Jump-host configuration across accounts has drifted—different SSH settings and agent versions. Which AWS capability best enforces desired state continuously?
Select an answer to reveal the explanation.
Short Explanation
Drift loves jump hosts—State Manager associations are the seatbelt that keeps SSH settings and agents where you left them. One-time launch configs and “trust the wiki” don’t survive a year of emergencies.
Full Explanation
Jump-host SSH settings and agent versions that drift across accounts undermine secure operations. AWS Systems Manager State Manager with associations continuously enforces desired configuration on the jump-host fleet, reapplying baselines when hosts diverge. That capability fits because configuration management for bastions must be continuous reconciliation, not a one-time bootstrap story. Relying on tribal knowledge documents without enforcement fails when emergencies push ad-hoc changes that never return to baseline. Applying configuration only once at launch and never reconciling afterward fails conceptually—drift is inevitable without reapply. Disabling Systems Manager access so hosts change only through ad-hoc SSH fails by removing the control plane that would prevent drift. Exam caveat: State Manager associations need least-privilege IAM, tested documents, and monitoring of association compliance; a wrong association can push bad config fleet-wide—canary first. Operational check: define the desired SSH/agent baseline as an association, apply to a pilot account’s jump hosts, review Association compliance in Fleet Manager, remediate failures, then roll to remaining municipal accounts.