AWS Systems Manager Default Host Configuration Management

SAA-C03 By islever Editorial Last updated

Design secure access to AWS resources.

Short answer

C Enable Default Host Configuration Management in Systems Manager to automatically manage EC2 instances and apply patches.

Question

A company has applications that run on Amazon EC2 instances. The EC2 instances connect to Amazon RDS databases by using an IAM role that has associated policies. The company wants to use AWS Systems Manager to patch the EC2 instances without disrupting the running applications. Which solution will meet these requirements?
  1. Create a new IAM role. Attach the AmazonSSMManagedInstanceCore policy to the new IAM role. Attach the new IAM role to the EC2 instances and the existing IAM role.
  2. Create an IAM user. Attach the AmazonSSMManagedInstanceCore policy to the IAM user. Configure Systems Manager to use the IAM user to manage the EC2 instances.
  3. Enable Default Host Configuration Management in Systems Manager to manage the EC2 instances. Correct Answer
  4. Remove the existing policies from the existing IAM role. Add the AmazonSSMManagedInstanceCore policy to the existing IAM role.

Key Takeaways

The question tests knowledge of automated managed instance registration; the trap is assuming manual IAM role configuration (Option A) is required when the service offers a built-in automation feature.

Default Host Configuration Management in AWS Systems Manager automates the creation and attachment of an IAM role, allowing SSM to manage EC2 instances without manual intervention or disruption to existing workloads.

Common mistake: Many learners choose Option A, believing they must manually attach permissions to the existing role. This ignores that EC2 instances can only have one IAM role attached at a time, making Option A technically impossible for adding a second role.

Expert Analysis

Why the Answer Is Correct

Default Host Configuration Management (DHCM) automatically creates and attaches an IAM instance profile to new or existing EC2 instances in a Region, enabling Systems Manager to manage them as 'managed instances' without manual setup. As noted by user jaswantn, DHCM "creates and applies a default IAM role to ensure that Systems Manager has permissions to manage all instances... and perform automated patch scans." This meets the requirement of patching without disrupting the application's existing connectivity to RDS via its current IAM role.

Why the Other Options Are Wrong

Option A is invalid because an EC2 instance can only have one IAM role attached at a time; you cannot attach both the existing role and a new SSM role simultaneously. Option B is incorrect because Systems Manager manages instances through their attached IAM roles, not IAM users. Option D would break the application's access to RDS by removing the policies required for that connection.

Community Comment Notes

Community consensus strongly favors C. User LeonSauveterre correctly identified the technical constraint: "A - EC2 instances can have only one IAM role attached at a time." Several users, including MatAlves and FlyingHawk, cited official documentation confirming that DHCM eliminates the need for manual IAM role creation, reducing operational overhead.

Official Reference

https://docs.aws.amazon.com/systems-manager/latest/userguide/setup-instance-permissions.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

When asked about managing EC2 instances with Systems Manager, look for 'Managed Instances' or 'Host Configuration'. If the question emphasizes minimal administrative effort or avoiding manual IAM setup, Default Host Configuration Management is often the correct automated solution.

Frequently Asked Questions

Why can't I attach two IAM roles to one EC2 instance?

AWS restricts each EC2 instance to a single IAM role/instance profile at any given time. To add permissions, you must replace the role or use a feature like DHCM that handles this automatically.

Does Default Host Configuration affect existing instances?

Yes, when enabled, it automatically registers existing unmanaged EC2 instances in the region as managed instances and attaches the necessary IAM role.

More SAA-C03 FAQ →

Community Votes

C
79%
A
21%

79% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 11 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 11

  1. jaswantn 👍 12
    option C....Default Host Management Configuration creates and applies a default IAM role to ensure that Systems Manager has permissions to manage all instances in the Region and perform automated patch scans using Patch Manager.
  2. MatAlves 👍 3 Answered C
    "The Default Host Management Configuration setting allows AWS Systems Manager to manage your Amazon EC2 instances automatically as managed instances. Default Host Management Configuration makes it possible to manage EC2 instances without your having to manually create an AWS Identity and Access Management (IAM) instance profile. Instead, Default Host Management Configuration creates and applies a default IAM role to ensure that Systems Manager has permissions to manage all instances in the AWS account and AWS Region where it's activated."
  3. NayeraB 👍 2
    So is C same as A, but automated?
  4. LeonSauveterre 👍 1 Answered C
    Well.. Actually I don't know what to choose. A or C ?? A - EC2 instances can have only one IAM role attached at a time. Whether attaching multiple roles is possible or not depends on whether AWS allows such configuration in your environment. B - Systems Manager manages EC2 instances through the instance's attached IAM role, not an IAM user. C - It doesn't address the core requirement of maintaining the existing RDS connectivity. It still requires the EC2 instances to have the necessary IAM permissions to be managed by SSM. The IAM role associated with the EC2 instance must still have the AmazonSSMManagedInstanceCore policy attached to enable Systems Manager capabilities. D - Removing the existing policies would break the application's ability to connect to the RDS database. This directly contradicts the requirement of not disrupting running applications.
  5. rosanna 👍 1 Answered A
    I'd vote for A because the request here is not to disrupt the existing workload, meaning the existing IAM role must be intact with the addition to the new permission set that gives SSM patch manager patching capabilities.
Show 6 more comments
  1. FlyingHawk 👍 1 Answered C
    https://docs.aws.amazon.com/systems-manager/latest/userguide/setup-instance-permissions.html, DHMC eliminates the need to manually create and attach a new IAM role for Systems Manager, reducing operational overhead.
  2. Pics00094 👍 6 Answered C
    C is the answer
  3. Andy_09 👍 3
    C is a better option
  4. Andy_09 👍 3
    Correct answer A
  5. 88f8032 👍 2 Answered A
    i think A
  6. osmk 👍 2
    C is fine

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide