A SysOps administrator is using EC2 Image Builder in a build pipeline. The build pipeline fails and produces the following error message: "Step timed out while step is verifying the Systems Manager…

Question

Options

• AAdd the EC2instanceConnect AWS managed policy to the IAM service-linked role for Image
• BAdd the EC2instanceProfileForlmageBullder AWS managed policy and the
• CAdd the ec2:DescribeInstances permission and the ssm:StartAutomationExecution permission to
• DAdd only the ec2:DescribeInstances permission to the build pipeline role.

• A
  8% (4)
• B
  75% (40)
• C
  4% (2)
• D
  13% (7)

Explanation

Option B is correct because EC2 Image Builder uses the SSM Agent on the build instance to execute pipeline steps, and the instance profile role must have both the EC2InstanceProfileForImageBuilder and AmazonSSMManagedInstanceCore managed policies - the former grants Image Builder-specific permissions while the latter enables SSM to register and communicate with the instance. Without these on the instance profile role, SSM Agent cannot verify itself, causing the timeout regardless of networking.

Why the distractors fail:

• A - EC2InstanceConnect is for browser/CLI SSH access, not SSM Agent communication; it solves the wrong problem entirely.
• C - ssm:StartAutomationExecution launches SSM Automation documents but does not grant the SSM Agent registration or session permissions needed for instance verification; the permission set is incomplete.
• D - ec2:DescribeInstances alone gives read-only EC2 metadata access and has no bearing on SSM Agent availability or verification.

Memory tip: Think "Image Builder pipeline = two policies working together on the instance profile" - the ImageBuilder policy for build orchestration + the SSMManagedInstanceCore policy so the SSM Agent can phone home. If you see an SSM Agent timeout in Image Builder, the answer is almost always a missing policy on the instance profile, not the service-linked role.

No community discussion yet for this question.