A company wants to use AWS Systems Manager to manage a large fleet of Amazon EC2 instances. The company hosts the instances in private subnets. The company follows the principle of least privilege…

Question

Options

• AReplace the NAT gateway with a NAT instance that is deployed in the public subnet. Update the
• BCreate a VPC endpoint for Systems Manager. Remove routes to the internet through the NAT
• CAttach the AmazonSSMManagedInstanceCore AWS managed policy to the EC2 instance profile
• DAttach a custom policy that allows all actions to ssm* to the EC2 instance profile that is

• B
  6% (1)
• C
  88% (14)
• D
  6% (1)

Explanation

For EC2 instances to register and appear in AWS Systems Manager (Fleet Manager, Run Command, Patch Manager, etc.), the instance’s IAM instance profile must have the correct permissions. The recommended least-privilege policy is AmazonSSMManagedInstanceCore, which grants SSM Agent the necessary access to Systems Manager, AWS Identity and Access Management, and (optionally) CloudWatch Logs. Without this policy, the agent cannot register the instance, even if network connectivity through a NAT gateway is present.

No community discussion yet for this question.