A hospital must restart one clinical instance a single time. The ticket includes a shell script with long-lived access keys embedded in it. What should perform that restart?
Select an answer to reveal the explanation.
Short Explanation
A spare key under the doormat is how houses get robbed. You already have a managed restart document, so the one-off reboot should use that document and an IAM role, not a script that carries its own keys. The trap is treating a restart as a reason to invent a credential.
Full Explanation
AWS-RestartEC2Instance is the managed Systems Manager Automation document that restarts one instance. Started with an IAM role, it takes the instance ID and never needs the access keys that were pasted into the ticket. A laptop script that reboots the host with those keys copies a long-lived secret into the change record and leaves no Automation execution to review. A new IAM user created only to hold access keys inside the restart script keeps that secret and adds another identity to rotate. A custom runbook that stores those same access keys in a parameter and then reboots still keeps the keys, which is the problem the ticket already created. Caveat: the role that starts the document still needs permission to restart that instance, and a restart drops work that existed only in memory. Operational check: start AWS-RestartEC2Instance for that instance ID, confirm the execution succeeds, and confirm the instance status checks pass afterward.