Examkin

Question

Difficulty: HardEventBridge and Systems Manager Remediation

A company uses AWS Config to monitor resource compliance and has enabled the `s3-bucket-server-side-encryption-enabled` managed rule. A SysOps administrator wants to set up near-real-time automated remediation so that when a non-compliant Amazon S3 bucket is detected, a default server-side encryption configuration is applied using the `AWS-EnableS3BucketEncryption` Systems Manager Automation document. The remediation workflow must be orchestrated using Amazon EventBridge.

Which configuration actions must the administrator perform to establish this automated remediation pipeline? (Select TWO.)

  1. Configure the Amazon EventBridge rule with an event pattern that matches events from `aws.config` with a detail-type of `Config Rules Compliance Change` where the compliance type is `NON_COMPLIANT` for the specific S3 encryption rule.Answer
  2. Configure the Amazon EventBridge rule target to point to the `AWS-EnableS3BucketEncryption` Systems Manager Automation document, and assign an IAM execution role to the rule that contains both `ssm:StartAutomationExecution` permissions and `iam:PassRole` permissions for the Systems Manager Automation execution role.Answer
  3. C
    Configure the Amazon EventBridge rule target to invoke Systems Manager Run Command on the S3 bucket using the `AWS-EnableS3BucketEncryption` document, and pass the bucket name as an instance parameter.
  4. D
    Add `iam:PassRole` permissions directly to the trust policy of the Systems Manager Automation execution role, allowing the EventBridge service principal to assume the role directly.
  5. E
    Configure the AWS Config rule's automatic remediation target to directly invoke the Systems Manager Run Command API, and assign `ssm:SendCommand` permissions to the AWS Config service-linked role.

Answer

Configure the Amazon EventBridge rule with an event pattern matching non-compliant AWS Config compliance change events, and set the EventBridge rule target to the Automation document with an IAM execution role containing the start automation and pass role permissions.
To automate resource remediation, Amazon EventBridge must detect the compliance status change from AWS Config by filtering for compliance events containing the `NON_COMPLIANT` state for the specific Config rule. To execute the remediation, the rule targets the `AWS-EnableS3BucketEncryption` Systems Manager Automation document. The EventBridge rule execution role must be granted `ssm:StartAutomationExecution` to run the document, as well as `iam:PassRole` permissions to pass the remediation service role to Systems Manager.

Step-by-Step Solution

1
Define the event detection pattern.
Create an EventBridge rule that filters for `aws.config` events, matching the detail-type `Config Rules Compliance Change` and filtering for the specific `s3-bucket-server-side-encryption-enabled` rule with a compliance status of `NON_COMPLIANT`.
This ensures that remediation is only triggered immediately when a bucket is evaluated as non-compliant by AWS Config.
2
Configure the target and execution permissions.
Set the rule target to the `AWS-EnableS3BucketEncryption` Systems Manager Automation document, and assign an IAM execution role to the EventBridge rule.
EventBridge needs permissions to initiate the execution of the Automation document.
3
Grant PassRole permissions to the execution role.
Include the `iam:PassRole` permission in the EventBridge execution role, referencing the Amazon Resource Name (ARN) of the Systems Manager Automation service role.
Since the Automation document executes actions on S3 using a delegated service role, the initiator (EventBridge) must have permission to pass this service role to Systems Manager.

Key Concept

Event-driven remediation using Amazon EventBridge rules to detect AWS Config compliance changes and invoke AWS Systems Manager Automation documents with proper execution and role-passing permissions.
Estimated Time:2m 30s
Rate this question

Topics

EventBridge and Systems Manager Remediation

More questions from this topic