Examkin

Question

Difficulty: MediumTroubleshooting Monitoring, Logging, and Permissions

A SysOps administrator is configuring an AWS Config rule to automatically remediate non-compliant Amazon S3 buckets. The remediation action is set to run an AWS Systems Manager (SSM) Automation document. The administrator creates a service role named ConfigRemediationRole with a trust policy allowing ssm.amazonaws.com to assume it and attaches the necessary permissions to remediate S3 buckets. However, when the administrator attempts to assign this role to the remediation configuration in AWS Config, the console returns an error indicating that they are not authorized to perform the action.

Which action is required to resolve this authorization failure?

  1. A
    Modify the S3 bucket policy to grant the administrator's IAM user kms:Decrypt and kms:GenerateDataKey permissions.
  2. Add the iam:PassRole permission for the ConfigRemediationRole to the IAM policy of the administrator who is configuring the remediation.Answer
  3. C
    Add the sts:AssumeRole permission for the config.amazonaws.com service principal directly to the administrator's IAM policy.
  4. D
    Configure an Amazon EventBridge rule to route the remediation request directly to the S3 bucket, bypassing AWS Config.

Answer

Add the iam:PassRole permission for the ConfigRemediationRole to the IAM policy of the administrator who is configuring the remediation.
When configuring AWS Config remediation (which uses Systems Manager Automation under the hood), the SysOps administrator must specify an IAM service role that the automation service will assume to execute the tasks. To assign this role, the administrator's IAM identity must have the iam:PassRole permission. This prevents users from escalating their privileges by passing highly privileged roles to AWS services.

Step-by-Step Solution

1
Identify the service role being passed to the remediation action (ConfigRemediationRole).
Confirm that the service role is designed to be assumed by ssm.amazonaws.com.
Ensure the service role itself is correctly configured before troubleshooting the administrator's rights.
2
Examine the administrator's IAM policy permissions.
Observe that the administrator lacks the iam:PassRole permission for ConfigRemediationRole.
AWS services require iam:PassRole to verify that the user configuring the service has permission to delegate the role.
3
Add the iam:PassRole action targeting the ConfigRemediationRole ARN to the administrator's IAM policy.
The administrator is now authorized to assign the service role to the AWS Config remediation action.
This grants the explicit authorization needed by the IAM console and API to pass the role to Systems Manager.

Key Concept

IAM PassRole Permission for Service Configurations
Rate this question

Topics

Troubleshooting Monitoring, Logging, and Permissions

More questions from this topic