Examkin

Question

Difficulty: Very hardAWS Systems Manager Configuration and Run Command Automation

A SysOps Administrator is configuring an AWS Systems Manager Automation workflow to automate configuration checks across a fleet of Amazon EC2 instances using a custom runbook. The SSM Agent is installed and running on all instances, and the instances are configured with an IAM instance profile containing the AmazonSSMManagedInstanceCore managed policy. The custom runbook executes a script on the instances that decrypts secure string credentials from the Systems Manager Parameter Store.

When the administrator attempts to start the Automation workflow, the execution fails to start immediately with an access denied error. In addition, manual test runs of the command on the instances fail to retrieve and decrypt the credentials.

Which two actions must the SysOps Administrator take to resolve these issues and ensure the Automation workflow runs successfully? (Select two.)

  1. Add the ssm:GetParameter permission and the kms:Decrypt permission for the parameter's KMS key to the IAM role associated with the EC2 instances' instance profile.Answer
  2. Add the iam:PassRole permission to the administrator's IAM user policy targeting the Systems Manager Automation service role.Answer
  3. C
    Add the sts:AssumeRole permission to the EC2 instance profile trust policy, allowing the Systems Manager Automation service role to assume the instance profile role.
  4. D
    Add a Patch Group tag to the EC2 instances that maps to a custom SSM Patch Baseline containing the KMS key details.
  5. E
    Add a key policy to the KMS key that grants the Systems Manager service principal (ssm.amazonaws.com) the kms:Decrypt permission.

Answer

Add the ssm:GetParameter permission and the kms:Decrypt permission for the parameter's KMS key to the IAM role associated with the EC2 instances' instance profile, and add the iam:PassRole permission to the administrator's IAM user policy targeting the Systems Manager Automation service role.
The correct configurations involve resolving the permission issues at two different boundaries: the Automation execution boundary and the EC2 instance execution boundary. First, the administrator needs the iam:PassRole permission to pass the Automation service role to Systems Manager. Second, the EC2 instance profile's IAM role must be updated to allow access to the Parameter Store (ssm:GetParameter) and the KMS key (kms:Decrypt) because the command runs in the context of the instance's credentials.

Step-by-Step Solution

1
Identify the cause of the Automation start failure.
The Systems Manager Automation workflow fails to start because the administrator's IAM identity lacks the permission to pass the Automation service role to Systems Manager.
When starting a workflow that executes under a service role, AWS requires the initiating user to have the iam:PassRole permission to prevent privilege escalation.
2
Identify the cause of the Parameter Store decryption failure on the instances.
The instance-level command execution fails because the EC2 instance profile IAM role has only the AmazonSSMManagedInstanceCore policy, which does not grant access to custom Parameter Store parameters or custom KMS keys.
AWS Systems Manager Agent runs commands on the EC2 instance using the credentials of the attached instance profile. The profile must be explicitly granted access to retrieve the parameter and decrypt it using the corresponding KMS key.
3
Configure the required permissions for the administrator and the EC2 instances.
Apply iam:PassRole to the administrator's policy, and apply ssm:GetParameter and kms:Decrypt to the EC2 instance profile's IAM role.
These updates satisfy both authorization requirements (initiating the automation workflow and decrypting secure credentials on the managed nodes).

Key Concept

Authorizing AWS Systems Manager Automation and providing managed nodes with secure access to KMS-encrypted Parameters
Estimated Time:3m 0s
Rate this question

Topics

AWS Systems Manager Configuration and Run Command Automation