AWSAWS Systems ManagerManagement

`aws_ssm_association` cost estimation

Binds an SSM document to target instances so State Manager keeps them in a desired configuration. The association is free on standard EC2, but hybrid on-premises nodes in advanced tier and heavy Automation use do bill.

The aws_ssm_association resource is the core of AWS Systems Manager State Manager. It ties an SSM document (a command or automation runbook) to a set of targets (instance IDs, tags, or a resource group) on a schedule, so State Manager continually enforces a desired state: installing agents, applying patches, running compliance checks, or configuring software. Creating an association is free, and running State Manager associations against standard AWS-managed EC2 instances is free as well.

Systems Manager is largely free in its standard tier, which is why the association shows no direct cost. The charges appear in specific, bounded cases. First, hybrid and multicloud nodes: on-premises servers and non-EC2 machines managed through Systems Manager are free in the standard instances tier, but if you switch to the advanced instances tier (required for features like Session Manager on hybrid nodes or more than 1,000 hybrid instances) they bill about 0.00695 dollars per hybrid instance per hour, roughly 5 dollars per instance per month. Second, if your association targets run Automation runbooks that call other paid services, or exceed the Automation free tier (100,000 steps per account per month, then about 0.002 dollars per step for standard and more for the automation actions that call Lambda or run scripts), those steps bill.

There are also the usual downstream costs the association can trigger. A document that writes command output to S3 or CloudWatch Logs incurs those storage and ingestion charges. A patch-scanning association that reports compliance is free to run, but remediation that launches or reboots instances affects EC2 cost. And associations that run frequently against large fleets can generate CloudWatch metrics and logs volume worth watching.

The practical takeaway: for the common case of keeping EC2 fleets patched and configured, aws_ssm_association is genuinely free and one of the cheapest ways to enforce configuration at scale, far cheaper than a dedicated config-management server. The cost only appears with hybrid advanced-tier nodes, heavy Automation, or the logging and storage the documents produce.

c3x reports aws_ssm_association as free and flags the advanced-tier hybrid instance charge and Automation step charges as the dimensions to check for non-standard setups.

Terraform example

A minimal but realistic configuration that C3X can estimate.

resource "aws_ssm_association" "patch_scan" {
  name             = "AWS-RunPatchBaseline"
  association_name = "weekly-patch-scan"

  # Target by tag so new instances are enrolled automatically, at no extra cost.
  targets {
    key    = "tag:Environment"
    values = ["production"]
  }

  parameters = {
    Operation = "Scan"
  }

  schedule_expression = "cron(0 2 ? * SUN *)"

  # Writing command output to S3 adds S3 storage/request charges.
  output_location {
    s3_bucket_name = aws_s3_bucket.ssm_logs.id
    s3_key_prefix  = "patch-scan/"
  }
}

Pricing dimensions

What you actually pay for when you provision aws_ssm_association.

Dimension	Unit	What's being charged
SSM association (standard EC2)	free	Creating and running State Manager associations against AWS-managed EC2 instances is free. $0 (free)
Advanced-tier hybrid instances	per instance-hour	On-premises or non-EC2 nodes in the advanced instances tier bill hourly. Standard tier is free. $0.00695 per hybrid instance-hour (~$5/month)
Automation steps (over free tier)	per step	Automation runbook steps beyond the monthly free tier bill per step; some automation actions cost more. $0.002 per step after 100,000 free steps/month
Output to S3 or CloudWatch Logs	per GB	Command output written to S3 or CloudWatch incurs those services' storage and ingestion charges. $0.023 per GB-month (S3) / $0.50 per GB ingested (Logs)

Optimization tips

Common ways to reduce aws_ssm_association cost without changing the workload.

Keep hybrid nodes in the standard instances tier

~$5/month per hybrid instance kept in standard tier

The standard instances tier is free for on-premises and non-EC2 nodes. Only move to the advanced tier when you truly need its features, since advanced tier bills about 5 dollars per hybrid instance per month.

Target by tag instead of static instance IDs

Tag-based targeting enrolls new instances automatically and drops terminated ones, at no cost. This avoids drift and keeps a single free association covering a whole fleet rather than many hand-maintained ones.

Right-size Automation runbooks

Automation gives 100,000 free steps per account per month. Reserve step-heavy runbooks for where they add value, and prefer simple Command documents for routine tasks so you stay inside the free tier.

Set retention on association output logs

If associations write output to CloudWatch Logs, set a retention period so log storage does not accumulate. For long-term audit, direct output to S3 where storage is far cheaper.

FAQ

Does an SSM association cost anything?

For standard AWS-managed EC2 instances, no. Creating and running State Manager associations against EC2 is free. Costs only appear with advanced-tier hybrid nodes, Automation usage beyond the free tier, or the S3 and CloudWatch output the documents produce.

When do Systems Manager charges actually apply?

The main paid cases are on-premises or non-EC2 nodes in the advanced instances tier (about 5 dollars per instance per month), Automation steps beyond 100,000 per month, and any downstream storage or logging your documents write. Standard EC2 management is free.

Is State Manager cheaper than a config-management server?

Yes, for EC2 fleets it is effectively free and requires no server to run, unlike a self-managed Chef, Puppet, or Ansible control node. That makes aws_ssm_association one of the cheapest ways to enforce configuration at scale on AWS.

Can an association indirectly increase my bill?

Yes. A document that writes output to S3 or CloudWatch Logs adds storage and ingestion charges, and remediation actions that launch or reboot instances affect EC2 cost. The association is free; the actions it drives can have downstream cost.