Is there a way to check that ssm send_command is running properly?

Question

I am currently trying to remotely run a script on my ec2 instance using python and boto but I can't tell if my call to send_command is working correctly. As of right now my code looks like

ec2 = boto3.client('ssm',region_name='us-east-2', aws_access_key_id='XXXXXXXXX',aws_secret_access_key='XXXXXXXXXXXXXXXXXXX')
a = ec2.send_command(InstanceIds=ids, DocumentName='AWS-RunShellScript', Comment='abcdabcd', Parameters={"commands":["mkdir hello"]})

all I am trying to do is make a new directory and then ssh into my instance and see if it is there. I have run this script a few times now and have had no luck at all, is there something I am missing or is there a better way to check if the send_command call is working?

Answer 1

Yes, there are in fact many ways to check if the command worked or not.

If we run the following command:

ssm_response = ec2.send_command(InstanceIds=[instance_id],
                                 DocumentName='AWS-RunShellScript',
                                 Parameters={"commands": ["cd ~ && mkdir hello && ls -lart"]})

The return of the send_command is a dictionary which contains an id for the command. This id can be retrieved as follows:

command_id = ssm_response['Command']['CommandId']

We need this id since it is expected that the command will run for a longer time and send_command will not wait until the command terminates.

In order to get the status of the command, we can use get_command_invocation as follows:

command_invocation_result = ec2.get_command_invocation(CommandId=command_id, InstanceId=instance_id)

The result of this function is also a dictionary, from which we may retrieve a lot of information about the command.

command_invocation_result['Status'] ## Returns the status of the execution of the command
command_invocation_result['StatusDetails'] ## Returns more information about the execution status

We can get also the output of the command and the error output of the command:

command_invocation_result['StandardOutputContent']
command_invocation_result['StandardErrorContent']

Please not that in the command I'm doing an ls -lart for which the output can be retrieved from the StandardOutputContent.

Documentation for the send_command and get_invocation_command: https://boto3.amazonaws.com/v1/documentation/api/latest/reference/services/ssm.html

Also, we can go into the AWS console -> Systems Manager -> Run Command, select the Command History and we should get some information about the executed commands there as well:

Last but not least, in order to successfully run commands, the EC2 instance needs to have an IAM role for SSM: https://docs.aws.amazon.com/systems-manager/latest/userguide/sysman-rc-setting-up.html