Examkin

Question

Difficulty: EasyAWS Systems Manager Configuration and Run Command Automation

A SysOps Administrator wants to use AWS Systems Manager Run Command to execute a script on an Amazon EC2 instance. The SSM Agent is installed and running on the instance. However, the EC2 instance is not associated with any IAM role, and it does not appear in the list of managed instances in the Systems Manager console. Which of the following actions will resolve this issue?

  1. Attach an IAM instance profile containing the AmazonSSMManagedInstanceCore policy to the EC2 instance.Answer
  2. B
    Add the iam:PassRole permission to the Administrator's IAM policy to allow them to pass the Systems Manager role.
  3. C
    Assign a Resource Group tag to the instance that matches the Systems Manager patch group baseline.
  4. D
    Add a route targeting an Internet Gateway to the route table of the instance's public subnet.

Answer

Attach an IAM instance profile containing the AmazonSSMManagedInstanceCore policy to the EC2 instance.
For an EC2 instance to register with AWS Systems Manager and appear as a managed instance, it must meet two main requirements: the SSM Agent must be installed and running, and the instance must have an IAM instance profile attached with permissions to communicate with the Systems Manager service (typically via the AmazonSSMManagedInstanceCore policy). Since the SSM Agent is already running but no IAM role is attached, attaching the instance profile resolves the registration issue.

Step-by-Step Solution

1
Identify the missing requirement for SSM managed instances.
Managed instances require the SSM Agent to be running and an IAM role with the correct permissions attached.
Establishing a trust relationship between the EC2 instance and the Systems Manager service is necessary for registration.
2
Attach the appropriate IAM instance profile.
Attach the instance profile containing the AmazonSSMManagedInstanceCore policy to the EC2 instance.
This grants the instance the permissions required to communicate with Systems Manager APIs.
3
Verify that the instance registers as a managed instance.
The instance now appears in the Systems Manager console under Managed Instances and is ready for Run Command.
With both the agent running and the IAM role attached, registration completes successfully.

Key Concept

Systems Manager EC2 Instance Prerequisites
Rate this question

Topics

AWS Systems Manager Configuration and Run Command Automation