AWS SSM Send Commandで複数EC2に一括スクリプト実行する構成設計｜マルチAZ運用自動化の実践

この記事のポイント

・aws ssm send-command でタグ指定した複数EC2に同時実行できる
・IAMロールとSSM Agentで踏み台不要・SSH不要のセキュア実行が可能
・MaxConcurrency/MaxErrorsでリスクをコントロールできる
・get-command-invocationでインスタンス単位に結果確認できる

# SSM Agentのステータス確認
$ sudo systemctl status amazon-ssm-agent

* amazon-ssm-agent.service - amazon-ssm-agent
     Loaded: loaded (/usr/lib/systemd/system/amazon-ssm-agent.service; enabled)
     Active: active (running) since Wed 2026-09-10 09:14:23 UTC; 3 weeks 4 days ago
   Main PID: 812 (amazon-ssm-agen)

# SSMに登録されているインスタンス一覧（オンライン状態のみ表示）
$ aws ssm describe-instance-information \
  --filters "Key=PingStatus,Values=Online" \
  --query "InstanceInformationList[*].{ID:InstanceId,IP:IPAddress,Status:PingStatus}" \
  --output table \
  --region ap-northeast-1

-------------------------------------------------------------------
|              DescribeInstanceInformation                         |
+------------------------+---------------+---------+
|          ID            |      IP       | Status  |
+------------------------+---------------+---------+
|  i-0a1b2c3d4e5f6789   |  10.0.1.45    | Online  |
|  i-0f9e8d7c6b5a4321   |  10.0.2.67    | Online  |
|  i-0c1d2e3f4a5b6c7d   |  10.0.3.89    | Online  |
|  i-0d4e5f6a7b8c9012   |  10.0.1.102   | Online  |
|  i-0e5f6a7b8c9d0ef3   |  10.0.2.114   | Online  |
|  i-0f6a7b8c9d0e1f24   |  10.0.3.128   | Online  |
+------------------------+---------------+---------+

# Terraform: SSM実行用IAMロール定義（最小権限）
resource "aws_iam_role" "ssm_ec2" {
  name = "ssm-ec2-role"
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Action    = "sts:AssumeRole"
      Effect    = "Allow"
      Principal = { Service = "ec2.amazonaws.com" }
    }]
  })
}

resource "aws_iam_role_policy_attachment" "ssm_core" {
  role       = aws_iam_role.ssm_ec2.name
  policy_arn = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore"
}

resource "aws_iam_instance_profile" "ssm_ec2" {
  name = "ssm-ec2-instance-profile"
  role = aws_iam_role.ssm_ec2.name
}

# 2台のインスタンスを直接指定してdf -hを実行
$ aws ssm send-command \
  --instance-ids "i-0a1b2c3d4e5f6789" "i-0f9e8d7c6b5a4321" \
  --document-name "AWS-RunShellScript" \
  --parameters 'commands=["df -h"]' \
  --region ap-northeast-1

# Env=prod タグのついた全インスタンスを対象に一括実行
$ aws ssm send-command \
  --targets "Key=tag:Env,Values=prod" \
  --document-name "AWS-RunShellScript" \
  --parameters 'commands=["df -h","free -m"]' \
  --region ap-northeast-1

$ aws ssm send-command \
  --targets "Key=tag:Env,Values=prod" \
           "Key=tag:Role,Values=web" \
  --document-name "AWS-RunShellScript" \
  --parameters 'commands=["echo "=== $(hostname) ==="","df -h /","free -m"]' \
  --timeout-seconds 60 \
  --max-concurrency "50%" \
  --max-errors "1" \
  --output-s3-bucket-name "my-ssm-logs-bucket" \
  --output-s3-key-prefix "run-command/prod-web/2026-10-08" \
  --region ap-northeast-1

{
    "Command": {
        "CommandId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
        "DocumentName": "AWS-RunShellScript",
        "ExpiresAfter": "2026-10-08T16:14:23.000000+00:00",
        "Status": "Pending",
        "TargetCount": 6,
        "CompletedCount": 0,
        "ErrorCount": 0
    }
}

# 特定インスタンスの実行結果（標準出力・標準エラー）を確認
$ aws ssm get-command-invocation \
  --command-id "a1b2c3d4-e5f6-7890-abcd-ef1234567890" \
  --instance-id "i-0a1b2c3d4e5f6789" \
  --region ap-northeast-1

{
    "CommandId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
    "InstanceId": "i-0a1b2c3d4e5f6789",
    "Status": "Success",
    "StatusDetails": "Success",
    "StandardOutputContent": "=== ip-10-0-1-45.ap-northeast-1.compute.internal ===\nFilesystem      Size  Used Avail Use% Mounted on\n/dev/xvda1       30G  8.2G   22G  28% /\n              total        used        free\nMem:           7786        4123        2108\n",
    "StandardErrorContent": ""
}

# 全インスタンスの実行ステータスを一覧表示
$ aws ssm list-command-invocations \
  --command-id "a1b2c3d4-e5f6-7890-abcd-ef1234567890" \
  --query "CommandInvocations[*].{Instance:InstanceId,Status:Status}" \
  --output table \
  --region ap-northeast-1

--------------------------------------------
|       ListCommandInvocations              |
+------------------------+------------------+
|       Instance         |     Status       |
+------------------------+------------------+
|  i-0a1b2c3d4e5f6789   |  Success         |
|  i-0f9e8d7c6b5a4321   |  Success         |
|  i-0c1d2e3f4a5b6c7d   |  Success         |
|  i-0d4e5f6a7b8c9012   |  Success         |
|  i-0e5f6a7b8c9d0ef3   |  Success         |
|  i-0f6a7b8c9d0e1f24   |  Success         |
+------------------------+------------------+

# S3とCloudWatch Logs両方に出力を保存するセキュリティパッチ適用例
$ aws ssm send-command \
  --targets "Key=tag:Env,Values=prod" \
  --document-name "AWS-RunShellScript" \
  --parameters 'commands=["yum update -y --security 2>&1"]' \
  --timeout-seconds 600 \
  --max-concurrency "25%" \
  --max-errors "1" \
  --output-s3-bucket-name "my-ssm-logs-bucket" \
  --output-s3-key-prefix "security-patch/2026-10-08" \
  --cloud-watch-output-config \
    'CloudWatchOutputEnabled=true,CloudWatchLogGroupName=/ssm/run-command/prod' \
  --region ap-northeast-1