Examkin

Question

Difficulty: HardEventBridge and Systems Manager Remediation

A SysOps administrator needs to configure automated remediation for non-compliant Amazon EC2 instances. When an EC2 instance is flagged as non-compliant by the AWS Config rule `ec2-instance-no-public-ip`, the instance must be stopped automatically using the Systems Manager Automation document `AWS-StopEC2Instance`.

The administrator creates an Amazon EventBridge rule that triggers when AWS Config detects a compliance change for the rule.

How should the SysOps administrator configure the Amazon EventBridge rule target and the associated IAM permissions to automate this remediation?

  1. A
    Configure the EventBridge rule target as Systems Manager Run Command, specifying the `AWS-StopEC2Instance` document. Use an Input Transformer to pass the resource ID from `$.detail.resourceId` as a command parameter. Assign the target an IAM execution role that contains `ssm:SendCommand` permissions.
  2. B
    Configure the EventBridge rule target as Systems Manager Automation, specifying the `AWS-StopEC2Instance` document. Use an Input Transformer to map the non-compliant resource ID from `$.detail.resourceId` to the `InstanceId` parameter of the document. Assign the target an IAM execution role that contains `ssm:StartAutomationExecution` permissions, and ensure the Systems Manager Automation service role has a trust policy allowing `events.amazonaws.com` to assume the role, without adding `iam:PassRole` permissions.
  3. Configure the EventBridge rule target as Systems Manager Automation, specifying the `AWS-StopEC2Instance` document. Use an Input Transformer to map the non-compliant resource ID from `$.detail.resourceId` to the `InstanceId` parameter of the document. Assign the target an IAM execution role that contains permissions for `ssm:StartAutomationExecution` and `iam:PassRole` for the Systems Manager Automation service role.Answer
  4. D
    Configure the EventBridge rule target as Systems Manager Automation, specifying the `AWS-StopEC2Instance` document. In the EventBridge rule's Event Pattern, map the non-compliant resource ID from `$.detail.resourceId` directly to the target's `InstanceId` parameter. Assign the target an IAM execution role that contains permissions for `ssm:StartAutomationExecution` and `iam:PassRole` for the Systems Manager Automation service role.

Answer

Configure the EventBridge rule target as Systems Manager Automation, specifying the `AWS-StopEC2Instance` document, using an Input Transformer to map `$.detail.resourceId` to the `InstanceId` parameter, and assigning an IAM execution role with `ssm:StartAutomationExecution` and `iam:PassRole` permissions.
To remediate the non-compliant EC2 instance, the EventBridge rule target must invoke Systems Manager Automation using the `AWS-StopEC2Instance` document. An Input Transformer is required to dynamically map the resource ID (the EC2 instance ID) from the AWS Config compliance event payload (`$.detail.resourceId`) to the `InstanceId` parameter of the Automation document. The IAM execution role associated with the EventBridge target must have `ssm:StartAutomationExecution` permissions to initiate the execution and `iam:PassRole` permissions to pass the execution role that executes the stop API call.

Step-by-Step Solution

1
Select the correct Systems Manager capability for the remediation task.
Identify that stopping an EC2 instance is an AWS API-level task executed via a Systems Manager Automation document (`AWS-StopEC2Instance`), not via Run Command.
Run Command is for OS-level execution, whereas Automation is for AWS resource lifecycle actions.
2
Map the resource identifier from the AWS Config event payload to the target parameters.
Configure an EventBridge Input Transformer to extract the non-compliant instance ID using the JSONPath expression `$.detail.resourceId` and assign it to the `InstanceId` parameter of the Automation document.
EventBridge Event Patterns only filter events; parameter mapping requires an Input Transformer.
3
Configure the required IAM permissions for the EventBridge execution role.
Ensure the IAM role assigned to the EventBridge target contains `ssm:StartAutomationExecution` and `iam:PassRole` permissions targeting the Automation service role.
EventBridge must have permissions to initiate the automation execution and pass the service role that contains `ec2:StopInstances` permissions to Systems Manager.

Key Concept

Configuring Systems Manager Automation as an EventBridge target requires mapping the target parameters using an Input Transformer and granting EventBridge both `ssm:StartAutomationExecution` and `iam:PassRole` permissions.
Rate this question

Topics

EventBridge and Systems Manager Remediation

More questions from this topic