AWS Certified SysOps Administrator – AssociateDeployment, Provisioning, and AutomationHard
A security team requires that all new Amazon EC2 instances launched in a specific VPC automatically join the corporate Active Directory domain. This process must be fully automated at instance launch. Which AWS service and configuration would best achieve this requirement?
- AUtilize AWS Directory Service to create a managed Active Directory and configure a run command document.
- BUse EC2 user data script to run domain join commands during instance boot.
- CCreate a custom Amazon Machine Image (AMI) with the domain join pre-configured.
- DImplement AWS Systems Manager State Manager with a document to join the domain.
Show answer & explanationAnswer & explanation
Correct answer: D. Implement AWS Systems Manager State Manager with a document to join the domain.
While user data can join a domain, it's less manageable for ongoing compliance. AWS Systems Manager State Manager, combined with an AWS-provided or custom document, can automatically apply and maintain the domain join configuration on instances that match a specific tag or Auto Scaling group, ensuring continuous compliance and easier management across a fleet of instances.
Why the other options are wrong
- A. AWS Directory Service provides the AD, but State Manager (or user data) is needed to *join* the instances to it. A run command document is executed on-demand, not automatically upon launch for new instances.
- B. User data can work, but State Manager offers better central management, reporting, and ongoing compliance enforcement, especially for a fleet of instances.
- C. Custom AMIs require frequent rebuilding to stay updated and don't provide a dynamic way to join instances launched from different AMIs or to re-join if they leave the domain.
AWS Systems Manager State Manager
A Systems Manager capability that allows you to define and apply a consistent configuration state across your EC2 instances and on-premises servers.
- Enforces desired state configuration.
- Uses documents (e.g., 'AWS-JoinDomain') for tasks.
- Can be scheduled or applied on association.
Memory trick: State Manager ensures domain's embrace.