Question

A SysOps administrator manages a fleet of 300 EC2 instances running various Linux distributions. The compliance team needs a centralized, regularly updated record of all installed applications, OS versions, and network configurations across every instance so they can query which hosts have a specific vulnerable software package installed. The solution must require minimal ongoing manual effort. Which AWS Systems Manager capability should the administrator use?

Accepted Answer

Configure Systems Manager Inventory with a State Manager association to collect application, network, and OS metadata on a schedule, then query the data with resource data sync to Amazon S3 and Athena.

Answer

Use Systems Manager Run Command to execute a shell script on all instances each day that lists installed packages and uploads the output to Amazon S3.

Answer

Enable Systems Manager Patch Manager scanning so patch compliance reports reveal which software packages are installed on each instance.

Answer

Store the list of installed software for each instance as parameters in Systems Manager Parameter Store and update them manually when software changes.