Examkin

Question

Difficulty: MediumAWS Config Rules and Conformance Packs

An organization's security policy requires all Amazon Aurora DB clusters to have copy tags to snapshots enabled. A SysOps Administrator needs to use AWS Config to evaluate compliance and automatically remediate non-compliant DB clusters using an AWS Systems Manager (SSM) Automation document. The remediation must run with a specific service role.

Which of the following configurations must be implemented to ensure the automated remediation executes successfully? (Select TWO.)

  1. Grant the iam:PassRole permission for the remediation IAM role to the IAM identity configuring the remediation action in AWS Config.Answer
  2. Configure the IAM role used for remediation with a trust policy that allows the AWS Systems Manager service principal (ssm.amazonaws.com) to assume the role.Answer
  3. C
    Add the iam:PassRole permission to the trust policy of the remediation IAM role, allowing AWS Config (config.amazonaws.com) to assume it directly.
  4. D
    Create an Amazon EventBridge rule that triggers whenever the AWS Config rule compliance status changes to NON_COMPLIANT, and configure the target of the EventBridge rule to execute the SSM Automation document directly.
  5. E
    Grant sts:AssumeRole permissions for the remediation role directly to the RDS service principal (rds.amazonaws.com).

Answer

The correct configurations are: granting the iam:PassRole permission to the IAM identity configuring remediation, and configuring the remediation IAM role to trust the Systems Manager service principal (ssm.amazonaws.com).
To set up automated remediation using AWS Config rules and Systems Manager (SSM) Automation, two primary configuration requirements must be satisfied. First, the IAM identity (such as a user or role) that configures the remediation action in AWS Config must possess the iam:PassRole permission for the remediation execution role, allowing them to associate it with the remediation action. Second, because Systems Manager Automation executes the actual remediation API calls on behalf of the user, the remediation role's trust policy must allow the ssm.amazonaws.com service principal to assume it.

Step-by-Step Solution

1
Verify the role-based execution pattern of AWS Config automated remediation.
Determine that Config delegates execution of remediation to Systems Manager Automation.
This identifies Systems Manager (ssm.amazonaws.com) as the principal that must assume the remediation execution role.
2
Identify the identity-based permission needed to delegate the remediation role.
Verify that the SysOps Administrator or the pipeline configuring AWS Config must have the iam:PassRole permission.
The AWS service needs permission to pass the role to Systems Manager to run the remediation task on the resource.
3
Configure the trust policy of the execution role.
Ensure the trust policy allows ssm.amazonaws.com to assume the role.
Without this trust relationship, Systems Manager cannot assume the execution role to run the remediation document.

Key Concept

AWS Config Automated Remediation Configuration and IAM Permissions
Rate this question

Topics

AWS Config Rules and Conformance Packs

More questions from this topic