Configure the Systems Manager Document to Use the aws-downloadContent Plugin with a sourceType of GitHub and sourcelnfo with the Repository Details:
* Theaws-downloadContentplugin can download content from various sources, including GitHub, which is necessary for bootstrapping the laptops with the code stored in the GitHub repository.
schemaVersion: '2.2'
description: "Download and run bootstrap script from GitHub"
mainSteps:
- action: aws:downloadContent
name: downloadBootstrapScript
inputs:
sourceType: GitHub
sourceInfo: '{"owner":"my-org","repository":"my-repo","path":"scripts/bootstrap.sh","getOptions":"branch:
main"}'
destinationPath: /tmp/bootstrap.sh
- action: aws:runShellScript
name: runBootstrapScript
inputs:
runCommand:
- chmod +x /tmp/bootstrap.sh
- /tmp/bootstrap.sh
* This setup ensures that the bootstrap code is downloaded from GitHub and executed on the laptops using Systems Manager.
References:
* AWS Systems Manager aws-downloadContent Plugin
* Running Commands Using Systems Manager

Explanation
The Auto Scaling group service-linked role must have a specific grant in the source account in order to decrypt the encrypted AMI. This is because the service-linked role does not have permissions to assume the default IAM role in the source account.
The following steps are required to meet the requirements:
* In the source account, copy the unencrypted AMI to an encrypted AMI. Specify the KMS key in the copy action.
* In the source account, create a KMS grant that delegates permissions to the Auto Scaling group service-linked role in the target account.
* In the source account, share the encrypted AMI with the target account.
* In the target account, attach the KMS grant to the Auto Scaling group service-linked role.
The first three steps are the same as the steps that I described earlier. The fourth step is required to grant the Auto Scaling group service-linked role permissions to decrypt the AMI in the target account.

The following are the steps that the company can take to change the log level dynamically when the deployment occurs:
* Create a script that uses the CodeDeploy environment variable DEPLOYMENT_GROUP_NAME to identify which deployment group the instance is part of.
* Use this information to configure the log level settings.
* Reference this script as part of the BeforeInstall lifecycle hook in the appspec.yml file.
TheDEPLOYMENT_GROUP_NAMEenvironment variable is automatically set by CodeDeploy when the deployment is triggered. This means that the script does not need to call the metadata service or the EC2 API to identify the deployment group.
This solution is the least complex and requires the least management overhead. It also does not require different script versions for each deployment group.
The following are the reasons why the other options are not correct:
* Option A is incorrect because it would require tagging the Amazon EC2 instances, which would be a manual and time-consuming process.
* Option C is incorrect because it would require creating a custom environment variable for each environment. This would be a complex and error-prone process.
* Option D is incorrect because it would use the DEPLOYMENT_GROUP_ID environment variable.
However, this variable is not automatically set by CodeDeploy, so the script would need to call the metadata service or the EC2 API to get the deployment group ID. This would add complexity and overhead to the solution.

Step 1: Centralizing Image Scanning in a Shared Services AccountThe first requirement is to centralize the image scanning process, ensuring pre-scan and post-scan images are stored separately. This can be achieved by creating separate pre-scan and post-scan repositories in the shared services account, with the appropriate resource-based policies to control access.
* Action:Create separate ECR repositories for pre-scan and post-scan images in the shared services account. Configure resource-based policies to allow write access to pre-scan repositories and read access to post-scan repositories.
* Why:This ensures that images are isolated before and after the scan, following the compliance requirements.