The company migrated servers to EC2 and needs to monitor memory utilization and free disk space using CloudWatch. What is the appropriate action for a SysOps administrator to enable those metrics across all instances?

The correct approach is to install and configure the CloudWatch agent on each EC2 instance and attach an IAM role with permissions to publish metrics and logs to CloudWatch. Standard CloudWatch monitoring for EC2 instances only provides basic metrics like CPU utilization, network I/O, and disk I/O. Memory utilization and disk space are custom metrics that require the CloudWatch agent to collect and send them. Attaching an IAM role is the secure and recommended way to grant permissions to EC2 instances, avoiding the use of long-lived credentials. Enabling CloudWatch monitoring from the AWS Console only activates basic monitoring; it does not automatically install agents or collect custom metrics. Using IAM user credentials directly on instances is an insecure practice. Modifying security groups is necessary for network access, but it does not grant permission to publish metrics to CloudWatch; that requires IAM permissions.