Examkin

Question

Difficulty: MediumPatch Management and OS Compliance Automation

A SysOps Administrator is setting up automated patching for a fleet of Windows Server EC2 instances using AWS Systems Manager Patch Manager. The instances are divided into 'Staging' and 'Production' environments, and each group must be patched on different schedules using Systems Manager Maintenance Windows. The administrator has created two custom patch baselines. Which combination of steps is required to successfully implement this configuration? (Select TWO.)

  1. Tag the EC2 instances with the case-sensitive key 'Patch Group' and a value representing their environment, and then associate the patch group names with the custom patch baselines in Systems Manager.Answer
  2. Configure an IAM policy for the administrator with the 'iam:PassRole' action allowed on the Maintenance Window service role to permit task registration and execution.Answer
  3. C
    Tag the EC2 instances with the lowercase key 'patch_group' and a value representing their environment, and then map these keys to the custom patch baselines in Systems Manager.
  4. D
    Configure the trust relationship of the EC2 instance profiles to permit 'sts:AssumeRole' for the Systems Manager service role 'ssm.amazonaws.com'.
  5. E
    Create a resource-based policy on the custom patch baselines that grants execution permissions to the IAM role associated with the Maintenance Window.

Answer

To successfully implement this configuration, the administrator must tag the EC2 instances with the case-sensitive key 'Patch Group' and a value representing their environment, and configure an IAM policy for the administrator with the 'iam:PassRole' action allowed on the Maintenance Window service role.
Applying the exact case-sensitive tag key 'Patch Group' to the instances allows Systems Manager to identify and map them to their registered custom patch baselines. Additionally, the administrator must possess the 'iam:PassRole' permission to successfully register the execution task with the Maintenance Window service role, which authorizes Systems Manager to run the patch document on the target instances.

Step-by-Step Solution

1
Tag the target EC2 instances.
Apply the tag with Key='Patch Group' and Value='Staging' or Value='Production' to the respective instances.
Systems Manager Patch Manager requires the exact case-sensitive tag key 'Patch Group' to associate instances with patch groups.
2
Associate patch groups with patch baselines.
Register the 'Staging' and 'Production' patch groups with their corresponding custom patch baselines in the Systems Manager console.
This mapping ensures that the appropriate custom patch baseline is selected during the patching run.
3
Configure iam:PassRole permissions.
Ensure the administrator's IAM policy permits the 'iam:PassRole' action on the Maintenance Window service role.
This permission is necessary for the administrator to register the task in the Maintenance Window and allow Systems Manager to assume the role on their behalf.

Key Concept

AWS Systems Manager Patch Manager configuration requires mapping instances to baselines using the case-sensitive 'Patch Group' tag key, and registering Maintenance Window tasks requires iam:PassRole permissions.
Rate this question

Topics

Patch Management and OS Compliance Automation

More questions from this topic