Examkin

Question

Difficulty: MediumEvent-Driven Automation and Operational Responses

A company requires all Amazon EBS volumes in its AWS account to be encrypted. A SysOps administrator configures the AWS Config managed rule `encrypted-volumes` to monitor compliance. If an unencrypted volume is created, AWS Config must automatically trigger an AWS Systems Manager (SSM) Automation document to delete the non-compliant volume.

What configuration steps must the administrator perform to successfully implement this automated remediation?

  1. Configure the AWS Config rule's automatic remediation to target the `AWS-DeleteEBSVolume` SSM document. Specify an IAM service role for the remediation that has permissions to delete EBS volumes, and grant the administrator the `iam:PassRole` permission for this service role.Answer
  2. B
    Configure the AWS Config rule's automatic remediation to target the `AWS-DeleteEBSVolume` SSM document. Specify an IAM service role for the remediation that has permissions to delete EBS volumes, and modify the trust policy of the administrator's IAM user to assume the service role.
  3. C
    Create an Amazon EventBridge rule triggered by AWS Config compliance change events, and target the `AWS-DeleteEBSVolume` SSM document, relying on the default EventBridge service-linked role to authorize the deletion of the volume.
  4. D
    Configure a CloudWatch Logs metric filter to scan AWS Config logs for non-compliance messages, create a CloudWatch alarm based on this metric, and set the alarm action to run the `AWS-DeleteEBSVolume` SSM document.

Answer

Configure the AWS Config rule's automatic remediation to target the `AWS-DeleteEBSVolume` SSM document. Specify an IAM service role for the remediation that has permissions to delete EBS volumes, and grant the administrator the `iam:PassRole` permission for this service role.
The correct configuration uses AWS Config's built-in automatic remediation feature targeting Systems Manager Automation. An IAM role with permissions to delete EBS volumes is passed to AWS Config to run the automation document on the administrator's behalf. For the administrator to successfully configure this delegation, they must have the `iam:PassRole` permission for that IAM role.

Step-by-Step Solution

1
Identify the target remediation document in AWS Systems Manager Automation, which is `AWS-DeleteEBSVolume`.
The target automation document is chosen for resource deletion.
AWS Config native remediation works by executing Systems Manager Automation documents.
2
Create or identify an IAM service role with the necessary permissions to delete EBS volumes, and grant the administrator identity configuring the remediation the `iam:PassRole` privilege for this role.
The service role is authorized to act, and the administrator is allowed to delegate this role to AWS Config.
AWS Config needs to pass this role to Systems Manager, which requires the administrator to have `iam:PassRole` permissions.
3
Configure the automatic remediation behavior on the AWS Config rule, specifying the document name and the parameter mapping for the resource ID.
The AWS Config rule automatically triggers the SSM Automation execution using the specified role when compliance evaluations report a non-compliant volume.
This establishes the event-driven automation link between the compliance state change and the remediation target.

Key Concept

AWS Config automatic remediation requires both an execution service role with target resource permissions and the `iam:PassRole` permission for the identity establishing the remediation link.
Rate this question

Topics

Event-Driven Automation and Operational Responses