Examkin

Question

Difficulty: HardEventBridge and Systems Manager Remediation

A SysOps administrator is configuring automated remediation to isolate Amazon EC2 instances when Amazon GuardDuty detects command-and-control (C&C) activity. The administrator wants to use Amazon EventBridge to detect the GuardDuty finding and trigger the AWS Systems Manager Automation document AWS-StopEC2Instance to stop the affected instance. Which combination of target configuration and IAM permissions will successfully implement this automated remediation?

  1. A
    Configure the EventBridge rule to forward the GuardDuty findings to AWS Config. Configure an AWS Config custom rule to trigger the Systems Manager Automation document as a remediation action, and attach an IAM policy to AWS Config allowing the config.amazonaws.com service principal to perform the ssm:StartAutomationExecution action.
  2. B
    Configure the EventBridge rule with the Systems Manager Automation document as the target. Provide an IAM service role for EventBridge that allows the events.amazonaws.com service principal to assume it, and attach a policy allowing ssm:StartAutomationExecution for the target document, relying on the Automation document's default execution permissions without iam:PassRole.
  3. Configure the EventBridge rule with the Systems Manager Automation document as the target. Provide an IAM service role for EventBridge that allows the events.amazonaws.com service principal to assume it, and attach a policy allowing ssm:StartAutomationExecution for the target document and iam:PassRole for the Systems Manager Automation execution role.Answer
  4. D
    Configure the EventBridge rule with the Systems Manager Automation document as the target. Modify the IAM trust policy of the Systems Manager Automation execution role to trust events.amazonaws.com directly, and use an EventBridge input transformer to map the EC2 instance ID to the execution role ARN in the target payload.

Answer

Configure the EventBridge rule with the Systems Manager Automation document as the target. Provide an IAM service role for EventBridge that allows the events.amazonaws.com service principal to assume it, and attach a policy allowing ssm:StartAutomationExecution for the target document and iam:PassRole for the Systems Manager Automation execution role.
The correct option correctly configures the EventBridge rule target to the Systems Manager Automation document, and grants EventBridge the necessary IAM permissions. Specifically, it allows EventBridge to assume a role to call ssm:StartAutomationExecution on the target document and includes the iam:PassRole permission so that EventBridge can pass the Systems Manager Automation execution role to the Systems Manager service, which executes the actions.

Step-by-Step Solution

1
Configure the Amazon EventBridge rule pattern to match Amazon GuardDuty findings representing command-and-control activity.
GuardDuty finding events will match the rule pattern and trigger the designated targets.
This establishes the detection trigger in the event flow.
2
Set the EventBridge rule target to the AWS Systems Manager Automation document AWS-StopEC2Instance, specifying the EC2 instance ID from the event as a parameter.
The target document is selected and mapped to the affected resource.
This establishes the remediation action in the event flow.
3
Create an IAM role for EventBridge with a trust policy allowing events.amazonaws.com and a permissions policy allowing ssm:StartAutomationExecution and iam:PassRole for the execution role.
EventBridge receives permissions to execute the automation and pass the necessary service role to Systems Manager.
EventBridge requires these permissions to initiate the automation run under the context of the automation execution role.

Key Concept

Configuring event-driven automated remediation using Amazon EventBridge and AWS Systems Manager Automation requires setting up an IAM service role for EventBridge with both the ssm:StartAutomationExecution permission and the iam:PassRole permission to securely pass the execution role to Systems Manager.
Estimated Time:3m 0s
Rate this question

Topics

EventBridge and Systems Manager Remediation

More questions from this topic