Examkin

Question

Difficulty: MediumAWS Systems Manager Configuration and Run Command Automation

A SysOps Administrator is setting up an AWS Systems Manager Automation execution that uses a custom runbook to perform administrative tasks across multiple Amazon EC2 instances. The SSM Agent is running on all target instances, and an IAM instance profile containing the AmazonSSMManagedInstanceCore policy is already attached. When the administrator attempts to start the Automation execution using a service role, the execution fails immediately with an access denied error. Which two actions are required to resolve this error and run the automation successfully? (Select TWO.)

  1. Attach an IAM policy to the administrator's IAM identity that grants the iam:PassRole permission for the Systems Manager service role ARN.Answer
  2. Configure the trust policy of the Systems Manager service role to allow the service principal ssm.amazonaws.com to assume the role.Answer
  3. C
    Add the iam:PassRole permission to the IAM trust policy of the EC2 instance profile to allow the Systems Manager service to pass the role to the instances.
  4. D
    Modify the trust policy of the Systems Manager service role to allow EC2 instances to assume it using the STS AssumeRole API.
  5. E
    Define a Patch Group tag key and value on the target instances and register the custom SSM document with a matching patch baseline.

Answer

The administrator must attach an IAM policy to their own IAM identity that grants the iam:PassRole permission for the Systems Manager service role ARN, and configure the trust policy of the Systems Manager service role to allow the service principal ssm.amazonaws.com to assume the role.
Executing Systems Manager Automation using a service role requires the user to have iam:PassRole permissions for the service role. Additionally, the service role itself must trust the ssm.amazonaws.com service principal to allow the Systems Manager service to assume it.

Step-by-Step Solution

1
Identify the missing administrative permission by verifying the error message and IAM policies.
Confirm that the administrator lacks the iam:PassRole permission to pass the role to Systems Manager.
Systems Manager requires the administrator to pass the service role so the service can execute the automation steps under that role.
2
Attach a policy to the administrator's IAM user or group containing the iam:PassRole permission targeting the service role ARN.
The administrator now has the authority to delegate the service role to Systems Manager.
This grants the necessary delegation permission required by IAM when passing roles to AWS services.
3
Verify and update the trust relationship on the Systems Manager service role.
The service role trust policy allows the ssm.amazonaws.com service principal to assume the role.
Without this trust relationship, Systems Manager cannot assume the role to perform actions on AWS resources.

Key Concept

IAM PassRole permissions and service trust relationships for Systems Manager Automation
Estimated Time:1m 30s
Rate this question

Topics

AWS Systems Manager Configuration and Run Command Automation