SSM Agent is the AWS Systems Manager component installed on a managed node, such as an EC2 instance, to receive and process Systems Manager commands, session requests, patching tasks, and other remote administration operations. It acts as the local endpoint for AWS control-plane actions, translating approved management requests into activity on the instance.
In cyber security, SSM Agent matters because it can provide safer administration than exposed SSH or RDP, but only if its permissions and session controls are tightly scoped. Attackers may try to abuse approved Session Manager access, port forwarding, or document permissions to reach local services that were meant to stay private, including link-local metadata endpoints. Defenders should keep SSM Agent updated, restrict who can start sessions, limit which documents can be used, and treat instance metadata and temporary credentials as sensitive assets.