Examkin

Soru

Zorluk: ZorAWS Systems Manager Configuration and Run Command Automation

A SysOps Administrator needs to automate a weekly security compliance script on a fleet of Amazon EC2 instances. The administrator wants to use AWS Systems Manager State Manager to execute a custom SSM document. The execution logs must be saved to a centralized, encrypted Amazon S3 bucket. The administrator needs to configure the required IAM permissions, Systems Manager components, and verify the setup.

What is the correct sequence of steps to configure, automate, and verify this setup?

  1. 1Attach an IAM instance profile containing the AmazonSSMManagedInstanceCore policy to the target EC2 instances, and ensure the SSM Agent is active on the instances.
  2. 2Create the custom SSM Command document containing the security compliance script.
  3. 3Create an IAM service role for Systems Manager with a trust relationship for ssm.amazonaws.com and attach a policy allowing s3:PutObject to the target S3 bucket.
  4. 4Create a State Manager association that references the custom SSM document, targets the instances using resource tags, specifies the S3 bucket for logs, and associates the IAM service role.
  5. 5Review the execution status of the association in the State Manager console and verify that log files are created in the target S3 bucket.

Cevap

The correct sequence is: first, attach the IAM instance profile with AmazonSSMManagedInstanceCore to the EC2 instances; second, create the custom SSM Command document containing the compliance script; third, create the IAM service role for Systems Manager with S3 write permissions; fourth, create the State Manager association targeting the instances and configuring S3 logging; fifth, verify the execution status and output logs in the S3 bucket.
To automate a compliance script with Systems Manager, the instances must first be registered as managed nodes, which requires the AmazonSSMManagedInstanceCore IAM role and the SSM Agent. Next, the script must be defined in an SSM Command document. To write logs to an S3 bucket, an IAM service role for Systems Manager with S3 write permissions is required. Once these prerequisites are met, a State Manager association can be created to bind the document to the targets on a schedule with the logging configuration. Finally, the execution and logs can be verified.

Adım Adım Çözüm

1
Configure IAM permissions and SSM agent on the target EC2 instances.
EC2 instances become managed nodes in Systems Manager.
Systems Manager cannot run command documents on instances unless they are registered as managed nodes with the SSM Agent active and the AmazonSSMManagedInstanceCore policy attached.
2
Define the compliance script in a custom SSM Command document.
The SSM Command document is available for execution.
An SSM document must be defined to encapsulate the script execution logic before it can be referenced in any association.
3
Create an IAM service role for Systems Manager with S3 bucket permissions.
An IAM role with ssm.amazonaws.com trust relationship and s3:PutObject permission is created.
Systems Manager requires an IAM service role to gain authorization to write execution logs directly to the target S3 bucket.
4
Create a State Manager association linking the document, targets, schedule, and S3 role.
State Manager automates the execution of the compliance script.
The association binds the SSM document to the target instances (using resource tags) and specifies the execution parameters including scheduling and logging configuration.
5
Verify execution logs and status.
The status is shown as Success in State Manager, and log files are present in the S3 bucket.
Verifying the console status and checking the S3 bucket ensures the script executed successfully and the logs were written correctly.

Anahtar Kavram

AWS Systems Manager Configuration and Run Command Automation
Bu soruyu puanla

Konular

AWS Systems Manager Configuration and Run Command Automation