A company needs an inventory of applications running across many EC2 instances. Users and IAM roles with required permissions for AWS Systems Manager are configured. The latest Systems Manager Agent is running on every instance. While enabling inventory collection, the administrator notices some instances in the same subnet are not managed by Systems Manager. What must the administrator do to resolve this?

For Systems Manager to manage an EC2 instance, the instance must have an associated IAM instance profile with the necessary permissions (e.g., AmazonSSMManagedInstanceCore). Without this role, Systems Manager cannot communicate with the agent running on the instance, even if the agent is installed and running. The problem states that some instances in the same subnet are not managed, implying a configuration issue at the instance level rather than network connectivity. Specific tags are not required for Systems Manager to manage instances, though tags can be used for targeting. IAM Access Analyzer helps identify resource access issues but doesn't automatically fix them or address missing instance profiles. While VPC endpoints can improve security and routing, they are not a prerequisite for basic Systems Manager functionality and wouldn't resolve a missing instance profile.