cloud, on the edge. The only requirement is that the SSM Agent can reach the SSM service endpoints over HTTPS.
SSM Hybrid Activations is the registration mechanism for non-EC2 hosts. The flow is:
  1. You generate an activation ID and activation code from AWS — a short-lived, limited-use credential pair
  1. You install the SSM Agent on your host and register it using that code
  1. The host appears in SSM Fleet Manager with an  mi-  prefix and is immediately manageable
After registration, the activation code is no longer needed. The agent maintains its own secure channel to SSM using the IAM service role you assigned at activation time. That role is the host's identity in AWS — it defines what the host can do, and it is the only credential that matters going forward.
What you do not need:
  • X.509 certificates or a PKI
  • OIDC endpoints or token exchange
  • Long-lived IAM user credentials on the host
  • Any secrets rotation infrastructure
Important — know the boundaries: SSM Hybrid Activations establishes the identity of the system within SSM. It is not application-level identity federation. Scripts running via Run Command inherit the permissions of the IAM service role, but applications running on the host cannot use this mechanism to assume arbitrary IAM roles independently. For workloads that need their own AWS identity, see  IAM Roles Anywhere .

When to use this vs. alternatives

Scenario
Right tool
Operational tasks from non-EC2 hosts: run scripts, upload to S3, pull config
SSM Hybrid Activations
Application workloads that need to call AWS APIs with their own identity
IAM Roles Anywhere
Human workforce access to AWS accounts
IAM Identity Center
Full workload identity federation with an external IdP
STS + OIDC / SAML
SSM Hybrid Activations is available at no additional cost for up to 1,000 non-EC2 managed nodes per AWS account per Region (standard tier). The advanced tier is required for more than 1,000 nodes or to use Session Manager with hybrid nodes.

Solution architecture

The AWS-side setup has three components:
┌─────────────────────────────────────────────────────────────────┐
│                        AWS Account                              │
│                                                                 │
│  ┌──────────────────┐    ┌──────────────────────────────────┐   │
│  │  IAM Service     │    │  AWS Systems Manager             │   │
│  │  Role            │◄───│                                  │   │
│  │                  │    │  • Hybrid Activation (ID + Code) │   │
│  │  - SSMCore       │    │  • Fleet Manager (mi- nodes)     │   │
│  │  - s3:PutObject  │    │  • Run Command                   │   │
│  └──────────────────┘    │  • SSM Document                  │   │
│                          └──────────────┬───────────────────┘   │
│                                         │ Run Command            │
│  ┌──────────────────┐                   │                        │
│  │  Amazon S3       │◄──────────────────┘                        │
│  │  (demo bucket)   │  aws s3 cp (via service role creds)        │
│  └──────────────────┘                                            │
└─────────────────────────────────────────────────────────────────┘
         ▲
         │ SSM Agent (HTTPS outbound only)
         │
┌────────┴────────────────────────────────┐
│  Non-AWS hosts (Azure VMs in this demo) │
│                                         │
│  • ssm-hybrid-node  (Ubuntu 22.04)      │
│  • ssm-hybrid-win   (Windows Server 22) │
└─────────────────────────────────────────┘

The SSM Agent on each host connects outbound to SSM over HTTPS — no inbound ports required, no VPN, no Direct Connect. The agent uses long-polling via the SSM Messages service to receive commands, executes them, and returns results. The IAM service role is what gives those commands their AWS permissions.

Prerequisites

  • An AWS account with permissions to create IAM roles, S3 buckets, Lambda functions, and CloudFormation stacks
  • A non-EC2 host running a  supported OS  with outbound HTTPS access to the SSM service endpoints
  • The  AWS CLI  installed on each hybrid node (required for the  aws s3 cp  in the demo script)

Step 1: Deploy the AWS-side infrastructure

All AWS-side resources are deployed with a single CloudFormation stack. The template creates:
  •  SSMHybridServiceRole  — IAM service role with  AmazonSSMManagedInstanceCore  and  s3:PutObject  on the demo bucket. The trust policy uses  aws:SourceAccount  and  aws:SourceArn  conditions to prevent confused deputy attacks.
  •  DemoBucket  — S3 bucket with server-side encryption and all public access blocked.
  •  ActivationFunction  +  HybridActivation  — A Lambda-backed CloudFormation Custom Resource that calls  ssm:CreateActivation  and surfaces the activation ID and code as stack outputs. ( AWS::SSM::Activation  is not a native CloudFormation resource type, so a Custom Resource is required.)
  •  UploadToS3Document  — An SSM Command Document with OS-aware steps:  aws:runShellScript  for Linux and  aws:runPowerShellScript  for Windows, using  precondition  blocks to run the right script automatically. Parameters use  interpolationType: ENV_VAR  for injection safety, which requires SSM Agent 3.3.2746.0 or later. Run  aws ssm describe-instance-information  to confirm your agent version before running the document.
Save the template below as  cfn-ssm-hybrid.yaml  and deploy. If you are registering more than one host (as in this walkthrough), set  ActivationInstanceLimit  to match the number of hosts:
aws cloudformation deploy \
  --template-file cfn-ssm-hybrid.yaml \
  --stack-name ssm-hybrid-demo \
  --capabilities CAPABILITY_NAMED_IAM \
  --region us-east-1 \
  --parameter-overrides ActivationInstanceLimit=2

Retrieve the outputs:
aws cloudformation describe-stacks \
  --stack-name ssm-hybrid-demo \
  --region us-east-1 \
  --query "Stacks[0].Outputs" \
  --output table

Output key
Description
ActivationId
Activation ID for SSM Agent registration
ActivationCode
Activation code for SSM Agent registration
DemoBucketName
S3 bucket that will receive uploaded files
SSMAgentRegistrationCommand
Complete Linux registration command, ready to paste
Security note: The activation code appears in your stack outputs in plaintext. Treat it like a password — do not commit it to source control. If it expires before use, redeploy the stack with a new  ActivationExpiryHours  value to generate a fresh one. The default expiry is 24 hours.

Step 2: Install and register the SSM Agent

On each non-EC2 host, install the SSM Agent and register it with the activation ID and code from the stack outputs. AWS recommends using  ssm-setup-cli  for non-EC2 installations as it handles both download and registration securely in a single tool.
Ubuntu / Debian:
REGION="us-east-1"   # must match the region where you created the activation
mkdir /tmp/ssm
curl https://amazon-ssm-$REGION.s3.$REGION.amazonaws.com/latest/debian_amd64/ssm-setup-cli \
  -o /tmp/ssm/ssm-setup-cli
sudo chmod +x /tmp/ssm/ssm-setup-cli
sudo /tmp/ssm/ssm-setup-cli -register \
  -activation-code "<ActivationCode>" \
  -activation-id "<ActivationId>" \
  -region "$REGION"

Note for Ubuntu snap installations: If your Ubuntu system uses the snap package, use the following commands instead:__PRE_PLACEHOLDER_4__
RHEL / CentOS / other RPM-based Linux:
REGION="us-east-1"   # must match the region where you created the activation
mkdir /tmp/ssm
curl https://amazon-ssm-$REGION.s3.$REGION.amazonaws.com/latest/linux_amd64/ssm-setup-cli \
  -o /tmp/ssm/ssm-setup-cli
sudo chmod +x /tmp/ssm/ssm-setup-cli
sudo /tmp/ssm/ssm-setup-cli -register \
  -activation-code "<ActivationCode>" \
  -activation-id "<ActivationId>" \
  -region "$REGION"

Windows Server (run as Administrator):
AWS now recommends  ssm-setup-cli.exe  for Windows hybrid installations as well. It downloads, installs, and registers the agent in a single step.
$region = "us-east-1"
$code   = "<ActivationCode>"
$id     = "<ActivationId>"

[System.Net.ServicePointManager]::SecurityProtocol = 'TLS12'
$dir = $env:TEMP + "\ssm"
New-Item -ItemType directory -Path $dir -Force
cd $dir
(New-Object System.Net.WebClient).DownloadFile(
    "https://amazon-ssm-$region.s3.$region.amazonaws.com/latest/windows_amd64/ssm-setup-cli.exe",
    "$dir\ssm-setup-cli.exe"
)
.\ssm-setup-cli.exe -register `
    -activation-code="$code" `
    -activation-id="$id" `
    -region="$region"

# Verify registration
Get-Content ($env:ProgramData + "\Amazon\SSM\InstanceData\registration")
Get-Service -Name "AmazonSSMAgent" | Select-Object Name, Status

Expected output:
{"ManagedInstanceID":"mi-0EXAMPLE4444444444","Region":"us-east-1"}

Name            Status
----            ------
AmazonSSMAgent  Running

Within seconds of the agent starting, the host appears in  SSM Fleet Manager  with an  mi-  prefix and Online status.
On activation limits: Each activation has a registration limit (default: 1) and an expiry window (default: 24 hours). The limit controls how many hosts can register with a single activation code — not how many hosts you can manage. Once a host is registered, it stays registered regardless of whether the activation expires. If you need to register more hosts than the limit allows, create a new activation or increase the limit when deploying the stack with  --parameter-overrides ActivationInstanceLimit=N .

Step 3: Verify both nodes are online

aws ssm describe-instance-information \
  --region us-east-1 \
  --query "InstanceInformationList[?starts_with(InstanceId, 'mi-')].{ID:InstanceId,Status:PingStatus,Platform:PlatformName,AgentVersion:AgentVersion}" \
  --output table

--------------------------------------------------------------------------------------------------------------------------
|                                          DescribeInstanceInformation                                                   |
+--------------+-----------------------+--------------------------------------------+----------+
| AgentVersion |          ID           |                 Platform                   | Status   |
+--------------+-----------------------+--------------------------------------------+----------+
|  3.3.3883.0  |  mi-0EXAMPLE3333333333 |  Ubuntu                                    |  Online  |
|  3.3.3883.0  |  mi-0EXAMPLE4444444444 |  Microsoft Windows Server 2022 Datacenter  |  Online  |
+--------------+-----------------------+--------------------------------------------+----------+

Two nodes. Two different operating systems. Both running on Azure. Both managed by AWS Systems Manager.

Step 4: Upload data to S3 via Run Command

From AWS, send the SSM Document to a hybrid node. The document uses  precondition  blocks to detect the OS automatically and run the appropriate script — no need to know or specify the OS when invoking the command.
COMMAND_ID=$(aws ssm send-command \
  --document-name "HybridDemo-UploadToS3" \
  --targets "Key=InstanceIds,Values=<your-mi-id>" \
  --parameters "BucketName=<DemoBucketName>" \
  --region us-east-1 \
  --query "Command.CommandId" \
  --output text)
echo "CommandId: $COMMAND_ID"

Check the result (allow a few seconds for the command to complete):
aws ssm get-command-invocation \
  --command-id "$COMMAND_ID" \
  --instance-id "<your-mi-id>" \
  --region us-east-1 \
  --query "{Status:Status,Output:StandardOutputContent}" \
  --output table

After running against both nodes, verify the files landed in S3:
aws s3 ls s3://<DemoBucketName>/uploads/ --region us-east-1

2026-03-21 16:51:46   196   demo-ssm-hybrid-node-20260321165144.txt
2026-03-21 17:25:10   216   demo-ssm-hybrid-win-20260321172506.txt

Download and inspect each file:
aws s3 cp s3://<DemoBucketName>/uploads/demo-ssm-hybrid-node-20260321165144.txt . --region us-east-1
cat demo-ssm-hybrid-node-20260321165144.txt

=== SSM Hybrid Activations Demo ===
Host:      ssm-hybrid-node
Timestamp: Sat Mar 21 16:51:44 UTC 2026
Kernel:    6.8.0-1044-azure
This file was uploaded from an on-prem host via SSM Run Command.

aws s3 cp s3://<DemoBucketName>/uploads/demo-ssm-hybrid-win-20260321172506.txt . --region us-east-1
type demo-ssm-hybrid-win-20260321172506.txt

=== SSM Hybrid Activations Demo ===
Host:      ssm-hybrid-win
Timestamp: Sat Mar 21 17:25:06 UTC 2026
OS:        Microsoft Windows NT 10.0.20348.0
This file was uploaded from an on-prem host via SSM Run Command.

 Kernel: 6.8.0-1044-azure  and  OS: Microsoft Windows NT 10.0.20348.0  — both files were generated and uploaded by VMs running on Microsoft Azure, orchestrated entirely from AWS, with no long-lived credentials to manage on either host.

How the permissions work

This is the part worth slowing down on, because it's what makes the whole thing elegant.
When the SSM Agent registers with a hybrid activation, it writes temporary AWS credentials to the shared credentials file on the host. On Linux, this is  /root/.aws/credentials ; on Windows, it is the  .aws\credentials  file under the SYSTEM user profile. These credentials are derived from the IAM service role you specified at activation time and are automatically refreshed by the agent before they expire. That role is the host's identity in AWS for the lifetime of its registration.
Note: SSM Agent version 3.2.x.x and later may also store credentials at  /var/lib/amazon/ssm/credentials  (Linux) or  %PROGRAMFILES%\Amazon\SSM\credentials  (Windows) when onboarded via Default Host Management Configuration. For hybrid activations, the agent uses the shared credentials file path described above. See  SSM Agent technical details  for the full credentials precedence chain.
When Run Command executes a script on the host, the script runs as root on Linux and as SYSTEM on Windows — the same user context as the SSM Agent itself. This means the script has direct access to the agent-managed credentials file. The AWS CLI and SDKs find these credentials automatically through the  default credential provider chain . There is nothing to configure, no environment variables to set, and no rotation to manage.
In this demo, the service role has:
  •  AmazonSSMManagedInstanceCore  — allows the agent to communicate with the SSM service (specific  ssm:  actions for document retrieval, inventory, association management, and compliance reporting), the SSM Messages service ( ssmmessages:* ), and the EC2 Messages service ( ec2messages:* ).
  •  s3:PutObject  on the demo bucket — the only S3 permission granted, scoped to the specific bucket
The IAM service role is also the right place to enforce least privilege. If you have different groups of hosts that need different AWS permissions, create separate activations pointing to separate service roles. The activation is the binding between a host and its AWS identity.

Security considerations

Treat the activation code as a short-lived secret. It is a registration credential — once used, it has no further value, but if intercepted before use it could allow an unauthorized host to register under your service role. Store it securely during the deployment window and delete it after all hosts are registered. If you suspect exposure, delete the activation from the SSM console immediately and create a new one.
Scope the IAM service role to least privilege. Every host registered with a given activation inherits the same service role. Grant only the permissions your automation actually needs. In production, replace the broad  s3:PutObject  with a resource-scoped policy that names the specific bucket and prefix.
Set the shortest activation expiry your deployment process can tolerate. The default is 24 hours. For automated deployments where the registration happens immediately after stack creation, you can reduce this to 1–2 hours. Expiry has no effect on already-registered nodes.
Audit with CloudTrail.  SendCommand  API calls are logged in  AWS CloudTrail  as management events — you get a record of who triggered a command, against which nodes, using which document, and when. Command output is not in CloudTrail; to capture that, configure Run Command to send output to an S3 bucket or CloudWatch Logs when you call  send-command  using the  --output-s3-bucket-name  or  --cloud-watch-output-config  options. Together, these give you a complete audit trail of both the invocation and the execution result.
Deregister nodes you no longer manage. A registered node that is decommissioned but not deregistered remains a valid identity in SSM. Use  aws ssm deregister-managed-instance --instance-id mi-xxxx  or the Fleet Manager console as part of your host decommission process.

Clean up

# Deregister each hybrid node
aws ssm deregister-managed-instance --instance-id mi-0EXAMPLE3333333333 --region us-east-1
aws ssm deregister-managed-instance --instance-id mi-0EXAMPLE4444444444 --region us-east-1

# Empty the S3 bucket first (CloudFormation cannot delete a non-empty bucket)
aws s3 rm s3://<DemoBucketName>/ --recursive --region us-east-1

# Delete the CloudFormation stack
aws cloudformation delete-stack --stack-name ssm-hybrid-demo --region us-east-1

Delete any VMs you deployed in another cloud for this walkthrough.

Conclusion

In this post, we registered two VMs running on Microsoft Azure — one Linux, one Windows — as AWS Systems Manager managed nodes using SSM Hybrid Activations, and used Run Command to upload data from both to Amazon S3. The entire AWS-side setup was a single CloudFormation stack. The entire on-host setup was a one-time agent installation and registration command.
No certificates. No PKI. No OIDC. No secrets rotation. The activation code is used once and discarded. After that, the IAM service role is the only identity that matters, and it lives entirely in AWS.
SSM Hybrid Activations is not the right tool for every problem. If your applications need to call AWS APIs with their own workload identity,  IAM Roles Anywhere  is the right answer — it gives you full X.509-based identity federation with fine-grained per-workload control. But for the large number of customers who need to automate operational tasks on non-AWS hosts, SSM Hybrid Activations gets you there in an afternoon, at no additional cost for up to 1,000 nodes per account per Region, and without you having to manage any secrets on your hosts.
To learn more, see the  SSM hybrid and multicloud documentation .


Appendix: CloudFormation template

AWSTemplateFormatVersion: "2010-09-09"
Description: >
  SSM Hybrid Activations demo — IAM service role, S3 bucket, hybrid activation
  (via Lambda Custom Resource), and a cross-platform SSM Command Document.

Parameters:
  ActivationInstanceLimit:
    Type: Number
    Default: 1
    Description: Max hosts that can register with this activation
  ActivationExpiryHours:
    Type: Number
    Default: 24
    Description: Hours until the activation code expires (max 720)
  DefaultInstanceName:
    Type: String
    Default: hybrid-demo-node
    Description: Display name for registered managed nodes

Resources:

  DemoBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true

  SSMHybridServiceRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: SSMHybridServiceRole
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: ssm.amazonaws.com
            Action: sts:AssumeRole
            Condition:
              StringEquals:
                aws:SourceAccount: !Ref AWS::AccountId
              ArnLike:
                aws:SourceArn: !Sub "arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:*"
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore
      Policies:
        - PolicyName: S3DemoBucketWrite
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action: s3:PutObject
                Resource: !Sub "${DemoBucket.Arn}/*"

  ActivationLambdaRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      Policies:
        - PolicyName: SSMActivationManage
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - ssm:CreateActivation
                  - ssm:DeleteActivation
                  - ssm:AddTagsToResource
                  - iam:PassRole
                Resource: "*"

  ActivationFunction:
    Type: AWS::Lambda::Function
    Properties:
      Runtime: python3.12
      Handler: index.handler
      Role: !GetAtt ActivationLambdaRole.Arn
      Timeout: 30
      Code:
        ZipFile: |
          import boto3, json, urllib.request, datetime

          def send(event, context, status, data={}, reason=""):
              body = json.dumps({
                  "Status": status, "Reason": reason,
                  "PhysicalResourceId": data.get("ActivationId", "none"),
                  "StackId": event["StackId"], "RequestId": event["RequestId"],
                  "LogicalResourceId": event["LogicalResourceId"], "Data": data,
              }).encode()
              req = urllib.request.Request(event["ResponseURL"], data=body,
                                           headers={"Content-Type": ""}, method="PUT")
              urllib.request.urlopen(req)

          def handler(event, context):
              ssm = boto3.client("ssm")
              props = event["ResourceProperties"]
              try:
                  if event["RequestType"] in ("Create", "Update"):
                      expiry = (datetime.datetime.now(datetime.timezone.utc) +
                                datetime.timedelta(hours=int(props["ExpiryHours"]))).strftime(
                                    "%Y-%m-%dT%H:%M:%S")
                      resp = ssm.create_activation(
                          DefaultInstanceName=props["DefaultInstanceName"],
                          IamRole=props["IamRole"],
                          RegistrationLimit=int(props["RegistrationLimit"]),
                          ExpirationDate=expiry,
                          Tags=[{"Key": "blog-demo", "Value": "ssm-hybrid"}],
                      )
                      send(event, context, "SUCCESS", {
                          "ActivationId": resp["ActivationId"],
                          "ActivationCode": resp["ActivationCode"],
                      })
                  elif event["RequestType"] == "Delete":
                      aid = event.get("PhysicalResourceId", "")
                      if aid and aid != "none":
                          try:
                              ssm.delete_activation(ActivationId=aid)
                          except Exception:
                              pass
                      send(event, context, "SUCCESS")
              except Exception as e:
                  send(event, context, "FAILED", reason=str(e))

  HybridActivation:
    Type: Custom::SSMHybridActivation
    Properties:
      ServiceToken: !GetAtt ActivationFunction.Arn
      IamRole: !Ref SSMHybridServiceRole
      RegistrationLimit: !Ref ActivationInstanceLimit
      ExpiryHours: !Ref ActivationExpiryHours
      DefaultInstanceName: !Ref DefaultInstanceName

  UploadToS3Document:
    Type: AWS::SSM::Document
    Properties:
      Name: HybridDemo-UploadToS3
      DocumentType: Command
      DocumentFormat: YAML
      Content:
        schemaVersion: "2.2"
        description: Uploads a sample file from the hybrid node to S3. Supports Linux and Windows.
        parameters:
          BucketName:
            type: String
            default: !Ref DemoBucket
            interpolationType: ENV_VAR
            allowedPattern: "^[a-z0-9][a-z0-9\\-\\.]*[a-z0-9]$"
          S3Prefix:
            type: String
            default: uploads
            interpolationType: ENV_VAR
            allowedPattern: "^[a-zA-Z0-9!\\-_\\.\\*'()/]*$"
        mainSteps:
          - action: aws:runShellScript
            name: UploadLinux
            precondition:
              StringEquals: [platformType, Linux]
            inputs:
              runCommand:
                - |
                  set -e
                  # ENV_VAR interpolation requires SSM Agent >= 3.3.2746.0
                  # Fallback for older agents that perform raw string substitution
                  BUCKET="${SSM_BucketName:-{{ BucketName }}}"
                  PREFIX="${SSM_S3Prefix:-{{ S3Prefix }}}"
                  FILENAME="demo-$(hostname)-$(date +%Y%m%d%H%M%S).txt"
                  TMPFILE="/tmp/$FILENAME"
                  printf "=== SSM Hybrid Activations Demo ===\nHost:      $(hostname)\nTimestamp: $(date -u)\nKernel:    $(uname -r)\nThis file was uploaded from an on-prem host via SSM Run Command.\n" > "$TMPFILE"
                  aws s3 cp "$TMPFILE" "s3://$BUCKET/$PREFIX/$FILENAME"
                  echo "Uploaded s3://$BUCKET/$PREFIX/$FILENAME"
          - action: aws:runPowerShellScript
            name: UploadWindows
            precondition:
              StringEquals: [platformType, Windows]
            inputs:
              runCommand:
                - |
                  # ENV_VAR interpolation requires SSM Agent >= 3.3.2746.0
                  # Fallback for older agents: use {{ }} substitution if env var is empty
                  $ErrorActionPreference = 'Stop'
                  if ([string]::IsNullOrEmpty($env:SSM_BucketName)) {
                    $Bucket = "{{ BucketName }}"
                    $Prefix = "{{ S3Prefix }}"
                  } else {
                    $Bucket = $env:SSM_BucketName
                    $Prefix = $env:SSM_S3Prefix
                  }
                  $Filename = "demo-$env:COMPUTERNAME-$(Get-Date -Format 'yyyyMMddHHmmss').txt"
                  $TmpFile = "$env:TEMP\$Filename"
                  @"
                  === SSM Hybrid Activations Demo ===
                  Host:      $env:COMPUTERNAME
                  Timestamp: $(Get-Date -Format 'ddd MMM dd HH:mm:ss UTC yyyy')
                  OS:        $([System.Environment]::OSVersion.VersionString)
                  This file was uploaded from an on-prem host via SSM Run Command.
                  "@ | Out-File -FilePath $TmpFile -Encoding utf8
                  & 'C:\Program Files\Amazon\AWSCLIV2\aws.exe' s3 cp $TmpFile "s3://$Bucket/$Prefix/$Filename"
                  Write-Output "Uploaded s3://$Bucket/$Prefix/$Filename"

Outputs:
  ActivationId:
    Value: !GetAtt HybridActivation.ActivationId
  ActivationCode:
    Value: !GetAtt HybridActivation.ActivationCode
  DemoBucketName:
    Value: !Ref DemoBucket
  SSMAgentRegistrationCommand:
    Description: Linux registration command using ssm-setup-cli (recommended)
    Value: !Sub
      - |
        mkdir /tmp/ssm
        curl https://amazon-ssm-${AWS::Region}.s3.${AWS::Region}.amazonaws.com/latest/linux_amd64/ssm-setup-cli -o /tmp/ssm/ssm-setup-cli
        sudo chmod +x /tmp/ssm/ssm-setup-cli
        sudo /tmp/ssm/ssm-setup-cli -register -activation-code "${Code}" -activation-id "${Id}" -region "${AWS::Region}"
      - Code: !GetAtt HybridActivation.ActivationCode
        Id: !GetAtt HybridActivation.ActivationId


If you have feedback about this post, submit comments in the Comments section below. If you have questions, start a new thread on  AWS re:Post  or  contact AWS Support .
# aws-systems-manager# security
Any opinions in this article are those of the individual author and may not reflect the opinions of AWS.
Enjoyed reading this content? Let the author know!

Your likes, comments, shares, and saves help creators reach more builders.

Loading recommendations

Loading article