Question

A CloudOps engineer manages a fleet of 400 EC2 instances across multiple accounts. The security team needs a periodically updated report of all installed applications, application versions, and OS configuration on every instance, stored centrally so they can query which instances have an outdated version of a specific package. The solution must require no custom agents beyond what is already deployed and minimal ongoing maintenance. Which approach best meets these requirements?

Accepted Answer

Configure AWS Systems Manager Inventory to collect metadata on a schedule and use resource data sync to aggregate the data to a central S3 bucket for querying with Amazon Athena.

Answer

Use SSM Run Command on a schedule to execute a shell script that lists installed packages and writes the output to CloudWatch Logs for analysis.

Answer

Enable AWS Config with a custom rule that records installed software as configuration items and review the Config timeline for each instance.

Answer

Deploy the CloudWatch agent to stream package listings as custom metrics and build a CloudWatch dashboard to track versions.