Question

A SysOps administrator must build a repeatable process that produces a hardened, fully patched 'golden' AMI every month. The process should launch a temporary EC2 instance from the current base AMI, apply the latest OS patches, run a hardening script, create a new AMI, and then terminate the temporary instance — all without manual intervention. Which AWS service and feature should the administrator use to orchestrate this multi-step workflow?

Accepted Answer

AWS Systems Manager Automation using a runbook that launches the instance, patches it, creates the AMI, and terminates the instance

Answer

AWS Systems Manager Run Command to execute the patch and hardening commands directly against a running instance

Answer

AWS Systems Manager State Manager association that continuously enforces the patch baseline on the base AMI

Answer

AWS Systems Manager Patch Manager maintenance window that scans and installs patches on production instances