A SysOps administrator is configuring an automated remediation pipeline to stop any Amazon EC2 instance that is flagged as non-compliant by an AWS Config rule named `required-tags`. The remediation must execute the `AWS-StopEC2Instance` AWS Systems Manager Automation document automatically when compliance fails.
Which TWO configuration actions are required to successfully set up this automation pipeline? (Select TWO.)
- Configure an Amazon EventBridge rule with an event pattern that filters for AWS Config compliance change events, specifying the rule name `required-tags` and a compliance status of `NON_COMPLIANT`.Answer
- Configure an IAM role for the EventBridge rule that includes `ssm:StartAutomationExecution` permissions for the target document and `iam:PassRole` permissions for the Systems Manager Automation service role.Answer
- CConfigure the EventBridge rule to use an Input Transformer to convert an EventBridge schedule payload into an AWS Config API query parameter.
- DConfigure an IAM role for the Systems Manager Automation service role that contains `sts:AssumeRole` permissions for AWS Config, and configure AWS Config to trigger the execution directly without EventBridge.
- EConfigure an IAM policy on the EC2 instance's IAM instance profile that grants `ssm:StartAutomationExecution` and `iam:PassRole` permissions to the Amazon EventBridge service principal.
Answer
Configuring an EventBridge rule that filters for compliance changes with a status of `NON_COMPLIANT` for the `required-tags` rule, and creating an IAM role for the EventBridge rule with `ssm:StartAutomationExecution` and `iam:PassRole` permissions.
The correct actions involve configuring an EventBridge rule with an event pattern that filters for AWS Config compliance change events, specifying the rule name `required-tags` and a compliance status of `NON_COMPLIANT`. Additionally, the EventBridge rule execution role must be configured with `ssm:StartAutomationExecution` permissions to call the Systems Manager target, along with `iam:PassRole` permissions to pass the Systems Manager Automation service role during invocation.
Step-by-Step Solution
Key Concept
Automating resource remediation using EventBridge rules to trigger Systems Manager Automation documents, which requires specific event filtering patterns and IAM permissions (including ssm:StartAutomationExecution and iam:PassRole).