Examkin

Soru

Zorluk: OrtaAWS Systems Manager Configuration and Run Command Automation

A SysOps Administrator is using AWS Systems Manager Run Command to execute the `AWS-RunPatchBaseline` document on a group of Amazon EC2 instances. All instances are powered on, and the SSM Agent is installed and running on each instance. Each instance has an IAM instance profile attached with the `AmazonSSMManagedInstanceCore` policy. The command targets instances using the tag key `PatchGroup` and value `Production`. The command executes successfully on several instances, but other instances with this intended configuration are neither updated nor shown in the Run Command target list.

Which two conditions could explain why these instances were not targeted?

  1. The instances are in a private subnet with no internet route, and the VPC lacks the required VPC interface endpoints (ssm, ssmmessages, and ec2messages) for Systems Manager.Cevap
  2. The resource tags on the affected instances use different character casing (such as `patchgroup` or `production`), and Systems Manager tag-based targeting is case-sensitive.Cevap
  3. C
    The user executing the Run Command does not have the `iam:PassRole` permission to pass the Systems Manager service role to the target EC2 instances.
  4. D
    The instances are not mapped to a patch group in the Systems Manager Patch Manager patch baseline, which prevents Run Command from executing the document on them.
  5. E
    The security groups of the affected instances do not permit inbound TCP port 22 (SSH) traffic from the Systems Manager service endpoint.

Cevap

The correct reasons are that the instances are in a private subnet with no internet route and the VPC lacks the required VPC interface endpoints for Systems Manager, and that the resource tags on the affected instances use different character casing as tag-based targeting is case-sensitive.
For EC2 instances to be targetable by Systems Manager Run Command, they must be registered as managed instances, which requires the SSM Agent to communicate with the Systems Manager service. If instances are in a private subnet with no route to the internet, VPC interface endpoints for ssm, ssmmessages, and ec2messages must be configured for the SSM Agent to connect. Additionally, tag-based targeting in Systems Manager is case-sensitive, meaning a tag mismatch in casing (such as lowercase keys or values) will prevent the instances from being targeted.

Adım Adım Çözüm

1
Verify SSM managed instance status in Fleet Manager.
Identify that the affected instances are not listed as managed instances in Systems Manager.
Run Command can only target instances that are successfully registered as managed instances.
2
Check tag casing on the affected instances.
Ensure that the tag key and value match 'PatchGroup' and 'Production' exactly, respecting case sensitivity.
Systems Manager tag filters are case-sensitive, so any casing discrepancy prevents targeting.
3
Verify network connectivity from the private subnet to AWS Systems Manager endpoints.
Ensure that the VPC has interface endpoints (ssm, ssmmessages, ec2messages) configured and associated with the private subnet's route tables.
SSM Agent requires outbound connectivity on port 443 to register the instance as a managed instance.

Anahtar Kavram

AWS Systems Manager Run Command targeting requires instances to be managed instances (with network connectivity to SSM endpoints) and matches resource tags using case-sensitive comparison.
Bu soruyu puanla

Konular

AWS Systems Manager Configuration and Run Command Automation