Examkin

Question

Difficulty: EasyEventBridge and Systems Manager Remediation

An organization needs to automatically stop any Amazon EC2 instance that fails an AWS Config security compliance check. A SysOps administrator wants to route these compliance changes to a Systems Manager Automation document named AWS-StopEC2Instance to remediate the issue. Which two configuration actions are required to set up this automation pipeline?

  1. Configure an Amazon EventBridge rule with an event pattern matching AWS Config Compliance Change events, and set the target to the Systems Manager Automation document.Answer
  2. Create an IAM role with a trust policy for the EventBridge service principal (events.amazonaws.com) and a policy allowing the ssm:StartAutomationExecution action, then assign it to the EventBridge rule.Answer
  3. C
    Configure an AWS Config remediation action directly within the AWS Config rule using the EventBridge event pattern as the target.
  4. D
    Create an IAM policy with sts:AssumeRole for the EC2 instance profile, and attach it to the EventBridge rule without configuring Systems Manager permissions.
  5. E
    Create a Systems Manager Event Rule within the Systems Manager console to poll AWS Config compliance logs stored in Amazon S3.

Answer

To establish the automated remediation pipeline, you must configure an Amazon EventBridge rule matching AWS Config compliance changes targeting the Systems Manager Automation document, and assign an IAM role to the EventBridge rule allowing the ssm:StartAutomationExecution action.
Establishing this remediation pipeline requires two primary parts: defining the event routing and establishing the correct permissions. The event pattern matching AWS Config Compliance Change events correctly filters for non-compliant resources to trigger the target Automation document. The IAM role containing the trust relationship for the EventBridge service principal and the permission to start automation executions satisfies the access requirements.

Step-by-Step Solution

1
Configure the EventBridge Rule event pattern to capture compliance changes from AWS Config and set the target to the AWS-StopEC2Instance Automation document.
The EventBridge rule is set to trigger when an AWS Config compliance change event occurs.
This establishes the event detection and trigger pathway.
2
Create and assign an IAM execution role to the EventBridge rule that trusts events.amazonaws.com and permits ssm:StartAutomationExecution.
EventBridge has the authorization to call Systems Manager and start the remediation workflow.
EventBridge must have the security permissions to launch the target Automation document.

Key Concept

Automated remediation using Amazon EventBridge rules to trigger AWS Systems Manager Automation documents, requiring appropriate IAM execution permissions.
Rate this question

Topics

EventBridge and Systems Manager Remediation

More questions from this topic