Examkin

Question

Difficulty: MediumTroubleshooting Monitoring, Logging, and Permissions

A SysOps administrator is troubleshooting an automated compliance remediation workflow. An Amazon EventBridge rule is configured to detect non-compliant Amazon S3 buckets reported by AWS Config and trigger an AWS Systems Manager (SSM) Automation runbook to remediate them. The EventBridge rule successfully fires, but the Systems Manager Automation execution fails immediately with an access denied error. Which of the following actions are required to resolve this issue? (Select TWO.)

  1. Attach an IAM policy to the EventBridge execution role that grants the iam:PassRole permission for the Systems Manager Automation service role.Answer
  2. Configure the trust policy of the Systems Manager Automation service role to allow the ssm.amazonaws.com service principal to assume the role.Answer
  3. C
    Modify the AWS Config rule's remediation configuration to execute the runbook directly, as Amazon EventBridge rules cannot target Systems Manager Automation.
  4. D
    Enable CloudWatch detailed monitoring on the target S3 buckets to ensure EventBridge receives compliance status events within one minute.
  5. E
    Modify the log retention policy of the AWS Config delivery channel's CloudWatch Logs log group to keep logs indefinitely.

Answer

Attach an IAM policy to the EventBridge execution role that grants the iam:PassRole permission for the Systems Manager Automation service role, and configure the trust policy of the Systems Manager Automation service role to allow the ssm.amazonaws.com service principal to assume the role.
To resolve the access denied error when Amazon EventBridge triggers Systems Manager Automation, two permissions must be configured. First, the EventBridge execution role must be granted the iam:PassRole permission for the Systems Manager Automation service role. Second, the Systems Manager Automation service role must trust the ssm.amazonaws.com service principal so that the Systems Manager service can successfully assume the role to run the remediation steps.

Step-by-Step Solution

1
Check the EventBridge execution role permissions.
Confirm that the role has permissions to run SSM Automation (ssm:StartAutomationExecution) and pass the automation service role (iam:PassRole).
EventBridge needs to pass the execution role to Systems Manager to run the remediation workflow on its behalf.
2
Examine the trust policy of the Systems Manager Automation service role.
Ensure that the trust policy allows the ssm.amazonaws.com service principal to perform sts:AssumeRole.
Without this trust relationship, Systems Manager cannot assume the role to run the runbook's steps.

Key Concept

IAM permissions and service trust relationships required for EventBridge to trigger Systems Manager Automation.
Rate this question

Topics

Troubleshooting Monitoring, Logging, and Permissions

More questions from this topic