Examkin

Question

Difficulty: HardAWS Config Rules and Conformance Packs

A SysOps Administrator is deploying an AWS Config organization conformance pack from the organization's management account. The conformance pack contains a rule to evaluate whether Amazon S3 buckets have public read access enabled, and it includes an automatic remediation configuration that runs the AWS-DisableS3BucketPublicReadWrite Systems Manager (SSM) Automation document. During deployment, the administrator observes that although the conformance pack and rules deploy successfully to all member accounts, the automated remediation fails to execute when a non-compliant bucket is discovered. Which combination of configuration steps will resolve this issue and allow the remediation to run successfully? (Select TWO.)

  1. Configure the trust relationship of the remediation IAM role in each member account to allow the Systems Manager service principal (ssm.amazonaws.com) to assume the role.Answer
  2. Grant the iam:PassRole permission for the remediation IAM role to the IAM identity deploying the organization conformance pack.Answer
  3. C
    Configure an Amazon EventBridge rule in the management account to detect AWS Config non-compliance events and trigger the Systems Manager Automation document in the member accounts.
  4. D
    Configure the trust relationship of the remediation IAM role in each member account to allow the AWS Config service principal (config.amazonaws.com) to assume the role.
  5. E
    Attach an IAM policy to the AWS Config service-linked role in the member accounts that grants the iam:PassRole permission for the Systems Manager Automation document.

Answer

Configure the trust relationship of the remediation IAM role in each member account to trust the Systems Manager service principal (ssm.amazonaws.com), and grant the iam:PassRole permission for the remediation IAM role to the IAM identity deploying the organization conformance pack.
To successfully execute automated remediations deployed via an organization conformance pack, the remediation role in each member account must have a trust policy allowing the Systems Manager service principal (ssm.amazonaws.com) to assume the role, as Systems Manager executes the Automation document. Additionally, the deploying identity in the management account must have the iam:PassRole permission for the remediation role to authorize passing it to the service.

Step-by-Step Solution

1
Identify the execution pathway for AWS Config rule remediation.
AWS Config triggers Systems Manager Automation to perform the remediation, which requires Systems Manager to assume the remediation execution role in the target member account.
This establishes that the role's trust policy must allow the ssm.amazonaws.com service principal to assume the role.
2
Determine the required permissions for the administrator or deployment role.
The identity configuring or deploying the conformance pack must have the iam:PassRole permission to pass the remediation execution role to the Systems Manager service.
Without this permission, AWS Config cannot associate the execution role with the automation execution task.
3
Verify and eliminate incorrect service integrations and permission configurations.
Eliminate EventBridge routing options because remediation is native, eliminate trust relationships for config.amazonaws.com because the execution agent is Systems Manager, and eliminate PassRole policies targeting SSM documents.
This isolates the two required configuration changes.

Key Concept

AWS Config Rule automatic remediation requires establishing correct cross-service trust relationships (specifically for AWS Systems Manager) and granting the iam:PassRole permission to the deploying identity to authorize delegation of the execution role.
Rate this question

Topics

AWS Config Rules and Conformance Packs

More questions from this topic