A company has a non-production application that runs on an Amazon EC2 instance. The EC2 instance has an instance profile and an associated IAM role. The company wants to automate patching for the…

Question

Options

• ACreate a new IAM role. Attach the AmazonSSMManagedInstanceCore policy to the new IAM role.
• BCreate an IAM user. Attach the AmazonSSMManagedInstanceCore policy to the IAM user.
• CAttach the AmazonSSMManagedInstanceCore policy to the existing IAM role. Use AWS Systems
• DAttach the AmazonSSMManagedInstanceCore policy to an existing IAM user. Use EC2 Image

• A
  9% (4)
• B
  2% (1)
• C
  87% (40)
• D
  2% (1)

Explanation

To manage EC2 instances with AWS Systems Manager (SSM), the EC2 instance must be configured as a managed instance by attaching an IAM role that has the AmazonSSMManagedInstanceCore managed policy. This policy allows: SSM agent to register the instance with SSM Perform actions like patching, automation, session management, inventory collection, etc. Access to SSM endpoints (via internet or VPC endpoint if needed) Since the EC2 instance already has an IAM role, the least operational overhead option is to attach the required policy to the existing role (Option C). No need to create new IAM roles or users, which simplifies management and adheres to the principle of least privilege. Patching can then be automated via SSM Patch Manager, ensuring consistency, compliance, and operational efficiency.

No community discussion yet for this question.