Examkin

Question

Difficulty: MediumAutomating Deployment and Configuration Management

An enterprise manages a fleet of Amazon EC2 instances in an Auto Scaling group (ASG) deployed via AWS CloudFormation. Security policies require that all instances maintain a specific software configuration baseline, including a running logging agent, and that any unauthorized manual configuration changes on the instances be automatically remediated. Systems Manager Agent (SSM Agent) is installed on all instances. Which combination of actions should the Solutions Architect take to meet these requirements? (Select TWO.)

  1. Create an AWS Systems Manager State Manager association using an SSM document that defines the desired configuration baseline, targeting the EC2 instances using resource tags.Answer
  2. Configure the State Manager association to run on a recurring schedule to automatically reapply the document's configuration, which remediates any local configuration drift.Answer
  3. C
    Incorporate a custom script into the AWS CloudFormation template using cfn-init, and execute a scheduled hourly stack update to identify and remediate internal OS-level modifications.
  4. D
    Deliver the Systems Manager execution logs to a centralized S3 bucket in a separate security account, encrypting the logs using the default AWS-managed KMS key (aws/s3) of the security account.
  5. E
    Create a Service Control Policy (SCP) at the root of the AWS Organization to grant the necessary Systems Manager permissions to the EC2 instances in all member accounts.

Answer

To automatically detect and remediate OS-level configuration changes, a Systems Manager State Manager association must be created with an SSM document defining the baseline, targeting instances via tags. The association should be configured on a recurring schedule to enforce the configuration and remediate drift.
Automating OS-level configuration management and drift remediation is best accomplished with AWS Systems Manager State Manager. By defining the configuration baseline inside an SSM document and creating a State Manager association targeting the instances by resource tags, the configuration is applied systematically. Setting the association to execute on a recurring schedule ensures that any configuration changes introduced by manual operations are automatically overwritten and corrected back to the desired baseline.

Step-by-Step Solution

1
Define the target configuration baseline.
An SSM document (such as a Command document or a Policy document) is created, outlining the software installation steps and services that must be running.
This establishes the declarative state that Systems Manager will enforce on the instances.
2
Target the instances and create the association.
A State Manager association is created, targeting the EC2 instances via resource tags (e.g., Environment=Production).
This links the SSM document to the specific subset of instances that must comply with the configuration baseline.
3
Schedule automatic enforcement.
The association is scheduled to run on a recurring cron or rate expression (e.g., every 30 minutes).
Periodic execution allows the SSM Agent on the instances to check the current state against the document and automatically reapply configurations if manual changes have caused drift.

Key Concept

Automated drift remediation at the OS level using AWS Systems Manager State Manager
Estimated Time:2m 0s
Rate this question

Topics

Automating Deployment and Configuration Management