AWS Systems Manager and OpsWorks Exam Scenarios

Purpose of This Lesson

This lesson focuses on recognizing the correct AWS Systems Manager or AWS OpsWorks solution for common operational scenarios. The central decisions involve instance permissions, Systems Manager Agent availability, patching impact, credential storage, automated compliance remediation, and configuration-management migration.

Key Concepts

• SSM Parameter Store secure strings: Sensitive values such as database or external-service credentials can be stored as secure strings and retrieved by applications or deployment workflows.
• IAM role for EC2: An application running on an EC2 instance should use an instance IAM role to obtain permission to read required Parameter Store values. Hard-coding credentials or using user access keys on the instance is not the intended approach.
• Systems Manager Patch Manager: Patch Manager applies updates to managed instances, commonly through patch groups and maintenance windows. The maintenance schedule and batch size affect application impact.
• Systems Manager Session Manager: Instances must be properly configured before they appear as available managed nodes. A custom AMI must include the Systems Manager Agent, and the instance profile must provide the permissions required for Systems Manager management.
• CloudFormation parameters and tags: A CloudFormation deployment can receive an environment value as a parameter and use it with stored credentials or environment-specific configuration.
• AWS Config plus Systems Manager Automation: AWS Config can identify resources that violate a policy, while a Systems Manager Automation document can perform remediation.
• AWS OpsWorks: OpsWorks supports managed configuration management with technologies such as Chef. OpsWorks Stacks models applications using layers.

Operational Scenario Analysis

Secure credential retrieval from Parameter Store

If an application on EC2 needs database credentials stored as secure strings in SSM Parameter Store, assign an IAM role to the instance. Grant that role permission to read the required parameters. The application can then retrieve the values without embedding credentials in its code or image.

The important distinction is that the permission belongs to the EC2 instance role, not to a human IAM user who happens to administer the instance.

Reducing patching impact

Patch Manager can update instances in a patch group during a maintenance window. If application performance degrades when too many instances are patched simultaneously, reduce the batch size—for example, patch 10% of the instances at a time. This spreads the operational impact instead of updating the entire group concurrently.

Troubleshooting missing Session Manager instances

A custom Linux AMI may not appear in the Session Manager console for two separate reasons:

1. The Systems Manager Agent is not installed or not running.
2. The EC2 instance profile lacks the permissions needed for Systems Manager management.

Checking only IAM permissions is insufficient when the agent is absent. Conversely, installing the agent does not solve the problem if the instance cannot authenticate to Systems Manager through its role.

Deploying environment-specific external-service credentials

For multiple environments deployed with CloudFormation, store the external-service credentials in SSM Parameter Store and pass an environment tag or environment value as a CloudFormation parameter. This allows the deployment to select the appropriate environment-specific configuration without placing credentials directly in the template.

Automating access-key policy enforcement

When a company requires IAM access keys to be disabled after 60 days, an AWS Config rule can identify noncompliant keys. A Systems Manager Automation document can then be used to remediate the finding automatically. The pattern is:

Detect with AWS Config → remediate with Systems Manager Automation.

Moving Chef configuration management to AWS

A company using Chef recipes on premises may use AWS OpsWorks as a managed Chef environment on AWS. If the requirement is specifically to model an application with layers, the appropriate service choice is AWS OpsWorks Stacks.

Exam- or Assessment-Relevant Takeaways

• Use an EC2 IAM role when an application on the instance must retrieve secure parameters.
• For secure-string access, the role needs permission to read the relevant SSM Parameter Store parameters.
• When patching affects application performance, reduce the number of instances patched concurrently through the maintenance-window configuration.
• Session Manager availability depends on both the Systems Manager Agent and suitable instance-profile permissions.
• A custom AMI can fail to appear as a managed instance if the agent was not included or configured.
• Use AWS Config to detect policy violations and Systems Manager Automation to perform automated remediation.
• Choose AWS OpsWorks when the scenario calls for managed Chef configuration management.
• Choose AWS OpsWorks Stacks when the requirement is to model an application using layers.
• Do not confuse storing credentials in Parameter Store with granting an application permission to retrieve them; both storage and IAM authorization are required.

Tool / Feature Decision Guide

Requirement	Appropriate choice	Decisive reason
EC2 application needs database credentials stored as secure strings	EC2 IAM role with Parameter Store read permissions	Grants the workload access without embedding credentials in the application
Patching all instances at once harms performance	Patch Manager maintenance window with a smaller batch, such as 10%	Limits simultaneous operational impact
EC2 instances are missing from Session Manager	Verify the Systems Manager Agent and instance-profile permissions	Both agent presence and authorization are required
Environment-specific credentials are needed in CloudFormation deployments	Parameter Store plus an environment parameter or tag	Separates deployment configuration from credentials and supports multiple environments
IAM access keys must be disabled after 60 days	AWS Config rule with Systems Manager Automation remediation	Config detects noncompliance and Automation applies the corrective action
Existing Chef recipes are moving from on premises to AWS	AWS OpsWorks	Provides managed Chef configuration management on AWS
An OpsWorks application must be modeled with layers	AWS OpsWorks Stacks	Stacks represents applications through layers

Common Traps / Misconceptions

• Assuming the Systems Manager Agent alone is enough: The agent also needs appropriate permissions through the instance profile.
• Assuming permissions alone are enough: An instance with the right role can still be unavailable if the agent is missing or not functioning.
• Using IAM user access keys for EC2 applications: Workloads should use an instance role when accessing AWS services.
• Patching every instance simultaneously: A maintenance window does not necessarily mean all instances must be updated at once; use a smaller batch to reduce impact.
• Confusing detection with remediation: AWS Config identifies noncompliance, while Systems Manager Automation carries out the remediation workflow.
• Treating OpsWorks and OpsWorks Stacks as interchangeable answers: OpsWorks addresses managed configuration management such as Chef, while OpsWorks Stacks is the relevant choice when the scenario emphasizes application layers.
• Putting credentials directly in a CloudFormation template: Store sensitive values in Parameter Store and pass environment-specific selection information separately.

Real-World Engineer / Analyst Notes

• Validate both identity permissions and agent health when troubleshooting managed-node visibility.
• Use patching batch size as a risk-control mechanism for production workloads: smaller batches reduce blast radius but may lengthen the maintenance process.
• Keep environment selection separate from secret values. A deployment should identify which environment it targets without exposing credentials in templates.
• For automated compliance, define the full chain: the rule that detects a violation, the automation document that responds, and the scope of resources affected.
• When evaluating OpsWorks scenarios, look for the operational technology named in the requirement—especially Chef—and then look for the modeling term layers to distinguish OpsWorks Stacks.

Quick Reference Summary

• EC2 application + secure Parameter Store credentials: Use an instance IAM role with permission to read the parameters.
• Patch performance issue: Patch a smaller percentage of the patch group during each maintenance window.
• Missing from Session Manager: Check both the Systems Manager Agent and instance-profile permissions.
• Multiple CloudFormation environments: Store credentials in Parameter Store and pass an environment parameter or tag.
• 60-day access-key policy: AWS Config detects noncompliant keys; Systems Manager Automation remediates them.
• Chef migration to AWS: Use AWS OpsWorks.
• Application modeled with layers: Use AWS OpsWorks Stacks.

Flashcards

Q: An EC2 application needs database credentials stored as secure strings in SSM Parameter Store. What authorization pattern should it use?

A: Attach an IAM role to the EC2 instance and grant the role permission to read the required parameters. The application then retrieves the credentials through the instance identity rather than using embedded credentials.

Q: What is the operational tradeoff when reducing Patch Manager’s patch batch to 10% of a patch group?

A: It reduces simultaneous application impact and limits the blast radius of patching, but the complete update process may take longer.

Q: A custom Linux AMI’s instances do not appear in Session Manager. What two areas should be checked first?

A: Check whether the Systems Manager Agent is installed and available, and verify that the instance profile grants the permissions required for Systems Manager management.

Q: Why is an EC2 instance profile preferable to IAM access keys for an application retrieving Parameter Store values?

A: The instance profile provides workload permissions through an IAM role without placing long-lived user credentials in the application or instance configuration.

Q: A CloudFormation deployment targets development, testing, and production, each with different external-service credentials. How should the deployment select the correct configuration?

A: Store the credentials in SSM Parameter Store and pass an environment value, such as an environment tag or parameter, to the CloudFormation deployment.

Q: Which service detects IAM access keys that violate a 60-day policy, and which service can remediate them?

A: AWS Config detects the noncompliant keys, and a Systems Manager Automation document can automatically remediate the finding.

Q: What is the trap in assuming that an instance with the correct Systems Manager permissions will automatically be available in Session Manager?

A: Permissions do not replace the Systems Manager Agent. The instance needs both a functioning agent and the required instance-profile permissions.

Q: When would AWS OpsWorks be a suitable choice for a company moving existing Chef recipes to AWS?

A: It is suitable when the company wants managed Chef configuration management on AWS while continuing to use its Chef-based approach.

Q: When does the scenario specifically point to AWS OpsWorks Stacks?

A: It points to OpsWorks Stacks when the requirement is to model an application using layers.

Q: How do AWS Config and Systems Manager Automation work together in a compliance workflow?

A: AWS Config evaluates resources and identifies noncompliance. Systems Manager Automation executes the corrective workflow for the detected issue.

Q: Why should sensitive external-service credentials not be placed directly in a CloudFormation template?

A: The lecture’s pattern is to keep credentials in SSM Parameter Store and pass environment-selection information to the template, separating secret storage from deployment logic.

Q: A production patch group experiences slowdowns whenever updates run. What feature should be adjusted before abandoning Patch Manager?

A: Adjust the maintenance window’s concurrency or batch approach so that a smaller portion of the patch group—such as 10%—is updated at a time.

Practice Questions

Question 1

A production application becomes slow whenever Systems Manager Patch Manager updates its Linux instances. The instances belong to one patch group, and the company still wants automated patching. What is the best adjustment?

A. Remove the instance profile from the instances
B. Patch a smaller percentage of the patch group during the maintenance window
C. Store the patches in Parameter Store
D. Replace Patch Manager with Session Manager

Correct answer: B

Explanation: Reducing the batch size, such as patching 10% at a time, limits concurrent impact on the application while retaining Patch Manager.

Question 2

Instances created from a custom Linux AMI are not visible in the Session Manager console. The instance profile appears to have the necessary Systems Manager permissions. What is the most likely remaining issue to investigate?

A. The AMI may not contain a functioning Systems Manager Agent
B. The instances must use IAM user access keys
C. The instances must be placed in an OpsWorks layer
D. The CloudFormation template must store the agent in Parameter Store

Correct answer: A

Explanation: Session Manager requires both suitable instance-profile permissions and the Systems Manager Agent. A custom AMI may not have the agent installed or configured.

Question 3

A company wants to enforce a rule that IAM access keys are disabled after 60 days. Which design matches the described automation pattern?

A. Session Manager detects keys and Patch Manager disables them
B. CloudFormation detects keys and OpsWorks remediates them
C. AWS Config identifies noncompliant keys and Systems Manager Automation remediates them
D. Parameter Store identifies keys and an EC2 role disables them

Correct answer: C

Explanation: AWS Config performs the compliance detection, while a Systems Manager Automation document performs the remediation.

Question 4

A company uses Chef recipes on premises and wants a managed Chef environment on AWS. It also wants to represent the application using layers. Which choice best fits the combined requirement?

A. AWS Config rules
B. AWS OpsWorks Stacks
C. Systems Manager Session Manager
D. Systems Manager Patch Manager

Correct answer: B

Explanation: AWS OpsWorks supports managed Chef configuration management, and OpsWorks Stacks models applications using layers.

Question 5

A CloudFormation process deploys the same application to several environments. Each environment requires different external-service credentials. Which approach best avoids putting those credentials directly into the template?

A. Store credentials in SSM Parameter Store and pass the environment selection as a parameter or tag
B. Create a separate IAM user access key for every EC2 instance
C. Store all credentials in the AMI and select them with Session Manager
D. Patch each environment with a different maintenance-window percentage

Correct answer: A

Explanation: Parameter Store holds the credentials, while an environment parameter or tag lets the deployment select the appropriate environment-specific configuration.

WordPress Metadata

Suggested Slug:
aws-systems-manager-opsworks-exam-scenarios

Meta Description:
Review SOA-C03 scenarios involving Systems Manager Parameter Store, Patch Manager, Session Manager, Automation, IAM access keys, and AWS OpsWorks Stacks.

Tags:
AWS Systems Manager, AWS OpsWorks, Parameter Store, Patch Manager, Session Manager, AWS Config, Systems Manager Automation, IAM access keys, CloudFormation, EC2, Chef, SOA-C03