[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"cheat-sheet---en":3,"domain-info---en":3,"topic-info----en":3,"prev-aws-certified-cloudops-engineer-associate-deployment-provisioning-automation-deployment-strategies-deploying-updates-to-live-workloads-en":4,"lesson-aws-certified-cloudops-engineer-associate-deployment-provisioning-automation-deployment-strategies-deploying-updates-to-live-workloads-en":589,"next-aws-certified-cloudops-engineer-associate-deployment-provisioning-automation-deployment-strategies-deploying-updates-to-live-workloads-en":605},null,{"locked":5,"reason":3,"meta":6,"item":19},false,{"title":7,"description":8,"isFree":9,"estimatedMinutes":10,"difficulty":11,"learningObjectives":12},"Choosing a Deployment Strategy","The five deployment strategies the exam expects you to tell apart: all at once, rolling, immutable, blue/green, and canary or linear traffic shifting. What each one costs in capacity, in time, and in exposed users, and why the data tier is the part none of them fix.",true,25,"intermediate",[13,14,15,16,17,18],"Explain the two questions (replace or rebuild, and how much traffic) that generate every deployment strategy","Compare all at once, rolling, immutable, blue/green, canary, and linear on capacity cost, exposure, and rollback speed","Calculate the capacity a rolling deployment leaves in service, and decide whether a fleet can absorb it","Distinguish blue/green from canary using the traffic mechanism rather than the environment count","Identify the database and session constraints that make an application unsafe to deploy with two versions live","Map exam keywords such as quick rollback, full capacity, and small percentage of traffic to the strategy they point at",{"id":20,"title":7,"body":21,"description":8,"difficulty":11,"estimatedMinutes":10,"extension":491,"infographics":492,"isFree":9,"learningObjectives":507,"meta":508,"navigation":9,"path":509,"quiz":510,"seo":586,"stem":587,"__hash__":588},"courses/courses/aws-certified-cloudops-engineer-associate/en/domains/03-deployment-provisioning-automation/04-deployment-strategies/01-deployment-strategies-overview.md",{"type":22,"value":23,"toc":477},"minimark",[24,28,31,36,39,46,52,55,60,64,72,75,78,82,85,88,101,104,107,114,117,121,124,130,136,139,195,198,202,205,211,217,220,223,230,234,364,367,371,374,406,413,417,420,426,429,435,441,444,448,471,474],[25,26,27],"p",{},"Twelve EC2 instances sit behind an Application Load Balancer. You have a new AMI that fixes a logging bug and, without knowing it, ships a database driver that leaks connections under load. In about 40 minutes, the pool will be exhausted and requests will start timing out.",[25,29,30],{},"Every deployment strategy in this lesson ships that same broken AMI. What they change is how many people are affected before you notice, and how long it takes to undo. That is the whole subject.",[32,33,35],"h2",{"id":34},"the-two-questions-behind-every-strategy","The two questions behind every strategy",[25,37,38],{},"Strip the vocabulary away and there are only 2 decisions.",[25,40,41,45],{},[42,43,44],"strong",{},"Do you change the servers you have, or build new ones?"," Changing what you have is cheap and leaves you nothing to fall back to. Building new ones costs a second set of capacity and gives you a known-good version still running while you evaluate the new one.",[25,47,48,51],{},[42,49,50],{},"When the new version is live, how much traffic reaches it at once?"," All of it, a growing fraction, or a fixed small slice you have chosen to risk.",[25,53,54],{},"Every named strategy is a specific answer to those 2 questions. Once you see that, the names stop being a list to memorize and start being coordinates.",[56,57],"infographic",{"alt":58,"slug":59},"Four charts compare how quickly each deployment strategy puts production traffic on the new version, from an instant jump for all at once to a small measured shelf for canary.","deployment-strategy-exposure-curves",[32,61,63],{"id":62},"all-at-once-the-strategy-you-get-for-free","All at once: the strategy you get for free",[25,65,66,67,71],{},"Stop the application everywhere, install the new version, start it. This is what a plain ",[68,69,70],"code",{},"yum update"," and a restart across a fleet does, and it is what you get by default when nobody configures anything.",[25,73,74],{},"It is the fastest and the cheapest. No extra instances, no traffic plumbing, no waiting for batches. For a nightly batch worker, a development environment, or a single-instance internal tool with an agreed maintenance window, it is the correct answer and everything else is overengineering.",[25,76,77],{},"The cost is that there is a window where nothing serves, and rollback is a second deployment. If your 12 instances take 4 minutes each to restart, undoing a bad release takes another 4 minutes of outage, on top of however long it took you to notice. Nothing about the strategy is designed to help you notice.",[32,79,81],{"id":80},"rolling-trade-deployment-time-for-availability","Rolling: trade deployment time for availability",[25,83,84],{},"Split the fleet into batches and update one batch at a time. Instances in the current batch are taken out of the load balancer, updated, health checked, and put back before the next batch starts.",[25,86,87],{},"Work the numbers on those 12 instances with a batch size of 25 percent:",[89,90,91,95,98],"ul",{},[92,93,94],"li",{},"Batch size is 3 instances, so there are 4 batches.",[92,96,97],{},"While a batch is out, 9 instances serve traffic. That is 75 percent capacity.",[92,99,100],{},"Total deployment time is roughly 4 times (update time plus health check time), so a deployment that takes 4 minutes per batch runs for 16 minutes instead of 4.",[25,102,103],{},"That 75 percent number is the design constraint, and it is where teams get hurt. If 12 instances are sized for peak, then 9 instances at peak are 25 percent short, and the deployment itself causes the latency spike. The batch size is not a convenience setting; it is a capacity decision that has to hold at your busiest hour, not your average one.",[25,105,106],{},"The fix, when you can pay for it, is to launch an extra batch first and terminate it at the end. You never drop below 100 percent serving capacity, you pay for 3 extra instances for 16 minutes, and the deployment takes one batch longer.",[25,108,109,110,113],{},"Now the part people underestimate. ",[42,111,112],{},"For most of a rolling deployment, both versions are serving live requests."," Instances in completed batches answer with the new version while pending batches answer with the old one, and the load balancer does not care which is which. It is tempting to read \"gradual\" as \"safe\", but gradual is exactly what creates the mixed window. If the new version writes a record shape the old version cannot parse, a rolling deployment does not reduce the damage, it extends the period during which the damage is possible.",[25,115,116],{},"Rollback matches the same shape: to undo, you roll the fleet again. There is no pointer to move, because the old version has been overwritten wherever the deployment has already reached.",[32,118,120],{"id":119},"immutable-and-bluegreen-build-first-switch-second","Immutable and blue/green: build first, switch second",[25,122,123],{},"The alternative is to stop touching running servers at all. Launch a complete new set from the new configuration, let it prove itself with health checks, and only then retire the originals.",[25,125,126,129],{},[42,127,128],{},"Immutable"," is this applied to one group of instances. If the new set never goes healthy, you terminate it and the original instances are untouched, because they were never modified. A failed immutable deployment costs you money and a wasted 20 minutes, and costs your users nothing.",[25,131,132,135],{},[42,133,134],{},"Blue/green"," is the same idea applied to a whole environment. Blue is production. Green is a full parallel copy running the new version: its own instances, its own target group, its own health checks. When green looks right, you move the traffic pointer from blue to green. Blue keeps running, idle, for as long as you want a rollback path.",[25,137,138],{},"The pointer is the entire trick, and its mechanism decides how fast you can undo:",[140,141,142,158],"table",{},[143,144,145],"thead",{},[146,147,148,152,155],"tr",{},[149,150,151],"th",{},"Pointer",[149,153,154],{},"Rollback speed",[149,156,157],{},"Catch",[159,160,161,173,184],"tbody",{},[146,162,163,167,170],{},[164,165,166],"td",{},"Load balancer listener rule or target group weight",[164,168,169],{},"Effective on the next request",[164,171,172],{},"Both environments must sit behind the same load balancer",[146,174,175,178,181],{},[164,176,177],{},"DNS record (Route 53 or a CNAME swap)",[164,179,180],{},"Bounded by TTL and resolver caching",[164,182,183],{},"Some clients keep resolving the old answer long past the TTL",[146,185,186,189,192],{},[164,187,188],{},"Alias or pointer inside the service (a Lambda alias, an ECS service revision)",[164,190,191],{},"Effective immediately",[164,193,194],{},"Scoped to that one service, not the environment",[25,196,197],{},"Because blue is still running, rollback is a pointer move rather than a rebuild, which is what \"fast rollback\" actually means in the exam's vocabulary. The bill is straightforward: for the length of the deployment window you are paying for 2 full environments.",[32,199,201],{"id":200},"canary-and-linear-a-dial-instead-of-a-switch","Canary and linear: a dial instead of a switch",[25,203,204],{},"Canary and linear are not different ways to build the new version. They assume you have already built it, exactly as blue/green does, and they change only the last step: instead of moving all traffic at once, you move a controlled fraction.",[25,206,207,210],{},[42,208,209],{},"Canary"," shifts in 2 increments. A small percentage, say 10 percent, goes to the new version. You hold there for a set time while you watch error rates and latency. If the numbers hold, the remaining 90 percent follows.",[25,212,213,216],{},[42,214,215],{},"Linear"," shifts in equal steps at equal intervals: 10 percent every 2 minutes until everything has moved.",[25,218,219],{},"What you buy is a measurement. Health checks tell you the process is listening on a port; a canary tells you real requests from real users are being answered correctly. The cost is that some users do meet the bug, by design, and the deployment now takes as long as your evaluation window.",[25,221,222],{},"Which means a canary is only worth running when 2 things are true: enough traffic reaches the canary slice to produce a readable signal, and you have decided in advance which metric and which threshold ends the deployment. A 1 percent canary on a service handling 20 requests per minute gives you about 3 requests to reason with. That is theater, not evidence.",[25,224,225,226,229],{},"Here is the boundary the exam probes. Blue/green and canary both run 2 environments, so counting environments does not tell them apart. ",[42,227,228],{},"Blue/green minimizes how long anyone is exposed to a bad version, by making the switch instant and reversible. Canary minimizes how many people are exposed, by holding most traffic back while you look."," One is a switch, the other is a dial.",[32,231,233],{"id":232},"the-comparison-that-matters","The comparison that matters",[140,235,236,255],{},[143,237,238],{},[146,239,240,243,246,249,252],{},[149,241,242],{},"Strategy",[149,244,245],{},"Extra capacity",[149,247,248],{},"Traffic on the new version before you have evidence",[149,250,251],{},"Rollback",[149,253,254],{},"Both versions live at once",[159,256,257,274,290,304,320,336,351],{},[146,258,259,262,265,268,271],{},[164,260,261],{},"All at once",[164,263,264],{},"None",[164,266,267],{},"100 percent, immediately",[164,269,270],{},"Deploy the old version again",[164,272,273],{},"No, an outage instead",[146,275,276,279,281,284,287],{},[164,277,278],{},"Rolling",[164,280,264],{},[164,282,283],{},"Rises one batch at a time",[164,285,286],{},"Roll the fleet again",[164,288,289],{},"Yes, for most of the deployment",[146,291,292,295,298,300,302],{},[164,293,294],{},"Rolling with an extra batch",[164,296,297],{},"One batch",[164,299,283],{},[164,301,286],{},[164,303,289],{},[146,305,306,308,311,314,317],{},[164,307,128],{},[164,309,310],{},"A full parallel set",[164,312,313],{},"0 percent until health checks pass, then 100 percent",[164,315,316],{},"Terminate the new set",[164,318,319],{},"Only at the handover",[146,321,322,324,327,330,333],{},[164,323,134],{},[164,325,326],{},"A full second environment",[164,328,329],{},"0 percent until the switch, then 100 percent",[164,331,332],{},"Move the pointer back",[164,334,335],{},"Only at the switch",[146,337,338,340,342,345,348],{},[164,339,209],{},[164,341,326],{},[164,343,344],{},"The canary percentage only",[164,346,347],{},"Shift the weight back",[164,349,350],{},"Yes, deliberately",[146,352,353,355,357,360,362],{},[164,354,215],{},[164,356,326],{},[164,358,359],{},"Grows one increment at a time",[164,361,347],{},[164,363,350],{},[25,365,366],{},"Read the table as a price list. Capacity is money. Exposure is user impact. Rollback speed is the time you spend serving a known-bad version. You are always paying with at least one of the three.",[32,368,370],{"id":369},"picking-one","Picking one",[25,372,373],{},"The decision is usually forced by a constraint rather than a preference, so start with the constraints:",[89,375,376,382,388,394,400],{},[92,377,378,381],{},[42,379,380],{},"A maintenance window is acceptable."," All at once. It is faster and cheaper, and the sophistication buys you nothing.",[92,383,384,387],{},[42,385,386],{},"No downtime allowed, no budget for extra capacity."," Rolling. Size the batch so the remaining fleet carries peak.",[92,389,390,393],{},[42,391,392],{},"Full capacity required throughout, some budget available."," Rolling with an extra batch, or immutable.",[92,395,396,399],{},[42,397,398],{},"Rollback must be measured in seconds."," Blue/green, or its traffic-shifted variants. Nothing that rebuilds capacity can meet that bar.",[92,401,402,405],{},[42,403,404],{},"You need evidence from real traffic before committing."," Canary or linear, with a named metric and a threshold.",[25,407,408,409,412],{},"One constraint overrides all of these: ",[42,410,411],{},"can 2 versions of the application run at the same time?"," If they cannot, rolling, canary, and linear are all off the table regardless of budget, and you are choosing between a maintenance window and a blue/green switch.",[32,414,416],{"id":415},"the-part-none-of-them-solve","The part none of them solve",[25,418,419],{},"Blue/green gets described as risk-free rollback, and for stateless application code that is close to true. The moment state enters, it stops being true, and this is where real incidents come from.",[25,421,422,425],{},[42,423,424],{},"The database is usually shared."," Green almost never gets its own copy of production data, because a copy would immediately be stale. So blue and green talk to the same database, and any schema change applies to both. Ship a migration that drops a column the old code reads, and the rollback path is gone: switching back to blue now means switching to code that cannot query its own database.",[25,427,428],{},"The discipline is to make schema changes backward compatible and separate them from the code that needs them. Add the new column and start writing to it while the old code ignores it. Deploy the code that reads it. Only after the new version is proven, in a later release, remove the old column. Slower, and it keeps the pointer meaningful.",[25,430,431,434],{},[42,432,433],{},"Data written during the window does not roll back."," If green serves for 10 minutes and writes 4,000 rows in a new format, moving the pointer to blue restores the old code and leaves those 4,000 rows exactly where they are. Traffic rollback is not data rollback.",[25,436,437,440],{},[42,438,439],{},"Session state has to live outside the instances."," A user halfway through a checkout on blue who lands on green needs their session to exist there. If sessions are held in instance memory, every one of these strategies drops customers mid-transaction, and the load balancer's stickiness settings only hide it until the instance goes away.",[25,442,443],{},"State the misconception plainly, because it survives most people's first blue/green: an instant traffic switch is not an instant undo. It undoes routing. It does not undo writes, migrations, cache contents, or messages already published to a queue.",[32,445,447],{"id":446},"exam-tips","Exam tips",[89,449,450,453,456,459,462,465,468],{},[92,451,452],{},"\"Quickest deployment\" or \"a short period of downtime is acceptable\" points at all at once. It is the right answer more often than candidates expect, because they read simple as wrong.",[92,454,455],{},"\"No downtime and no additional cost\" is rolling. Adding \"must maintain full capacity throughout\" is what turns it into rolling with an additional batch.",[92,457,458],{},"\"Roll back quickly\" or \"revert immediately if there is a problem\" means the old version must still be running: blue/green, or a weighted traffic shift. Any answer that redeploys the previous version is describing a slow rollback.",[92,460,461],{},"\"Test with a small percentage of production traffic\" is canary. \"Shift traffic in equal increments over equal intervals\" is linear. The distinguishing words are percentage and increments, not the number of environments.",[92,463,464],{},"A scenario that mentions a DNS or CNAME swap and then complains that some users still reach the old version is testing TTL and resolver caching, not a service failure.",[92,466,467],{},"Watch for a database detail buried in a blue/green question. A schema migration in the same release is the trap, and the correct answer is usually to make the change backward compatible or to run it as a separate earlier step.",[92,469,470],{},"An immutable deployment that fails leaves the original instances serving. A rolling deployment that fails leaves you with a mix of versions. Questions about the state after a failure are testing exactly that difference.",[25,472,473],{},"Carry one sentence out of this lesson: the strategy you pick is a statement about what you are willing to spend to shorten the gap between shipping a bad version and being able to undo it. You pay in money (a second environment), in time (a slower rollout), or in users (someone meets the bug). There is no option that pays nothing.",[25,475,476],{},"The next lesson turns each of these shapes into the specific AWS setting that produces it, which is where the exam actually lives: instance refresh percentages, CloudFormation update policies, ECS deployment strategies, Lambda aliases, and managed blue/green for RDS.",{"title":478,"searchDepth":479,"depth":479,"links":480},"",3,[481,483,484,485,486,487,488,489,490],{"id":34,"depth":482,"text":35},2,{"id":62,"depth":482,"text":63},{"id":80,"depth":482,"text":81},{"id":119,"depth":482,"text":120},{"id":200,"depth":482,"text":201},{"id":232,"depth":482,"text":233},{"id":369,"depth":482,"text":370},{"id":415,"depth":482,"text":416},{"id":446,"depth":482,"text":447},"md",[493],{"slug":59,"concept":494,"style":495,"aspectRatio":496,"labels":497},"Four small line charts arranged in a 2x2 grid, all sharing the same axes: the horizontal axis is time from the start of a deployment to its end, and the vertical axis is the share of production traffic served by the new version, from 0 to 100 percent. All at once is a single vertical jump at the far left. Rolling is a staircase climbing in equal steps across the full width. Blue/green stays flat on zero for most of the width and then jumps vertically once, near the right. Canary is a low flat shelf, then one jump to the top. The emphasis is on the shape of each curve and on how much area sits under it before the team has any evidence the new version is good, and a footer line states the shared tradeoff.","comparison","16:9",[498,499,500,501,502,503,504,505,506],"Time","Share of production traffic on the new version","0%","100%","All at once: 100% from the first second, nothing held back","Rolling: climbs one batch at a time, both versions live throughout","Blue/green: 0% while green is built and checked, then a single switch","Canary: a small shelf you can measure, then the rest","The flatter the curve stays early, the fewer users meet the bug before you can undo it.",[13,14,15,16,17,18],{},"/courses/aws-certified-cloudops-engineer-associate/en/domains/03-deployment-provisioning-automation/04-deployment-strategies/01-deployment-strategies-overview",{"passingScore":511,"questions":512},70,[513,522,530,540,546,554,562,570,578],{"question":514,"type":515,"options":516,"correctAnswer":518,"explanation":521},"A 12-instance fleet is deployed with a rolling strategy using a batch size of 25 percent. What is the lowest serving capacity during the deployment, and what does that require of the fleet?","single",[517,518,519,520],"100 percent, because rolling deployments never remove capacity","75 percent, so the remaining 9 instances must be able to carry peak traffic","50 percent, because half the fleet is always in the old version","25 percent, because only the current batch serves traffic","A batch of 3 instances leaves 9 of 12 in service, which is 75 percent of the fleet. Rolling deployments trade capacity for the absence of a maintenance window, so the strategy is only safe if the reduced fleet can still serve your peak load. The version that keeps full capacity launches an extra batch first, which costs one batch of instances for the length of the deployment.",{"question":523,"type":515,"options":524,"correctAnswer":527,"explanation":529},"Which statement best captures the difference between a blue/green deployment and a canary deployment?",[525,526,527,528],"Blue/green runs two environments and canary runs one","Blue/green is for containers and canary is for virtual machines","Blue/green switches all traffic at one moment, while canary sends a measured percentage first","Canary requires a load balancer and blue/green does not","Both build a second environment, so counting environments does not separate them. The real difference is the traffic mechanism: blue/green is a switch and canary is a dial, which is why canary needs a metric and an evaluation window to be worth anything. Answers that name a compute platform are wrong because every strategy here works on instances, containers, and functions.",{"question":531,"type":532,"options":533,"correctAnswers":538,"explanation":539},"An operations team wants the fastest possible rollback for a customer-facing API. Which two mechanisms give rollback measured in seconds? (Choose 2.)","multiple",[534,535,536,537],"Moving a load balancer listener rule back to the original target group","Redeploying the previous application version to the existing instances","Shifting the traffic weight back to the version that was already serving","Rolling the fleet again with the previous launch template",[534,536],"Rollback is fast only when the old version is still running and you are moving a pointer, which is exactly what a listener rule change or a weight change does. The two wrong answers both rebuild capacity, so undoing takes as long as deploying did, and during that time the broken version is still serving requests.",{"question":541,"type":515,"options":542,"correctAnswer":544,"explanation":545},"True or False: a rolling deployment guarantees that only one version of the application is serving requests at any moment.",[543,544],"True","False","A rolling deployment is defined by the fact that completed batches run the new version while pending batches still run the old one, so both are live for most of the deployment. This matters when the two versions disagree about a data format or an API contract, because the mixed window is when those disagreements produce corrupt records.",{"question":547,"type":515,"options":548,"correctAnswer":552,"explanation":553},"A team performs a blue/green switch by changing a Route 53 record from the blue environment to the green one. Ten minutes after the switch they see errors and revert the record, but a portion of users keeps hitting green for another hour. What explains this?",[549,550,551,552],"Route 53 health checks are still failing over to green","The green environment must be terminated before traffic returns to blue","Route 53 propagates record changes on a fixed 60-minute schedule","Resolvers and clients cached the record, so they keep using it until the TTL expires","DNS-based switching is not instant in either direction, because recursive resolvers and application runtimes hold the answer for the record's TTL and some ignore it entirely. That is why you lower the TTL well before a planned switch and never terminate the old environment the moment the record changes.",{"question":555,"type":515,"options":556,"correctAnswer":557,"explanation":561},"An application ships a release that adds a NOT NULL column and drops an old one in the same migration, then deploys the code with a blue/green switch. Why is the promised instant rollback no longer real?",[557,558,559,560],"The blue environment can no longer read the migrated schema, so switching back breaks it","Blue/green deployments cannot be used with a relational database","The switch cannot be reversed once the green environment has served a request","The migration locks the pointer until it finishes","Blue and green normally share one database, so a destructive migration changes the state that both versions depend on, and the old code stops working against it. The fix is to make schema changes backward compatible and ship them ahead of the code: add first, migrate, and only remove the old column after the new version is proven.",{"question":563,"type":515,"options":564,"correctAnswer":567,"explanation":569},"A workload runs 4 instances at steady state and the business will not pay for extra capacity during deployments, but it also cannot take a maintenance window. Which strategy fits?",[565,566,567,568],"Blue/green, because it has the fastest rollback","Canary, because it exposes only a small percentage of users","Rolling, accepting reduced capacity and a slower rollback","All at once, because 4 instances restart quickly","Blue/green and canary both need a second set of instances running at the same time, which the cost constraint rules out, and all at once accepts an outage, which the availability constraint rules out. Rolling is the only strategy that keeps serving without extra capacity, and the price you pay is the dip in capacity plus a rollback that takes another full pass over the fleet.",{"question":571,"type":515,"options":572,"correctAnswer":574,"explanation":577},"Which statement about a canary deployment is correct?",[573,574,575,576],"A canary automatically rolls back when any error appears in the logs","A canary percentage is only useful if enough traffic reaches it to produce a readable signal","A canary shifts traffic in equal increments at equal intervals","A canary replaces the old version in place on a subset of servers","A canary buys you a measurement, so 1 percent of a service that gets 20 requests a minute tells you nothing before the evaluation window ends. Equal increments at equal intervals describes a linear deployment, and rollback still depends on an alarm or a human deciding, not on error text appearing somewhere.",{"question":579,"type":515,"options":580,"correctAnswer":583,"explanation":585},"An immutable deployment fails because the new instances never pass their health checks. What is the state of the workload?",[581,582,583,584],"Half the fleet serves the new version and half serves the old one","The environment is down until an operator redeploys the previous version","The original instances are still serving, and the new ones are terminated","The new instances stay in service and are marked unhealthy","An immutable deployment builds a complete parallel set and only retires the originals once the new set is healthy, so a failure costs money and time but not availability. That is the property rolling deployments lack: a rolling failure leaves you stranded with some batches upgraded and some not.",{"title":7,"description":8},"courses/aws-certified-cloudops-engineer-associate/en/domains/03-deployment-provisioning-automation/04-deployment-strategies/01-deployment-strategies-overview","C3rqHBgf5bph7STlYeu2ISeuwDSx2xTq3_OuovjDmZA",{"locked":9,"reason":590,"meta":591,"item":3},"paywall",{"title":592,"description":593,"isFree":5,"estimatedMinutes":594,"difficulty":595,"learningObjectives":596},"Deploying Updates to Live Workloads","The AWS settings that produce each deployment strategy: Auto Scaling instance refresh percentages and rollback, the three CloudFormation update policies for an Auto Scaling group, ECS rolling and blue/green deployments with bake time and circuit breakers, Lambda weighted aliases, and managed RDS blue/green switchover.",32,"advanced",[597,598,599,600,601,602,603,604],"Predict how many instances an instance refresh replaces at a time from the minimum and maximum healthy percentages","Configure checkpoints, skip matching, and auto rollback on an instance refresh, and name the conditions that make rollback unavailable","Choose between the AutoScalingRollingUpdate, AutoScalingReplacingUpdate, and AutoScalingInstanceRefresh update policies","Calculate ECS rolling deployment task counts from minimumHealthyPercent and maximumPercent, and diagnose a deployment that cannot start or stop tasks","Explain how the ECS deployment circuit breaker counts failures and which deployment it rolls back to","Set up an ECS blue/green, linear, or canary deployment with bake time and lifecycle hooks","Shift Lambda traffic between versions with a weighted alias, and identify which version served a request","Describe an RDS blue/green switchover and what happens to the old environment",{"locked":5,"reason":3,"meta":606,"item":617},{"title":607,"description":608,"isFree":9,"estimatedMinutes":609,"difficulty":11,"learningObjectives":610},"Systems Manager Fleet Management","Manage a fleet through Systems Manager instead of SSH: the three conditions that make a node manageable, instance profiles versus Default Host Management Configuration, Session Manager, Run Command targeting and rate control, Fleet Manager and Inventory, and the diagnostic order for a node that never appears.",26,[611,612,613,614,615,616],"Name the three conditions a node must meet to appear as a Systems Manager managed node","Choose between an IAM instance profile and Default Host Management Configuration, and identify the setting that makes one override the other","Explain how Session Manager replaces SSH and bastion hosts, and where its session logging does not reach","Target a Run Command operation by instance ID, tag, or resource group, and predict its behavior from the concurrency and error threshold defaults","Describe what Fleet Manager and Inventory give you that the EC2 console does not","Diagnose a running instance that never appears in the managed node list, in the order that finds the cause fastest",{"id":618,"title":607,"body":619,"description":608,"difficulty":11,"estimatedMinutes":609,"extension":491,"infographics":1483,"isFree":9,"learningObjectives":1499,"meta":1500,"navigation":9,"path":1501,"quiz":1502,"seo":1562,"stem":1563,"__hash__":1564},"courses/courses/aws-certified-cloudops-engineer-associate/en/domains/03-deployment-provisioning-automation/05-operational-automation/01-systems-manager-fleet-management.md",{"type":22,"value":620,"toc":1474},[621,624,627,631,638,644,650,660,664,671,675,686,699,772,775,789,799,805,809,816,827,830,840,846,857,864,868,875,889,892,976,994,997,1023,1042,1154,1165,1169,1175,1185,1188,1195,1199,1202,1205,1224,1235,1238,1315,1326,1329,1413,1426,1428,1467,1470],[25,622,623],{},"You have 400 EC2 instances and a question that takes 10 seconds to answer on any one of them: which version of the agent is installed? The SSH answer costs you a bastion host, a key distribution problem, an inbound port on every security group, and a shell script wrapped around 400 hostnames with no record of what ran where. Systems Manager exists so that question costs one API call and produces an audit trail.",[25,625,626],{},"The previous topic ended with shipping a new version of your software. This topic is about the software already running: reaching it, keeping it consistent, and automating the parts of your week that are the same every week.",[32,628,630],{"id":629},"the-three-conditions-that-make-a-node-manageable","The three conditions that make a node manageable",[25,632,633,634,637],{},"Every Systems Manager tool in this domain (Session Manager, Run Command, Patch Manager, State Manager) works on ",[42,635,636],{},"managed nodes",", and nothing works until an instance becomes one. Three conditions must all hold.",[25,639,640,643],{},[42,641,642],{},"SSM Agent must be installed and running"," on a supported operating system. Most AWS-provided AMIs ship with it preinstalled, which is why this condition usually passes without you doing anything and why it is easy to forget when someone brings a custom image.",[25,645,646,649],{},[42,647,648],{},"The node must have credentials"," that let it call the Systems Manager API. On EC2 that means an IAM instance profile or the account-level alternative covered in the next section. On an on-premises server or VM it means an IAM service role and a hybrid activation.",[25,651,652,655,656,659],{},[42,653,654],{},"The agent must be able to reach a Systems Manager endpoint"," on port 443 to register itself. After registration, the service checks the node's health with a signal ",[42,657,658],{},"every 5 minutes",".",[56,661],{"alt":662,"slug":663},"Three sequential gates show that a node becomes a managed node only after the agent, its credentials, and its endpoint connectivity all pass, with the failure symptom listed under each gate.","ssm-managed-node-three-gates",[25,665,666,667,670],{},"Hold onto the order, because it is also the diagnostic order later in this lesson. Note the direction of the connection too: ",[42,668,669],{},"SSM Agent initiates every connection outbound."," You never open an inbound port for Systems Manager, which is the single fact that makes this whole toolset a security improvement over SSH rather than a convenience layer on top of it.",[32,672,674],{"id":673},"two-ways-to-give-an-instance-credentials","Two ways to give an instance credentials",[25,676,677,678,681,682,685],{},"The classic approach is an ",[42,679,680],{},"IAM instance profile"," carrying the ",[68,683,684],{},"AmazonSSMManagedInstanceCore"," managed policy. It is per instance, it is explicit, and it is what a question about a single misconfigured node almost always turns on.",[25,687,688,691,692,681,695,698],{},[42,689,690],{},"Default Host Management Configuration"," is the account-level alternative, and AWS recommends it where the use case allows. Turn it on and every instance in that account and Region that runs Instance Metadata Service Version 2 with SSM Agent 3.2.582.0 or later becomes a managed instance automatically, with no instance profile at all. It uses a service role named ",[68,693,694],{},"AWSSystemsManagerDefaultEC2InstanceManagementRole",[68,696,697],{},"AmazonSSMManagedEC2InstanceDefaultPolicy"," policy.",[140,700,701,712],{},[143,702,703],{},[146,704,705,707,710],{},[149,706],{},[149,708,709],{},"Instance profile",[149,711,690],{},[159,713,714,725,738,751,761],{},[146,715,716,719,722],{},[164,717,718],{},"Scope",[164,720,721],{},"One instance at a time",[164,723,724],{},"Every eligible instance in the account and Region",[146,726,727,730,733],{},[164,728,729],{},"Identity",[164,731,732],{},"A role you attach",[164,734,735,737],{},[68,736,694],{}," by default",[146,739,740,743,747],{},[164,741,742],{},"Policy",[164,744,745],{},[68,746,684],{},[164,748,749],{},[68,750,697],{},[146,752,753,756,758],{},[164,754,755],{},"IMDS requirement",[164,757,264],{},[164,759,760],{},"IMDSv2 only, IMDSv1 is not supported",[146,762,763,766,769],{},[164,764,765],{},"Turn on where",[164,767,768],{},"Per instance",[164,770,771],{},"Per Region, in each Region you want covered",[25,773,774],{},"Three details decide questions here.",[25,776,777,780,781,784,785,788],{},[42,778,779],{},"It is per Region."," Turning it on in ",[68,782,783],{},"eu-west-1"," does nothing for ",[68,786,787],{},"us-east-1",". Teams discover this when half their fleet is managed and half is not.",[25,790,791,794,795,798],{},[42,792,793],{},"An instance profile wins."," SSM Agent tries instance profile permissions before Default Host Management Configuration permissions, so an old instance profile that allows ",[68,796,797],{},"ssm:UpdateInstanceInformation"," keeps that instance on the old path and the account-level role never gets used. Before you turn the feature on, remove that permission from existing instance profiles.",[25,800,801,804],{},[42,802,803],{},"Propagation is not instant."," After you turn it on, instances can take up to 30 minutes to pick up the new role's credentials.",[32,806,808],{"id":807},"session-manager-a-shell-with-no-inbound-port","Session Manager: a shell with no inbound port",[25,810,811,812,815],{},"You need a shell on a production instance at 2 in the morning. ",[42,813,814],{},"Session Manager"," gives you one from the console or the CLI, with no open inbound port, no SSH key, and no bastion host.",[25,817,818,819,822,823,826],{},"The connection is a bidirectional channel between your client and SSM Agent. Traffic is encrypted with ",[42,820,821],{},"TLS 1.2",", requests to open the channel are signed with ",[42,824,825],{},"Sigv4",", and you can layer a KMS key on top to encrypt the session data beyond the default TLS encryption. Access is granted entirely through IAM policy, which is what makes \"give the on-call engineer production access for the length of their rotation\" a policy change rather than a key rotation exercise.",[25,828,829],{},"Two capabilities beyond an interactive shell are worth naming:",[25,831,832,835,836,839],{},[42,833,834],{},"Port forwarding"," redirects a port inside the node to a local port on your machine. A database listening on 5432 inside a private subnet becomes ",[68,837,838],{},"localhost:9999"," on your laptop, with no VPN and no public IP.",[25,841,842,845],{},[42,843,844],{},"Configurable shell profiles"," let you set the shell, environment variables, working directory, and startup commands for every session, which is how you make sessions land somewhere predictable.",[25,847,848,849,852,853,856],{},"For auditing, sessions can stream to a ",[42,850,851],{},"CloudWatch Logs log group"," or an ",[42,854,855],{},"S3 bucket",", with or without your own KMS key, and CloudTrail records the API calls that started them. An EventBridge rule on session start and end can push a notification to SNS.",[25,858,859,860,863],{},"Here is the misconception that survives most first readings of this feature. ",[42,861,862],{},"Session logging does not cover port forwarding or SSH sessions."," In those modes Session Manager is only a tunnel; SSH encrypts everything inside the TLS connection, so the service has nothing to record. If a scenario requires a transcript of commands, the answer involves interactive shell sessions, not port forwarding.",[32,865,867],{"id":866},"run-command-one-action-across-the-fleet","Run Command: one action across the fleet",[25,869,870,871,874],{},"Session Manager is for one node and a human. ",[42,872,873],{},"Run Command"," is for many nodes and one document, and it costs nothing extra.",[25,876,877,878,881,882,881,885,888],{},"You pick a Command-type SSM document (",[68,879,880],{},"AWS-RunShellScript",", ",[68,883,884],{},"AWS-RunPowerShellScript",[68,886,887],{},"AWS-RunPatchBaseline",", and so on), pick targets, and set the rate controls.",[25,890,891],{},"Targets come in four forms:",[893,894,898],"pre",{"className":895,"code":896,"language":897,"meta":478,"style":478},"language-bash shiki shiki-themes material-theme-lighter github-light github-dark","# by instance ID\n--targets Key=instanceids,Values=i-02573cafcfEXAMPLE,i-0471e04240EXAMPLE\n\n# by tag\n--targets Key=tag:Environment,Values=Production\n\n# by resource group name (maximum one per command)\n--targets Key=resource-groups:Name,Values=web-tier\n\n# by resource type inside resource groups (maximum five types)\n--targets Key=resource-groups:ResourceTypeFilters,Values=AWS::EC2::Instance\n","bash",[68,899,900,909,919,924,930,938,943,949,957,962,968],{"__ignoreMap":478},[901,902,905],"span",{"class":903,"line":904},"line",1,[901,906,908],{"class":907},"sutJx","# by instance ID\n",[901,910,911,915],{"class":903,"line":482},[901,912,914],{"class":913},"sbgvK","--targets",[901,916,918],{"class":917},"s_sjI"," Key=instanceids,Values=i-02573cafcfEXAMPLE,i-0471e04240EXAMPLE\n",[901,920,921],{"class":903,"line":479},[901,922,923],{"emptyLinePlaceholder":9},"\n",[901,925,927],{"class":903,"line":926},4,[901,928,929],{"class":907},"# by tag\n",[901,931,933,935],{"class":903,"line":932},5,[901,934,914],{"class":913},[901,936,937],{"class":917}," Key=tag:Environment,Values=Production\n",[901,939,941],{"class":903,"line":940},6,[901,942,923],{"emptyLinePlaceholder":9},[901,944,946],{"class":903,"line":945},7,[901,947,948],{"class":907},"# by resource group name (maximum one per command)\n",[901,950,952,954],{"class":903,"line":951},8,[901,953,914],{"class":913},[901,955,956],{"class":917}," Key=resource-groups:Name,Values=web-tier\n",[901,958,960],{"class":903,"line":959},9,[901,961,923],{"emptyLinePlaceholder":9},[901,963,965],{"class":903,"line":964},10,[901,966,967],{"class":907},"# by resource type inside resource groups (maximum five types)\n",[901,969,971,973],{"class":903,"line":970},11,[901,972,914],{"class":913},[901,974,975],{"class":917}," Key=resource-groups:ResourceTypeFilters,Values=AWS::EC2::Instance\n",[25,977,978,979,986,987,990,991,659],{},"Two rules about tag targeting decide questions. ",[42,980,981,982,985],{},"Multiple ",[68,983,984],{},"Key"," criteria are combined with AND",", so ",[68,988,989],{},"Key=tag:Department,Values=Finance Key=tag:ServerRole,Values=Database"," hits only nodes carrying both. And an array of targets holds ",[42,992,993],{},"a maximum of 5 keys with 5 values each",[25,995,996],{},"Now the rate controls, which are the same pair you met on Automation runbooks:",[89,998,999,1011],{},[92,1000,1001,1006,1007,1010],{},[42,1002,1003],{},[68,1004,1005],{},"--max-concurrency"," is how many nodes run the command at once, as a number or a percentage. ",[42,1008,1009],{},"The default is 50."," Delivery ramps up: the command goes to one node, waits for acknowledgement, then two more, then grows exponentially until it reaches the limit.",[92,1012,1013,1018,1019,1022],{},[42,1014,1015],{},[68,1016,1017],{},"--max-errors"," is how many failures are tolerated before Systems Manager stops sending to more nodes. ",[42,1020,1021],{},"The default is 0",", which means the first failure stops further dispatch.",[25,1024,1025,1026,1029,1030,1033,1034,1037,1038,1041],{},"Walk the arithmetic AWS gives for this. Send a command to 50 nodes with ",[68,1027,1028],{},"--max-errors 10%",": the threshold is 5, so the system stops sending when the ",[42,1031,1032],{},"sixth"," error arrives. Invocations already in flight are allowed to finish, and some of them may fail too. If a scenario demands that no more than N nodes ever fail, ",[68,1035,1036],{},"--max-errors N"," alone is not enough; you also need ",[68,1039,1040],{},"--max-concurrency 1"," so invocations proceed one at a time.",[893,1043,1045],{"className":895,"code":1044,"language":897,"meta":478,"style":478},"aws ssm send-command \\\n  --document-name \"AWS-RunShellScript\" \\\n  --targets Key=tag:Environment,Values=Production \\\n  --parameters 'commands=[\"systemctl restart nginx\"]' \\\n  --max-concurrency 10 \\\n  --max-errors 1 \\\n  --output-s3-bucket-name ops-command-output \\\n  --service-role-arn arn:aws:iam::111122223333:role/SSMRunCommandNotifications \\\n  --notification-config NotificationArn=arn:aws:sns:eu-west-1:111122223333:ops-alerts,NotificationEvents=Failed,NotificationType=Command\n",[68,1046,1047,1062,1079,1089,1105,1116,1126,1136,1146],{"__ignoreMap":478},[901,1048,1049,1052,1055,1058],{"class":903,"line":904},[901,1050,1051],{"class":913},"aws",[901,1053,1054],{"class":917}," ssm",[901,1056,1057],{"class":917}," send-command",[901,1059,1061],{"class":1060},"s_hVV"," \\\n",[901,1063,1064,1068,1072,1074,1077],{"class":903,"line":482},[901,1065,1067],{"class":1066},"stzsN","  --document-name",[901,1069,1071],{"class":1070},"sjJ54"," \"",[901,1073,880],{"class":917},[901,1075,1076],{"class":1070},"\"",[901,1078,1061],{"class":1060},[901,1080,1081,1084,1087],{"class":903,"line":479},[901,1082,1083],{"class":1066},"  --targets",[901,1085,1086],{"class":917}," Key=tag:Environment,Values=Production",[901,1088,1061],{"class":1060},[901,1090,1091,1094,1097,1100,1103],{"class":903,"line":926},[901,1092,1093],{"class":1066},"  --parameters",[901,1095,1096],{"class":1070}," '",[901,1098,1099],{"class":917},"commands=[\"systemctl restart nginx\"]",[901,1101,1102],{"class":1070},"'",[901,1104,1061],{"class":1060},[901,1106,1107,1110,1114],{"class":903,"line":932},[901,1108,1109],{"class":1066},"  --max-concurrency",[901,1111,1113],{"class":1112},"srdBf"," 10",[901,1115,1061],{"class":1060},[901,1117,1118,1121,1124],{"class":903,"line":940},[901,1119,1120],{"class":1066},"  --max-errors",[901,1122,1123],{"class":1112}," 1",[901,1125,1061],{"class":1060},[901,1127,1128,1131,1134],{"class":903,"line":945},[901,1129,1130],{"class":1066},"  --output-s3-bucket-name",[901,1132,1133],{"class":917}," ops-command-output",[901,1135,1061],{"class":1060},[901,1137,1138,1141,1144],{"class":903,"line":951},[901,1139,1140],{"class":1066},"  --service-role-arn",[901,1142,1143],{"class":917}," arn:aws:iam::111122223333:role/SSMRunCommandNotifications",[901,1145,1061],{"class":1060},[901,1147,1148,1151],{"class":903,"line":959},[901,1149,1150],{"class":1066},"  --notification-config",[901,1152,1153],{"class":917}," NotificationArn=arn:aws:sns:eu-west-1:111122223333:ops-alerts,NotificationEvents=Failed,NotificationType=Command\n",[25,1155,1156,1157,1160,1161,1164],{},"Two operational notes on output. ",[42,1158,1159],{},"Command history is available for up to 30 days",", so anything you need to keep longer goes to S3 or CloudWatch Logs, which is also how you get past the console's truncated view of long output. And never pass a secret in a command's plaintext parameters: all Systems Manager API activity is logged, so anyone with access to those logs can read it. Use a ",[68,1162,1163],{},"SecureString"," parameter instead, which is the subject of a later lesson in this topic.",[32,1166,1168],{"id":1167},"fleet-manager-and-inventory-seeing-what-you-have","Fleet Manager and Inventory: seeing what you have",[25,1170,1171,1174],{},[42,1172,1173],{},"Fleet Manager"," is the console over all of this. It shows which managed nodes are running or stopped, and it lets you do systems administration work without opening a session at all: browse the file system and read file contents, manage the Windows registry, manage operating system user accounts and groups, view running processes, view log files on the node, connect to a Windows instance over RDP, and manage the EBS volumes attached to an instance. Every one of those actions is gated by IAM, so you can grant a support team log reading without granting them a shell.",[25,1176,1177,1180,1181,1184],{},[42,1178,1179],{},"Inventory"," answers the fleet-wide questions. It collects metadata on a schedule: applications and versions, AWS components, files, network configuration, Windows updates, instance details, services, tags, Windows registry keys, Windows roles, and any custom inventory you drop on the node as a JSON file. The shortest collection interval is ",[42,1182,1183],{},"every 30 minutes",", so treat it as a periodic snapshot rather than a live feed.",[25,1186,1187],{},"Inventory only collects metadata. It does not read your data.",[25,1189,1190,1191,1194],{},"The piece that turns Inventory into a real reporting tool is a ",[42,1192,1193],{},"resource data sync",": point every account and Region at one S3 bucket, then query the aggregated data with Athena. That is the difference between \"which nodes in this Region run OpenSSL 1.0\" and \"which nodes anywhere in the organization run OpenSSL 1.0.\"",[32,1196,1198],{"id":1197},"when-a-node-does-not-appear-in-the-list","When a node does not appear in the list",[25,1200,1201],{},"You confirmed the instance is running. It is not in the managed node list. Work the three conditions in order, because that order finds the cause with the least work.",[25,1203,1204],{},"Start with the fast check from the node itself. SSM Agent 3.1.501.0 and later ships a standalone tool:",[893,1206,1208],{"className":895,"code":1207,"language":897,"meta":478,"style":478},"ssm-cli get-diagnostics --output table\n",[68,1209,1210],{"__ignoreMap":478},[901,1211,1212,1215,1218,1221],{"class":903,"line":904},[901,1213,1214],{"class":913},"ssm-cli",[901,1216,1217],{"class":917}," get-diagnostics",[901,1219,1220],{"class":1066}," --output",[901,1222,1223],{"class":917}," table\n",[25,1225,1226,1227,1230,1231,1234],{},"On Windows Server, run ",[68,1228,1229],{},"ssm-cli.exe get-diagnostics --output table"," from ",[68,1232,1233],{},"C:\\Program Files\\Amazon\\SSM",". It returns one row per check with a Success, Failed, or Skipped status, and the failing row names the condition.",[25,1236,1237],{},"Map the rows to causes:",[140,1239,1240,1250],{},[143,1241,1242],{},[146,1243,1244,1247],{},[149,1245,1246],{},"Diagnostic row",[149,1248,1249],{},"What a failure means",[159,1251,1252,1260,1268,1280,1288,1296,1307],{},[146,1253,1254,1257],{},[164,1255,1256],{},"Agent service",[164,1258,1259],{},"The agent is not running, or not running as root (Linux) or SYSTEM (Windows)",[146,1261,1262,1265],{},[164,1263,1264],{},"AWS Credentials",[164,1266,1267],{},"No instance profile or service role attached, or it lacks the Systems Manager permissions",[146,1269,1270,1273],{},[164,1271,1272],{},"EC2 IMDS",[164,1274,1275,1276,1279],{},"The agent cannot reach ",[68,1277,1278],{},"http://169.254.169.254",", usually a local route, firewall, or proxy problem",[146,1281,1282,1285],{},[164,1283,1284],{},"Connectivity to ssm, ec2messages, ssmmessages",[164,1286,1287],{},"Security groups, network ACLs, route tables, OS firewall, or a missing VPC endpoint",[146,1289,1290,1293],{},[164,1291,1292],{},"Proxy configuration",[164,1294,1295],{},"The agent's proxy settings are wrong, which can also make Systems Manager misidentify the operating system",[146,1297,1298,1301],{},[164,1299,1300],{},"Sysprep image state (Windows)",[164,1302,1303,1304],{},"The agent will not start unless the state is ",[68,1305,1306],{},"IMAGE_STATE_COMPLETE",[146,1308,1309,1312],{},[164,1310,1311],{},"SSM Agent version",[164,1313,1314],{},"An old agent, which matters for features with a minimum version",[25,1316,1317,1318,1321,1322,1325],{},"From the API side, ",[68,1319,1320],{},"aws ssm describe-instance-associations-status --instance-id i-02573cafcfEXAMPLE"," returns an empty ",[68,1323,1324],{},"InstanceAssociationStatusInfos"," array until registration succeeds, so an empty result after 5 minutes is itself the signal.",[25,1327,1328],{},"For the connectivity condition, an instance either reaches the public endpoints over an outbound HTTPS route or reaches interface VPC endpoints instead:",[140,1330,1331,1341],{},[143,1332,1333],{},[146,1334,1335,1338],{},[149,1336,1337],{},"Endpoint",[149,1339,1340],{},"Why",[159,1342,1343,1353,1363,1373,1383,1393,1403],{},[146,1344,1345,1350],{},[164,1346,1347],{},[68,1348,1349],{},"com.amazonaws.region.ssm",[164,1351,1352],{},"The Systems Manager service endpoint",[146,1354,1355,1360],{},[164,1356,1357],{},[68,1358,1359],{},"com.amazonaws.region.ssmmessages",[164,1361,1362],{},"Required for the agent's data channel and for Session Manager",[146,1364,1365,1370],{},[164,1366,1367],{},[68,1368,1369],{},"com.amazonaws.region.ec2messages",[164,1371,1372],{},"The older agent-to-service call path, still used by older agents",[146,1374,1375,1380],{},[164,1376,1377],{},[68,1378,1379],{},"com.amazonaws.region.s3",[164,1381,1382],{},"Agent updates, and any script or output stored in a bucket",[146,1384,1385,1390],{},[164,1386,1387],{},[68,1388,1389],{},"com.amazonaws.region.ec2",[164,1391,1392],{},"Only for VSS-enabled snapshots",[146,1394,1395,1400],{},[164,1396,1397],{},[68,1398,1399],{},"com.amazonaws.region.kms",[164,1401,1402],{},"Optional, for KMS encryption in Session Manager or Parameter Store",[146,1404,1405,1410],{},[164,1406,1407],{},[68,1408,1409],{},"com.amazonaws.region.logs",[164,1411,1412],{},"Optional, for CloudWatch Logs output",[25,1414,1415,1416,1419,1420,1230,1423,659],{},"Two more causes worth carrying, because they look like bugs. A node whose status has been ",[42,1417,1418],{},"Connection Lost for at least 30 days"," may drop off the Fleet Manager list entirely until the underlying problem is fixed. And every managed node needs a TLS certificate from Amazon Trust Services in its trust store; a custom or on-premises image without one fails with an SSL error where you would expect an ",[68,1421,1422],{},"UnknownOperationException",[68,1424,1425],{},"curl -L https://ssm.region.amazonaws.com",[32,1427,447],{"id":446},[89,1429,1430,1433,1440,1445,1448,1453,1461,1464],{},[92,1431,1432],{},"Any \"the instance is running but does not appear in Systems Manager\" question is testing the three conditions. Read the stem for which one it removed: no agent, no instance profile, or no route to the endpoints.",[92,1434,1435,1436,1439],{},"A private subnet with no NAT gateway plus a Session Manager requirement means interface VPC endpoints, and ",[68,1437,1438],{},"ssmmessages"," is the one that carries the session.",[92,1441,1442,1443,659],{},"Default Host Management Configuration is per account and per Region, needs IMDSv2, and loses to an instance profile that allows ",[68,1444,797],{},[92,1446,1447],{},"\"No inbound ports, no bastion host, no SSH keys, and an audit trail\" is the phrase that points at Session Manager. If the same question also demands a command transcript, remember that port forwarding and SSH sessions are not logged.",[92,1449,1450,1451,659],{},"Run Command defaults: concurrency 50, error threshold 0. A question where a single failure stopped a fleet-wide command has not set ",[68,1452,1017],{},[92,1454,1455,1456,1458,1459,659],{},"To bound total failures rather than just stop dispatch, pair ",[68,1457,1017],{}," with ",[68,1460,1040],{},[92,1462,1463],{},"Command history lasts 30 days. Any requirement to retain output longer means S3 or CloudWatch Logs.",[92,1465,1466],{},"Inventory is metadata on a schedule with a 30-minute floor, and a resource data sync into S3 is what makes it queryable across accounts and Regions with Athena.",[25,1468,1469],{},"The rule to carry out of this lesson: on AWS, fleet access is an IAM problem, not a network problem. Once the three conditions hold, granting or revoking access to a server is a policy edit rather than a key rotation, and every action leaves a record. The next lesson uses that same managed node foundation to keep those servers patched and their configuration from drifting.",[1471,1472,1473],"style",{},"html pre.shiki code .sutJx, html code.shiki .sutJx{--shiki-light:#90A4AE;--shiki-light-font-style:italic;--shiki-default:#6A737D;--shiki-default-font-style:inherit;--shiki-dark:#6A737D;--shiki-dark-font-style:inherit}html pre.shiki code .sbgvK, html code.shiki .sbgvK{--shiki-light:#E2931D;--shiki-default:#6F42C1;--shiki-dark:#B392F0}html pre.shiki code .s_sjI, html code.shiki .s_sjI{--shiki-light:#91B859;--shiki-default:#032F62;--shiki-dark:#9ECBFF}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .s_hVV, html code.shiki .s_hVV{--shiki-light:#90A4AE;--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .stzsN, html code.shiki .stzsN{--shiki-light:#91B859;--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .sjJ54, html code.shiki .sjJ54{--shiki-light:#39ADB5;--shiki-default:#032F62;--shiki-dark:#9ECBFF}html pre.shiki code .srdBf, html code.shiki .srdBf{--shiki-light:#F76D47;--shiki-default:#005CC5;--shiki-dark:#79B8FF}",{"title":478,"searchDepth":479,"depth":479,"links":1475},[1476,1477,1478,1479,1480,1481,1482],{"id":629,"depth":482,"text":630},{"id":673,"depth":482,"text":674},{"id":807,"depth":482,"text":808},{"id":866,"depth":482,"text":867},{"id":1167,"depth":482,"text":1168},{"id":1197,"depth":482,"text":1198},{"id":446,"depth":482,"text":447},[1484],{"slug":663,"concept":1485,"style":1486,"aspectRatio":496,"labels":1487},"A left-to-right flow showing the three conditions an EC2 instance must pass before it is listed as a Systems Manager managed node. Three gate boxes sit in sequence: SSM Agent running, credentials attached, and endpoint reachability. Each gate has a pass arrow continuing right and a downward branch labelled with the symptom that gate produces when it fails and the ssm-cli check that reveals it. The final box on the right is the managed node list, with a note that the service confirms health every 5 minutes. The emphasis is that all three must pass and that the failing gate is identifiable from the symptom alone.","diagram",[1488,1489,1490,1491,1492,1493,1494,1495,1496,1497,1498],"Gate 1: SSM Agent installed and running on a supported OS","Fails: no agent process, or the service is not running as root or SYSTEM","ssm-cli check: Agent service","Gate 2: credentials attached, an instance profile or Default Host Management Configuration","Fails: the agent runs but never registers","ssm-cli check: AWS Credentials","Gate 3: the agent can reach the Systems Manager endpoints on port 443","Fails: no outbound route, no VPC endpoints, or a bad proxy","ssm-cli check: Connectivity to ssm, ec2messages, ssmmessages","Managed node list: health confirmed every 5 minutes","All three gates must pass, so the symptom tells you which gate broke before you touch anything.",[611,612,613,614,615,616],{},"/courses/aws-certified-cloudops-engineer-associate/en/domains/03-deployment-provisioning-automation/05-operational-automation/01-systems-manager-fleet-management",{"passingScore":511,"questions":1503},[1504,1512,1520,1528,1533,1541,1550,1554],{"question":1505,"type":515,"options":1506,"correctAnswer":1508,"explanation":1511},"An administrator turns on Default Host Management Configuration in a Region. Instances there still use instance profiles that grant ssm:UpdateInstanceInformation. Which credentials does SSM Agent use?",[1507,1508,1509,1510],"It alternates between the two and uses whichever answers first","The instance profile, because SSM Agent tries instance profile permissions before Default Host Management Configuration permissions","The Default Host Management Configuration role, because account-level settings take precedence","Neither, because the two configurations conflict and registration fails","SSM Agent attempts instance profile permissions first, so an instance profile that allows ssm:UpdateInstanceInformation keeps the instance on the old path and the account-level role is never used. This is why the setup instructions tell you to remove that permission from existing instance profiles before turning the feature on.",{"question":1513,"type":515,"options":1514,"correctAnswer":1516,"explanation":1519},"You run aws ssm send-command against 200 tagged nodes without specifying --max-concurrency or --max-errors. What happens?",[1515,1516,1517,1518],"All 200 nodes run the command at once, and the command completes regardless of failures","50 nodes run at a time, and Systems Manager stops sending the command after the first error","50 nodes run at a time, and the command continues through all 200 no matter how many fail","The command fails validation, because both parameters are required for tag targeting","The default for max-concurrency is 50 and the default for max-errors is 0, and a max-errors of 0 means the system stops sending the command to more nodes after the first error result comes back. Invocations already running are allowed to finish, so a run can still end with more failures than the threshold unless you also set max-concurrency to 1.",{"question":1521,"type":515,"options":1522,"correctAnswer":1525,"explanation":1527},"A security team needs a recorded transcript of everything engineers type on production instances. Engineers currently connect through Session Manager port forwarding to reach a local database client. What is the problem?",[1523,1524,1525,1526],"Port forwarding sessions cannot be started by IAM principals, only by the root user","Port forwarding requires an inbound security group rule, which the team has closed","Session logging is not available for sessions that connect through port forwarding or SSH","Session logs for port forwarding are written only to CloudTrail and never to S3","Session Manager only tunnels those connections, and SSH encrypts everything inside the TLS channel between the CLI and the Session Manager endpoint, so there is nothing for the service to record. Interactive shell sessions can still stream to CloudWatch Logs or S3, which is where a transcript requirement has to be satisfied.",{"question":1529,"type":515,"options":1530,"correctAnswer":1359,"explanation":1532},"Instances in a private subnet with no internet route must support Session Manager. Which interface VPC endpoint is required for the secure data channel?",[1359,1389,1409,1531],"com.amazonaws.region.monitoring","The ssmmessages endpoint carries the data channel that SSM Agent uses to talk to the service, and it is the one Session Manager depends on. The logs endpoint is optional and only needed if you stream session output to CloudWatch Logs, and the ec2 endpoint matters for VSS-enabled snapshots, not for connecting.",{"question":1534,"type":515,"options":1535,"correctAnswer":1539,"explanation":1540},"ssm-cli get-diagnostics on a running instance returns Success for every connectivity check but Failed for AWS Credentials. What is the cause?",[1536,1537,1538,1539],"The SSM Agent version is older than the minimum supported release","The instance metadata service is unreachable from the agent","A proxy is configured incorrectly for the agent","No instance profile is attached, or the attached one lacks the Systems Manager permissions","The AWS Credentials check reports whether the agent can obtain credentials from the attached instance profile or service role and whether those credentials carry the required permissions. Connectivity passing rules out the network, and the metadata service and proxy each have their own separate rows in the same table.",{"question":1542,"type":532,"options":1543,"correctAnswers":1548,"explanation":1549},"Which two statements about Default Host Management Configuration are correct? (Choose 2.)",[1544,1545,1546,1547],"It must be turned on separately in each AWS Region you want it to cover","It supports both Instance Metadata Service Version 1 and Version 2","It requires instances to use Instance Metadata Service Version 2","It replaces the need for SSM Agent on the instance",[1544,1546],"The setting is per account and per Region, and it covers only instances running IMDSv2 with SSM Agent 3.2.582.0 or later. It replaces the instance profile, not the agent, which still has to be installed and running for any Systems Manager tool to work.",{"question":1551,"type":515,"options":1552,"correctAnswer":543,"explanation":1553},"True or False: the execution history of a Run Command invocation is available in Systems Manager for up to 30 days.",[543,544],"Command history is retained for up to 30 days, which is why any output you need to keep beyond that has to be sent to an S3 bucket or a CloudWatch Logs log group when you run the command. CloudTrail keeps the record of the API call itself, but not the command output.",{"question":1555,"type":515,"options":1556,"correctAnswer":1559,"explanation":1561},"A team wants software inventory from every managed node refreshed as often as Systems Manager Inventory allows. What is the shortest collection interval they can configure?",[1557,1558,1559,1560],"Every 5 minutes","Every 15 minutes","Every 30 minutes","Every hour","Inventory collection intervals are specified in minutes, hours, or days, and the shortest supported interval is 30 minutes. Inventory is a periodic metadata snapshot rather than a live feed, so a scenario that demands second-by-second visibility is asking for CloudWatch, not Inventory.",{"title":607,"description":608},"courses/aws-certified-cloudops-engineer-associate/en/domains/03-deployment-provisioning-automation/05-operational-automation/01-systems-manager-fleet-management","8l5ONxVxA9PW5pFQgxh7PQ3RYyqaaHAuUa1jie1oxVI"]