Examkin

Soru

Zorluk: OrtaAutomating Deployment and Configuration Management

A company runs a critical business application on a fleet of Amazon EC2 instances. The infrastructure is deployed and managed using AWS CloudFormation. The internal operating system configurations and application settings on these instances must strictly align with a configuration definition defined in an Ansible playbook. Recently, system administrators have performed manual updates to the configuration files on individual instances via SSH to troubleshoot issues, resulting in configuration drift that has caused application instability. A solutions architect needs to design a solution that will automatically detect these manual operating system-level changes and restore the instances to the desired state with minimal service disruption and operational overhead. Which solution should the solutions architect implement?

  1. A
    Enable drift detection on the AWS CloudFormation stack. Configure an Amazon EventBridge rule that triggers whenever the stack status changes to DRIFTED. Program the rule to invoke an AWS Lambda function that terminates the drifted EC2 instances, allowing the Auto Scaling group to launch new instances with the initial bootstrap configuration.
  2. B
    Deploy an AWS Config rule to monitor the configuration of the EC2 instances. When a configuration change is detected, trigger an AWS Systems Manager Automation document to download the Ansible playbook from a centralized DevOps account S3 bucket using the AWS-managed KMS key aws/ssm to decrypt the playbook.
  3. Configure AWS Systems Manager State Manager by creating an association that targets the EC2 instances. Specify the AWS-ApplyAnsiblePlaybooks document and point it to the Ansible playbook stored in an Amazon S3 bucket. Configure the association to run on a regular schedule to automatically reapply the playbook and correct any operating system-level configuration drift.Cevap
  4. D
    Create a Service Control Policy (SCP) at the AWS Organizations level that denies access to modify files within the /etc directory on the EC2 instances. Use AWS Systems Manager Patch Manager to schedule daily runs that apply the Ansible playbook to verify instance compliance.

Cevap

Configure AWS Systems Manager State Manager by creating an association targeting the EC2 instances with the AWS-ApplyAnsiblePlaybooks document pointing to the Ansible playbook in Amazon S3, configured to run on a regular schedule.
AWS Systems Manager State Manager is specifically designed to enforce a consistent configuration state on EC2 instances. By creating an association targeting the fleet using the AWS-ApplyAnsiblePlaybooks document and referencing a playbook in S3, State Manager periodically executes Ansible to ensure the OS configuration matches the defined baseline. This automatically remediates any drift introduced by manual console or SSH operations with minimal overhead.

Adım Adım Çözüm

1
Determine the scope of the configuration drift.
The drift is occurring at the operating system file level (internal settings modified via SSH), not at the AWS resource property level.
This helps select the appropriate tool, as CloudFormation drift detection only tracks resource properties defined in the template, while Systems Manager manages internal OS state.
2
Select a configuration management tool capable of applying local playbooks.
AWS Systems Manager State Manager is selected because it integrates with target EC2 instances and can execute the AWS-ApplyAnsiblePlaybooks document.
State Manager associations can run periodically to enforce a desired state, automatically correcting local configuration drift.
3
Evaluate and eliminate options that violate access and security scopes.
Eliminated options using SCPs for OS restrictions and cross-account decryption using AWS-managed KMS keys.
SCPs cannot control OS files, and AWS-managed KMS keys cannot be modified or shared cross-account.

Anahtar Kavram

Operating system-level configuration drift management and remediation using AWS Systems Manager State Manager.
Bu soruyu puanla

Konular

Automating Deployment and Configuration Management