Examkin

Question

Difficulty: MediumAWS Config Rules and Conformance Packs

A SysOps Administrator is configuring automated compliance remediation for AWS Config. The administrator wants to ensure that any Amazon S3 bucket found to be non-compliant with the `s3-bucket-public-read-prohibited` managed rule is automatically remediated using the `AWS-DisableS3BucketPublicReadWrite` AWS Systems Manager (SSM) Automation document. The administrator creates an IAM role for the SSM Automation execution but needs to ensure the remediation can be successfully initiated from the AWS Config console. Which configuration is required to allow AWS Config to execute the automation successfully?

  1. Configure remediation directly within the AWS Config rule using the SSM Automation document, and grant the administrator's IAM identity the `iam:PassRole` permission for the Automation execution role.Answer
  2. B
    Configure remediation directly within the AWS Config rule using the SSM Automation document, and modify the trust policy of the Automation execution role to allow the administrator's IAM identity to assume it via `sts:AssumeRole`.
  3. C
    Configure an Amazon EventBridge rule to detect compliance status changes from AWS Config, and configure the target of the EventBridge rule to trigger the AWS Config rule's remediation action.
  4. D
    Configure an Amazon EventBridge rule to monitor configuration changes, and set the target to the S3 bucket's resource policy to block public read access directly.

Answer

Configure remediation directly within the AWS Config rule using the SSM Automation document, and grant the administrator's IAM identity the `iam:PassRole` permission for the Automation execution role.
The correct option correctly identifies that the administrator needs the `iam:PassRole` permission. When configuring AWS Config remediation with a custom SSM Automation execution role, the user setting up the automation must have the permission to pass that role to the Systems Manager service.

Step-by-Step Solution

1
Select the remediation target in the AWS Config console.
The AWS Config rule `s3-bucket-public-read-prohibited` is configured to use the Systems Manager Automation document `AWS-DisableS3BucketPublicReadWrite`.
AWS Config uses Systems Manager Automation documents to orchestrate automated remediation of non-compliant resources.
2
Ensure the administrator setting up the remediation has the necessary IAM permissions to delegate the execution role.
The administrator's IAM policy is updated to include the `iam:PassRole` permission targeting the ARN of the SSM Automation execution role.
When configuring AWS services to assume an IAM role on your behalf, you must have the `iam:PassRole` permission to prevent unauthorized privilege escalation.

Key Concept

AWS Config automated remediation requires the user configuring the rule to have `iam:PassRole` permissions to pass the execution role to the Systems Manager service.
Estimated Time:1m 30s
Rate this question

Topics

AWS Config Rules and Conformance Packs

More questions from this topic