Examkin

Question

Difficulty: MediumEvent-Driven Automation and Operational Responses

A SysOps administrator is configuring an automated response to stop underutilized Amazon EC2 instances. The administrator sets up an Amazon EventBridge rule that is triggered when a specific Amazon CloudWatch alarm enters the ALARM state. The EventBridge rule is configured with a target to execute the `AWS-StopEC2Instance` Systems Manager (SSM) Automation document using a custom execution role named `SSMAutomationExecutionRole`. The `SSMAutomationExecutionRole` has the policy permissions to stop EC2 instances and trusts `ssm.amazonaws.com`. During testing, the alarm triggers but the execution fails to start.

Which configuration change will allow the EventBridge rule to successfully trigger the Systems Manager Automation?

  1. Grant the EventBridge execution role the `ssm:StartAutomationExecution` permission and the `iam:PassRole` permission for the `SSMAutomationExecutionRole`.Answer
  2. B
    Modify the trust policy of the `SSMAutomationExecutionRole` to allow the EventBridge service principal (`events.amazonaws.com`) to assume the role instead of `ssm.amazonaws.com`.
  3. C
    Create an Amazon SNS topic as the target for the EventBridge rule, and subscribe the Systems Manager Automation document directly to the SNS topic.
  4. D
    Enable detailed monitoring on the target EC2 instances to allow EventBridge to process the CloudWatch metric alarm state changes.

Answer

Grant the EventBridge execution role the `ssm:StartAutomationExecution` permission and the `iam:PassRole` permission for the `SSMAutomationExecutionRole`.
For EventBridge to trigger a Systems Manager Automation execution using a specific execution role (AutomationAssumeRole), the role assigned to EventBridge must possess the `ssm:StartAutomationExecution` permission. Additionally, it must have the `iam:PassRole` permission for the target execution role (`SSMAutomationExecutionRole`) so that it can securely pass the role to Systems Manager for execution.

Step-by-Step Solution

1
Analyze the event-driven automation flow.
EventBridge detects the CloudWatch alarm state change and attempts to invoke the target Systems Manager Automation document using the specified execution role.
Understanding the path helps identify where authorization checks occur.
2
Identify the permissions needed by the invoking service (EventBridge).
EventBridge needs permission to start the execution (`ssm:StartAutomationExecution`) and must be authorized to pass the target IAM role (`iam:PassRole`) to Systems Manager.
Since EventBridge is executing a service on behalf of the user using a specific role, it must have the PassRole permission.
3
Configure the EventBridge target execution role policy.
Add the `iam:PassRole` permission pointing to the ARN of the `SSMAutomationExecutionRole` in the EventBridge role's IAM policy.
This grants EventBridge the authority to delegate tasks to Systems Manager under the security context of the specified role.

Key Concept

Delegating permissions to AWS services using the PassRole permission when configuring event-driven remediation targets.
Rate this question

Topics

Event-Driven Automation and Operational Responses