Examkin

Soru

Zorluk: Çok zorAWS Systems Manager Configuration and Run Command Automation

A SysOps Administrator is setting up automated patching for a fleet of Amazon EC2 instances using AWS Systems Manager Patch Manager. The administrator creates a custom patch baseline named 'Production-Security-Baseline' to install critical security updates. To target the instances, the administrator registers a patch group named 'Prod-Servers' and associates it with the custom baseline. The SSM Agent is verified as installed and running on all instances, and the 'AmazonSSMManagedInstanceCore' managed policy is attached to the IAM instance profile of each instance. The administrator tags the target instances with the key 'PatchGroup' and the value 'Prod-Servers'. During the next scheduled maintenance window, the administrator observes that the Systems Manager Run Command using the 'AWS-RunPatchBaseline' document executes successfully, but the instances are patched using the default baseline ('AWS-DefaultPatchBaseline') instead of 'Production-Security-Baseline'. Which of the following explains why the custom patch baseline was not applied to the instances?

  1. A
    The IAM instance profile attached to the instances is missing the 'iam:PassRole' permission, which prevents the Systems Manager Run Command execution from assuming the role required to run the custom baseline.
  2. B
    The custom patch baseline must be set as the default patch baseline in the AWS Region for the patch group association to override the default system baseline.
  3. The tag key used on the instances was 'PatchGroup', but AWS Systems Manager Patch Manager requires the tag key to be exactly 'Patch Group' (case-sensitive) to associate instances with a patch group.Cevap
  4. D
    The instances are located in a private subnet and cannot resolve the Systems Manager endpoint because the VPC gateway endpoint for Systems Manager has not been associated with the subnet's route table.

Cevap

The tag key used on the instances was 'PatchGroup', but AWS Systems Manager Patch Manager requires the tag key to be exactly 'Patch Group' (case-sensitive) to associate instances with a patch group.
AWS Systems Manager Patch Manager matches instances to patch baselines using patch groups, which are defined strictly by a case-sensitive resource tag key named 'Patch Group' (with a space). If the tag key is misspelled (such as 'PatchGroup' without a space), Patch Manager will fail to associate the instances with the patch group. As a result, when the 'AWS-RunPatchBaseline' command executes, it defaults to applying the system's default baseline ('AWS-DefaultPatchBaseline') rather than the custom baseline associated with the patch group.

Adım Adım Çözüm

1
Analyze target tag configuration
Identify that the administrator tagged the instances using the key 'PatchGroup' instead of the system-required 'Patch Group'.
Systems Manager Patch Manager requires the exact, case-sensitive tag key 'Patch Group' to map instances to patch groups.
2
Evaluate baseline mapping behavior
Determine that since the tag key did not match, Patch Manager could not associate the instances with the custom baseline registered to 'Prod-Servers'.
Without the correct tag key, the instances are not recognized as members of any registered patch group.
3
Determine execution fallback
Recognize that the execution used the default baseline 'AWS-DefaultPatchBaseline' instead of failing.
When the 'AWS-RunPatchBaseline' document runs on an instance that does not belong to a defined patch group, it falls back to the default patch baseline configured for that operating system.

Anahtar Kavram

AWS Systems Manager Patch Manager Patch Group and Baseline Association
Bu soruyu puanla

Konular

AWS Systems Manager Configuration and Run Command Automation