Examkin

Question

Difficulty: MediumAWS Systems Manager Configuration and Run Command Automation

A SysOps Administrator is using AWS Systems Manager Run Command to execute the `AWS-RunPatchBaseline` document on a fleet of Amazon EC2 instances. The SSM Agent is running on all target instances, and the `AmazonSSMManagedInstanceCore` IAM policy is attached to their instance profiles. The administrator has created a custom patch baseline for production instances and associated it with a patch group named `Production`. However, during execution, the administrator discovers that the production instances are being patched using the default patch baseline instead of the custom production patch baseline. Which of the following is the most likely cause of this behavior?

  1. The target instances do not have a resource tag with the key `Patch Group` and the value `Production` to associate them with the custom baseline.Answer
  2. B
    The IAM role attached to the EC2 instances does not have the `iam:PassRole` permission to pass the patch baseline to the Systems Manager service.
  3. C
    The route tables for the private subnets containing the production instances lack an association with the VPC endpoint for Systems Manager.
  4. D
    The KMS key policy used to encrypt the patch baseline configuration does not grant the EC2 instances permission to decrypt the metadata.

Answer

The target instances do not have a resource tag with the key 'Patch Group' and the value 'Production' to associate them with the custom baseline.
The correct answer is correct because AWS Systems Manager Patch Manager determines which patch baseline to apply to an instance based on the presence of a resource tag with the key 'Patch Group' and the corresponding patch group value. If the tag is missing, mismatched, or case-incorrect, the instance defaults to the default patch baseline.

Step-by-Step Solution

1
Identify the mechanism Systems Manager uses to map instances to custom baselines.
Systems Manager uses the 'Patch Group' resource tag on the EC2 instances.
To determine which baseline to apply, Patch Manager matches the 'Patch Group' tag value on the instance with the patch group registered to the baseline.
2
Analyze the symptom of the failure.
The instances are patched successfully but use the default patch baseline instead of the custom production one.
This indicates that Systems Manager could communicate with the instances and execute the document, but fell back to the default baseline because it could not match the instances to a registered patch group.
3
Deduce the configuration gap.
The instances lack the correct resource tag (key: 'Patch Group', value: 'Production').
Without this tag, the custom baseline association is ignored, and the default baseline is applied.

Key Concept

AWS Systems Manager Patch Manager utilizes case-sensitive resource tags (specifically with the key 'Patch Group') on managed instances to map them to registered patch baselines. If an instance lacks the designated patch group tag, it falls back to the default patch baseline.
Rate this question

Topics

AWS Systems Manager Configuration and Run Command Automation