Examkin

Question

Difficulty: EasyEventBridge and Systems Manager Remediation

A SysOps administrator wants to automatically stop any Amazon EC2 instance that is launched without a 'Project' tag. The administrator has created an Amazon EventBridge rule that detects when a new EC2 instance state changes to 'running'. Which target configuration and IAM permissions are required to successfully perform this remediation?

  1. Configure the rule to target AWS Systems Manager Automation using the AWS-StopEC2Instance runbook, and associate the rule with an IAM service role that allows EventBridge to execute ssm:StartAutomationExecution.Answer
  2. B
    Configure the rule to target AWS Systems Manager Run Command using the AWS-StopEC2Instance runbook, and associate the rule with an IAM service role that allows EventBridge to execute ssm:SendCommand.
  3. C
    Configure the rule to target AWS Systems Manager Automation using the AWS-StopEC2Instance runbook, but omit the IAM execution role since EventBridge has implicit permissions to run Systems Manager Automation.
  4. D
    Configure the rule to target AWS Systems Manager State Manager, and associate the rule with an IAM service role that allows EventBridge to execute ssm:CreateAssociation.

Answer

Configure the rule to target AWS Systems Manager Automation using the AWS-StopEC2Instance runbook, and associate the rule with an IAM service role that allows EventBridge to execute ssm:StartAutomationExecution.
The correct option is configuring the rule to target AWS Systems Manager Automation using the AWS-StopEC2Instance runbook, and associating the rule with an IAM service role that allows EventBridge to execute ssm:StartAutomationExecution. Systems Manager Automation is designed for control-plane remediation tasks, such as stopping EC2 instances, and EventBridge requires an explicit IAM role with ssm:StartAutomationExecution permissions to invoke the target runbook.

Step-by-Step Solution

1
Identify the correct AWS Systems Manager feature for orchestrating remediation workflows.
AWS Systems Manager Automation is selected because it supports runbooks (like AWS-StopEC2Instance) designed for control-plane remediation.
Automation runbooks are used for multi-step workflows and AWS API tasks, whereas Run Command is for in-guest OS scripts.
2
Determine the required IAM authorization for EventBridge to invoke Systems Manager.
An IAM service role assumed by EventBridge with permissions to execute ssm:StartAutomationExecution is required.
EventBridge does not have implicit permissions to trigger targets and requires an explicit role to interact with other AWS services.

Key Concept

AWS Systems Manager Automation and Amazon EventBridge integration for automated remediation
Estimated Time:1m 0s
Rate this question

Topics

EventBridge and Systems Manager Remediation

More questions from this topic