Examkin

Question

Difficulty: MediumEventBridge and Systems Manager Remediation

A company's compliance policy requires all Amazon RDS DB instances to have automated backups enabled. To monitor this, a SysOps administrator deploys the AWS Config managed rule `rds-backup-enabled`. The administrator wants to establish an automated remediation workflow that triggers when a DB instance is flagged as non-compliant. The remediation must use Amazon EventBridge to invoke an AWS Systems Manager Automation document that modifies the RDS instance to enable backups. Which combination of configuration steps and IAM permissions is required to successfully implement this automated remediation?

  1. Create an EventBridge rule that triggers on AWS Config compliance changes. Configure the rule to target Systems Manager Automation, assigning an IAM role to EventBridge with ssm:StartAutomationExecution permissions. Specify a service role with rds:ModifyDBInstance permissions in the Automation parameters, and ensure iam:PassRole is granted to the configuring principal.Answer
  2. B
    Create an EventBridge rule that triggers on AWS Config compliance changes. Configure the rule to target Systems Manager Run Command on the RDS instance. Assign an IAM role to EventBridge with ssm:SendCommand and rds:ModifyDBInstance permissions to execute the modification script.
  3. C
    Create an EventBridge rule that triggers on AWS Config compliance changes. Configure the rule to target Systems Manager Automation, assigning an IAM role to EventBridge with both ssm:StartAutomationExecution and rds:ModifyDBInstance permissions, without specifying a separate service role parameter.
  4. D
    Create an EventBridge rule that triggers on AWS Config compliance changes. Configure the rule to target an Amazon SNS topic. Configure the SNS topic to directly execute the Systems Manager Automation document using the SNS service role.

Answer

Create an EventBridge rule that triggers on AWS Config compliance changes. Configure the rule to target Systems Manager Automation, assigning an IAM role to EventBridge with ssm:StartAutomationExecution permissions. Specify a service role with rds:ModifyDBInstance permissions in the Automation parameters, and ensure iam:PassRole is granted to the configuring principal.
The correct answer configuration properly aligns permissions and targets. An EventBridge rule detects the AWS Config non-compliance event. It uses its execution role to trigger the Systems Manager Automation document via ssm:StartAutomationExecution. To perform the API modification of the RDS instance, the Automation document assumes an explicit service role (AutomationAssumeRole) containing rds:ModifyDBInstance permissions. The user or service creating the remediation rule must have iam:PassRole permission to associate the service role with the Automation document.

Step-by-Step Solution

1
Configure the EventBridge Rule to match the compliance change event.
EventBridge will intercept compliance change events from AWS Config for the rds-backup-enabled rule when the status changes to NON_COMPLIANT.
To initiate automated remediation, EventBridge must listen to the specific compliance evaluation events generated by AWS Config.
2
Set the target of the EventBridge rule to Systems Manager Automation and assign the required IAM permissions.
EventBridge will have permissions to execute the Systems Manager Automation document, and Systems Manager Automation will run with a service role that has RDS modification permissions.
EventBridge requires ssm:StartAutomationExecution permissions to start the automation. Systems Manager Automation requires a service role (AutomationAssumeRole) with rds:ModifyDBInstance permissions to enable RDS backups on behalf of the user.
3
Configure the iam:PassRole permission on the configuring principal.
The principal configuring the remediation can successfully delegate the service role to Systems Manager Automation.
AWS requires the iam:PassRole permission whenever a service role is passed to another service to prevent privilege escalation.

Key Concept

Configuring automated remediation using AWS Config compliance events, EventBridge rules, and Systems Manager Automation with appropriate IAM permissions.
Estimated Time:1m 30s
Rate this question

Topics

EventBridge and Systems Manager Remediation

More questions from this topic