SSM Managed Instance Auditor

Audits AWS Systems Manager (SSM) managed instances across six dimensions — instance coverage (SSM Agent reachable + IAM profile attached), association compliance, patch baseline adherence, Session Manager vs SSH exposure, inventory collection, and Run Command posture — then emits a deterministic verdict (UNMANAGED | NONCOMPLIANT | NO_SESSION_MANAGER | CONFIG_GAP | OK) per instance with enumerated findings and CLI remediation. Use when reviewing SSM fleet health, checking why an instance is "ConnectionLost" or "Inactive", validating patch compliance, verifying Session Manager coverage (versus open SSH), confirming inventory collection, or hardening operational posture befo…