Automate patching across a VM fleet

WHAT THIS TESTS This verifies you reach for automation and safe rollout practices rather than manual, error-prone, unrepeatable work across many machines.

A GOOD ANSWER COVERS Use a fleet management tool. On AWS, Systems Manager Patch Manager can target instances by tag, define a patch baseline, and apply patches across all 100 during a maintenance window without SSH access. Configuration management tools such as Ansible, Chef, or Puppet do the same by running a playbook against an inventory selected by tag or group. Crucially, do not patch all 100 at once: roll out in waves, canary on a small batch first, run health checks between waves, and halt or roll back automatically if errors spike, which limits blast radius. Schedule the work during a maintenance window and log which hosts were patched. For the long term, the more robust pattern is immutable infrastructure: bake a new golden image with the patch using an image builder, then replace instances by updating the autoscaling group's launch template and rolling the fleet, so every instance is provably identical and patching becomes a redeploy.

COMMON WRONG ANSWERS SSHing into each machine and running the package manager by hand, which is slow, inconsistent, and unauditable. Patching all instances simultaneously with no canary, risking a fleet-wide outage. Omitting health checks or rollback. Forgetting to record what was patched. Ignoring the immutable-image alternative entirely.

LIKELY FOLLOW-UPS How do you avoid downtime during patching? Why is immutable infrastructure preferable to in-place patching? How do you target only the right instances? What do you do if a patch breaks the canary?

ONE CONCRETE EXAMPLE A critical CVE drops. You run Patch Manager against instances tagged role=web, canarying ten percent first; health checks pass, so the remaining waves proceed automatically. Separately, you bake the fix into a new machine image so any future instance launches already patched, making the fleet converge to a known-good state without manual intervention.