amazon-web-services - AWS SSM Agent - Using the aws cli, is there a way to list all the AWS instances that are missing the SSM agent?

Question

I need to audit a large number of AWS accounts to determine which EC2 instances are missing the SSM agent. Then I need have all those instances and their tags outputted.

Running aws ssm describe-instance-information lists all the instances that have the agent installed and are running, but it doesn't list instances that are missing the agent or systems that might be turned off.

Answer 1

#!/bin/bash
for instance in $(aws ec2 describe-instances --query 'Reservations[*].Instances[*].[InstanceId]' --output text )
do
  managed=$(aws ssm describe-instance-information  --filters "Key=InstanceIds,Values=$instance" --query 'InstanceInformationList[*].[AssociationStatus]' --output text)
  if [[ "$managed" != "Success" ]]; then 
  managed="Not Managed"; 
fi
aws ec2 describe-instances --instance-id $instance --output text --query 'Reservations[*].Instances[*].[InstanceId, Placement.AvailabilityZone, [Tags[?Key==`Name`].Value] [0][0], [Tags[?Key==`App`].Value] [0][0], [Tags[?Key==`Product`].Value] [0][0], [Tags[?Key==`Team`].Value] [0][0] ]' 
echo "$managed"
done

保存并使脚本可执行，然后运行

script.sh > file.tsv

最后将其导入excel

Answer 2

这将打印所有实例的列表，并在受管理的实例下方打印“成功”。

for instance in $(aws ec2 describe-instances --query 'Reservations[*].Instances[*].[InstanceId]' --output text )
do;
  managed=$(aws ssm describe-instance-information  --filters "Key=InstanceIds,Values=$instance" --query 'InstanceInformationList[*].[AssociationStatus]' --output text)
  echo "$instance  $managed";
done

要添加一组简单但格式不正确的标签，请将 echo 行替换为

if [[ "$managed" != "Success" ]]; then 
  managed="Fail"; 
fi
echo "$instance  $managed"
aws --profile GC-Staging ec2 describe-instances --instance-id $instance --query 'Reservations[*].Instances[*].[Tags[*].Value]' --output text