Examkin

Soru

Zorluk: OrtaAWS Systems Manager Configuration and Run Command Automation

A company runs a fleet of EC2 instances within an isolated network environment. A SysOps Administrator attempts to run a maintenance script using AWS Systems Manager Run Command, targeting the instances manually. The SSM Agent is confirmed to be running on all target instances, and each instance has an IAM role with the AmazonSSMManagedInstanceCore policy attached. Despite these configurations, the Run Command execution fails immediately, and the instances are reported as "Offline" or "Inactive" in the Systems Manager console. Which configuration change will resolve this issue and allow the Run Command to execute?

  1. A
    Add the iam:PassRole permission to the administrator's IAM policy to allow Systems Manager to assume the instance role.
  2. Configure VPC interface endpoints (AWS PrivateLink) for Systems Manager, Systems Manager Messages, and EC2 Messages within the instance's VPC.Cevap
  3. C
    Register the instances with a Systems Manager Patch Group to authorize them for Run Command targeting.
  4. D
    Associate the VPC's route tables with a Gateway VPC Endpoint for Systems Manager to route execution commands.

Cevap

Configure VPC interface endpoints (AWS PrivateLink) for Systems Manager, Systems Manager Messages, and EC2 Messages within the instance's VPC.
For EC2 instances in an isolated network environment to communicate with AWS Systems Manager, they must be able to reach the Systems Manager endpoints. Since there is no internet path (like a NAT Gateway), this requires configuring Interface VPC Endpoints (AWS PrivateLink) for Systems Manager (ssm), Systems Manager Messages (ssmmessages), and EC2 Messages (ec2messages) inside the VPC. Once these endpoints are created, the SSM Agent can register and the instances will appear online.

Adım Adım Çözüm

1
Analyze the network configuration of the instances.
The instances are in an isolated network with no route to the internet, which means they cannot reach public AWS Systems Manager endpoints.
The SSM Agent requires outbound network connectivity to the Systems Manager service endpoints to receive commands.
2
Determine the correct private connection mechanism for Systems Manager.
Systems Manager requires interface VPC endpoints (powered by AWS PrivateLink) for ssm, ssmmessages, and ec2messages to allow communication from within a private VPC.
Gateway VPC endpoints are only supported for S3 and DynamoDB; all other services utilize interface VPC endpoints.
3
Verify and apply the interface endpoints.
Creating these interface endpoints in the VPC enables private DNS resolution and allows the SSM Agent to register successfully as online.
This establishes private, secure connectivity to the Systems Manager control plane without requiring an internet gateway or NAT gateway.

Anahtar Kavram

Systems Manager Network Connectivity Prerequisites for Private Subnets
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

AWS Systems Manager Configuration and Run Command Automation