AWS Systems Manager Patching with ALB IP Target Groups

SAA-C03 By islever Editorial Last updated

Design secure workloads and applications.

Short answer

CD Implement the AWS-EC2-PatchLoadBalancerInstance Automation document and use Maintenance Windows to remove instances from service.

Question

A company uses AWS Systems Manager for routine management and patching of Amazon EC2 instances. The EC2 instances are in an IP address type target group behind an Application Load Balancer (ALB). New security protocols require the company to remove EC2 instances from service during a patch. When the company attempts to follow the security protocol during the next patch, the company receives errors during the patching window. Which combination of solutions will resolve the errors? (Choose two.)
  1. Change the target type of the target group from IP address type to instance type.
  2. Continue to use the existing Systems Manager document without changes because it is already optimized to handle instances that are in an IP address type target group behind an ALB.
  3. Implement the AWSEC2-PatchLoadBalanacerInstance Systems Manager Automation document to manage the patching process. Correct Answer
  4. Use Systems Manager Maintenance Windows to automatically remove the instances from service to patch the instances. Correct Answer
  5. Configure Systems Manager State Manager to remove the instances from service and manage the patching schedule. Use ALB health checks to re-route traffic.

Key Takeaways

Tests the ability to integrate Systems Manager with ALB deregistration; the trap is assuming standard patching works without explicit traffic removal for IP-based targets.

Resolves errors when patching EC2 instances behind an Application Load Balancer using IP-based target groups by leveraging specific Automation documents and Maintenance Windows.

Common mistake: Candidates often select changing the target type (A) or assume existing documents work out-of-the-box (B), ignoring that IP targets bypass instance-level deregistration logic.

Expert Analysis

Why the Answer Is Correct

The correct options are C and D. Because the target group uses IP addresses, the ALB routes traffic based on IP, not the EC2 instance ID. Standard Systems Manager patching does not automatically deregister IPs from the target group, causing errors if the instance is stopped/patched while still registered. Option C is correct because the 'AWS-EC2-PatchLoadBalancerInstance' Automation document explicitly handles deregistering instances from a Load Balancer before patching and re-registering them after. Option D is correct because Maintenance Windows allow you to define execution roles and schedules, and when combined with the appropriate Automation document or scripts, they can orchestrate the safe removal of instances from service.

Why the Other Options Are Wrong

Option A is incorrect because changing the target type to 'instance' is a structural change to the architecture, not a fix for the patching process itself, and may not be feasible or desired. Option B is incorrect because the existing generic document is not optimized for this specific scenario involving IP-based target groups and requires modification or replacement. Option E is incorrect because State Manager is designed for maintaining state (compliance) rather than performing operational tasks like patching and load balancer deregistration; it does not handle the dynamic deregistration required here.

Community Comment Notes

Community consensus strongly supports CD, noting that the errors stem from instances being patched while still active in the target group. As LeonSauveterre noted, "The errors occur because the company is trying to patch instances that are still actively serving traffic." Another commenter, JoeAWS, initially suggested AC but was corrected, highlighting that simply changing the target type doesn't solve the immediate patching workflow error without the proper automation tool.

Official Reference

https://docs.aws.amazon.com/systems-manager-automation-runbooks/latest/userguide/automation-awsec2-patch-load-balancer-instance.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

Always check the target group type (IP vs Instance) when dealing with Load Balancers and Systems Manager. If it's IP-based, you need explicit deregistration logic, which is provided by specific Automation documents, not just standard maintenance windows.

Frequently Asked Questions

Why doesn't the default Systems Manager patch document work?

It doesn't know about the ALB IP target group registration, so it patches the instance while traffic is still routed to its IP.

Can I just change the target group to Instance type?

While possible, it changes your architecture. The question asks to resolve errors within the current setup, making Automation the direct fix.

More SAA-C03 FAQ →

Community Votes

CD
100%

100% of anonymous learners picked answer CD. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 5 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 5

  1. bujuman 👍 3
    https://docs.aws.amazon.com/systems-manager-automation-runbooks/latest/userguide/automation-awsec2-patch-load-balancer-instance.html
  2. LeonSauveterre 👍 2
    YOU SHOULD KNOW: The errors occur because the company is trying to patch instances that are still actively serving traffic. A - Unnecessary when existing tools can handle the issue. B - The existing document is not optimized for instances in an IP address type target group, so errors would persist. C - This document automates the process of deregistering instances from the ALB during patching and re-registering them afterward, ensuring no traffic is routed to the instances while they are being patched. It directly addresses the issue and adheres to best practices. D - Maintenance Windows allow you to define a schedule for patching and ensure instances are temporarily removed from service during the process. E - This alone can't de-register and re-register instances.
  3. JoeAWS 👍 1
    The document deregisters instances from target group. Since they are using IP address type, it won't prevent traffic from reaching the server. Need to work choice A into the answer.
  4. EllenLiu 👍 1
    https://docs.aws.amazon.com/systems-manager/latest/userguide/state-manager-vs-maintenance-windows.html
  5. aragon_saa 👍 3
    Answe is CD

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide