A retail platform runs 400 EC2 instances across three OUs and needs monthly OS patching with automated reboot control, failed-patch ticket creation, and concurrency limits to protect checkout. Maintenance windows keep slipping. Which automated runbook design provides controlled patching with integrated incident response?
Select an answer to reveal the explanation.
Short Explanation
Patching fleets is like orchestrating rolling stage lights without blacking out the show. Maintenance Windows give you scheduling, concurrency, and Patch Manager compliance with Automation for ticketed remediation.
Full Explanation
Systems Manager Patch Manager defines patch baselines and compliance, Maintenance Windows provides cron scheduling, target selection across OUs, concurrency and error thresholds, and reboot control, while Systems Manager Automation runbooks execute multi-step remediation such as snapshot, patch, verify, and create tickets, with EventBridge routing failures to SNS, Jira, or ServiceNow for incident response and CloudWatch tracking. EC2 Image Builder builds golden AMIs but does not patch running instances in place, and coupling it to Step Functions misses baseline compliance and safe rolling controls. AWS Config with Lambda detects noncompliance but is not a patch orchestrator and lacks maintenance scheduling, concurrency limits, and reboot handling. OpsWorks lifecycle events target Chef-based stacks, not fleet-wide patch orchestration at scale, and cannot provide centralized patch compliance reporting. Exam caveat is that Patch Manager plus Maintenance Windows plus Automation is the canonical patch runbook pattern, and practical check is to confirm baseline approvals, concurrency set to protect checkout, and EventBridge rule creates tickets on Automation failure.