Implement in-place and blue/green deployment strategies for Amazon EC2 and on-premises instances with AWS CodeDeploy, deployment groups and Auto Scaling groups.

A company is migrating releases for a fleet of on-premises Linux servers in its own data centre to AWS CodeDeploy, so it can use the same revisions and deployment groups it already uses for its Amazon EC2 instances. The on-premises servers cannot assume an Amazon EC2 instance profile because they are not EC2 instances. Which approach MOST securely and correctly registers these on-premises servers as CodeDeploy targets?

• AInstall the CodeDeploy agent on each server and register them as on-premises instances using IAM session credentials obtained through AWS Security Token Service, configured with the register-on-premises-instance workflow.check_circle Correct
• BInstall the CodeDeploy agent on each server and embed a long-lived IAM user access key and secret key in the agent configuration file so the servers can authenticate to the CodeDeploy service indefinitely.
• CAttach an Amazon EC2 instance profile role to each on-premises server through AWS Systems Manager hybrid activation so the servers can assume the same role the EC2 instances use for deployments.
• DPlace the on-premises servers behind an AWS Site-to-Site VPN and add their private addresses to the deployment group so CodeDeploy treats them as Amazon EC2 instances reachable over the tunnel.

Why A is correct: On-premises CodeDeploy registration uses the agent plus short-lived STS-based credentials tied to an IAM identity, which is the supported and least-privilege way to enrol servers that have no EC2 instance profile.

Why B is wrong: Embedding long-lived static keys on each server is a standing credential-leak risk and violates least privilege; CodeDeploy on-premises registration is designed to avoid persistent keys on the hosts.

Why C is wrong: A hybrid activation registers a server as a managed node for Systems Manager but it does not attach an EC2 instance profile, and CodeDeploy on-premises registration is its own distinct enrolment path.

Why D is wrong: Network reachability over a VPN does not enrol a host with CodeDeploy; the servers still need the agent and on-premises registration, and CodeDeploy cannot treat them as EC2 instances by address alone.