aws-cloudwatch
- 连接机器 下载ssm-agent
aws-ec2 安装ssm-agent
aws-linux安装ssm-agent
使用 SSM 代理查找 AMI 预装
- 先运行:systemctl status amazon-ssm-agent 查看sshm-agent的状态。
- 然后安装提示,执行 systemctl start amazon-ssm-agent 启动即可
使用 SSM Agent 日志文件进行故障排除
root@ip-172-31-1-212 ~]# tail -f /var/log/amazon/ssm/amazon-ssm-agent.log<h1>404 - Not Found</h1></body>
</html>status code: 404, request id:
2024-11-19 07:09:10.4718 ERROR EC2RoleProvider Failed to connect to Systems Manager with SSM role credentials. error calling RequestManagedInstanceRoleToken: AccessDeniedException: Systems Manager's instance management role is not configured for account: 850995553350status code: 400, request id: 894ea524-6f26-4ac7-ab48-935483e83c06
2024-11-19 07:09:10.4719 ERROR [CredentialRefresher] Retrieve credentials produced error: no valid credentials could be retrieved for ec2 identity. Default Host Management Err: error calling RequestManagedInstanceRoleToken: AccessDeniedException: Systems Manager's instance management role is not configured for account: 850995553350status code: 400, request id: 894ea524-6f26-4ac7-ab48-935483e83c06
2024-11-19 07:09:10.4719 INFO [CredentialRefresher] Sleeping for 28m58s before retrying retrieve credentials
2024-11-19 07:38:08.4797 WARN EC2RoleProvider Failed to connect to Systems Manager with instance profile role credentials. Err: retrieved credentials failed to report to ssm. Error: EC2RoleRequestError: no EC2 instance role found
caused by: EC2MetadataError: failed to make EC2Metadata request
<?xml version="1.0" encoding="iso-8859-1"?>
配置步骤
- 检查 IAM 角色
确保你的 EC2 实例已绑定一个 IAM 角色。
在 AWS 管控台,导航到 EC2 > 实例 > 安全 > 修改 IAM 角色。
如果未绑定角色,需绑定一个角色(如:SSM-Managed-Instance-Role)。 - 附加权限策略
进入 IAM 控制台,执行以下操作:
找到角色:
在左侧导航中选择 角色,然后找到分配给 EC2 实例的 IAM 角色。
添加策略:
编辑角色权限,搜索并添加以下策略:
AmazonSSMManagedInstanceCore
(可选)CloudWatchAgentServerPolicy
如果需要自定义策略,则根据上文复制策略内容并保存。
3. 重新启动 Amazon SSM Agent
SSH 登录到 EC2 实例后,执行以下命令:
sudo systemctl restart amazon-ssm-agent
选择AmazonSSMManagedInstanceCore 权限
- 然后去实例中选择实例–>操作–>安全—>修改IAM角色,修改你新建的即可
配置修改完毕后一定要记得重启systemctl restart amazon-ssm-agent
sudo systemctl restart amazon-ssm-agent