> For the complete documentation index, see [llms.txt](https://docs.release.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.release.com/integrations/integrations-overview/aws-integration/control-your-eks-fleet-with-systems-manager.md). # Control your EKS fleet with systems manager How to use AWS Systems Manager to install agents or to configure your EKS worker nodes automatically. Customers that run self-hosted EKS clusters may need a way to manage their worker nodes for compliance, security, or for operational reasons. For example, you may need to install a monitoring agent on the EKS worker nodes to validate system configuration or to run vulnerability scans on each physical node in the cluster. Release installs the AWS Systems Manager Agent (SSM Agent) on each node in advance so new clusters and nodes are available in the Fleet Manager and Operations Management section of AWS Systems Manager. The AWS SSM Agent is fully audited, logged, and configurable inside your AWS account. The Systems Manager creates an SSM document that defines the installation or configuration steps to execute on each node. The document can be associated to a node or nodes by tag, and executed ad hoc or on a recurring basis. Documents can be shared across accounts and regions. You can create and manage these documents via the AWS Console, AWS CLI, Terraform, or any other method. To enable AWS SSM Agent on your nodes: 1. Create an SSM document to install or configure your nodes. 2. Create a fleet association to match nodes (or apply to all nodes). 3. Create a schedule to apply the document to your fleet at set intervals. ## Example: Installing Vanta Agent Here we install [Vanta Agent](https://www.vanta.com) on each node in a cluster. These directions are general and you can use them to start any configuration or installation. ### 1. Create an SSM document The SSM document is a YAML or JSON file that describes parameters, steps, and configuration options to apply to nodes. Example SSM documents are available in AWS. Here we use the [AWS default document called `AWS-RunRemoteScript`](https://docs.aws.amazon.com/systems-manager/latest/userguide/integration-github-python.html). This generic template is designed to download a script or file from GitHub or S3 and then execute it on either a Linux or Windows server. For Linux, run the installation script from Github and supply an API key. For the Windows agent, download a signed version from the Vanta Agent website and store the binary in S3 for installation. Specify the parameters of the source code that will be run in a later step. ``` "sourceInfoLinux": { "description": "(Required) Specify the information required to access the resource from the source. If source type is GitHub, then you can specify any of the following: 'owner', 'repository', 'path', 'getOptions', 'tokenInfo'. If source type is S3, then you can specify 'path'.", "type": "StringMap", "displayType": "textarea", "default": { "owner": "VantaInc", "repository": "vanta-agent-scripts", "branch": "master", "path": "install-linux.sh" } }, "sourceInfoWindows": { "description": "(Required) Specify the information required to access the resource from the source. If source type is GitHub, then you can specify any of the following: 'owner', 'repository', 'path', 'getOptions', 'tokenInfo'. If source type is S3, then you can specify 'path'.", "type": "StringMap", "displayType": "textarea", "default": { "path": ""https://s3.amazonaws.com/our-example-bucket/ourVantaAgent/vantaagent.exe"" } } ``` Specify the command line that will be used in the Linux or Windows installation. The Vanta key can be pulled from parameter store or secrets manager when specified in the parameters section. ``` "commandLineLinux": { "description": "(Required) Specify the command line to be executed. The following formats of commands can be run: 'pythonMainFile.py argument1 argument2', 'ansible-playbook -i \"localhost,\" -c local example.yml'", "type": "String", "default": "VANTA_KEY={{ssm:/admin/vanta/vanta_key}} ./install-linux.sh" }, "commandLineWindows": { "description": "(Required) Specify the command line to be executed. The following formats of commands can be run: 'pythonMainFile.py argument1 argument2', 'ansible-playbook -i \"localhost,\" -c local example.yml'", "type": "String", "default": "vantaagent.exe" } ``` Set a temporary working folder for the installation. ``` "workingDirectoryLinux": { "type": "String", "default": "/tmp", "description": "(Optional) The path where the content will be downloaded and executed from on your instance.", "maxChars": 4096 }, "workingDirectoryWindows": { "type": "String", "default": "${env:TEMP}", "description": "(Optional) The path where the content will be downloaded and executed from on your instance.", "maxChars": 4096 }, ``` The installation is executed for each distribution. ``` "mainSteps": [ { "action": "aws:downloadContent", "name": "downloadContentLinux", "inputs": { "sourceType": "Github", "sourceInfo": "{{ sourceInfoLinux }}", "destinationPath": "{{ workingDirectoryLinux }}" } }, { "action": "aws:downloadContent", "name": "downloadContentWindows", "inputs": { "sourceType": "S3", "sourceInfo": "{{ sourceInfoWindows }}", "destinationPath": "{{ workingDirectoryWindows }}" } }, { "precondition": { "StringEquals": [ "platformType", "Windows" ] }, "action": "aws:runPowerShellScript", "name": "runPowerShellScript", "inputs": { "runCommand": [ "", "$installed = (Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Where { $_.DisplayName -match 'Vanta' }) -eq $null" "", "If(-Not $installed) {", " {{ commandLineWindows }}", "}" "" ], "workingDirectory": "{{ workingDirectoryWindwos }}", "timeoutSeconds": "{{ executionTimeout }}" } }, { "precondition": { "StringEquals": [ "platformType", "Linux" ] }, "action": "aws:runShellScript", "name": "runShellScriptLinux", "inputs": { "runCommand": [ "", "if ! sudo yum list installed vanta || ! sudo service vanta.service status", "then", " {{ commandLineLinux }} ", "fi", "" ], "workingDirectory": "{{ workingDirectoryLinux }}", "timeoutSeconds": "{{ executionTimeout }}" } } ] ``` ### 2. Create a Fleet Association To associate the SSM document with nodes in your cluster, follow the [association guide](https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-state-assoc.html) in the AWS documentation. You can specify nodes by tag names and values as in the table below. The simplest choice is to select "all" instances, or you can choose Resource Groups (see the documentation). We don't recommend you choose them manually. ![](https://585411240-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M1neGLLQ0sDXeK6ooSo%2Fuploads%2Fgit-blob-bda1dddaffa3044268070b826d273cdce37c1563%2Fimage.png?alt=media) Here are some common tags for EKS clusters: | Selection Criterion | Tag Key | Tag Value | | -------------------------------- | ---------------------------- | -------------------- | | Any EKS worker node | alpha.eksctl.io/cluster-name | | | Only nodes in a specific cluster | alpha.eksctl.io/cluster-name | \ | | Nodes marked production | VantaOwner | | ### 3. Create a Schedule You can use a cron-style method to apply the State Manager association: * to any nodes added to your cluster, * if the application somehow uninstalls, or * if the application stops working. This keeps all nodes up to date as they are added, removed, or changed. ![Specify a schedule for your association](https://585411240-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M1neGLLQ0sDXeK6ooSo%2Fuploads%2Fgit-blob-1dab6b07e2211d7a34ace456a53c6a634e174695%2Fimage.png?alt=media) #### Specify a logging bucket You can log the output and executions in any logging bucket. ![](https://585411240-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M1neGLLQ0sDXeK6ooSo%2Fuploads%2Fgit-blob-72d2bcfd8e3eee83d8aff920e740565c2d495b16%2Fimage.png?alt=media) #### Check it's working After a time you can inspect logs in an S3 bucket. You can also view progress and events in the SSM Inventory Dashboard or State Manager History section. ![Verify the installation and executions](https://585411240-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-M1neGLLQ0sDXeK6ooSo%2Fuploads%2Fgit-blob-797df20147d63b8183c79094810f004f2d35bb4b%2Fimage.png?alt=media) ## References * [How to write an SSM document](https://aws.amazon.com/blogs/mt/writing-your-own-aws-systems-manager-documents/) * [SSM Document Syntax](https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-doc-syntax.html) * [Creating SSM Documents](https://docs.aws.amazon.com/systems-manager/latest/userguide/create-ssm-doc.html) * [Running shell scripts on SSM instances](https://docs.aws.amazon.com/systems-manager/latest/userguide/run-command.html) * [Creating a State Manager Association](https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-state-assoc.html) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.release.com/integrations/integrations-overview/aws-integration/control-your-eks-fleet-with-systems-manager.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.