Question

A DevOps team manages a fleet of 400 EC2 instances across multiple accounts. Corporate policy requires that a specific CloudWatch agent configuration and a hardened set of OS security settings be present on every instance at all times. Developers occasionally SSH into instances and manually change settings, causing configuration drift. The team wants a fully managed, ongoing solution that automatically reapplies the desired configuration on a schedule without building custom Lambda automation or relying on instance launch scripts. Which approach best meets these requirements?

Accepted Answer

Create an AWS Systems Manager State Manager association that targets the instances by tag, references an SSM document for the CloudWatch agent and security settings, and runs on a defined schedule to continuously enforce the desired state.

Answer

Bake the CloudWatch agent configuration and security settings into a golden AMI and rebuild all instances weekly using an EC2 Image Builder pipeline.

Answer

Use an EventBridge rule that triggers an SSM Run Command document whenever an instance enters the running state to reapply the configuration.

Answer

Add the CloudWatch agent configuration and security settings to the EC2 user data script so they are applied at every boot.