Examkin

Question

Difficulty: HardAWS Config Rules and Conformance Packs

A SysOps Administrator is configuring automatic remediation for an AWS Config rule named `s3-bucket-ssl-requests-only` using the `AWS-PublishSNSNotification` Systems Manager (SSM) Automation document. The administrator has created a custom IAM role named `SSMRemediationRole` containing the necessary permissions to publish to the Amazon SNS topic. When the administrator attempts to associate this remediation action with the AWS Config rule in the AWS Management Console, the operation fails with an authorization error. Which of the following actions should the administrator perform to resolve this issue and ensure that the remediation executes successfully? (Select TWO.)

  1. Attach an IAM policy to the administrator's IAM identity that grants the `iam:PassRole` permission for the `SSMRemediationRole` ARN.Answer
  2. Configure the trust policy of the `SSMRemediationRole` to allow the `ssm.amazonaws.com` service principal to assume the role.Answer
  3. C
    Attach an IAM policy to the AWS Config service role that grants the `iam:PassRole` permission for the `SSMRemediationRole` ARN.
  4. D
    Configure the trust policy of the `SSMRemediationRole` to allow the `config.amazonaws.com` service principal to assume the role.
  5. E
    Configure an Amazon EventBridge rule to detect AWS Config compliance changes and trigger the Systems Manager Automation document, bypassing the AWS Config remediation configuration.

Answer

Attach an IAM policy to the administrator's IAM identity that grants the iam:PassRole permission for the SSMRemediationRole ARN, and configure the trust policy of the SSMRemediationRole to allow the ssm.amazonaws.com service principal to assume the role.
To successfully configure and run automatic remediation for an AWS Config rule using a Systems Manager (SSM) Automation document with a custom execution role, two key permissions are required. First, the administrator setting up the remediation in the console or via the API must have the `iam:PassRole` permission on their IAM identity, referencing the ARN of the execution role. This allows the administrator to pass the role to the service. Second, because Systems Manager is the service that assumes the role to run the remediation document, the trust policy of the execution role must trust the `ssm.amazonaws.com` service principal.

Step-by-Step Solution

1
Identify the identity attempting to configure the remediation action and verify its permissions.
The identity lacks the iam:PassRole permission on the target role, resulting in an authorization error during configuration.
When configuring AWS Config automatic remediation with an SSM Automation document, the user or role performing the configuration must be authorized to pass the execution role to the service.
2
Add the iam:PassRole permission to the administrator's IAM policy for the specific SSMRemediationRole ARN.
The authorization error is resolved, allowing the remediation action to be successfully associated with the AWS Config rule.
This grants the administrator the ability to delegate the execution role to the target service.
3
Configure the trust relationship policy of the SSMRemediationRole.
The trust policy allows ssm.amazonaws.com to assume the role.
When AWS Config triggers the remediation, AWS Systems Manager assumes the specified role to execute the automation document; therefore, the role must trust the Systems Manager service principal.

Key Concept

Configuring automatic remediation in AWS Config rules requires the configuring administrator to have iam:PassRole permissions for the execution role, and the execution role must trust the ssm.amazonaws.com service principal since Systems Manager executes the automation.
Rate this question

Topics

AWS Config Rules and Conformance Packs

More questions from this topic