Examkin

Soru

Zorluk: OrtaAWS Systems Manager Configuration and Run Command Automation

A SysOps Administrator is using AWS Systems Manager Run Command to execute a configuration script on a fleet of Amazon EC2 instances. The administrator attempts to target the instances using the resource tag key `Environment` with the value `Production`. The administrator verifies that the SSM Agent is installed and running on the instances, and an IAM instance profile containing the `AmazonSSMManagedInstanceCore` policy is attached. However, the Run Command console reports that zero instances are targeted. Upon checking the Systems Manager Fleet Manager console, the administrator notices that none of the target EC2 instances are listed as managed nodes. Which of the following is the most likely cause of this issue?

  1. A
    The target EC2 instances are associated with a patch group tag that does not match the patch group defined in the default Systems Manager patch baseline.
  2. The target EC2 instances are launched in a private subnet and lack network routing to a NAT gateway or interface VPC endpoints for Systems Manager.Cevap
  3. C
    The administrator's IAM user policy is missing the `iam:PassRole` permission for the IAM instance profile role attached to the instances.
  4. D
    The EventBridge rule configured to trigger the Systems Manager Run Command is using an incorrect target pathway that bypasses the required API endpoints.

Cevap

The target EC2 instances are launched in a private subnet and lack network routing to a NAT gateway or interface VPC endpoints for Systems Manager.
The correct answer identifies that the instances lack a network path to contact AWS Systems Manager endpoints. For the SSM Agent to register an EC2 instance as a managed node, it must communicate with the Systems Manager service. In a private subnet, this requires either a route to a NAT gateway/instance or interface VPC endpoints (PrivateLink) for Systems Manager. If this connectivity is missing, the instances will never show up in Fleet Manager, rendering them untargetable by Run Command.

Adım Adım Çözüm

1
Analyze the preconditions specified in the troubleshooting scenario.
The SSM Agent is running, and the IAM instance profile with `AmazonSSMManagedInstanceCore` is attached, but the instances are not showing up as managed nodes in Fleet Manager.
This narrows the root cause down to network connectivity issues rather than agent status or IAM role permissions on the instance.
2
Evaluate the network connectivity requirements for the SSM Agent.
The SSM Agent requires outbound access to Systems Manager service endpoints (ssm, ssmmessages, ec2messages) to register the instance as a managed node.
If instances are in a private subnet without a NAT gateway or interface VPC endpoints, the agent cannot establish communication, and the instances will not appear in Fleet Manager.
3
Determine which option represents the correct network connectivity resolution.
Ensuring the private subnet has routing to a NAT gateway or configuring interface VPC endpoints resolves the registration failure.
This establishes the necessary connection path for the SSM Agent to register the node.

Anahtar Kavram

AWS Systems Manager Managed Node Registration and Connectivity Requirements
Bu soruyu puanla

Konular

AWS Systems Manager Configuration and Run Command Automation