Examkin

Question

Difficulty: MediumSecurity Monitoring, Logging, and Compliance Auditing

An administrator wants to implement automatic remediation for non-compliant resources detected by an AWS Config rule. The rule identifies Amazon S3 buckets that allow public read access. The administrator plans to use the `AWS-DisableS3BucketPublicReadWrite` Systems Manager (SSM) Automation document as the remediation action. During configuration, the administrator encounters permission errors and the remediation fails to run.

Which actions must the administrator take to successfully resolve the permission issues and enable the automated remediation? (Select TWO.)

  1. Configure an IAM execution role with a trust policy that allows the ssm.amazonaws.com service principal to assume it, and attach policies granting permissions to modify S3 bucket settings.Answer
  2. Grant iam:PassRole permissions for the Systems Manager execution role to the IAM identity configuring the AWS Config remediation action.Answer
  3. C
    Attach an IAM policy to the target Amazon S3 buckets granting the iam:PassRole permission to the AWS Config service-linked role.
  4. D
    Configure an Amazon EventBridge rule with a target that points directly to the Amazon S3 service API to block public access, passing the AWS Config service role.
  5. E
    Enable detailed monitoring in Amazon CloudWatch for the AWS Config rules to reduce the evaluation latency to 1-minute intervals.

Answer

The administrator must configure an IAM execution role with a trust policy that allows the ssm.amazonaws.com service principal to assume it (with permissions to modify S3 settings), and grant the iam:PassRole permission for the execution role to the IAM identity configuring the remediation.
To remediate non-compliant resources automatically via AWS Config and Systems Manager Automation, two requirements must be satisfied. First, a role assumed by Systems Manager (ssm.amazonaws.com) must exist and have permissions to perform the corrective actions on S3. Second, the user or service principal initiating the automation setup must possess the iam:PassRole permission to pass this execution role to Systems Manager.

Step-by-Step Solution

1
Create an IAM role for Systems Manager execution.
An IAM role is created with a trust relationship for ssm.amazonaws.com and a policy allowing the required S3 bucket configuration changes.
Systems Manager needs permissions to perform the actual remediation steps on S3 buckets.
2
Assign the PassRole permission to the configuring administrator.
The administrator has iam:PassRole permission explicitly defined for the target execution role ARN in their IAM policy.
This permission allows the administrator to pass the Systems Manager execution role to the service for performing remediation actions.

Key Concept

AWS Config automated remediation using Systems Manager Automation documents requires configuring service trust relationships and granting the administrator iam:PassRole permissions to delegate roles to the service.
Rate this question

Topics

Security Monitoring, Logging, and Compliance Auditing

More questions from this topic