Examkin

Question

Difficulty: EasyAWS Systems Manager Configuration and Run Command Automation

A SysOps Administrator needs to execute an administrative script across a fleet of Amazon EC2 instances using AWS Systems Manager Run Command. The instances must be targeted as a group based on their department, and they must register successfully as managed instances. Currently, the SSM Agent is installed and running on the instances, and they have outbound internet access, but they do not appear in the Systems Manager console. Which two actions must the SysOps Administrator take to meet these requirements? (Select two.)

  1. Attach an IAM role containing the AmazonSSMManagedInstanceCore policy to the EC2 instances via an instance profile.Answer
  2. Apply a resource tag with a department key and value to the EC2 instances, and target them using this tag in Run Command.Answer
  3. C
    Create an IAM policy with iam:PassRole permissions and attach it to the EC2 instances to allow them to assume the Systems Manager service role.
  4. D
    Configure a patch group tag key named Patch Group on the EC2 instances and map it to a custom patch baseline to enable Run Command execution.
  5. E
    Migrate the EC2 instances to a private subnet that lacks a route to an Internet Gateway in its route table.

Answer

Attaching an IAM role containing the AmazonSSMManagedInstanceCore policy to the EC2 instances and applying a resource tag to target them dynamically in Run Command are the correct actions.
To successfully execute Run Command on EC2 instances, they must first be registered as managed instances. This requires attaching an IAM role with the AmazonSSMManagedInstanceCore policy to the instances via an instance profile. To target the instances dynamically as a group based on their department, a resource tag (such as Department=Sales) must be applied to the instances, allowing the SysOps Administrator to specify the tag when executing the Run Command.

Step-by-Step Solution

1
Ensure the EC2 instances have the required IAM permissions to communicate with the Systems Manager API by attaching an IAM role with the AmazonSSMManagedInstanceCore policy via an instance profile.
The EC2 instances register successfully as managed instances in the Systems Manager console.
Managed instances require permissions to call Systems Manager APIs to register and check for run commands.
2
Apply a tag to the instances representing their department (e.g., Department=Finance) and use the tag-based targeting option when running the command in Systems Manager.
Run Command executes the script only on the instances matching the specified tag.
Tag-based targeting allows dynamic grouping and execution without having to select instance IDs manually.

Key Concept

To run commands on EC2 instances using AWS Systems Manager Run Command, instances must be configured as managed instances (requiring the SSM Agent and the AmazonSSMManagedInstanceCore IAM policy) and can be targeted dynamically using resource tags.
Rate this question

Topics

AWS Systems Manager Configuration and Run Command Automation