SSM Agent That rpm On EL 10 Cannot Verify, Verified
The AWS Systems Manager Agent on EL 10, where rpm refuses the SSM signing key (a SHA-1 self-signature) and dnf fails its GPG check, so the usual answer is --nogpgcheck. This role verifies the detached signature with gpg against a pinned fingerprint first, pins the version (latest differs by region), and registers a hybrid activation once. Original role, live-tested on Rocky Linux 10.
Verification
Live-testedReally deployed to a container sandbox, proven idempotent (a second run changes nothing), verified against the role’s assertions, then torn down.
Conformance
- Static validation (yamllint · ansible-lint)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live-tested - applied, verified, destroyed
Last verified 2026-09-19 · podman 4.9.3 · ansible 2.21.4 · how we verify
Documentation
amazon-ssm-agent
The AWS Systems Manager Agent on a host that is not Amazon Linux: a pinned
version, fetched from AWS's regional bucket, verified against the SSM
signing key with gpg before it is installed, enabled as a service. Hybrid
activation for machines outside EC2 is three variables. Original role for
EL 10, live-tested with podman on Rocky Linux 10.
rpm on EL 10 cannot verify this package - so most installs verify
nothing. The SSM signing key's self-signature uses SHA-1, and rpm 4.19's
OpenPGP policy (Sequoia) refuses to import it: rpm --import fails with
"No binding signature", rpm -K reports SIGNATURES NOT OK, and
dnf install https://.../amazon-ssm-agent.rpm fails its GPG check. The
usual answer is --nogpgcheck, which installs whatever arrived. This role
fetches the detached .sig as well, verifies it with gpg in a GnuPG home
of its own against a pinned fingerprint, and only then installs with rpm's
check off - the signature has been checked, by a tool that can.
The key rotates about yearly. The Systems Manager User Guide carries
the current key (1C5B 395C BE5E 74E2 F1CA 2159 2784 DBF3 88D1 9D46,
valid to 2027-11-25) and two expired predecessors. The role ships the
current key and pins its fingerprint; when AWS rotates, this role fails
loudly at the fingerprint assertion instead of trusting a new key it has
never seen. Update files/ssm-agent-signer.asc and the fingerprint from
the guide, on purpose.
"latest" is not one thing. The latest/ path on the regional buckets
served two different versions from two regions in the same minute. The role
pins amazon_ssm_agent_version and downloads that path; a newer agent is a
variable change and a run.
On EC2 the instance profile is the identity. Outside EC2, set the activation code, id and region from Systems Manager > Hybrid activations and the role registers once (guarded on the registration file). With neither - the live test's container - the agent starts, finds no identity, exits, and systemd restarts it every 90 seconds; the live test accepts that state, reads the reason from the journal, and asserts the registration path stays untouched.
License
Commercial - IaC Bazaar EULA. (c) IaC Bazaar.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Variables
- Test
Related modules
aws-image-builder
A pipeline with no schedule builds when somebody clicks, so the golden image ages until a person remembers it; image tests are the switch turned off to save an hour and scanning is off unless enabled; and the build instance's metadata service can hand its credentials to whatever a step downloads. Weekly rebuilds when a dependency changed, tests and scanning on, IMDSv2-only builds.
aws-lightsail-instance
A Lightsail instance is created with 22 and 80 open to every address; its public address changes when it stops unless a static IP is attached, and every DNS record pointing at it is then wrong; and automatic snapshots are off. The port list replaced by your rules with SSH from anywhere accepted by name, a static IP attached, and the daily AutoSnapshot add-on on at the hour you choose.
aws-ssm-patch-manager
A patch baseline that approves security patches after a delay, the patch group that binds instances to it by tag, and a maintenance window that runs AWS-RunPatchBaseline on a schedule with the output in CloudWatch. Install rather than Scan (scan-only by name), RebootIfNeeded, and unapproved security updates counted as non-compliant so the approval delay shows on the dashboard.
aws-elastic-beanstalk
AWS Elastic Beanstalk with the defaults turned the right way: managed platform updates are ON (AWS leaves them off, so the platform is never patched), health reporting is enhanced rather than basic, logs stream to CloudWatch and survive termination, IMDSv1 is disabled, deployments go out in batches instead of all at once, and application versions are pruned before they hit the quota.
aws-batch
Batch does not retry by default, so a reclaimed spot instance or a timed-out image pull ends as FAILED - reported as if the job failed on its merits, which is how somebody ends up debugging working code. Retries infrastructure failures and exits on real ones.
aws-ec2-instance
EC2 instance with IMDSv2, encrypted EBS, instance profile, and EIP - secure defaults out of the box.