{"id":14952,"date":"2025-11-10T04:34:28","date_gmt":"2025-11-10T10:34:28","guid":{"rendered":"https:\/\/www.supportpro.com\/blog\/?p=14952"},"modified":"2026-03-30T01:25:09","modified_gmt":"2026-03-30T07:25:09","slug":"how-to-resolve-aws-ssm-agent-not-showing-as-managed-complete-fixing-guide","status":"publish","type":"post","link":"https:\/\/www.supportpro.com\/blog\/how-to-resolve-aws-ssm-agent-not-showing-as-managed-complete-fixing-guide\/","title":{"rendered":"How to Resolve AWS SSM Agent Not Showing as Managed: Complete Fixing Guide"},"content":{"rendered":"\n<p>This guide shares some practical pointers for digging into issues with AWS Systems Manager. Most of the time, problems show up in a few predictable places &#8211; the SSM Agent, Session Manager, Parameter Store, or Automation workflows. The idea here is to help you zero in on what\u2019s actually going wrong instead of chasing symptoms<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>1. SSM Agent Connectivity<\/strong><\/h2>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Check the Instance IAM Role<\/strong><\/h3>\n\n\n\n<p>Start by making sure the EC2 instance actually has an IAM instance profile.<br>The role should include <strong>AmazonSSMManagedInstanceCore<\/strong>.<br>If you\u2019re using a custom IAM policy, double-check that it lets the agent talk to the Systems Manager service \u2014 that part gets missed more often than we\u2019d like to admit.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Network Reachability<\/strong><\/h3>\n\n\n\n<p>If the instance lives in a public subnet:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>It needs a public IP.<\/li>\n\n\n\n<li>Outbound HTTPS (443) should be open.<\/li>\n<\/ul>\n\n\n\n<p>If it&#8217;s in a private subnet:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Make sure it can reach the internet through a NAT Gateway, <em>or<\/em> that VPC endpoints are in place.<\/li>\n\n\n\n<li>Route tables and security groups should allow outbound 443.<br>Network issues are easily the most common blockers here.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Instances Without Internet<\/strong><\/h3>\n\n\n\n<p>If your instance has no path out to the internet at all, set up these endpoints:<\/p>\n\n\n\n<div class=\"wp-block-group is-vertical is-layout-flex wp-container-core-group-is-layout-8cf370e7 wp-block-group-is-layout-flex\">\n<p>ssm.&lt;region&gt;.amazonaws.com<\/p>\n\n\n\n<p>ssmmessages.&lt;region&gt;.amazonaws.com<\/p>\n\n\n\n<p>ec2messages.&lt;region&gt;.amazonaws.com<\/p>\n<\/div>\n\n\n\n<p>After creating them:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Attach them to the subnets the instance is in.<\/li>\n\n\n\n<li>Enable Private DNS. Otherwise, the agent will try to reach public endpoints and fail.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Check the Agent Service<\/strong><\/h3>\n\n\n\n<p>Run:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo systemctl status amazon-ssm-agent<\/code><\/pre>\n\n\n\n<p>If it&#8217;s down:<\/p>\n\n\n\n<div class=\"wp-block-group is-vertical is-layout-flex wp-container-core-group-is-layout-8cf370e7 wp-block-group-is-layout-flex\">\n<p>sudo systemctl start amazon-ssm-agent<\/p>\n\n\n\n<p>sudo systemctl enable amazon-ssm-agent<\/p>\n<\/div>\n\n\n\n<p>If it&#8217;s missing, install it according to your OS instructions.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Instance Metadata Service<\/strong><\/h3>\n\n\n\n<p>The agent pulls credentials from IMDS.<br>If IMDS is disabled (which sometimes happens by accident in hardened images), the agent won\u2019t authenticate and will quietly fail.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Confirm It Shows as \u201cManaged\u201d<\/strong><\/h3>\n\n\n\n<p>Go to: <strong>Systems Manager \u2192 Managed Instances<\/strong>.<br>If the instance isn\u2019t listed or shows <em>Connection Lost<\/em>, check:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\/var\/log\/amazon\/ssm\/amazon-ssm-agent.log<\/code><\/pre>\n\n\n\n<p>The logs usually make the problem obvious once you see it.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>2. Session Manager Issues<\/strong><\/h2>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Verify the Agent<\/strong><\/h3>\n\n\n\n<p>If your Session Manager screen just sits there blank or stalls, it\u2019s usually the agent not responding.<\/p>\n\n\n\n<p>sudo systemctl status amazon-ssm-agent<\/p>\n\n\n\n<p>Restart if needed.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>IAM Permissions<\/strong><\/h3>\n\n\n\n<p>The role needs to be able to start sessions:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ssm:StartSession<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>ssm:DescribeInstanceInformation<\/code><\/pre>\n\n\n\n<p>If session logs are encrypted with KMS, both the user and the instance role need <strong>kms:Decrypt<\/strong> permissions. Easy detail to overlook.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Network \/ Proxy Check<\/strong><\/h3>\n\n\n\n<p>Run:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>nc -zv ssmmessages.&lt;region&gt;.amazonaws.com 443<\/code><\/pre>\n\n\n\n<p>If you\u2019re in a proxy setup, make sure the agent is using the proxy settings \u2014 it doesn\u2019t inherit them by default.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Logging &amp; Encryption<\/strong><\/h3>\n\n\n\n<p>If sessions drop or disconnect randomly, check:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>S3 or CloudWatch log bucket access<\/li>\n\n\n\n<li>KMS permissions if logging is encrypted<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>3. Parameter Store Issues<\/strong><\/h2>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>IAM Permissions<\/strong><\/h3>\n\n\n\n<p>Make sure the instance role has:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ssm:GetParameter<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>kms:Decrypt (if the parameter is SecureString)<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Parameter Name &amp; Type<\/strong><\/h3>\n\n\n\n<p>Verify the exact path \u2014 including any folder-style prefixes.<br>Also note the type: String, StringList, or SecureString.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>CLI Availability<\/strong><\/h3>\n\n\n\n<p>If you&#8217;re pulling parameters via scripts:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo yum install -y awscli<\/code><\/pre>\n\n\n\n<p>And confirm the AWS region matches where the parameters live.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>4. Automation Document Errors<\/strong><\/h2>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>aws:runCommand<\/strong><\/h3>\n\n\n\n<p>Check that the instance is listed as <em>Managed<\/em> and that the role can run commands:<\/p>\n\n\n\n<div class=\"wp-block-group is-vertical is-layout-flex wp-container-core-group-is-layout-8cf370e7 wp-block-group-is-layout-flex\">\n<p>ssm:SendCommand<\/p>\n\n\n\n<p>ssm:ListCommandInvocations<\/p>\n<\/div>\n\n\n\n<p>Output details are under <strong>Systems Manager \u2192 Automation \u2192 Executions<\/strong>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>aws:copyImage<\/strong><\/h3>\n\n\n\n<p>The automation role should allow:<\/p>\n\n\n\n<div class=\"wp-block-group is-vertical is-layout-flex wp-container-core-group-is-layout-8cf370e7 wp-block-group-is-layout-flex\">\n<p>ec2:CopyImage<\/p>\n\n\n\n<p>ec2:DescribeImages<\/p>\n<\/div>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Typical Causes<\/strong><\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Trust relationship missing in the role<\/li>\n\n\n\n<li>Incorrect parameters (like SubnetId or RoleArn)<\/li>\n\n\n\n<li>The instance isn\u2019t registered as Managed<\/li>\n\n\n\n<li>VPC endpoint or network path missing<\/li>\n<\/ul>\n\n\n\n<p>Once you\u2019ve seen these a few times, they\u2019re pretty recognizable.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>Conclusion<\/strong><\/h2>\n\n\n\n<p>In most cases, fixing Systems Manager issues comes down to IAM access, network paths, or the agent simply not running. Once those core pieces are aligned, everything else tends to fall into place without much friction. Don\u2019t hesitate to re-check the basics &#8211; the root cause is usually simpler than it first appears.If you ever feel like it\u2019s going in circles or you&#8217;d rather have a second set of eyes, <a href=\"https:\/\/www.supportpro.com\/requestquote.php\" title=\"\"><strong>SupportPRO<\/strong> <\/a>is always here to help. Whether it\u2019s a quick configuration check or full environment troubleshooting, we\u2019ll work with you to get everything running smoothly again.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">FAQ Section<\/h2>\n\n\n\n<h4 class=\"wp-block-heading\">1. Why is my EC2 instance not appearing in AWS Systems Manager?<\/h4>\n\n\n\n<p>This usually happens when the <strong>SSM Agent is stopped<\/strong>, the instance lacks the <strong>AmazonSSMManagedInstanceCore IAM role<\/strong>, or network access to Systems Manager endpoints is blocked.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">2. How do I fix SSM Agent connection issues?<\/h4>\n\n\n\n<p>Verify the agent status using:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>systemctl status amazon-ssm-agent<\/code><\/pre>\n\n\n\n<p>Ensure outbound HTTPS (port 443), IAM permissions, and VPC endpoints are correctly configured.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">3. Why does Session Manager fail to start a session?<\/h4>\n\n\n\n<p>Common causes include missing IAM permissions (<code>ssm:StartSession<\/code>), inactive SSM Agent, proxy misconfiguration, or missing KMS decrypt permissions.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">4. What causes Parameter Store access errors?<\/h4>\n\n\n\n<p>Incorrect parameter paths, missing <code>ssm:GetParameter<\/code> permission, or lack of <code>kms:Decrypt<\/code> access for SecureString parameters are typical reasons.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">5. Why do AWS Automation workflows fail?<\/h4>\n\n\n\n<p>Automation failures often occur due to missing IAM trust relationships, unmanaged instances, incorrect parameters, or network\/VPC endpoint misconfiguration.<\/p>\n\n\n\n<div class=\"wp-block-media-text alignwide has-media-on-the-right is-stacked-on-mobile is-vertically-aligned-center has-white-background-color has-background\"><div class=\"wp-block-media-text__content\">\n<p class=\"has-large-font-size\">Facing issues? <\/p>\n\n\n\n<p class=\"has-large-font-size\">Our technical support<br>engineers can solve it. <\/p>\n\n\n\n<!--HubSpot Call-to-Action Code --><span class=\"hs-cta-wrapper\" id=\"hs-cta-wrapper-3350a795-db50-482f-9911-301930d1b1be\"><span class=\"hs-cta-node hs-cta-3350a795-db50-482f-9911-301930d1b1be\" id=\"hs-cta-3350a795-db50-482f-9911-301930d1b1be\"><!--[if lte IE 8]><div id=\"hs-cta-ie-element\"><\/div><![endif]--><a href=\"https:\/\/cta-redirect.hubspot.com\/cta\/redirect\/2725694\/3350a795-db50-482f-9911-301930d1b1be\" ><img decoding=\"async\" class=\"hs-cta-img\" id=\"hs-cta-img-3350a795-db50-482f-9911-301930d1b1be\" style=\"border-width:0px;\" src=\"https:\/\/no-cache.hubspot.com\/cta\/default\/2725694\/3350a795-db50-482f-9911-301930d1b1be.png\"  alt=\"Contact Us today!\"\/><\/a><\/span><script charset=\"utf-8\" src=\"https:\/\/js.hscta.net\/cta\/current.js\"><\/script><script type=\"text\/javascript\"> hbspt.cta.load(2725694, '3350a795-db50-482f-9911-301930d1b1be', {\"useNewLoader\":\"true\",\"region\":\"na1\"}); <\/script><\/span><!-- end HubSpot Call-to-Action Code -->\n<\/div><figure class=\"wp-block-media-text__media\"><img fetchpriority=\"high\" decoding=\"async\" width=\"904\" height=\"931\" src=\"https:\/\/www.supportpro.com\/blog\/wp-content\/uploads\/2022\/09\/Free-server-checkup.png\" alt=\"guy server checkup\" class=\"wp-image-12943 size-full\" srcset=\"https:\/\/www.supportpro.com\/blog\/wp-content\/uploads\/2022\/09\/Free-server-checkup.png 904w, https:\/\/www.supportpro.com\/blog\/wp-content\/uploads\/2022\/09\/Free-server-checkup-291x300.png 291w, https:\/\/www.supportpro.com\/blog\/wp-content\/uploads\/2022\/09\/Free-server-checkup-768x791.png 768w, https:\/\/www.supportpro.com\/blog\/wp-content\/uploads\/2022\/09\/Free-server-checkup-585x602.png 585w\" sizes=\"(max-width: 904px) 100vw, 904px\" \/><\/figure><\/div>\n","protected":false},"excerpt":{"rendered":"<p>This guide shares some practical pointers for digging into issues with AWS Systems Manager. Most of the time, problems show up in a few predictable places &#8211; the SSM Agent,&hellip;<\/p>\n","protected":false},"author":4,"featured_media":14953,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_lmt_disableupdate":"","_lmt_disable":"","footnotes":""},"categories":[1],"tags":[],"class_list":["post-14952","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-miscellaneous"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.supportpro.com\/blog\/wp-json\/wp\/v2\/posts\/14952","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.supportpro.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.supportpro.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.supportpro.com\/blog\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.supportpro.com\/blog\/wp-json\/wp\/v2\/comments?post=14952"}],"version-history":[{"count":2,"href":"https:\/\/www.supportpro.com\/blog\/wp-json\/wp\/v2\/posts\/14952\/revisions"}],"predecessor-version":[{"id":16831,"href":"https:\/\/www.supportpro.com\/blog\/wp-json\/wp\/v2\/posts\/14952\/revisions\/16831"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.supportpro.com\/blog\/wp-json\/wp\/v2\/media\/14953"}],"wp:attachment":[{"href":"https:\/\/www.supportpro.com\/blog\/wp-json\/wp\/v2\/media?parent=14952"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.supportpro.com\/blog\/wp-json\/wp\/v2\/categories?post=14952"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.supportpro.com\/blog\/wp-json\/wp\/v2\/tags?post=14952"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}