Examkin

Question

Difficulty: MediumEvent-Driven Automation and Operational Responses

A company's security policy requires that any exposed IAM access keys detected by AWS Health must be automatically deactivated immediately. A SysOps administrator is configuring an event-driven remediation workflow using AWS Systems Manager Automation. Which of the following actions should the SysOps administrator take to implement this automation? (Select TWO.)

  1. Create an Amazon EventBridge rule that filters for the AWS Health service event type AWS_RISK_CREDENTIAL_EXPOSED, and select the Systems Manager Automation runbook AWS-DisableAccessKey as the target.Answer
  2. Configure an IAM service role for Systems Manager Automation that contains the iam:UpdateAccessKey permission, and attach a policy allowing iam:PassRole for this role to the identity configuring the automation.Answer
  3. C
    Configure a CloudWatch metric filter on AWS CloudTrail logs for the PutUserPolicy event, create a CloudWatch Alarm with detailed monitoring enabled, and set the alarm's action to run the remediation runbook.
  4. D
    Create an Amazon EventBridge rule that targets an Amazon SNS topic, and subscribe the Systems Manager Automation service endpoint to the topic to trigger the deactivation workflow.
  5. E
    Configure a trust policy on the IAM role to allow eventbridge.amazonaws.com to assume the role and execute the iam:UpdateAccessKey action directly without needing iam:PassRole permissions.

Answer

Create an Amazon EventBridge rule filtering for the AWS Health event type AWS_RISK_CREDENTIAL_EXPOSED targeting the AWS-DisableAccessKey runbook, and configure an IAM service role for Systems Manager Automation with iam:UpdateAccessKey and grant iam:PassRole permissions to the configuring user.
The correct actions involve setting up an Amazon EventBridge rule that filters for the specific AWS Health event type AWS_RISK_CREDENTIAL_EXPOSED and targets the Systems Manager Automation runbook AWS-DisableAccessKey. Additionally, the service role assumed by Systems Manager must have permissions to update the access key state (iam:UpdateAccessKey), and the configuring user must have iam:PassRole permissions to pass the role to the service.

Step-by-Step Solution

1
Identify the trigger event and target runbook for exposed credentials.
Determine that the AWS Health event AWS_RISK_CREDENTIAL_EXPOSED can trigger an EventBridge rule that targets the AWS-DisableAccessKey Systems Manager Automation runbook.
EventBridge is the primary event routing service in AWS that can match AWS Health notifications and trigger operational responses.
2
Define the IAM permissions and roles required for executing the Systems Manager Automation runbook.
Create an IAM role that trusts ssm.amazonaws.com with iam:UpdateAccessKey permissions, and ensure the configuration identity has iam:PassRole permissions for this role.
Systems Manager Automation needs to assume a service role with appropriate permissions to modify IAM resources, and the user must be authorized to pass this role to the service.

Key Concept

Automating security remediation through event-driven workflows using Amazon EventBridge, AWS Health events, and AWS Systems Manager Automation with proper IAM permissions.
Estimated Time:2m 0s
Rate this question

Topics

Event-Driven Automation and Operational Responses