Examkin

Question

Difficulty: EasyEventBridge and Systems Manager Remediation

A SysOps administrator wants to automate the remediation of Amazon S3 buckets that are accidentally configured with public write permissions. The administrator creates an Amazon EventBridge rule that triggers when a PutBucketPolicy API call is logged in AWS CloudTrail. The target of this rule is the AWS Systems Manager Automation document AWS-DisableS3BucketPublicWrite. When testing the setup by making a bucket public, the remediation fails to execute. Which configuration action is required to resolve this issue?

  1. Attach the iam:PassRole permission to the EventBridge IAM role to allow it to pass the Systems Manager execution role to the Systems Manager service.Answer
  2. B
    Modify the trust relationship of the EventBridge execution role to allow sts:AssumeRole to the S3 service, which removes the need for any role-passing permissions.
  3. C
    Reconfigure the EventBridge rule to send the CloudTrail event to an Amazon SNS topic, which can directly trigger the Systems Manager Automation document.
  4. D
    Enable detailed monitoring on the S3 bucket to increase the CloudTrail event logging frequency so that EventBridge can detect the changes.

Answer

Attach the iam:PassRole permission to the EventBridge IAM role to allow it to pass the Systems Manager execution role to the Systems Manager service.
The correct action is to attach the iam:PassRole permission to the EventBridge IAM role. When EventBridge initiates a Systems Manager Automation document that runs with an execution role, it must pass that role to Systems Manager. Without the iam:PassRole permission, the operation fails authorization and the automation fails to start.

Step-by-Step Solution

1
Identify the authorization requirements between services.
EventBridge requires permissions to start the Systems Manager Automation and to pass the execution role to Systems Manager.
When configuring AWS services to perform actions on your behalf using specific roles, the calling service must be granted the permission to pass the role.
2
Update the IAM policy for the EventBridge execution role.
The iam:PassRole permission is added to the EventBridge service role targeting the Systems Manager automation role.
This allows the EventBridge service to delegate execution rights to Systems Manager, enabling the remediation workflow to start successfully.

Key Concept

IAM PassRole requirement for service-to-service automation triggering
Rate this question

Topics

EventBridge and Systems Manager Remediation

More questions from this topic