Question

A DevOps team manages configuration on a fleet of 400 EC2 Linux instances across three accounts. They need a repeatable, versioned procedure that (1) stops an application service, (2) applies OS package updates, (3) modifies a config file from a template, and (4) restarts the service — executed as a single unit with the ability to roll back to a prior version if a change causes issues. The procedure must be stored as code, invocable on-demand and on a schedule, and support parameterized inputs per environment. Which approach best meets these requirements?

Accepted Answer

Author a Systems Manager Command document (schema 2.2) with multiple plugin steps, publish it with document versioning, and run it via State Manager associations and on-demand Run Command with environment-specific parameters.

Answer

Write a single large bash script, store it in an S3 bucket, and use a cron job on each instance to download and execute it, tracking changes with S3 object versioning.

Answer

Create an SSM Automation runbook that calls aws:executeAwsApi to reboot each instance, relying on the default patch baseline to apply all updates automatically.

Answer

Use AWS Config custom rules with SSM remediation to detect drift in the config file and package versions, letting Config trigger fixes on each evaluation cycle.