A SysOps administrator is responsible for hundreds of EC2 instances running Windows and Linux. Each instance is tagged with its operating system and all instances are reachable through AWS Systems Manager Session Manager. A zero-day vulnerability requires custom mitigation scripts supplied by the security team for each OS. The administrator must run the provided code quickly across the fleet and produce a report proving successful execution on every instance. What is the fastest way to accomplish this?

AWS Systems Manager Run Command is the fastest and most efficient solution. It allows you to execute commands across a fleet of instances simultaneously, targeting them using tags like the OS tag mentioned. The AWS-RunShellScript (for Linux) and AWS-RunPowerShellScript (for Windows) documents are designed for this purpose. Run Command automatically tracks execution status and output, providing a comprehensive history that serves as proof of successful execution. Creating a Lambda function is overly complex and time-consuming for this immediate need. Logging in manually to hundreds of instances is impractical and prone to errors. Modifying launch templates and relaunching instances would cause significant downtime and is not suitable for a rapid, zero-day vulnerability response.