A SaaS company manages 800 EC2 instances and container images across production and staging accounts. Security requires continuous vulnerability detection for OS and images plus scheduled OS patching with approval windows and centralized compliance reporting. Which design provides automated scanning and patch management?
Select an answer to reveal the explanation.
Short Explanation
You've got 800 instances to watch, so you'll love having a night-shift guard plus a regular oil change for your car. Inspector with a delegated admin continuously scans your OS and images, while Patch Manager handles your baselines, windows, and compliance reporting.
Full Explanation
Amazon Inspector with delegated administration continuously scans EC2, ECR images, and Lambda for software vulnerabilities and network exposure, aggregating findings multi-account, while AWS Systems Manager Patch Manager defines patch baselines, maintenance windows, and approval rules to automate OS patching with compliance dashboards. Together they separate detection from remediation with centralized reporting. Macie discovers sensitive data in S3 rather than OS vulnerabilities, and manual updates with spreadsheets lack automation and auditability. Config rules can evaluate patch compliance state but rebooting via Lambda is not managed patch orchestration and misses baselines and windows. CloudTrail Lake audits API activity, not software vulnerabilities, and user-data patching is inconsistent and not scheduled. Exam caveat: Inspector equals assessment scanning, Patch Manager equals remediation execution; compliance scenarios often need both. Practical check: confirm SSM agent coverage and review Inspector findings against patch compliance.