A SysOps administrator is configuring an automated remediation workflow to enable deletion protection on Amazon RDS DB instances that are flagged as non-compliant by AWS Config. The administrator creates an Amazon EventBridge rule that detects the compliance state change events and targets an AWS Systems Manager Automation runbook. The EventBridge rule must pass a specific IAM role (RDSRemediationRole) to the Systems Manager service so that the runbook can perform the modification.
Although the EventBridge rule triggers, the Automation execution fails to start with a permission error.
Which action will resolve this issue?
- Grant the EventBridge execution role the iam:PassRole permission for the RDSRemediationRole.Answer
- BAdd events.amazonaws.com as a trusted entity in the trust policy of the RDSRemediationRole.
- CUpdate the EventBridge rule event pattern to include the iam:PassRole action under the target parameters.
- DAttach the AmazonSSMAutomationRole managed policy to the target RDS DB instances.
Answer
Grant the EventBridge execution role the iam:PassRole permission for the RDSRemediationRole.
The correct answer is to grant the EventBridge execution role the iam:PassRole permission for the RDSRemediationRole. In AWS, when a service (EventBridge) triggers an automation workflow in another service (Systems Manager) and passes a service role (AutomationAssumeRole) for that workflow to use, the invoking service's role must have the iam:PassRole permission. This ensures that EventBridge is authorized to pass the specified execution role to Systems Manager.
Step-by-Step Solution
Key Concept
IAM PassRole permissions in automated service remediation workflows