Examkin

Question

Difficulty: HardAWS Systems Manager Configuration and Run Command Automation

A SysOps Administrator is setting up AWS Systems Manager to automate configuration compliance and patch management across a fleet of Amazon EC2 instances. The SSM Agent is confirmed to be running on all instances, and the `AmazonSSMManagedInstanceCore` policy is attached to their IAM instance profiles.

The administrator faces two distinct issues:
1. When creating a State Manager association that uses a custom execution role to run an automation document, the creation fails with an error indicating that the administrator is not authorized to perform the operation.
2. An automated patching window executes successfully, but a subset of instances fails to receive the updates defined in a custom patch baseline. The administrator verifies that the patch baseline has been correctly associated with the patch group named 'Production-Servers' in Patch Manager.

Which combination of actions will resolve these issues? (Select TWO.)

  1. Add the `iam:PassRole` permission to the SysOps Administrator's IAM user policy, specifying the custom execution role's ARN in the Resource element.Answer
  2. Add a tag to the target EC2 instances with the key `Patch Group` and the value `Production-Servers`.Answer
  3. C
    Add the `iam:PassRole` permission to the trust policy of the custom execution role, specifying `ssm.amazonaws.com` as the principal.
  4. D
    Attach an IAM policy containing `ssm:SendCommand` to the target EC2 instances' IAM instance profiles.
  5. E
    Associate the patch group `Production-Servers` directly with the EC2 instance profile using the Systems Manager Quick Setup console.

Answer

Add the `iam:PassRole` permission to the SysOps Administrator's IAM user policy specifying the custom execution role's ARN, and apply a tag with the key `Patch Group` and value `Production-Servers` to the target EC2 instances.
To resolve the association creation failure, the administrator must have the `iam:PassRole` permission for the target role in their IAM policy. To resolve the patching misalignment, the EC2 instances must be tagged with the key `Patch Group` set to the value `Production-Servers`, allowing Patch Manager to match them to the correct patch baseline.

Step-by-Step Solution

1
Analyze the State Manager association authorization failure.
Identify that the administrator lacks the permission to delegate the execution role to the Systems Manager service.
AWS services require explicit delegation via `iam:PassRole` in the user's policy to assume a role and perform actions on their behalf.
2
Analyze the patching failure on the subset of EC2 instances.
Determine that the instances are not correctly mapped to the custom patch baseline.
Systems Manager Patch Manager uses a case-sensitive tag key named `Patch Group` to associate target instances with patch baselines.
3
Select the correct combination of fixes.
Add the `iam:PassRole` permission to the administrator's IAM policy for the role ARN, and apply the tag key `Patch Group` with the value `Production-Servers` to the instances.
These actions address the configuration delegation issue and the baseline mapping mechanism respectively.

Key Concept

Delegating permissions to AWS Systems Manager via IAM PassRole and mapping EC2 instances to patch baselines using case-sensitive Patch Group tags.
Estimated Time:2m 30s
Rate this question

Topics

AWS Systems Manager Configuration and Run Command Automation