Question

A CloudOps engineer must run a one-time shell script across 200 Linux EC2 instances to collect a specific application configuration file and log the output. The instances are spread across multiple accounts and already have the SSM Agent installed and appropriate IAM instance profiles. The engineer needs to execute the command immediately, target instances dynamically by tag, and capture command output centrally without logging into any instance. Which AWS Systems Manager capability best fits this requirement?

Accepted Answer

Use SSM Run Command with a tag-based target selection and configure output to be written to an S3 bucket and CloudWatch Logs.

Answer

Create an SSM State Manager association that applies the script on a recurring schedule to all tagged instances.

Answer

Build an SSM Automation runbook with an aws:approve step and execute it against each instance ID individually.

Answer

Store the script in SSM Parameter Store as a SecureString and reference it from a Patch Manager maintenance window.