A county wants fleets to stay patched and configuration-consistent without operators SSHing into snowflake servers. Which AWS approach best supports that configuration-management goal?
Select an answer to reveal the explanation.
Short Explanation
SSH snowflakes melt under audit. Patch Manager keeps the fleet on the same patch calendar, and Parameter Store hands out the same config knobs—no unique pet servers required.
Full Explanation
County fleets stay compliant when patching and configuration are centralized instead of depending on interactive SSH to unique hosts. Systems Manager Patch Manager applies agreed patch baselines across instances with inventory and reporting, while Parameter Store distributes shared configuration so servers consume the same knobs without per-box drift. That combination reduces snowflake servers and removes the operational habit of logging in to fix one host at a time. Unique SSH keys and manual patch scripts per instance do not scale and defeat consistent inventory. Disabling management agents and relying on annual console walkthroughs leaves months of unpatched exposure across the civic estate. Embedding production secrets in world-readable user-data scripts spreads credentials into launch history and instance metadata paths that are hard to rotate safely. Exam caveat: Patch Manager still requires the SSM agent, instance permissions, and maintenance windows aligned to civic change calendars—missing any of those stalls compliance dashboards. Operational check: confirm agent online status for a sample fleet, run a patch scan against the baseline, verify a non-secret parameter resolves identically on two instances, and ensure secrets live in a dedicated secrets store rather than user-data.