Examkin

Question

Difficulty: EasyAWS Config Rules and Conformance Packs

A SysOps Administrator is configuring automatic remediation for an AWS Config rule. The remediation is designed to run an AWS Systems Manager Automation document. The administrator attempts to save the remediation configuration but receives an error stating that the action cannot be performed because of missing permissions. Which permission is missing from the administrator's IAM policy?

  1. A
    events:PutTargets permission to route the non-compliant Config rule evaluations to Systems Manager
  2. B
    sts:AssumeRole trust policy allowing AWS Config to assume the administrator's IAM user identity
  3. iam:PassRole permission for the remediation execution roleAnswer
  4. D
    cloudwatch:PutMetricAlarm permission to trigger the remediation workflow

Answer

iam:PassRole permission for the remediation execution role
To successfully configure automatic remediation in AWS Config, the IAM identity (user or role) setting up the remediation must have the iam:PassRole permission for the remediation execution role. This permission ensures that the administrator has the authority to delegate that execution role to AWS Config, which then passes it to Systems Manager to execute the automation document.

Step-by-Step Solution

1
Analyze the remediation mechanism
The remediation uses AWS Config automatic remediation powered by AWS Systems Manager Automation.
AWS Config requires an execution role to perform remediation actions in Systems Manager on the resources.
2
Identify the role passing requirement
The identity configuring the remediation must have permission to pass the execution role to the service.
To prevent privilege escalation, AWS requires the iam:PassRole permission whenever a user passes an IAM role to a service.

Key Concept

AWS Config Automatic Remediation Permissions
Estimated Time:45s
Rate this question

Topics

AWS Config Rules and Conformance Packs

More questions from this topic