Examkin

Soru

Zorluk: ZorPatch Management and OS Compliance Automation

A company implements AWS Systems Manager Patch Manager to automate operating system updates for a fleet of Windows Server instances. An administrator creates a custom patch baseline and registers a patch group named 'Win-Prod' to this baseline. The administrator then configures a Maintenance Window targeted to target instances by group, and applies tags to the managed instances. However, during the next execution cycle, the administrator observes that none of the instances receive updates, and their compliance status remains 'Never'. Which of the following describes the most likely reason for this behavior?

  1. A
    The administrator who configured the Maintenance Window did not have the `iam:PassRole` permission for the maintenance window service role, which prevented the patching task from executing.
  2. The instances are tagged with the key 'patch-group' instead of the case-sensitive key 'Patch Group', causing the maintenance window targeting the 'Win-Prod' group to skip these instances.Cevap
  3. C
    The instances reside in a public subnet that lacks a route to the Internet Gateway, preventing the SSM agent on the instances from connecting to the Patch Manager service endpoints.
  4. D
    The custom patch baseline utilizes AWS KMS key encryption, but the KMS key policy does not grant the EC2 instance profile role permission to perform decrypt operations.

Cevap

The target EC2 instances are tagged with the key 'patch-group' instead of the case-sensitive key 'Patch Group', which prevented Patch Manager from matching the instances to the registered baseline.
For AWS Systems Manager Patch Manager to associate a managed node with a specific patch baseline, the node must be tagged with the exact case-sensitive key 'Patch Group' and the value must match the patch group name registered to the baseline. If an incorrect tag key such as 'patch-group' is used, Patch Manager will not map the node to the custom baseline. Furthermore, if the Maintenance Window targets instances by the patch group tag, these mis-tagged instances will not be targeted at all, resulting in no patch scans executing on them and leaving their compliance status as 'Never'.

Adım Adım Çözüm

1
Verify the tag keys on the target EC2 instances.
Observe that the tag key is 'patch-group' instead of 'Patch Group'.
AWS Systems Manager is strictly case-sensitive and expects the tag key 'Patch Group' to associate instances with their respective patch groups.
2
Check the Patch Group association under the custom Patch Baseline configuration.
Ensure the patch group name 'Win-Prod' is correctly registered to the custom baseline.
Confirming the baseline is mapped to the intended patch group name ensures that once tags are corrected, the instances will inherit the correct rules.
3
Correct the tag key on the EC2 instances to 'Patch Group' and trigger a scan.
The instances are targeted by the Maintenance Window and their compliance status updates from 'Never' to compliant or non-compliant.
Using the correct case-sensitive tag allows Systems Manager to resolve the association, execute the patch scan, and record compliance data.

Anahtar Kavram

Applying correct patch baseline rules through case-sensitive Patch Group tags in Systems Manager
Bu soruyu puanla

Konular

Patch Management and OS Compliance Automation

Bu konudan daha fazla soru