Examkin

Question

Difficulty: HardAWS Config Rules and Conformance Packs

To enforce a security policy, an operations team uses a conformance pack containing the vpc-flow-logs-enabled AWS Config rule. A SysOps Administrator is responsible for setting up automated remediation. The administrator creates an IAM role named ConfigRemediationRole with a trust policy for ssm.amazonaws.com and attaches a permissions policy to enable flow logs. When configuring the automatic remediation action in AWS Config with the AWS-EnableVPCFlowLogs Systems Manager Automation document, the administrator receives an 'Access Denied' error upon saving the configuration. Which action should the administrator take to successfully save the remediation configuration?

  1. Add a policy to the administrator's IAM user or role that permits the iam:PassRole action on the ConfigRemediationRole resource.Answer
  2. B
    Edit the trust policy of ConfigRemediationRole to allow the config.amazonaws.com service principal to assume the role instead of ssm.amazonaws.com.
  3. C
    Set up an Amazon EventBridge rule to monitor AWS Config compliance change events and target the Systems Manager Automation document.
  4. D
    Attach an IAM policy to the ConfigRemediationRole allowing the iam:PassRole action to be performed on the ssm.amazonaws.com service principal.

Answer

Add a policy to the administrator's IAM user or role that permits the iam:PassRole action on the ConfigRemediationRole resource.
The correct answer is correct because AWS Config requires the user configuring automated remediation to have the `iam:PassRole` permission for the role passed to Systems Manager Automation. This permission must be attached to the IAM identity of the administrator who is saving the configuration.

Step-by-Step Solution

1
Analyze the error context.
The 'Access Denied' error occurs when saving the remediation configuration in AWS Config, indicating that the administrator's IAM identity lacks the necessary permissions to associate the execution role with the Config remediation rule.
AWS Config needs to pass the ConfigRemediationRole to Systems Manager to execute the remediation document.
2
Determine the required IAM permission.
The identity configuring the remediation must be authorized to pass the remediation role. This requires the iam:PassRole permission.
The iam:PassRole permission is a security control that prevents users from passing roles with higher privileges than their own to AWS services.
3
Apply the permission to the administrator's policy.
Adding the iam:PassRole action targeting the ConfigRemediationRole ARN to the administrator's IAM policy successfully resolves the Access Denied error and allows the configuration to save.
This grants the administrator permission to associate the specific role with the remediation configuration.

Key Concept

AWS Config Remediation IAM Permissions
Estimated Time:2m 30s
Rate this question

Topics

AWS Config Rules and Conformance Packs

More questions from this topic