A SysOps Administrator is configuring an AWS Systems Manager Automation workflow to execute a custom script via Run Command on a fleet of Amazon EC2 instances targeted by instance tags. The instances are running, have the SSM Agent installed, and have the AmazonSSMManagedInstanceCore policy attached to their IAM instance profile. The administrator attempts to run the Automation using a custom IAM service role, but the execution fails immediately with an authorization error. Which actions must the administrator take to successfully execute the Automation? (Select TWO.)
- Attach an IAM policy to the administrator's IAM identity that grants the iam:PassRole permission for the Automation service role.Answer
- Configure the trust relationship of the Automation service role to allow the ssm.amazonaws.com service principal to assume the role.Answer
- CConfigure a patch group tag on the EC2 instances that matches the name of the custom Run Command document.
- DAdd an inline policy with sts:AssumeRole directly to the administrator's IAM user policy targeting the Automation service role.
- EAssociate the target instances with a new subnet route table containing a route to a Systems Manager Gateway Endpoint.
Answer
Attach an IAM policy to the administrator's IAM identity that grants the iam:PassRole permission for the Automation service role, and configure the trust relationship of the Automation service role to allow the ssm.amazonaws.com service principal to assume the role.
To execute a Systems Manager Automation workflow using a custom service role, the executing administrator must have the iam:PassRole permission for that service role to delegate execution rights. Additionally, the service role itself must trust the Systems Manager service principal (ssm.amazonaws.com) to allow the service to assume the role and execute the tasks.
Step-by-Step Solution
Key Concept
Delegating permissions to AWS Systems Manager Automation using service roles and the iam:PassRole permission.