Examkin

Question

Difficulty: HardTroubleshooting Monitoring, Logging, and Permissions

An organization has configured an automated remediation workflow to manage costs for underutilized resources. A CloudWatch alarm is set to trigger when the CPU utilization of an Amazon EC2 instance falls below 10%10\% for three consecutive monitoring periods. The alarm is integrated with an Amazon EventBridge rule that targets the `AWS-StopEC2Instance` Systems Manager (SSM) Automation runbook. During a testing phase, the alarm changes to the `ALARM` state, but the EC2 instance continues to run. The administrator checks the EventBridge metrics and notices that the `FailedInvocations` metric for the rule is incrementing, while the `TriggeredRules` metric is also active. No execution history is visible in the Systems Manager Automation console. Which of the following troubleshooting steps should the administrator perform to resolve this issue? (Select TWO.)

  1. Verify that the IAM role associated with the EventBridge rule target has a trust policy allowing the `events.amazonaws.com` service principal to assume the role.Answer
  2. Verify that the IAM role associated with the EventBridge rule target has a policy that allows the `ssm:StartAutomationExecution` action on the target runbook.Answer
  3. C
    Add the `ssm:StartAutomationExecution` permission to the EC2 instance profile's IAM role.
  4. D
    Ensure that the trust policy of the IAM role used by the EventBridge rule allows the `ssm.amazonaws.com` service principal to assume the role.
  5. E
    Change the CloudWatch alarm action to target the Systems Manager Automation runbook directly, bypassing EventBridge.

Answer

Verify that the IAM role associated with the EventBridge rule target has a trust policy allowing the `events.amazonaws.com` service principal to assume the role, and verify that this IAM role has a policy that allows the `ssm:StartAutomationExecution` action on the target runbook.
To resolve the issue where EventBridge fails to invoke the Systems Manager Automation target, two key configuration components are required. First, the EventBridge rule must use an IAM role that trusts the EventBridge service (`events.amazonaws.com`) so the service can assume it. Second, the IAM role must have an attached policy granting the `ssm:StartAutomationExecution` permission on the Systems Manager runbook resource, enabling EventBridge to launch the automation. Without these, invocations fail, and the execution is never recorded in Systems Manager.

Step-by-Step Solution

1
Analyze the EventBridge metrics.
The active `TriggeredRules` metric combined with an incrementing `FailedInvocations` metric indicates that EventBridge is successfully catching the state change event but is failing to execute the target action (SSM Automation).
This isolates the failure to the interface between EventBridge and Systems Manager, suggesting a permissions or configuration issue rather than an alarm failure.
2
Verify EventBridge service trust relationship.
Ensure the execution role used by the EventBridge rule contains a trust policy allowing `events.amazonaws.com` to perform `sts:AssumeRole`.
EventBridge must be allowed to assume the specified IAM role to carry out tasks on behalf of the user.
3
Verify execution role permissions.
Ensure the execution role's permission policy allows the `ssm:StartAutomationExecution` action on the target Systems Manager runbook resource ARN.
Without explicit API permission in the policy, the assumed role cannot invoke the Systems Manager runbook, leading to target execution failures.

Key Concept

IAM Permissions for EventBridge Target Execution
Rate this question

Topics

Troubleshooting Monitoring, Logging, and Permissions

More questions from this topic