How AWS SSM agent communicates with 𝐒𝐲𝐬𝐭𝐞𝐦 𝐌𝐚𝐧𝐚𝐠𝐞𝐫 𝐒𝐞𝐫𝐯𝐢𝐜𝐞 using 𝐕𝐏𝐂 𝐈𝐧𝐭𝐞𝐫𝐟𝐚𝐜𝐞 𝐞𝐧𝐝𝐩𝐨𝐢𝐧𝐭𝐬.

If you are reading this blog then you are interested to know how the SSM agent running on the EC2 instance is communicating with the AWS System Manager Service.

Basically the SSM agent needs internet access to reach to the System Manager Service but what if your instances are in a restricted environment where they are not allowed to access the internet then how can you use AWS System Manager for managing your instances.

Curious to know how you can use all the features of AWS System Manager inspite of running your instances on a restricted environment. Watch this video
SSM on EC2 with No Internet? Here's How!

Below is how the communication happens from SSM agent running on EC2 to AWS System Manager.

1️⃣ 𝐂𝐚𝐥𝐥𝐬 𝐈𝐧𝐬𝐭𝐚𝐧𝐜𝐞 𝐌𝐞𝐭𝐚𝐝𝐚𝐭𝐚 𝐒𝐞𝐫𝐯𝐢𝐜𝐞: The SSM agent gets the instance metadata for example AWS region.
2️⃣ 𝐃𝐍𝐒 𝐋𝐨𝐨𝐤𝐮𝐩 𝐟𝐨𝐫 𝐀𝐏𝐈 𝐄𝐧𝐝𝐩𝐨𝐢𝐧𝐭: The SSM agent attempts to resolve the API endpoint (e.g., ssm..amazonaws.com) via the private DNS.
3️⃣ 𝐏𝐫𝐢𝐯𝐚𝐭𝐞 𝐃𝐍𝐒 𝐑𝐞𝐬𝐨𝐥𝐯𝐞𝐬 𝐭𝐨 𝐕𝐏𝐂 𝐄𝐧𝐝𝐩𝐨𝐢𝐧𝐭: The private DNS resolves the SSM API domain to the private IP address of the VPC interface endpoint’s ENI.
4️⃣ 𝐓𝐫𝐚𝐟𝐟𝐢𝐜 𝐑𝐨𝐮𝐭𝐞𝐝 𝐭𝐨 𝐄𝐧𝐝𝐩𝐨𝐢𝐧𝐭 𝐄𝐍𝐈: The EC2 instance sends the API request to the private IP address of the VPC interface endpoint's ENI.
5️⃣ 𝐏𝐫𝐢𝐯𝐚𝐭𝐞𝐋𝐢𝐧𝐤 𝐂𝐨𝐦𝐦𝐮𝐧𝐢𝐜𝐚𝐭𝐢𝐨𝐧: The VPC interface endpoint forwards the request over AWS PrivateLink to the AWS SSM service.
6️⃣ 𝐒𝐒𝐌 𝐒𝐞𝐫𝐯𝐢𝐜𝐞 𝐏𝐫𝐨𝐜𝐞𝐬𝐬𝐞𝐬 𝐑𝐞𝐪𝐮𝐞𝐬𝐭: AWS Systems Manager processes the API request and Response Sent via PrivateLink to the VPC interface endpoint
7️⃣ 𝐑𝐞𝐬𝐩𝐨𝐧𝐬𝐞 𝐃𝐞𝐥𝐢𝐯𝐞𝐫𝐞𝐝 𝐭𝐨 𝐒𝐒𝐌 𝐀𝐠𝐞𝐧𝐭: The VPC interface endpoint forwards the response to the EC2 instance, where the SSM agent receives and processes it.

For more Tech Bytes on Cloud and Devops you can view the below playlist or follow my channel NandiTechBytes.
📽 Devops Projects & Tasks

Cheers
Keep Learning!