An IT firm has deployed web applications using Amazon EC2 instance. Team members in the operations team do not have permission to restart Amazon EC2 instance. The Operations Head is exploring an option to enable team members to restart EC2 instances using AWS Systems Manager runbooks & seeking your support to create appropriate permissions. While assigning permissions, there should not be any deviation in the least privilege access guidelines established by the Security Team.
Which permission needs to be assigned to enable members to restart the EC2 instance? 

Answer options:

A.Create a runbook to restart an Amazon EC2 instance & embed the IAM service role in the runbook.
B.Create a runbook to restart an Amazon EC2 instance & run runbook as an administrator instead of user.
C.Create a runbook to restart an Amazon EC2 instance allowing team members ‘AmazonSSMFullAccess’ permissions to restart a specific Amazon EC2 instance.
D.Create a runbook to restart an Amazon EC2 instance allowing team members full permissions to restart an Amazon EC2 instance.

Correct Answer: A
Runbooks run in the context of the user who initiated the runbooks. In the above case, team members will need permission to restart an Amazon EC2 instance which will be used by runbooks. Another option is to use service roles. With service roles, runbooks are run against the AWS resource & users who initiated the runbooks do not require permission to restart the Amazon EC2 instance.
Option B is incorrect as using a service role is a preferred option instead of using an administrator account to initiate runbooks.
Options C & D are incorrect as this will be against the least privilege permission guidelines.
For more information on running runbooks with service roles, refer to the following URL,
https://docs.aws.amazon.com/systems-manager/latest/userguide/automation-walk-security-delegated.html