Examkin

Question

Difficulty: MediumAWS Systems Manager Configuration and Run Command Automation

A SysOps Administrator is tasked with executing a custom configuration script on a new fleet of Amazon EC2 instances using AWS Systems Manager Run Command. The script needs to retrieve files from a private Amazon S3 bucket, and all command execution outputs must be streamed to an Amazon CloudWatch Logs group for auditing.

Arrange the steps in the correct sequence to configure the prerequisites and successfully execute the script.

  1. 1Create the CloudWatch Logs group and configure an IAM role with the AmazonSSMManagedInstanceCore policy along with permissions for s3:GetObject and CloudWatch logging.
  2. 2Attach the IAM role as an instance profile to the EC2 instances and verify that the SSM Agent is running on the instances.
  3. 3Verify that the EC2 instances are registered and appear as managed nodes in the Systems Manager Fleet Manager console.
  4. 4Execute the Systems Manager Run Command using the AWS-RunShellScript document, specifying the managed nodes as targets and enabling CloudWatch Logs output.

Answer

The correct sequence starts with creating the IAM role and CloudWatch Logs group, followed by attaching the IAM role to the EC2 instances and running the SSM Agent. Next, the administrator verifies that the instances are registered as managed nodes, and finally, executes the Run Command using the custom script and enabling CloudWatch Logs output.
The correct sequence begins with provisioning the necessary IAM policies and the target log group. The IAM role must then be attached to the instances to grant them an identity. Only after the instances are recognized as managed nodes by Systems Manager can the Run Command be executed to run the configuration script and stream the logs.

Step-by-Step Solution

1
Set up IAM permissions and the CloudWatch Logs group.
The destination log group exists and the IAM policy is ready with the required S3 and CloudWatch permissions.
Resources and permission policies must be established before they can be attached to instances or used as destinations.
2
Attach the IAM instance profile and verify the SSM Agent.
The EC2 instances run with the necessary IAM identity and the SSM Agent process is active.
The SSM Agent needs the IAM role permissions to successfully communicate with the Systems Manager service endpoints.
3
Verify managed node status in Systems Manager.
The instances appear in the SSM Fleet Manager console as online managed nodes.
Systems Manager cannot execute Run Command documents on instances that have not successfully completed the registration handshake.
4
Execute the Run Command targeting the managed nodes.
The shell script is executed on the target instances, and logs are successfully sent to CloudWatch.
Run Command execution is the final operational step once all IAM, agent, and network prerequisites are satisfied.

Key Concept

Configuring the necessary IAM instance profile permissions, SSM Agent registration, and executing commands using Systems Manager Run Command with logging.
Rate this question

Topics

AWS Systems Manager Configuration and Run Command Automation