Set the Systems Manager default EC2 instance management role so new instances are managed automatically

Why the Answer Is Correct

The fleet consists of Amazon Linux instances that already have SSM Agent installed and use IMDSv2, so the only remaining requirement for Systems Manager management is an IAM instance profile whose permissions allow Systems Manager to manage the instance. AWS Systems Manager provides a default EC2 instance management role that is attached automatically to EC2 instances when they are created, and an administrator configures it by creating an IAM role whose trust policy allows Systems Manager to assume it, attaching the AmazonSSMManagedEC2InstanceDefaultPolicy managed policy to that role, and then setting the default-ec2-instance-management-role Systems Manager service setting to that role (A). Once configured, every instance created afterward receives the role automatically and is managed by Systems Manager from the moment it comes up, with no per-instance action, no scheduled evaluation, and no remediation run. Ky_24 explained exactly this automatic role association, and Srikantha noted that setting the default-ec2-instance-management-role service setting means new instances automatically assume the correct role for seamless Systems Manager management. A is the correct answer.

Why the Other Options Are Wrong

B ensures AWS Config is set up, creates a Config rule validating that an EC2 instance has SSM Agent installed, runs it on configuration changes, and configures automatic remediation running AWS-InstallSSMAgent. Two problems exist. The agent is already installed on these Amazon Linux instances, so validating and installing it addresses nothing; the actual gap is the instance profile. And because the mechanism is a Config rule with remediation, it is reactive: a newly created instance is unmanaged until the configuration change is evaluated and remediation runs, which fails the requirement that instances be managed automatically after creation. C configures Systems Manager Patch Manager with a patch baseline, a patch group for all instances, and a maintenance window with a task that installs SSM Agent daily. A daily maintenance window means a newly created instance could remain unmanaged for up to a day, and Patch Manager is a patching mechanism rather than a mechanism for granting instance profile permissions. D creates an EC2 instance role trusting Amazon EC2 with AmazonSSMManagedInstanceCore attached, then uses a Config rule, ec2-instance-profile-attached, with the AWS-SetupManagedRoleOnEc2Instance document as remediation. Although the role and policy are appropriate, attaching the role through Config remediation is reactive, so the instance exists without the role until the rule evaluates; the requirement is that instances be managed automatically after creation. A is correct.

Community Comment Notes

Community voted A unanimously. Srikantha explained that by setting the default-ec2-instance-management-role service setting, new EC2 instances automatically assume the correct role, allowing seamless management by AWS Systems Manager. Ky_24 described the default instance management role being automatically attached to new EC2 instances upon creation. ArunRav made the decisive supporting observation that Amazon Linux already has the agent installed, so option A's remaining steps are what complete Systems Manager management. No alternative received support.