AWSAWS Systems ManagerManagement

`aws_ssm_maintenance_window` cost estimation

An SSM maintenance window is free. It is a schedule for running automation on your fleet, and cost comes from what the tasks do on instances you already pay for.

An aws_ssm_maintenance_window defines a recurring schedule (a cron or rate expression, a duration, and a cutoff) during which Systems Manager runs registered tasks against a set of targets. The window itself is free: there is no charge for defining a schedule, its targets, or its tasks. It is a calendar for maintenance work, nothing more.

The cost comes from what the tasks actually do, and mostly it is cost you are already paying. A window that runs Run Command to patch or restart instances uses compute time on EC2 instances that are billed regardless; the maintenance work does not add an instance charge, it just uses the box you already rent. Run Command and State Manager on standard managed instances are free. Cost appears in a few specific cases: Automation documents that run for long durations bill Automation steps beyond the free tier, tasks that invoke a Lambda function incur that function's per-request and GB-second charges, and running the advanced-instances tier of hybrid activations (on-premises servers) is billed per instance per hour. The window is the trigger; the billed thing is the target work.

The optimization is to keep windows tight and targeted. A short duration with a sensible cutoff prevents long-running Automation from racking up steps, and targeting only the instances that need work avoids invoking Lambda or Automation across a whole fleet unnecessarily. c3x prices the instances the tasks run on and any Lambda or advanced-tier usage they invoke, and treats the maintenance window as the free schedule it is.

Terraform example

A minimal but realistic configuration that C3X can estimate.

resource "aws_ssm_maintenance_window" "patch" {
  name     = "weekly-patch"
  schedule = "cron(0 3 ? * SUN *)"
  duration = 3
  cutoff   = 1
}

resource "aws_ssm_maintenance_window_target" "instances" {
  window_id     = aws_ssm_maintenance_window.patch.id
  resource_type = "INSTANCE"
  targets {
    key    = "tag:Patch"
    values = ["true"]
  }
}

Pricing dimensions

What you actually pay for when you provision aws_ssm_maintenance_window.

Dimension	Unit	What's being charged
Maintenance window	free	Defining the schedule, targets, and tasks has no charge; Run Command on managed instances is free. $0
Automation steps	per step beyond free tier	Long-running Automation documents run by the window bill for steps past the monthly free tier. ~$0.002 per step (over free tier)
Lambda or advanced-tier targets	per invocation / per instance-hour	Tasks that invoke Lambda are billed per request and GB-second; advanced hybrid instances bill per hour. Advanced instances: ~$0.00695/hour

Optimization tips

Common ways to reduce aws_ssm_maintenance_window cost without changing the workload.

Keep the duration and cutoff tight

A short window with a sensible cutoff stops long-running Automation documents from racking up billable steps, and ensures tasks do not start work they cannot finish in the window.

Target only instances that need the work

Limits task runs to relevant hosts

Scoping targets by tag avoids invoking Lambda or Automation across the whole fleet. Run maintenance only where it applies to keep any per-invocation cost minimal.

Stay on the standard instances tier

The advanced-instances tier for hybrid on-premises servers bills per instance-hour. Use it only when you exceed the standard tier's limits or need its features.

FAQ

Does an SSM maintenance window cost money?

No. Defining a maintenance window, its targets, and its tasks is free, and Run Command on managed EC2 instances is free. Cost comes from what the tasks do: Automation steps over the free tier, Lambda invocations, or advanced hybrid instances.

Do I pay for patching run by a maintenance window?

Not for the patching action itself on managed EC2 instances. Run Command is free, and the work uses compute on instances you already pay for. You only add cost if tasks call Lambda or run heavy Automation beyond the free tier.

How do I avoid unexpected cost from maintenance windows?

Keep the window duration short with a cutoff so Automation cannot run long, target only the instances that need work by tag, and stay on the standard instances tier unless you genuinely need the advanced hybrid tier.