Q92 — AWS SAA-C03 Ch.15

Question 92 of 100 | ← Chapter 15

Q1192. A company has a non-production application that runs on an Amazon EC2 instance. The EC2 instance has an instance profile and an associated IAM role.The company wants to automate patching for the EC2 instance.Which solution will meet this requirement?

Correct Answer: C. Attach the AmazonSSMManagedlnstanceCore policy to the existing IAM role. Use AWS Systems Manager to patch the EC2 instance.

Explanation

To automate patching for the Amazon EC2 instance that already has an instance profile and an associated IAM role, the most straightforward and secure solution is:C. Attach the AmazonSSMManagedInstanceCore policy to the existing IAM role. Use AWS Systems Manager to patch the EC2 instance.Analysis of Options:A. Create a new IAM role. Attach the AmazonSSMManagedInstanceCore policy to the new IAM role. Attach the new IAM role to EC2 instance profile. Use AWS Systems Manager to patch the instance. Limitation: This option involves creating a new IAM role, which is unnecessary if the EC2 instance already has an existing IAM role associated with its instance profile. Creating a new role adds complexity without providing any additional benefit in this scenario.B. Create an IAM user. Attach the AmazonSSMManagedInstanceCore policy to the IAM user. Configure AWS Systems Manager to use the IAM user to patch the instance. Limitation: Using an IAM user for this purpose is not recommended because IAM users are typically used for long-term credentials for humans or applications. For EC2 instances, it's better to use IAM roles, which provide temporary security credentials and are more secure and manageable. C. Attach the AmazonSSMManagedInstanceCore policy to the existing IAM role. Use AWS Systems Manager to patch the EC2 instance.Advantage: This option involves attaching the necessary policy (AmazonSSMManagedInstanceCore) to the existing IAM role associated with the EC2 instance. This allows AWS Systems Manager to manage and patch the instance securely without the need for creating new roles or users. It is the most straightforward and secure solution for automating patching.D. Attach the AmazonSSMManagedInstanceCore policy to an existing IAM user. Use EC2 Image Builder to patch the EC2 instance.Limitation: This option suggests using an IAM user (which, as mentioned, is not recommended for this purpose) and EC2 Image Builder. EC2 Image Builder is primarily used for creating and managing custom AMIs, not for patching running EC2 instances. AWS Systems Manager is the appropriate tool for patching running instances.Conclusion:C. Attach the AmazonSSMManagedInstanceCore policy to the existing IAM role. Use AWS Systems Manager to patch the EC2 instance. is the best solution to meet the company's requirement of automating patching for the EC2 instance. It leverages the existing IAM role and AWS Systems Manager to provide a secure and efficient patching solution.