How to Automatically Install Auditing Software on All EC2 Instances Across Regions?
Short answer
A Deploy a Distributor package via State Manager associations in every Region so all existing and new managed EC2 instances receive the auditing software.
Question
A CloudOps engineer must implement a solution that automatically installs the auditing software on all existing EC2 instances. The solution also must automatically install the auditing software on any new EC2 instances when they are launched.
Which solution will meet these requirements?
Key Takeaways
It tests whether you know State Manager associations continuously enforce a desired software state on managed instances, and the trap is treating a one-time manual install or an EventBridge reaction as sufficient for new instances.
This scenario tests automated software deployment across multi-Region EC2 fleets using Systems Manager Distributor and State Manager associations. The correct solution packages the auditing software once and applies a State Manager association in each Region so existing and newly launched managed instances receive it.
Common mistake: Choosing option D because EventBridge reacts to RunInstances, but the rule cannot inject an installer step into the instance launch or reboot, and it does not cover existing instances.
Expert Analysis
Why the Answer Is Correct
Option A uses AWS Systems Manager Distributor to package and publish the auditing software, then uses a State Manager association in each Region to install that package on all managed instances. State Manager is designed to maintain a desired state, so the association applies to existing managed instances and to new EC2 instances once they are registered with Systems Manager. Because Systems Manager associations are Regional, creating the association in each Region is necessary for a multi-Region fleet. This combination directly satisfies the requirement to install the software automatically on both existing and future instances.
Why the Other Options Are Wrong
Option B relies on manual Fleet Manager Remote Desktop sessions, CLI downloads, and manual installer execution, so it is neither automated nor reliable for new instances. Option C misuses Lambda layers as an EC2 software delivery mechanism and schedules a Lambda function from each instance, which does not provide a managed desired-state deployment. Option D reacts to RunInstances events, but an EventBridge rule cannot modify the launch event to insert a step that runs an installer on the instance, and rebooting instances does not install the auditing software.
Community Comment Notes
Bad_Mat's comment aligns with the correct reasoning, stating "A is the correct answer" and describing the Distributor package plus a State Manager association in each Region. That note captures the key architecture: package the software with Distributor and enforce installation through State Manager across managed instances. No other community objection changes the conclusion that option A is the only automated, persistent solution.
Official Reference
- https://docs.aws.amazon.com/systems-manager/latest/userguide/distributor.html
- https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-state-manager.html
These links open the official vendor documentation in a new tab.
Exam Strategy
When a requirement says "existing and any new instances," favor a persistent desired-state mechanism such as a State Manager association over one-time scripts or launch-event reactions. Check that the chosen option also works across Regions by creating the association in each Region.
Frequently Asked Questions
Why doesn't an EventBridge RunInstances rule install the auditing software?
Why are State Manager associations needed in each Region?
Discussion 1 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 1
-
Bad_Mat 👍 1 Answered AA is the correct answer: Create a Systems Manager Distributor package that includes the auditing software, store it in an Amazon S3 bucket, and create a Systems Manager State Manager association in each Region
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All SOA-C03 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SOA-C03 Practice Test →