Examkin

Question

Difficulty: HardEventBridge and Systems Manager Remediation

A company's security compliance audit reveals that several Amazon EBS snapshots have been shared publicly. The SysOps administrator must implement a solution to automatically revert any publicly shared EBS snapshots to private. The administrator decides to use Amazon EventBridge to detect the change and trigger the AWS Systems Manager Automation runbook `AWS-ModifySnapshotAttribute`.

Which actions are required to configure the automation pipeline and ensure it has the necessary permissions? (Select TWO.)

  1. Configure an IAM role for the EventBridge rule target that grants the `ssm:StartAutomationExecution` permission for the `AWS-ModifySnapshotAttribute` runbook.Answer
  2. Configure an IAM service role for the Systems Manager Automation execution that contains the `ec2:ModifySnapshotAttribute` permission.Answer
  3. C
    Configure an IAM role for the EventBridge rule target that grants the `iam:PassRole` permission for the EC2 Instance Profile role to allow direct modification of the snapshot.
  4. D
    Configure an Amazon EventBridge rule with an input transformer that triggers an Amazon EC2 Run Command target using the `AWS-RunShellScript` document on the affected EBS snapshot.
  5. E
    Configure an AWS Config rule to send a custom notification status to an Amazon SNS topic, and subscribe the Systems Manager Automation runbook directly to the SNS topic.

Answer

The correct actions are: configuring an IAM role for the EventBridge rule target that grants `ssm:StartAutomationExecution` for the target runbook, and configuring an IAM service role for the Systems Manager Automation execution that contains the `ec2:ModifySnapshotAttribute` permission.
To automate the remediation of public EBS snapshots, the EventBridge rule must have permission to invoke the Systems Manager Automation target, which is achieved by assigning an IAM role with the `ssm:StartAutomationExecution` permission. Additionally, the Systems Manager Automation runbook must have a service role (Automation Assume Role) with the necessary `ec2:ModifySnapshotAttribute` permission to execute the action of making the snapshot private.

Step-by-Step Solution

1
Determine the service integration triggers and the permissions needed for EventBridge to invoke Systems Manager Automation.
EventBridge requires a role with `ssm:StartAutomationExecution` to run the Systems Manager Automation target.
By default, EventBridge rules need explicit permissions to trigger target resources. An IAM role is associated with the target to allow the start execution action on the `AWS-ModifySnapshotAttribute` runbook.
2
Determine the permissions required for the execution of the Systems Manager Automation runbook to modify snapshot configurations.
Systems Manager Automation requires an execution role (Automation Assume Role) with the `ec2:ModifySnapshotAttribute` permission.
The runbook itself modifies the EC2 EBS snapshot attribute to make it private, which requires calling the EC2 API. This action is authorized using the Systems Manager Automation execution role.

Key Concept

Automating remediation of public resources using EventBridge and Systems Manager Automation.
Estimated Time:2m 30s
Rate this question

Topics

EventBridge and Systems Manager Remediation

More questions from this topic