Examkin

Question

Difficulty: HardAWS Systems Manager Configuration and Run Command Automation

A SysOps Administrator is running a compliance verification script across a fleet of Amazon EC2 instances in a private subnet using AWS Systems Manager Run Command with the AWS-RunShellScript document. The instances have the SSM Agent installed and running, and they are associated with an IAM instance profile containing the AmazonSSMManagedInstanceCore managed policy. To capture the full script output, the administrator specifies a custom Amazon S3 bucket in the Run Command parameters. The execution completes, but the command status shows as 'Failed' on all instances, and no logs are delivered to the S3 bucket. What should the administrator do to resolve this issue?

  1. Attach an IAM policy to the EC2 instances' IAM role that grants the s3:PutObject permission for the target S3 bucket.Answer
  2. B
    Associate a custom IAM service role with the Systems Manager service that has write access to the S3 bucket, and grant the administrator the iam:PassRole permission for this role.
  3. C
    Associate the instances with a Systems Manager Patch Group whose name matches the target S3 bucket path.
  4. D
    Configure a Gateway VPC Endpoint for Amazon S3 and associate it with the route tables of the EC2 instances' subnets.

Answer

Attach an IAM policy to the EC2 instances' IAM role that grants the s3:PutObject permission for the target S3 bucket.
When configuring AWS Systems Manager Run Command to upload output logs to an Amazon S3 bucket, the SSM Agent running locally on each EC2 instance performs the upload. The agent executes within the security context of the instance's IAM instance profile. Since the default AmazonSSMManagedInstanceCore managed policy does not grant permissions to write to arbitrary S3 buckets, you must explicitly attach a policy to the instance profile role that allows the s3:PutObject action on the target S3 bucket.

Step-by-Step Solution

1
Analyze how Systems Manager Run Command uploads logs to Amazon S3.
Identify that the SSM Agent running inside the EC2 instance OS initiates the upload directly to S3.
This establishes that the credentials used for the upload belong to the EC2 instance's IAM instance profile, not a service role.
2
Review the default permissions of the EC2 instance profile.
Determine that the AmazonSSMManagedInstanceCore policy allows communication with Systems Manager but does not grant write access to custom S3 buckets.
This explains why the command fails when attempting to upload logs to a newly specified custom S3 bucket.
3
Determine the necessary IAM policy adjustment.
Conclude that an IAM policy allowing the s3:PutObject action on the target bucket must be attached to the IAM role associated with the EC2 instances.
This provides the required write permission to allow the SSM Agent to successfully deliver the logs and complete the execution status.

Key Concept

EC2 Instance Profile permissions for SSM Run Command S3 log redirection
Estimated Time:2m 0s
Rate this question

Topics

AWS Systems Manager Configuration and Run Command Automation