How to Automatically Install Auditing Software on All EC2 Instances Across Regions?

Automate the management of existing resources. Provision and maintain cloud resources.

Answer Correct answer: A — Deploy a Distributor package via State Manager associations in every Region so all existing and new managed EC2 instances receive the auditing software.

A company runs multiple Amazon EC2 instances that are distributed across multiple AWS Regions. The company uses AWS Systems Manager tools to manage the EC2 instances. The company needs to deploy an auditing software package onto every instance to record user logins and any actions that users take. A CloudOps engineer must implement a solution that automatically installs the auditing software on all existing EC2 instances. The solution also must automatically install the auditing software on any new EC2 instances when they are launched. Which solution will meet these requirements?

Create a Systems Manager Distributor package that includes the auditing software. Store the package in an Amazon S3 bucket. Create a Systems Manager State Manager association in each Region to install the software package on all managed instances in the company's AWS account. Correct Answer
Load the installer for the auditing software into an Amazon S3 bucket. Connect to every instance by using Systems Manager Fleet Manager Remote Desktop. Download the installer by using the AWS CLI. Run the installer manually.
Create an AWS Lambda function that calls the software installer. Merge the auditing software into the Lambda function by using Lambda layers. Run the Lambda function from each instance by using a scheduled Amazon EventBridge rule.
Create an Amazon EventBridge rule to react to Amazon EC2 RunInstances events. Configure the rule to modify the events to include a step that runs the software installer. Reboot all the instances.

Community Insight

It tests whether you know State Manager associations continuously enforce a desired software state on managed instances, and the trap is treating a one-time manual install or an EventBridge reaction as sufficient for new instances.

This scenario tests automated software deployment across multi-Region EC2 fleets using Systems Manager Distributor and State Manager associations. The correct solution packages the auditing software once and applies a State Manager association in each Region so existing and newly launched managed instances receive it.

Choosing option D because EventBridge reacts to RunInstances, but the rule cannot inject an installer step into the instance launch or reboot, and it does not cover existing instances.

Community Discussion (1 comments)

Bad_Mat 👍 1 Selected: A

A is the correct answer: Create a Systems Manager Distributor package that includes the auditing software, store it in an Amazon S3 bucket, and create a Systems Manager State Manager association in each Region

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

Option A uses AWS Systems Manager Distributor to package and publish the auditing software, then uses a State Manager association in each Region to install that package on all managed instances. State Manager is designed to maintain a desired state, so the association applies to existing managed instances and to new EC2 instances once they are registered with Systems Manager. Because Systems Manager associations are Regional, creating the association in each Region is necessary for a multi-Region fleet. This combination directly satisfies the requirement to install the software automatically on both existing and future instances.

Why the Other Options Are Wrong

Option B relies on manual Fleet Manager Remote Desktop sessions, CLI downloads, and manual installer execution, so it is neither automated nor reliable for new instances. Option C misuses Lambda layers as an EC2 software delivery mechanism and schedules a Lambda function from each instance, which does not provide a managed desired-state deployment. Option D reacts to RunInstances events, but an EventBridge rule cannot modify the launch event to insert a step that runs an installer on the instance, and rebooting instances does not install the auditing software.

Community Comment Notes

Bad_Mat's comment aligns with the correct reasoning, stating "A is the correct answer" and describing the Distributor package plus a State Manager association in each Region. That note captures the key architecture: package the software with Distributor and enforce installation through State Manager across managed instances. No other community objection changes the conclusion that option A is the only automated, persistent solution.

Official Reference

Exam Strategy

When a requirement says "existing and any new instances," favor a persistent desired-state mechanism such as a State Manager association over one-time scripts or launch-event reactions. Check that the chosen option also works across Regions by creating the association in each Region.

Frequently Asked Questions

Why doesn't an EventBridge RunInstances rule install the auditing software?

EventBridge can react to RunInstances events, but it cannot inject an installer step into the instance launch or reboot the instance to install software. It also does not cover existing instances automatically.

Why are State Manager associations needed in each Region?

Systems Manager associations are Regional resources, so each Region needs its own association to target managed instances there. A single association does not automatically span all Regions.

More SOA-C03 FAQ →

Related Analysis

Practice All SOA-C03 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SOA-C03 Practice Test →

← Back to SOA-C03 Study Guide