Exam AWS Certified Solutions Architect - Associate SAA-C03 topic 1 question 723 discussion

option C....Default Host Management Configuration creates and applies a default IAM role to ensure that Systems Manager has permissions to manage all instances in the Region and perform automated patch scans using Patch Manager.

C is the answer

This is a terrible question because both A and C require a new role and cannot have more than one role for an EC2 - A is eliminated because it says two roles, C is eliminated because it will require two roles.... but it doesn't kill itself by saying such. So the least wrong answer to this question is C.

Answer: A. Create a new IAM role. Attach the AmazonSSMManagedInstanceCore policy to the new IAM role. Attach the new IAM role to the EC2 instances and the existing IAM role.

https://docs.aws.amazon.com/systems-manager/latest/userguide/setup-instance-permissions.html, DHMC eliminates the need to manually create and attach a new IAM role for Systems Manager, reducing operational overhead.

Well.. Actually I don't know what to choose. A or C ?? A - EC2 instances can have only one IAM role attached at a time. Whether attaching multiple roles is possible or not depends on whether AWS allows such configuration in your environment. B - Systems Manager manages EC2 instances through the instance's attached IAM role, not an IAM user. C - It doesn't address the core requirement of maintaining the existing RDS connectivity. It still requires the EC2 instances to have the necessary IAM permissions to be managed by SSM. The IAM role associated with the EC2 instance must still have the AmazonSSMManagedInstanceCore policy attached to enable Systems Manager capabilities. D - Removing the existing policies would break the application's ability to connect to the RDS database. This directly contradicts the requirement of not disrupting running applications.

I'd vote for A because the request here is not to disrupt the existing workload, meaning the existing IAM role must be intact with the addition to the new permission set that gives SSM patch manager patching capabilities.

"The Default Host Management Configuration setting allows AWS Systems Manager to manage your Amazon EC2 instances automatically as managed instances. Default Host Management Configuration makes it possible to manage EC2 instances without your having to manually create an AWS Identity and Access Management (IAM) instance profile. Instead, Default Host Management Configuration creates and applies a default IAM role to ensure that Systems Manager has permissions to manage all instances in the AWS account and AWS Region where it's activated."

i think A

So is C same as A, but automated?

C is fine

C is a better option

Correct answer A