Run Command, Automation and State Manager

Start as usual:

cd C:\aws-lab
aws login --profile saat-admin
$env:AWS_PROFILE = 'saat-admin'
$v = Get-Content C:\aws-lab\saat-vpc.json | ConvertFrom-Json
.\Start-SsmEndpoints.ps1

1Launch two web servers

Paste this whole block:

$base = aws ssm get-parameter --name /aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64 --query Parameter.Value --output text
$ids = foreach ($s in @(@('ops01', $v.PrivateA), @('ops02', $v.PrivateB))) {
  aws ec2 run-instances --image-id $base --instance-type t3.micro --subnet-id $s[1] --security-group-ids $v.AppSg --iam-instance-profile Name=saat-ec2-ssm-profile --metadata-options HttpTokens=required --tag-specifications "ResourceType=instance,Tags=[{Key=Name,Value=$($s[0])},{Key=Role,Value=web},{Key=course,Value=saatvedha-aws},{Key=lesson,Value=28}]" --query "Instances[0].InstanceId" --output text
}
foreach ($i in $ids) { do { Start-Sleep 20; $p = aws ssm describe-instance-information --filters "Key=InstanceIds,Values=$i" --query "InstanceInformationList[0].PingStatus" --output text } until ($p -eq 'Online') }
aws ssm describe-instance-information --filters "Key=tag:Role,Values=web" --query "InstanceInformationList[].[InstanceId,PingStatus,PlatformName]" --output text

You should see something like this:

i-0b1c2d3e4f5a60051      Online  Amazon Linux
i-0b1c2d3e4f5a60052      Online  Amazon Linux

2One command, every web server

Paste this whole block:

'{ "commands": [ "df -h /", "uptime" ] }' | Set-Content rc-params.json
$cmd = aws ssm send-command --document-name AWS-RunShellScript --targets "Key=tag:Role,Values=web" --parameters file://rc-params.json --max-concurrency 50% --max-errors 1 --comment "disk check" --query Command.CommandId --output text
Start-Sleep 15
foreach ($i in $ids) { aws ssm get-command-invocation --command-id $cmd --instance-id $i --query StandardOutputContent --output text }

You should see something like this, once per server:

Filesystem      Size  Used Avail Use% Mounted on
/dev/nvme0n1p1  8.0G  1.7G  6.3G  21% /
 19:42:10 up 12 min,  0 users,  load average: 0.00, 0.02, 0.01

Writing the parameters to a file avoids Windows PowerShell 5.1 stripping the inner quotes. --max-concurrency 50% runs on half the servers at a time, and --max-errors 1 stops sending to new servers after a second failure, so a bad command can’t hit the whole fleet.

3Write and run a runbook

Paste this whole block:

@'
description: Delete temp files older than 7 days and tag the instance
schemaVersion: '0.3'
parameters:
  InstanceId:
    type: String
    description: The instance to clean
mainSteps:
  - name: cleanTmp
    action: aws:runCommand
    inputs:
      DocumentName: AWS-RunShellScript
      InstanceIds:
        - '{{ InstanceId }}'
      Parameters:
        commands:
          - find /var/tmp -type f -mtime +7 -print -delete
          - df -h /
  - name: tagInstance
    action: aws:createTags
    inputs:
      ResourceType: EC2
      ResourceIds:
        - '{{ InstanceId }}'
      Tags:
        - Key: LastDiskCleanup
          Value: '{{ global:DATE }}'
'@ | Set-Content saat-diskcleanup.yaml
aws ssm create-document --name saat-DiskCleanup --document-type Automation --document-format YAML --content file://saat-diskcleanup.yaml --tags Key=course,Value=saatvedha-aws --query "DocumentDescription.Status" --output text
Start-Sleep 5
$ae = aws ssm start-automation-execution --document-name saat-DiskCleanup --parameters "InstanceId=$($ids[0])" --query AutomationExecutionId --output text
do { Start-Sleep 10; $st = aws ssm get-automation-execution --automation-execution-id $ae --query AutomationExecution.AutomationExecutionStatus --output text } until ($st -notin 'Pending', 'InProgress', 'Waiting')
aws ssm get-automation-execution --automation-execution-id $ae --query "AutomationExecution.StepExecutions[].[StepName,StepStatus]" --output text
aws ec2 describe-tags --filters "Name=resource-id,Values=$($ids[0])" "Name=key,Values=LastDiskCleanup" --query "Tags[0].Value" --output text

You should see something like this:

Creating
cleanTmp        Success
tagInstance     Success
2026-10-20

Two steps, in order, with a record of each. Anyone on the team can run the same runbook from the console without knowing the commands inside it. Open Systems Manager, then Automation, to see the execution and each step’s output.

4Keep a service running with State Manager

Paste this whole block. It creates an association, stops chronyd on ops02 to cause drift, then lets the association fix it:

'{ "commands": [ "systemctl is-active --quiet chronyd || systemctl restart chronyd", "systemctl is-active chronyd" ] }' | Set-Content assoc-params.json
$assoc = aws ssm create-association --association-name saat-keep-chrony --name AWS-RunShellScript --targets "Key=tag:Role,Values=web" --parameters file://assoc-params.json --schedule-expression "rate(30 minutes)" --query AssociationDescription.AssociationId --output text
'{ "commands": [ "systemctl stop chronyd", "systemctl is-active chronyd || true" ] }' | Set-Content stop-params.json
$stop = aws ssm send-command --document-name AWS-RunShellScript --instance-ids $ids[1] --parameters file://stop-params.json --query Command.CommandId --output text
Start-Sleep 15
aws ssm get-command-invocation --command-id $stop --instance-id $ids[1] --query StandardOutputContent --output text
aws ssm start-associations-once --association-ids $assoc
Start-Sleep 60
aws ssm describe-instance-associations-status --instance-id $ids[1] --query "InstanceAssociationStatusInfos[0].[Name,Status]" --output text

You should see something like this:

inactive
AWS-RunShellScript      Success

chronyd was stopped, and the association started it again. Normally you wouldn’t trigger it by hand; within 30 minutes it would have run by itself. This is how teams keep agents, time sync and security settings in place on servers people still log in to.

✅ Checkpoint: Run Command returned disk and uptime from both servers, saat-DiskCleanup ran both steps and tagged ops01, and saat-keep-chrony brought chronyd back on ops02. Keep everything for the break lab.