• The AWS Systems Manager CloudWatch Dashboard will no longer be available after April 30, 2026. Customers can continue to use Amazon CloudWatch console to view, create, and manage their Amazon CloudWatch dashboards, just as they do today. For more information, see [Amazon CloudWatch Dashboard documentation](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch_Dashboards.html). # Configuring instance tiers This topic describes the scenarios when you must activate the advanced-instanced tier. AWS Systems Manager offers a standard-instances tier and an advanced-instances tier for non-EC2 machines in a [hybrid and multicloud](operating-systems-and-machine-types.md#supported-machine-types) environment. You can register up to 1,000 standard [hybrid-activated nodes](activations.md) per account per AWS Region at no additional cost. However, registering more than 1,000 hybrid nodes requires that you activate the advanced-instances tier. There is a charge to use the advanced-instances tier. For more information, see [AWS Systems Manager Pricing](https://aws.amazon.com/systems-manager/pricing/). Even with fewer than 1,000 registered hybrid-activated nodes, two other scenarios require the advanced-instances tier: + You want to use Session Manager to connect to non-EC2 nodes. + You want to patch applications (not operating systems) released by Microsoft on non-EC2 nodes. **Note** There is no charge to patch applications released by Microsoft on Amazon EC2 instances. ## Advanced-instances tier detailed scenarios The following information provides details on the three scenarios for which you must activate the advanced-instances tier. Scenario 1: You want to register more than 1,000 hybrid-activated nodes Using the standard-instances tier, you can register a maximum of 1,000 non-EC2 nodes in a [hybrid and multicloud](operating-systems-and-machine-types.md#supported-machine-types) environment per AWS Region in a specific account without additional charge. If you need to register more than 1,000 non-EC2 nodes in a Region, you must use the advanced-instances tier. You can then activate as many machines for your hybrid and multicloud environment as you want. Charges for the advanced-instances tier are based on the number of advanced nodes activated as Systems Manager managed nodes and the hours those nodes are running. All Systems Manager managed nodes that use the activation process described in [Create a hybrid activation to register nodes with Systems Manager](hybrid-activation-managed-nodes.md) are then subject to charge if you exceed 1,000 on-premises nodes in a Region in a specific account . You can also activate existing Amazon Elastic Compute Cloud (Amazon EC2) instances using Systems Manager hybrid activations and work with them as non-EC2 instances, such as for testing. These also qualify as hybrid nodes. This isn't a common scenario. Scenario 2: Patching Microsoft-released applications on hybrid-activated nodes The advanced-instances tier is also required if you want to patch Microsoft-released applications on non-EC2 nodes in a hybrid and multicloud environment. If you activate the advanced-instances tier to patch Microsoft applications on non-EC2 nodes, charges are then incurred for all on-premises nodes, even if you have fewer than 1,000. There is no additional charge to patch applications released by Microsoft on Amazon Elastic Compute Cloud (Amazon EC2) instances. For more information, see [Patching applications released by Microsoft on Windows Server](patch-manager-patching-windows-applications.md). Scenario 3: Connecting to hybrid-activated nodes using Session Manager Session Manager provides interactive shell access to your instances. To connect to hybrid-activated managed nodes using Session Manager, you must activate the advanced-instances tier. Charges are then incurred for all hybrid-activated nodes, even if you have fewer than 1,000. **Summary: When do I need the advanced-instances tier?** Use the following table to review when you must use the advanced-instances tier, and for which scenarios additional charges apply. **** | Scenario | Advanced-instances tier required? | Additional charges apply? | | --- | --- | --- | | The number of hybrid-activated nodes in my Region in a specific account is more than 1,000. | Yes | Yes | | I want to use Patch Manager to patch Microsoft-released applications on any number of hybrid-activated nodes, even less than 1,000. | Yes | Yes | | I want to use Session Manager to connect to any number of hybrid-activated nodes, even less than 1,000. | Yes | Yes | | [\[See the AWS documentation website for more details\]](http://docs.aws.amazon.com/systems-manager/latest/userguide/fleet-manager-configure-instance-tiers.html) | No | No | **Topics** + [ ## Advanced-instances tier detailed scenarios ](#systems-manager-managed-instances-tier-scenarios) + [ # Turning on the advanced-instances tier ](fleet-manager-enable-advanced-instances-tier.md) + [ # Reverting from the advanced-instances tier to the standard-instances tier ](fleet-manager-revert-to-standard-tier.md) # Turning on the advanced-instances tier AWS Systems Manager offers a standard-instances tier and an advanced-instances tier for non-EC2 machines in a [hybrid and multicloud](operating-systems-and-machine-types.md#supported-machine-types) environment. The standard-instances tier lets you register a maximum of 1,000 hybrid-activated machines per AWS account per AWS Region. The advanced-instances tier is also required to use Patch Manager to patch Microsoft-released applications on non-EC2 nodes, and to connect to non-EC2 nodes using Session Manager. For more information, see [Turning on the advanced-instances tier](#fleet-manager-enable-advanced-instances-tier). This section describes how to configure your hybrid and multicloud environment to use the advanced-instances tier. **Before you begin** Review pricing details for advanced instances. Advanced instances are available on a per-use-basis. For more information see, [AWS Systems Manager Pricing](https://aws.amazon.com/systems-manager/pricing/). ## Configuring permissions to turn on the advanced-instances tier Verify that you have permission in AWS Identity and Access Management (IAM) to change your environment from the standard-instances tier to the advanced-instances tier. You must either have the `AdministratorAccess` IAM policy attached to your user, group, or role, or you must have permission to change the Systems Manager activation-tier service setting. The activation-tier setting uses the following API operations: + [GetServiceSetting](https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_GetServiceSetting.html) + [UpdateServiceSetting](https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_UpdateServiceSetting.html) + [ResetServiceSetting](https://docs.aws.amazon.com/systems-manager/latest/APIReference/API_ResetServiceSetting.html) Use the following procedure to add an inline IAM policy to a user account. This policy allows a user to view the current managed-instance tier setting. This policy also allows the user to change or reset the current setting in the specified AWS account and AWS Region. 1. Sign in to the AWS Management Console and open the IAM console at [https://console.aws.amazon.com/iam/](https://console.aws.amazon.com/iam/). 1. In the navigation pane, choose **Users**. 1. In the list, choose the name of the user to embed a policy in. 1. Choose the **Permissions** tab. 1. On the right side of the page, under **Permission policies**, choose **Add inline policy**. 1. Choose the **JSON** tab. 1. Replace the default content with the following: ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ssm:GetServiceSetting" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "ssm:ResetServiceSetting", "ssm:UpdateServiceSetting" ], "Resource": "arn:aws:ssm:us-east-1:111122223333:servicesetting/ssm/managed-instance/activation-tier" } ] } ``` ------ 1. Choose **Review policy**. 1. On the **Review policy** page, for **Name**, enter a name for the inline policy. For example: **Managed-Instances-Tier**. 1. Choose **Create policy**. Administrators can specify read-only permission by assigning the following inline policy to the user. ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ssm:GetServiceSetting" ], "Resource": "*" }, { "Effect": "Deny", "Action": [ "ssm:ResetServiceSetting", "ssm:UpdateServiceSetting" ], "Resource": "*" } ] } ``` ------ For more information about creating and editing IAM policies, see [Creating IAM Policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_create.html) in the *IAM User Guide*. ## Turning on the advanced-instances tier (console) The following procedure shows you how to use the Systems Manager console to change *all* non-EC2 nodes that were added using managed-instance activation, in the specified AWS account and AWS Region, to use the advanced-instances tier. **Before you begin** Verify that the console is open in the AWS Region where you created your managed instances. You can switch Regions by using the list in the top, right corner of the console. Verify that you have completed the setup requirements for your Amazon Elastic Compute Cloud (Amazon EC2) instances and non-EC2 machines in a [hybrid and multicloud](operating-systems-and-machine-types.md#supported-machine-types) environment. For information, see [Setting up managed nodes for AWS Systems Manager](systems-manager-setting-up-nodes.md). **Important** The following procedure describes how to change an account-level setting. This change results in charges being billed to your account. **To turn on the advanced-instances tier (console)** 1. Open the AWS Systems Manager console at [https://console.aws.amazon.com/systems-manager/](https://console.aws.amazon.com/systems-manager/). 1. In the navigation pane, choose **Fleet Manager**. 1. Choose **Settings**, and then choose **Change instance tier settings**. 1. Review the information in the dialog box about changing account settings. 1. If you approve, choose the option to accept, and then choose **Change setting**. The system can take several minutes to complete the process of moving all instances from the standard-instances tier to the advanced-instances tier. **Note** For information about changing back to the standard-instances tier, see [Reverting from the advanced-instances tier to the standard-instances tier](fleet-manager-revert-to-standard-tier.md). ## Turning on the advanced-instances tier (AWS CLI) The following procedure shows you how to use the AWS Command Line Interface to change *all* on-premises servers and VMs that were added using managed-instance activation, in the specified AWS account and AWS Region, to use the advanced-instances tier. **Important** The following procedure describes how to change an account-level setting. This change results in charges being billed to your account. **To turn on the advanced-instances tier using the AWS CLI** 1. Open the AWS CLI and run the following command. Replace each *example resource placeholder* with your own information. ------ #### [ Linux & macOS ] ``` aws ssm update-service-setting \ --setting-id arn:aws:ssm:region:aws-account-id:servicesetting/ssm/managed-instance/activation-tier \ --setting-value advanced ``` ------ #### [ Windows ] ``` aws ssm update-service-setting ^ --setting-id arn:aws:ssm:region:aws-account-id:servicesetting/ssm/managed-instance/activation-tier ^ --setting-value advanced ``` ------ There is no output if the command succeeds. 1. Run the following command to view the current service settings for managed nodes in the current AWS account and AWS Region. ------ #### [ Linux & macOS ] ``` aws ssm get-service-setting \ --setting-id arn:aws:ssm:region:aws-account-id:servicesetting/ssm/managed-instance/activation-tier ``` ------ #### [ Windows ] ``` aws ssm get-service-setting ^ --setting-id arn:aws:ssm:region:aws-account-id:servicesetting/ssm/managed-instance/activation-tier ``` ------ The command returns information like the following. ``` { "ServiceSetting": { "SettingId": "/ssm/managed-instance/activation-tier", "SettingValue": "advanced", "LastModifiedDate": 1555603376.138, "LastModifiedUser": "arn:aws:sts::123456789012:assumed-role/Administrator/User_1", "ARN": "arn:aws:ssm:us-east-2:123456789012:servicesetting/ssm/managed-instance/activation-tier", "Status": "PendingUpdate" } } ``` ## Turning on the advanced-instances tier (PowerShell) The following procedure shows you how to use the AWS Tools for Windows PowerShell to change *all* on-premises servers and VMs that were added using managed-instance activation, in the specified AWS account and AWS Region, to use the advanced-instances tier. **Important** The following procedure describes how to change an account-level setting. This change results in charges being billed to your account. **To turn on the advanced-instances tier using PowerShell** 1. Open AWS Tools for Windows PowerShell and run the following command. Replace each *example resource placeholder* with your own information. ``` Update-SSMServiceSetting ` -SettingId "arn:aws:ssm:region:aws-account-id:servicesetting/ssm/managed-instance/activation-tier" ` -SettingValue "advanced" ``` There is no output if the command succeeds. 1. Run the following command to view the current service settings for managed nodes in the current AWS account and AWS Region. ``` Get-SSMServiceSetting ` -SettingId "arn:aws:ssm:region:aws-account-id:servicesetting/ssm/managed-instance/activation-tier" ``` The command returns information like the following. ``` ARN:arn:aws:ssm:us-east-2:123456789012:servicesetting/ssm/managed-instance/activation-tier LastModifiedDate : 4/18/2019 4:02:56 PM LastModifiedUser : arn:aws:sts::123456789012:assumed-role/Administrator/User_1 SettingId : /ssm/managed-instance/activation-tier SettingValue : advanced Status : PendingUpdate ``` The system can take several minutes to complete the process of moving all nodes from the standard-instances tier to the advanced-instances tier. **Note** For information about changing back to the standard-instances tier, see [Reverting from the advanced-instances tier to the standard-instances tier](fleet-manager-revert-to-standard-tier.md). # Reverting from the advanced-instances tier to the standard-instances tier This section describes how to change hybrid-activated nodes running in the advanced-instances tier back to the standard-instances tier. This configuration applies to all hybrid-activated nodes in an AWS account and a single AWS Region. **Before you begin** Review the following important details. **Note** You can't revert back to the standard-instance tier if you're running more than 1,000 hybrid-activated nodes in the account and Region. You must first deregister nodes until you have 1,000 or fewer. This also applies to Amazon Elastic Compute Cloud (Amazon EC2) instances that use a Systems Manager hybrid activation (which isn't a common scenario). For more information, see [Deregistering managed nodes in a hybrid and multicloud environment](fleet-manager-deregister-hybrid-nodes.md). After you revert, you won't be able to use Session Manager, a tool in AWS Systems Manager, to interactively access your hybrid-activated nodes. After you revert, you won't be able to use Patch Manager, a tool in AWS Systems Manager, to patch applications released by Microsoft on hybrid-activated nodes. The process of reverting all hybrid-activated nodes back to the standard-instance tier can take 30 minutes or more to complete. This section describes how to revert all hybrid-activated nodes in an AWS account and AWS Region from the advanced-instances tier to the standard-instances tier. ## Reverting to the standard-instances tier (console) The following procedure shows you how to use the Systems Manager console to change all hybrid-activated nodes in your [hybrid and multicloud](operating-systems-and-machine-types.md#supported-machine-types) environment to use the standard-instances tier in the specified AWS account and AWS Region. **To revert to the standard-instances tier (console)** 1. Open the AWS Systems Manager console at [https://console.aws.amazon.com/systems-manager/](https://console.aws.amazon.com/systems-manager/). 1. In the navigation pane, choose **Fleet Manager**. 1. Select the **Account settings** dropdown and choose **Instance tier settings**. 1. Choose **Change account setting**. 1. Review the information in the pop-up about changing account settings, and then if you approve, choose the option to accept and continue. ## Reverting to the standard-instances tier (AWS CLI) The following procedure shows you how to use the AWS Command Line Interface to change all hybrid-activated nodes in your [hybrid and multicloud](operating-systems-and-machine-types.md#supported-machine-types) environment to use the standard-instances tier in the specified AWS account and AWS Region. **To revert to the standard-instances tier using the AWS CLI** 1. Open the AWS CLI and run the following command. Replace each *example resource placeholder* with your own information. ------ #### [ Linux & macOS ] ``` aws ssm update-service-setting \ --setting-id arn:aws:ssm:region:aws-account-id:servicesetting/ssm/managed-instance/activation-tier \ --setting-value standard ``` ------ #### [ Windows ] ``` aws ssm update-service-setting ^ --setting-id arn:aws:ssm:region:aws-account-id:servicesetting/ssm/managed-instance/activation-tier ^ --setting-value standard ``` ------ There is no output if the command succeeds. 1. Run the following command 30 minutes later to view the settings for managed instances in the current AWS account and AWS Region. ------ #### [ Linux & macOS ] ``` aws ssm get-service-setting \ --setting-id arn:aws:ssm:region:aws-account-id:servicesetting/ssm/managed-instance/activation-tier ``` ------ #### [ Windows ] ``` aws ssm get-service-setting ^ --setting-id arn:aws:ssm:region:aws-account-id:servicesetting/ssm/managed-instance/activation-tier ``` ------ The command returns information like the following. ``` { "ServiceSetting": { "SettingId": "/ssm/managed-instance/activation-tier", "SettingValue": "standard", "LastModifiedDate": 1555603376.138, "LastModifiedUser": "System", "ARN": "arn:aws:ssm:us-east-2:123456789012:servicesetting/ssm/managed-instance/activation-tier", "Status": "Default" } } ``` The status changes to *Default* after the request has been approved. ## Reverting to the standard-instances tier (PowerShell) The following procedure shows you how to use AWS Tools for Windows PowerShell to change hybrid-activated nodes in your hybrid and multicloud environment to use the standard-instances tier in the specified AWS account and AWS Region. **To revert to the standard-instances tier using PowerShell** 1. Open AWS Tools for Windows PowerShell and run the following command. ``` Update-SSMServiceSetting ` -SettingId "arn:aws:ssm:region:aws-account-id:servicesetting/ssm/managed-instance/activation-tier" ` -SettingValue "standard" ``` There is no output if the command succeeds. 1. Run the following command 30 minutes later to view the settings for managed instances in the current AWS account and AWS Region. ``` Get-SSMServiceSetting ` -SettingId "arn:aws:ssm:region:aws-account-id:servicesetting/ssm/managed-instance/activation-tier" ``` The command returns information like the following. ``` ARN: arn:aws:ssm:us-east-2:123456789012:servicesetting/ssm/managed-instance/activation-tier LastModifiedDate : 4/18/2019 4:02:56 PM LastModifiedUser : System SettingId : /ssm/managed-instance/activation-tier SettingValue : standard Status : Default ``` The status changes to *Default* after the request has been approved.