Question

A company manages a fleet of standardized bastion EC2 instances across 40 accounts using CloudFormation StackSets deployed from the organization's management account. Each account requires the same base configuration (installing a monitoring agent, configuring a hardened SSH banner, and applying OS package updates) applied at instance launch, and the operations team wants this configuration to be reapplied automatically whenever the underlying AMI is refreshed via a StackSet update. The team wants a solution that keeps the configuration declarative within the same CloudFormation template and executes reliably during instance provisioning. Which approach best meets these requirements?

Accepted Answer

Define the configuration steps in the AWS::CloudFormation::Init metadata on the instance's launch resource and invoke cfn-init and cfn-signal from the instance UserData, using a CreationPolicy to gate stack completion on successful configuration.

Answer

Package the configuration into a separate Systems Manager Automation runbook and trigger it from an EventBridge rule that fires on each StackSet operation, passing the account and instance IDs as parameters.

Answer

Embed the full sequence of shell commands directly in the instance UserData script so they run at every boot, and rely on StackSet drift detection to confirm the commands executed.

Answer

Store the configuration in an S3 bucket and use a Lambda-backed custom resource that copies and executes the script on each instance over SSH during stack creation.