Examkin

Question

Difficulty: MediumAWS CloudTrail Configuration and Management

A SysOps Administrator is configuring automated remediation to restart an AWS CloudTrail trail if it is stopped. The administrator creates an Amazon EventBridge rule that triggers on the `StopLogging` API call. The target of this rule is set to trigger an AWS Systems Manager Automation execution of the `AWS-ConfigureCloudTrail` document. The administrator configures the target to use an IAM service role named `SSMAutomationExecutionRole`, which has the necessary `cloudtrail:StartLogging` permissions and a trust policy allowing `ssm.amazonaws.com` to assume it. When the rule is triggered, the automation fails to start, and the EventBridge dead-letter queue reports an authorization error. Which configuration change will resolve this issue?

  1. A
    Modify the central logging Amazon S3 bucket policy to grant the `s3:PutObject` permission to the EventBridge service principal (events.amazonaws.com).
  2. B
    Reconfigure the EventBridge rule to target an Amazon SNS topic, and subscribe the Systems Manager Automation document directly to the SNS topic to trigger remediation.
  3. Attach an IAM policy to the role used by the EventBridge rule to execute the target, granting the `iam:PassRole` permission for the `SSMAutomationExecutionRole` ARN.Answer
  4. D
    Modify the trust policy of the `SSMAutomationExecutionRole` to allow the EventBridge service principal (events.amazonaws.com) to assume the role instead of Systems Manager.

Answer

Attach an IAM policy to the role used by the EventBridge rule to execute the target, granting the `iam:PassRole` permission for the `SSMAutomationExecutionRole` ARN.
The correct action is to attach an IAM policy to the role used by the EventBridge rule to execute the target, granting the `iam:PassRole` permission for the `SSMAutomationExecutionRole` ARN. When Amazon EventBridge triggers an AWS Systems Manager Automation that runs using a customer-specified execution role, the principal triggering the event must have permission to pass that role to Systems Manager. The `iam:PassRole` permission ensures that the EventBridge service is authorized to delegate the specified execution role to Systems Manager.

Step-by-Step Solution

1
Identify the service relationship and the delegation of authority required for EventBridge to trigger Systems Manager Automation.
EventBridge needs to invoke Systems Manager Automation and pass a specific runtime role (SSMAutomationExecutionRole) to the Systems Manager service.
When a service like EventBridge triggers an automation that runs under a specified role, the calling service must be permitted to pass that role to the target service.
2
Verify the permissions of the IAM role used by the EventBridge rule.
The EventBridge rule's role is missing the `iam:PassRole` permission for the targeted `SSMAutomationExecutionRole` ARN.
Without `iam:PassRole` on the calling identity, AWS prevents the identity from delegating the execution role to another service, resulting in an authorization failure.
3
Attach a policy to the EventBridge execution role containing the `iam:PassRole` permission for the SSM role's ARN.
The EventBridge rule is now authorized to pass the role, and the Systems Manager Automation executes successfully when the rule is triggered.
This establishes the secure delegation required for EventBridge to pass the execution role to Systems Manager.

Key Concept

Delegating IAM roles to AWS services using the PassRole permission during event-driven automated remediation.
Estimated Time:1m 30s
Rate this question

Topics

AWS CloudTrail Configuration and Management

More questions from this topic