Examkin

Question

Difficulty: MediumAWS Systems Manager Configuration and Run Command Automation

A SysOps Administrator is using AWS Systems Manager Run Command to execute a custom configuration script on a fleet of Amazon EC2 instances. The SSM Agent is running on all instances, and an IAM instance profile with the `AmazonSSMManagedInstanceCore` policy is attached to each instance. The administrator configures the command to write its execution output to an Amazon S3 bucket. The S3 bucket is encrypted using a customer managed key (CMK) in AWS Key Management Service (AWS KMS). When the command is executed, it runs successfully on the instances, but the console displays a log delivery failure with an 'Access Denied' error. Which of the following actions will resolve this issue?

  1. Add permissions for `kms:GenerateDataKey` and `kms:Decrypt` to the IAM instance profile role of the EC2 instances, and update the KMS key policy to allow the instance profile role to use the key.Answer
  2. B
    Attach an IAM policy with `kms:GenerateDataKey` and `kms:Decrypt` permissions to the IAM instance profile role of the EC2 instances, without modifying the KMS key policy.
  3. C
    Add the `iam:PassRole` permission to the administrator's IAM user policy to allow the Run Command to pass the instance profile role to the EC2 instances.
  4. D
    Configure the target EC2 instances into a Systems Manager Patch Group and associate the group with a patch baseline that has KMS access enabled.

Answer

Add permissions for `kms:GenerateDataKey` and `kms:Decrypt` to the IAM instance profile role of the EC2 instances, and update the KMS key policy to allow the instance profile role to use the key.
The correct answer is to add the required KMS permissions to the instance profile role and update the KMS key policy. When Systems Manager Run Command is configured to upload logs to an S3 bucket, the upload is performed directly by the SSM Agent running on the target EC2 instance. The SSM Agent uses the credentials of the IAM instance profile role attached to the instance. Because the S3 bucket is encrypted with a customer managed KMS key, the agent must be able to generate a data key and decrypt using the KMS key. To authorize this, the permissions must be present in both the IAM instance profile role policy and the KMS key policy (since KMS key policies are authoritative).

Step-by-Step Solution

1
Identify the entity uploading the Run Command logs to S3.
The SSM Agent runs locally on each EC2 instance and uses the credentials from the attached IAM instance profile to upload logs directly to the S3 bucket.
Understanding which entity performs the operation is critical for applying the correct IAM permissions.
2
Determine the encryption requirements for the S3 bucket.
The S3 bucket is encrypted using a customer managed key (CMK) in AWS KMS, which requires the writing entity (the EC2 instance profile role) to have `kms:GenerateDataKey` and `kms:Decrypt` permissions.
Writing to an encrypted S3 bucket requires access to the KMS key that protects the bucket.
3
Configure the KMS key policy and IAM policies to allow access.
Grant the permissions in the IAM instance profile policy and also update the KMS key policy to explicitly trust the instance profile role.
KMS key policies are authoritative; an IAM policy alone cannot grant access to a KMS key unless the key policy delegates access or explicitly allows the principal.

Key Concept

AWS Systems Manager Run Command S3 Logging and KMS Key Policy Precedence
Rate this question

Topics

AWS Systems Manager Configuration and Run Command Automation