Question

A company uses AWS Systems Manager to manage a large fleet of Amazon EC2 Linux instances in its production AWS account. The EC2 instances must adhere to a list of compliance requirements. The company’s DevOps engineers developed Chef cookbooks to identify and remediate configuration deviations. The company does not want to manage Chef server and agent infrastructure. The DevOps engineers must configure the Chef cookbooks to run periodically on the EC2 instances. Which solution meets these requirements?

Accepted Answer

A. Create a Systems Manager State Manager association. Associate the AWS-ApplyChefRecipes document with all EC2 instances. Configure the association to retrieve the Chef cookbooks from a source repository and to run every hour.

Answer

Store the Chef agent installation package in an Amazon S3 bucket. Configure a Systems Manager Run Command to invoke the AWS-InstallApplication command on all instances and to run the repair action. Schedule the Run Command to run every hour.

Answer

Create a Systems Manager State Manager association that applies the AWS-RefreshAssociation document to all EC2 instances. Configure the association to run every hour.

Answer

Configure a Systems Manager patch policy to run the scan and install operation every hour. Create a patch baseline for the EC2 instances. Configure the instance IAM profile with permissions for patch operations.