Examkin

Question

Difficulty: HardSecurity Monitoring, Logging, and Compliance Auditing

A SysOps Administrator is configuring automated remediation for non-compliant resources detected by AWS Config. The administrator is using an AWS Systems Manager (SSM) Automation document to remediate non-compliant Amazon S3 buckets. The administrator creates an IAM role named `S3RemediationRole` with the required permissions to modify bucket configurations. When configuring the remediation action in AWS Config, the administrator specifies the Amazon Resource Name (ARN) of `S3RemediationRole` as the `AutomationAssumeRole` parameter. However, when the remediation is triggered, the execution fails to start and indicates that the role cannot be assumed. Which action must the administrator take to resolve this issue?

  1. A
    Add the `iam:PassRole` permission to the `S3RemediationRole` permissions policy to allow the role to pass itself.
  2. B
    Modify the trust policy of `S3RemediationRole` to allow the `config.amazonaws.com` service principal to assume the role.
  3. Modify the trust policy of `S3RemediationRole` to allow the `ssm.amazonaws.com` service principal to assume the role.Answer
  4. D
    Create an Amazon EventBridge rule that triggers the SSM Automation document directly and configure the target to use `config.amazonaws.com` as the execution role.

Answer

Modify the trust policy of `S3RemediationRole` to allow the `ssm.amazonaws.com` service principal to assume the role.
AWS Config automated remediation executes remediations by calling AWS Systems Manager Automation. The IAM role specified as `AutomationAssumeRole` is assumed by the Systems Manager Automation service. Therefore, the trust policy of `S3RemediationRole` must list `ssm.amazonaws.com` as a trusted entity and allow the `sts:AssumeRole` action. Without this permission, Systems Manager cannot assume the role, and the remediation task fails to initialize.

Step-by-Step Solution

1
Identify the service executing the automated remediation document.
AWS Config delegates the execution of remediation actions to AWS Systems Manager Automation.
Understanding which service performs the action is critical to determining which service principal needs assume role permissions.
2
Determine the required service principal for the trust relationship.
The Systems Manager service principal (`ssm.amazonaws.com`) must assume `S3RemediationRole` to execute the remediation actions.
Since Systems Manager Automation is the caller, it must be the trusted entity in the IAM role's trust policy.
3
Update the trust policy of the IAM role.
The trust policy of `S3RemediationRole` is updated to allow `sts:AssumeRole` for the `ssm.amazonaws.com` service principal.
This allows the remediation execution to start successfully without encountering authentication or assume role errors.

Key Concept

AWS Config automated remediation utilizes Systems Manager Automation documents, meaning the specified execution role must trust the Systems Manager service principal (`ssm.amazonaws.com`), not AWS Config.
Estimated Time:2m 0s
Rate this question

Topics

Security Monitoring, Logging, and Compliance Auditing

More questions from this topic