Examkin

Question

Difficulty: HardAutomating Deployment and Configuration Management

A healthcare company runs a compliant web service on Amazon EC2 instances inside an Auto Scaling Group (ASG) behind an Application Load Balancer (ALB). The instances must apply specific configuration baselines via an AWS Systems Manager (SSM) State Manager association before serving production traffic. During rapid scale-out events, instances are registered with the ALB target group and begin receiving client traffic before the SSM State Manager association has completed execution, resulting in intermittent compliance auditing failures. A solutions architect must design a fully automated remediation strategy that prevents instances from serving traffic until they are compliant, while minimizing operational overhead. Which strategy should the solutions architect implement?

  1. A
    Modify the AWS CloudFormation template that manages the Auto Scaling group to include a CreationPolicy, and configure the EC2 user data script to run the cfn-signal helper script after the Systems Manager State Manager association finishes executing.
  2. Create a launch lifecycle hook in the Auto Scaling group. Configure an Amazon EventBridge rule that detects the lifecycle transition and triggers an AWS Systems Manager Automation workbook. The workbook executes the State Manager association on the target instance and completes the lifecycle action with a CONTINUE status upon successful execution.Answer
  3. C
    Increase the default cooldown period of the Auto Scaling group and adjust the Application Load Balancer health check interval to be longer than the maximum expected runtime of the State Manager association.
  4. D
    Configure the Application Load Balancer target group to perform a blue/green canary deployment for every scaling event, routing a small percentage of traffic to the new instance while a cron script on the instance polls the local SSM Agent status.

Answer

Create a launch lifecycle hook in the Auto Scaling group, trigger an AWS Systems Manager Automation workbook via Amazon EventBridge to apply the State Manager association, and complete the lifecycle action upon success.
The correct approach uses an Auto Scaling lifecycle hook to pause the instance launch state. By triggering an AWS Systems Manager Automation workbook via Amazon EventBridge, the workbook can invoke the State Manager association, verify configuration compliance on the target instance, and then programmatically complete the lifecycle action. This ensures the instance only receives traffic after it is fully configured.

Step-by-Step Solution

1
Configure an Auto Scaling launch lifecycle hook.
Newly launched instances are paused in the 'Pending:Wait' state and are prevented from completing registration with the ALB target group.
This guarantees that production traffic is not routed to the instance until the hook is completed.
2
Configure Amazon EventBridge to detect the lifecycle transition.
An EventBridge rule matches the lifecycle transition event and targets an AWS Systems Manager Automation workbook.
This automates the execution of the remediation script without requiring manual intervention.
3
Implement the SSM Automation workbook to execute the association and send the completion signal.
The workbook executes the configuration association on the specific instance ID and calls the CompleteLifecycleAction API with the 'CONTINUE' result upon success.
This allows the instance to resume launch and join the ALB target group only after the configuration baseline has been fully applied.

Key Concept

Auto Scaling Lifecycle Hooks and AWS Systems Manager Integration
Rate this question

Topics

Automating Deployment and Configuration Management