Grant EventBridge permission to run commands on the EKS worker nodes and target a State Manager association by node tags
A company uses an Amazon Elastic Kubernetes Service (Amazon EKS) cluster to host its machine learning (ML) application. As the ML model and the container image size grow, the time that new pods take to start up has increased to several minutes. A DevOps engineer needs to reduce the startup time to seconds. The solution must also reduce the startup time to seconds when the pod runs on nodes that were recently added to the cluster. The DevOps engineer creates an Amazon EventBridge rule that invokes an automation in AWS Systems Manager. The automation prefetches the container images from an Amazon Elastic Container Registry (Amazon ECR) repository when new images are pushed to the repository. The DevOps engineer also configures tags to be applied to the cluster and the node groups. What should the DevOps engineer do next to meet the requirements?
Community Votes
100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The control plane is fully managed by AWS and does not run the application containers, so prefetching images there would not warm the images the pods need (C rather than A or D). Matching on the nodes' tags, which the engineer has already configured, is what makes the association automatically cover nodes added later, satisfying the second requirement, whereas machine size (B) is neither a practical nor a flexible way to decide which images belong on which nodes. The IAM role must permit EventBridge to invoke Systems Manager on the nodes, not on the control plane.
Image prefetching must happen on the worker nodes that run the containers, and it must also apply to nodes added later, which means the automation has to be triggered by something that scales with the cluster. The tags already applied to the cluster and node groups become the targeting mechanism: an IAM role allows EventBridge to use Systems Manager to run commands in the EKS cluster's nodes, and a State Manager association keyed on the nodes' tags applies the prefetch automation to whichever nodes carry those tags, including newly added ones.
Running commands in the EKS cluster's control plane nodes (A and D) — the control plane is managed by AWS and does not run application containers, so prefetching container images there does not put the images on the nodes where pods actually start; trungtd and youonebe both identified this. Using the nodes' machine size as the association targeting criteria (B) — instance type does not determine which images a node should hold, so the association would prefetch the wrong images on the wrong nodes and would not be extensible. The tags already configured on the cluster and node groups are the intended selector.
Community Discussion (4 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Two requirements shape the answer: the prefetch must warm images where the pods actually run, and it must keep working for nodes added to the cluster later. Because the control plane in Amazon EKS is fully managed by AWS and does not run the application containers, the automation must run in the cluster's worker nodes, so the IAM role is created to allow EventBridge to use Systems Manager to run commands in the nodes rather than the control plane, eliminating options A and D. The State Manager association then uses the nodes' tags, which the engineer has already configured on the cluster and node groups, as its targeting criteria. Tag-based targeting is what makes the association apply automatically to nodes that join the cluster in the future, satisfying the second requirement, whereas machine size as a criterion, as in option B, is neither a practical nor a flexible way to decide which images belong on which nodes (C). C is the correct answer.Why the Other Options Are Wrong
A creates the role allowing EventBridge to run commands in the control plane nodes and creates a State Manager association using the control plane nodes' tags to prefetch images. The EKS control plane is managed by AWS and does not run application containers, so images prefetched there are never used for pod startup; trungtd and youonebe both stated this directly. D has the same control-plane flaw while additionally using the nodes' tags for targeting, which is inconsistent because the association is scoped to the control plane where the prefetch has no effect. B creates the role allowing commands in the nodes, which is correct, but targets the association on the nodes' machine size. Instance type has no relationship to which container images a node needs, so the association would prefetch the wrong images and would not scale as node types are mixed; trungtd rejected this on exactly the grounds that machine size is not a practical or flexible approach. C is correct.Community Comment Notes
Community voted C unanimously. trungtd gave the two decisive reasons, that the control plane manages the cluster but does not run the application containers which eliminates A and D, and that machine size is not a practical or flexible approach for determining where images should be prefetched. youonebe noted the control plane is fully managed by AWS. getadroit cited the AWS Containers Blog post on starting pods faster by prefetching images, which describes exactly this tag-based State Manager design. No alternative received support.Official Reference
Related Analysis
Practice All DOP-C02 Questions
Access 85 questions with complete answers and detailed explanations.
View Full DOP-C02 Practice Test →