Examkin

Question

Difficulty: MediumEventBridge and Systems Manager Remediation

A SysOps administrator wants to automate the remediation of non-compliant resources. AWS Config is configured with the `vpc-flow-logs-enabled` rule to monitor compliance. The administrator wants to use Amazon EventBridge and an AWS Systems Manager (SSM) Automation runbook to automatically enable VPC Flow Logs whenever a VPC is flagged as non-compliant. Which two configuration actions must the administrator perform to set up this remediation pipeline?

  1. Create an Amazon EventBridge rule with an event pattern that filters for AWS Config compliance change events where the compliance type is 'NON_COMPLIANT' for the `vpc-flow-logs-enabled` rule, and specify the Systems Manager Automation runbook as the target.Answer
  2. Attach an IAM policy to the EventBridge rule's IAM role that grants the `ssm:StartAutomationExecution` permission for the target Systems Manager Automation runbook.Answer
  3. C
    Create a CloudWatch log metric filter to scan AWS Config logs for non-compliant VPCs, and configure a CloudWatch alarm to trigger the Systems Manager Automation runbook.
  4. D
    Associate the `iam:PassRole` permission with the EventBridge service role to allow EventBridge to pass the flow logs role directly to AWS Config.
  5. E
    Configure an Amazon SNS topic as the EventBridge rule target, and subscribe the Systems Manager Automation runbook directly to the SNS topic.

Answer

The correct configuration actions are creating an Amazon EventBridge rule that filters for AWS Config compliance change events and targets the runbook, and granting the `ssm:StartAutomationExecution` permission to the EventBridge rule's IAM role.
The correct setup involves configuring an Amazon EventBridge rule that filters for AWS Config compliance change events (specifically for the rule checking VPC flow logs) and targets the Systems Manager Automation runbook. To execute the runbook, the EventBridge rule's IAM role must be granted the `ssm:StartAutomationExecution` permission.

Step-by-Step Solution

1
Configure the trigger source using AWS Config and EventBridge.
An EventBridge rule matches AWS Config events when the compliance status of the `vpc-flow-logs-enabled` rule transitions to 'NON_COMPLIANT'.
This establishes the event-driven mechanism to detect non-compliance immediately.
2
Configure the target and execution permissions for EventBridge.
The EventBridge rule is configured to target the Systems Manager Automation runbook, and its execution role is granted the `ssm:StartAutomationExecution` permission.
This allows EventBridge to authorize the invocation of the Systems Manager runbook.
3
Configure Systems Manager Automation role permissions.
Ensure the Systems Manager Automation execution role has permissions to execute the runbook commands (such as `ec2:CreateFlowLogs`) and the necessary `iam:PassRole` permission to delegate permissions.
This guarantees that the runbook can perform the actual remediation steps on the target VPC.

Key Concept

EventBridge rules can target AWS Systems Manager Automation runbooks to perform automated remediation when AWS Config detects compliance status changes.
Rate this question

Topics

EventBridge and Systems Manager Remediation

More questions from this topic