Using AWS Systems Manager

Fleet Manager — Inventory the Managed Instance

Inside Systems Manager → Node Management → Fleet Manager, opened the Account management dropdown and chose Set up inventory. Created an association named Inventory-Association targeting the Managed Instance manually. Defaults were left intact.

• Inventory is set up as an SSM association, not a one-shot scan — it re-collects on a schedule, so the data stays fresh without manual refreshes.
• The association immediately reported a banner "Setup inventory request succeeded" and the inventory began populating from the SSM agent's side.
• Drilling into the Node ID and opening the Inventory tab exposed every inventory type (applications, network, services, etc.) — useful to validate software policy without touching the instance.

Run Command — Install the Widget Manufacturing Dashboard

Under Node Management → Run Command, picked the custom document Install Dashboard App (filtered by Owner = Owned by me). That document runs an install script that lays down Apache, PHP, the AWS SDK, and the dashboard files, then starts the web server. Targets were specified manually (Managed Instance) and the S3 output bucket option was cleared.

• The lab guide highlights that the console form exposes the exact CLI under AWS command line interface command. That snippet (aws ssm send-command) is the same call you'd put in a script or CI pipeline — the GUI is just a wizard around it.
• Right after submitting, the Command ID page showed In Progress; per the guide it converges to Success in 1–2 minutes. The captured screenshot is the In Progress moment — the dashboard rendering after is the real proof the script finished.
• Targeting was manual here, but the same form accepts tag-based selection — that's how a single Run Command call hits an entire fleet.

After the command finished, the ServerIP value from the lab Credentials panel was opened in a browser. The dashboard rendered with two charts — output gauge and stage throughput bar — confirming that Apache, PHP, the SDK, and the app were all installed and the service was up.

Parameter Store — Toggle a feature flag without redeploying

Under Application Management → Parameter Store, created a parameter with the configuration below. No screenshot of the form — the dashboard's third chart is the proof that the value was picked up.

• The hierarchical name /dashboard/<option> is intentional — Parameter Store supports path queries (get-parameters-by-path), so the whole namespace is one fetch from the application.
• The app polls Parameter Store on each request. No redeploy, no config file rewrite, no restart — flip the value and the next refresh sees it. That's the dark-features / feature-flag pattern in one of its simplest forms.
• Refreshing the dashboard's browser tab showed a third chart appear: Shipping Throughput (Beta feature). Deleting the parameter would make it disappear again on the next refresh (optional step, not executed here — the apparition was proof enough).

Session Manager — Browser shell into the instance, no SSH

Under Node Management → Session Manager, started a session against the Managed Instance. A browser tab opened with a working shell as sh-4.2$ — no keypair, no port 22, no bastion. The session ID and the instance ID are stamped at the top of the terminal banner, which is what CloudTrail correlates for audit.

• Listed the application files installed by Run Command:

  ls /var/www/html

• Derived the region from the Instance Metadata Service (IMDS) and ran a region-aware describe-instances:

  # Get region from IMDS
  AZ=$(curl -s http://169.254.169.254/latest/meta-data/placement/availability-zone)
  export AWS_DEFAULT_REGION=${AZ::-1}
  
  # List information about EC2 instances
  aws ec2 describe-instances

• The ${AZ::-1} trim is the small clever bit — IMDS returns the AZ (us-west-2a); slicing off the trailing letter yields the region (us-west-2) without hardcoding it. The same script works in any region.
• The describe-instances output confirmed identity from the inside: the instance profile is arn:aws:iam::370129130217:instance-profile/App-Role and the tag Name = Managed Instance matches everything seen in the console.