Examkin

Question

Difficulty: MediumAWS Systems Manager Configuration and Run Command Automation

A SysOps Administrator needs to execute a shell script on a group of Amazon EC2 instances using AWS Systems Manager Run Command and archive the command output in an Amazon S3 bucket. The instances are currently running, but they do not have the required IAM permissions to associate with Systems Manager.

What is the correct sequence of steps to configure, execute, and capture the output of the Run Command operation?

  1. 1Attach an IAM instance profile containing the AmazonSSMManagedInstanceCore policy to the target EC2 instances.
  2. 2Execute the Run Command request, specifying the target tags, the command document, and the destination Amazon S3 bucket.
  3. 3The Systems Manager service processes the request and sends the command payload to the SSM Agent on the managed nodes.
  4. 4The SSM Agent executes the script payload locally within the operating system of each targeted EC2 instance.
  5. 5The SSM Agent uploads the command output and error logs directly to the designated Amazon S3 bucket.

Answer

The correct sequence begins with attaching the IAM instance profile to the EC2 instances, followed by executing the Run Command request with the S3 bucket configuration. The Systems Manager service then processes the request and sends the payload to the SSM Agent on the instances. The SSM Agent executes the script locally on each instance, and finally, the SSM Agent uploads the output logs to the S3 bucket.
The correct sequence mirrors the lifecycle of an AWS Systems Manager Run Command execution. First, the instances must become managed nodes, which is achieved by attaching the necessary IAM instance profile. Second, the Administrator initiates the Run Command execution, specifying the Amazon S3 bucket for logs. Third, the service routes this command to the agent running on the target instances. Fourth, the agent runs the script locally. Finally, the agent uploads the command output directly to the specified S3 bucket.

Step-by-Step Solution

1
Attach the IAM instance profile containing the AmazonSSMManagedInstanceCore policy to the target EC2 instances.
The EC2 instances register with AWS Systems Manager and appear as managed nodes.
Systems Manager cannot communicate with or manage EC2 instances that lack the necessary IAM permissions.
2
Call the Run Command API specifying target tags, the execution document, and the output S3 bucket.
The Systems Manager service receives the execution request.
The administrator must specify the execution parameters, including where execution logs should be delivered.
3
The Systems Manager service delivers the command payload to the SSM Agent on the managed nodes.
The SSM Agent on each target instance receives the command instructions.
The service acts as the controller and pushes the execution instructions to the registered agents.
4
The SSM Agent executes the command script locally on the instances.
The administrative script runs within the instance OS.
The SSM Agent acts as the local executor of the command within the host environment.
5
The SSM Agent uploads the stdout and stderr outputs to the specified Amazon S3 bucket.
Logs are securely stored in the S3 bucket for auditing and analysis.
The local agent handles copying the execution outputs back to the configured AWS storage endpoint.

Key Concept

The correct sequence of operations for AWS Systems Manager Run Command requires instances to first be managed nodes via proper IAM permissions, after which command requests are processed by the service, executed by the local agent, and logs are uploaded by the agent directly.
Estimated Time:1m 30s
Rate this question

Topics

AWS Systems Manager Configuration and Run Command Automation