Examkin

Question

Difficulty: EasyAWS Config Rules and Conformance Packs

A SysOps Administrator is configuring automatic remediation for an AWS Config rule that checks if Amazon S3 buckets have server-side encryption enabled. The administrator wants to use an AWS Systems Manager (SSM) Automation document to automatically remediate non-compliant buckets. Which of the following configuration steps are required to set up this automated remediation? (Select TWO.)

  1. Associate the AWS Config rule with the AWS-ConfigureS3BucketEncryption Systems Manager Automation document as the remediation target.Answer
  2. Specify an IAM execution role for the remediation, and grant the administrator the iam:PassRole permission for this role.Answer
  3. C
    Create an Amazon EventBridge rule that monitors AWS Config compliance change events to trigger the Systems Manager Automation document.
  4. D
    Attach an IAM policy to the administrator that allows sts:AssumeRole for the Systems Manager service principal to run the remediation.
  5. E
    Configure the AWS Config rule to send non-compliant resource alerts directly to an Amazon Simple Queue Service (Amazon SQS) queue to initiate the remediation.

Answer

Associate the AWS Config rule with the AWS-ConfigureS3BucketEncryption Systems Manager Automation document as the remediation target, and specify an IAM execution role for the remediation while granting the administrator the iam:PassRole permission for this role.
To set up automatic remediation in AWS Config, you must define the target Systems Manager Automation document (such as AWS-ConfigureS3BucketEncryption) and provide an IAM execution role that has permissions to remediate the resource. Crucially, the administrator configuring the rule must have the iam:PassRole permission to pass this execution role to AWS Config.

Step-by-Step Solution

1
Select the correct AWS Systems Manager Automation document to perform the S3 encryption remediation.
The target remediation document is associated with the AWS Config rule.
AWS Config requires a target action, typically a pre-defined or custom SSM Automation document, to perform remediation.
2
Configure the remediation execution role and permissions.
An IAM role with S3 write permissions is designated, and the administrator is granted the iam:PassRole permission.
AWS Config must assume a role to execute the remediation actions on behalf of the user, requiring the administrator to pass the role explicitly.

Key Concept

AWS Config Remediation Configuration
Rate this question

Topics

AWS Config Rules and Conformance Packs

More questions from this topic