Examkin

Question

Difficulty: HardPatch Management and OS Compliance Automation

An administrator is setting up automated security updates for a hybrid fleet of Red Hat Enterprise Linux (RHEL) managed nodes. The administrator configures a custom patch baseline and attempts to associate it with a specific subset of nodes using a custom patch group. The patching process is orchestrated using an AWS Systems Manager Maintenance Window that triggers the AWS-RunPatchBaseline document. During execution, the task fails to run on the targeted nodes, and they do not receive the specified updates. The managed nodes are verified as online and active in Systems Manager.

Which two configuration adjustments must the administrator make to ensure the custom patch baseline is applied to the target nodes during the maintenance window?

  1. Update the resource tags on the managed nodes to use the exact, case-sensitive key 'Patch Group' and match the baseline association value.Answer
  2. B
    Configure the tag key on the target managed nodes as 'patch-group' to comply with Systems Manager's lowercase tag formatting requirements.
  3. Assign the 'iam:PassRole' permission to the IAM user or role that registers the Maintenance Window task for the task execution role.Answer
  4. D
    Attach the 'AmazonSSMManagedInstanceCore' policy directly to the Maintenance Window task execution role to authorize command execution.

Answer

Updating the resource tags to the case-sensitive 'Patch Group' key and assigning the 'iam:PassRole' permission to the IAM identity registering the Maintenance Window task.
To resolve the issue, the administrator must ensure the target nodes are correctly associated with the patch group and the orchestration tasks are authorized. Systems Manager Patch Manager requires target nodes to be tagged with the exact case-sensitive key 'Patch Group' to apply the matching baseline. Additionally, the IAM user or role registering the Maintenance Window task must have the 'iam:PassRole' permission for the task execution role so that Systems Manager can assume it.

Step-by-Step Solution

1
Inspect the tags of the managed nodes targeted for patching.
Ensure they match the exact case-sensitive key 'Patch Group' and match the value defined in the baseline mapping.
Systems Manager Patch Manager relies strictly on this case-sensitive tag key to group and target instances correctly.
2
Examine the IAM permissions of the administrator or pipeline registering the Maintenance Window task.
Confirm that the identity has 'iam:PassRole' permissions for the designated task execution role.
AWS services require a delegation mechanism to assume a role on behalf of the caller, which is enforced via the 'iam:PassRole' permission.

Key Concept

Configuring correct tag casing for SSM Patch Groups and granting iam:PassRole permissions for executing Maintenance Window tasks.
Rate this question

Topics

Patch Management and OS Compliance Automation

More questions from this topic