A company is implementing a new CI/CD pipeline for their applications deployed on Amazon EC2 instances. They need to ensure that all EC2 instances are regularly patched with the latest security updates without manual intervention or requiring direct SSH access. Furthermore, these patching operations must occur during specific, pre-defined time windows to minimize impact on production workloads. Which AWS Systems Manager feature, combined with a specific configuration, should be used to achieve this?
- ASystems Manager Session Manager for remote access and manual patching.
- BSystems Manager Run Command with a custom shell script.
- CSystems Manager Patch Manager configured with Maintenance Windows.
- DSystems Manager State Manager with an association for patching.
Show answer & explanationAnswer & explanation
Correct answer: C. Systems Manager Patch Manager configured with Maintenance Windows.
Systems Manager Patch Manager automates the patching process for EC2 instances, applying security updates without SSH access. When combined with Maintenance Windows, it allows scheduling these patching operations to occur only during specified times, directly meeting the requirements for regular, automated, and scheduled patching with minimal production impact.
Why the other options are wrong
- A. Session Manager provides remote access but is for manual interaction, not automated, scheduled patching.
- B. Run Command can run scripts but doesn't inherently manage patch baselines or automatically schedule patches within windows.
- D. State Manager maintains desired configurations, which can include patching, but Patch Manager is purpose-built for patching and integrates more directly with Maintenance Windows for this specific use case.
SSM Patch Manager with Maintenance Windows
AWS Systems Manager Patch Manager automates the process of patching Amazon EC2 instances and on-premises servers with security and other updates. When integrated with Systems Manager Maintenance Windows, these patching operations can be scheduled to run automatically during specified, recurring time slots, minimizing disruption to production workloads.
- Automates OS and application patching.
- Defines patch baselines for approved updates.
- Maintenance Windows schedule operations to specific times.
- Eliminates manual patching and direct SSH access.
Memory trick: Patch Manager uses Maintenance Windows to keep your instances updated on schedule.