Systems Manager for fleet operations: SOA-C03 study notes and practice questions
What to know about Systems Manager for fleet operations for the SOA-C03 exam, from the Deployment, Provisioning, and Automation domain (22% of the exam guide), then 3 free questions to test it. Part of the SOA-C03 study guide.
Systems Manager questions ask how to operate many instances at once, securely, without logging in to each one.
Requirements for a managed node
The SSM Agent installed and running (preinstalled on many AWS AMIs).
An instance profile role with AmazonSSMManagedInstanceCore (or Default Host Management Configuration turned on).
Network access to the Systems Manager endpoints: a NAT gateway or interface VPC endpoints for ssm, ssmmessages and ec2messages.
If an instance doesn’t appear as managed, check these three.
The tools
Tool
Job
Session Manager
Browser or CLI shell with no inbound ports, bastions or SSH keys; sessions logged to S3 or CloudWatch Logs; access controlled by IAM
Run Command
Run a command document on many instances by tag, with rate control (concurrency) and error thresholds
Patch Manager
Patch baselines decide which patches are approved (with auto-approval delays); maintenance windows or patch policies decide when to install; patch groups by tag
State Manager
Keeps instances in a defined state on a schedule, such as the CloudWatch agent installed
Maintenance Windows
Schedule disruptive tasks
Inventory
Collects software, files and configuration from instances
Fleet Manager
Manage instances from the console (files, users, performance)
Parameter Store
Configuration and secrets
Distributor
Package and install software
Quick Setup
Configure common settings across accounts
Hybrid
Hybrid activations register on-premises servers as managed nodes, so the same tools work there.
Common traps
Opening port 22 for administrators. Session Manager needs no inbound rules.
Patching instantly when approval should wait. Patch baselines can delay auto-approval by days.
Instance not showing in Systems Manager: usually the role or network, not the agent.
A public library manages 200 EC2 instances, both Windows Server and Amazon Linux, with AWS Systems Manager.
Security patches must be installed every Sunday between 2:00 and 4:00 AM. To leave time for testing, a patch may be installed only after it has been released for at least 7 days.
The library wants this enforced automatically.
What should a CloudOps engineer configure?
Choose one answer.
AA. Patch baselines with an auto-approval delay of 7 days, and a maintenance window on Sundays from 2:00 to 4:00 AM that runs AWS-RunPatchBaseline with Install.
BB. A State Manager association that runs AWS-RunPatchBaseline with the Install operation every 30 minutes on all instances.
CC. An Automation runbook started each Sunday at 2:00 AM by an EventBridge schedule that applies all available updates with the operating system's package manager.
DD. Run Command with AWS-RunPatchBaseline and the Scan operation every Sunday, then have the team approve each patch in the console.
Show the answer and explanation
Answer: A
A. Right: Correct. Approval rules in a patch baseline can approve patches a set number of days after release. The maintenance window runs the patching task only during the allowed time. Learn more: Patch baselines (opens in a new tab)
Patch Manager separates what is approved from when it is installed. Patch baselines decide which patches are approved, including an approval delay after release, and maintenance windows decide when AWS-RunPatchBaseline installs them. Together they enforce both rules without manual steps.
A regional bank wants to remove its SSH bastion hosts.
Its EC2 instances run in private subnets with no NAT gateway, and their security groups must not allow any inbound traffic. Engineers must still get interactive shell access, with each session logged to Amazon S3.
The SSM Agent is already installed on the instances.
Which TWO actions should a CloudOps engineer take? (Choose two.)
Choose two answers.
AA. Create interface VPC endpoints for ssm, ssmmessages and ec2messages in the VPC, with private DNS turned on.
BB. Allow inbound TCP port 443 from the VPC's CIDR range in the instances' security groups so that Session Manager can connect.
CC. Create an EC2 Instance Connect Endpoint in the private subnets and allow SSH from it in the instances' security groups.
DD. Attach an instance profile whose role includes the AmazonSSMManagedInstanceCore managed policy.
EE. Create a gateway VPC endpoint for Systems Manager and add it to the private subnets' route tables.
Session Manager gives shell access with no open inbound ports, because the SSM Agent connects out to the service. The instance needs a role with AmazonSSMManagedInstanceCore and, without internet access, interface endpoints for the Systems Manager services. Session logging to S3 is then configured in Session Manager preferences, which also uses an S3 endpoint in a private VPC.
The agent connects out through the endpoints, so the security group needs no inbound rules and no bastion is left.
A logistics broker needs to run a one-time script that rotates a local log configuration on 500 EC2 instances tagged Role=Tracking. All instances are managed by AWS Systems Manager.
To limit the impact of a mistake, the script should run on no more than 10 percent of the instances at a time, and the job should stop if it fails on more than five instances.
Which approach should a CloudOps engineer use?
Choose one answer.
AA. A State Manager association with the AWS-RunShellScript document that applies the script to the tagged instances every day.
BB. Session Manager sessions opened by engineers to each instance in turn, running the script by hand in each shell.
CC. Run Command with the AWS-RunShellScript document, targeting the tag, with a concurrency of 10 percent and an error threshold of 5.
DD. A user data script added to the instances' launch template, followed by an instance refresh of every Auto Scaling group.
C. Right: Correct. Run Command can target instances by tag and has built-in rate controls. Concurrency limits how many instances run at once, and the error threshold stops the command after too many failures. Learn more: Run commands at scale (opens in a new tab)
Run Command is the Systems Manager tool for running ad hoc commands across many managed instances. It targets by tag and offers rate controls, a concurrency limit and an error threshold, so a bad script affects only a small part of the fleet before it stops.
Want more on Systems Manager for fleet operations? The 5 full-length practice sets have 10 more Systems Manager for fleet operations questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →