Examkin

Question

Difficulty: MediumPatch Management and OS Compliance Automation

A SysOps Administrator is configuring AWS Systems Manager Patch Manager to automate security updates for a fleet of Amazon Linux 2 EC2 instances. The instances run in a private VPC subnet with no internet connectivity. To allow communication with Systems Manager, the administrator successfully creates interface VPC endpoints for ssm, ssmmessages, and ec2messages. However, when the automated patching task runs, the instances fail to download the required OS update packages, and the patching execution fails. Which of the following should the administrator do to resolve this issue?

  1. Create a gateway VPC endpoint for Amazon S3 and associate it with the route table of the private subnet.Answer
  2. B
    Create a gateway VPC endpoint for Amazon S3, but rely on the default VPC route table without adding specific route entries to the subnet's route table.
  3. C
    Create a public route pointing to an Internet Gateway in the private subnet's route table to allow direct outbound connections to the Amazon Linux repositories.
  4. D
    Associate the custom patch baseline with a Patch Group named Amazon-Linux-2 and tag the target instances with the key Patch_Group and the value Amazon-Linux-2.

Answer

Create a gateway VPC endpoint for Amazon S3 and associate it with the route table of the private subnet.
Amazon Linux 2 package repositories are hosted in Amazon S3 buckets. In a private subnet with no internet access, instances can communicate with the Systems Manager service via interface VPC endpoints, but they cannot download the actual patch files from Amazon S3 without a route to S3. Creating a gateway VPC endpoint for Amazon S3 and associating it with the private subnet's route table allows the instances to securely download the update packages entirely within the AWS network.

Step-by-Step Solution

1
Identify the repository hosting locations for Amazon Linux 2 updates.
The package repositories for Amazon Linux 2 are hosted on AWS-managed S3 buckets in the local region.
Understanding where the patches are downloaded from helps isolate why the download phase is failing.
2
Analyze network pathing for S3 access from a private subnet.
Interface endpoints for ssm only cover service control communications, not the binary package downloads from S3.
Determining that a private path to S3 is required to securely download packages without an internet gateway.
3
Configure a gateway VPC endpoint for S3 and link it to the subnet's route table.
A route targeting the S3 prefix list is added to the private subnet's route table, allowing instances to reach the repository.
This establishes the necessary private routing to download patch binaries successfully.

Key Concept

Enabling S3 access for SSM Patch Manager in a private VPC subnet using Gateway Endpoints.
Rate this question

Topics

Patch Management and OS Compliance Automation

More questions from this topic