You are managing thousands of Amazon EC2 instances in an enterprise organization. You need to frequently configure multiple instances at the same time by running the same shell commands such as “docker restart”.
The operation should be fully monitored and recorded in CloudTrail. You do not want to configure SSH keys to access the instances.
Which of the following methods should you choose?

Answer options:

A.Create Ansible playbooks to execute shell commands in EC2 instances. Configure an inventory document to group and manage EC2 instances.
B.Install the Chef agent on EC2 instances. Register instances in AWS OpsWorks and edit cookbooks to execute shell commands.
C.Create CloudFormation templates to run shell scripts for multiple EC2 instances. Configure products and portfolios using the templates in AWS Service Catalog.
D.Install the AWS Systems Manager agent in EC2 instances and use AWS Systems Manager Run Command to manage instances remotely.

Answer: D
Option A is incorrect because Ansible still relies on SSH, and you need to configure the SSH keys. It is also difficult to maintain an audit of the operations in CloudTrail.
Option B is incorrect because AWS OpsWorks is a configuration management service that manages instances using Chef and Puppet. As per the asks, it needs the service to run shell commands on the EC2 instances. OpsWorks is too heavy for this scenario.
Option C is incorrect because using CloudFormation to run shell scripts on many EC2 instances would not be suitable. AWS CloudFormation generally would be used to deploy Infrastructure and services on AWS Cloud.
Option D is CORRECT because, with AWS Systems Manager Run Command, you can select several EC2 instances and run a pre-defined command script document. Users can easily manage a large number of instances without SSH access.
Reference:
https://aws.amazon.com/blogs/aws/manage-instances-at-scale-without-ssh-access-using-ec2-run-command/.