Examkin

Question

Difficulty: HardAWS Config Rules and Conformance Packs

An operations team is deploying a compliance control using AWS Config to ensure all Amazon DynamoDB tables have point-in-time recovery (PITR) enabled. To automatically correct non-compliant tables, the team intends to use an AWS Systems Manager (SSM) Automation runbook. They create a dedicated IAM role named 'SSMExecutionRole' containing the DynamoDB update permissions. During testing, when AWS Config identifies a non-compliant table, the remediation fails to execute. What configuration steps must be performed to allow AWS Config to successfully run the remediation using the specified role?

  1. A
    Establish an EventBridge rule that monitors AWS Config compliance change events and triggers the SSM runbook directly, bypassing the native AWS Config remediation configuration.
  2. B
    Modify the trust relationship of the SSMExecutionRole to authorize the config.amazonaws.com service principal, and grant the administrator's IAM policy the iam:PassRole privilege for this role.
  3. Modify the trust relationship of the SSMExecutionRole to authorize the ssm.amazonaws.com service principal, and grant the administrator's IAM policy the iam:PassRole privilege for this role.Answer
  4. D
    Assign the AWSConfigServiceRolePolicy managed policy to the SSMExecutionRole, and configure the DynamoDB tables to trust the config.amazonaws.com service principal.

Answer

Modify the trust relationship of the SSMExecutionRole to authorize the ssm.amazonaws.com service principal, and grant the administrator's IAM policy the iam:PassRole privilege for this role.
For AWS Config automatic remediation using Systems Manager (SSM) Automation, the remediation role (AutomationAssumeRole) is assumed by the Systems Manager service. Therefore, its trust relationship must allow the ssm.amazonaws.com service principal to perform the sts:AssumeRole operation. Additionally, the administrator who configures the remediation must have the iam:PassRole permission to pass the role to Systems Manager.

Step-by-Step Solution

1
Analyze the execution flow of AWS Config automatic remediation.
Identify that AWS Config triggers a Systems Manager (SSM) Automation runbook, which must assume the specified 'SSMExecutionRole' (AutomationAssumeRole) to modify resources.
Determines which AWS service principal actually executes the remediation actions and assumes the role.
2
Configure trust relationships for the remediation execution role.
Ensure the trust policy allows ssm.amazonaws.com to perform the sts:AssumeRole action.
Allows Systems Manager to assume the role needed to run the DynamoDB update operations.
3
Ensure appropriate permissions exist for the identity setting up the Config remediation.
Ensure the administrator configuring the Config remediation has iam:PassRole permissions targeting the SSMExecutionRole.
Required because AWS Config needs permission to pass the execution role to the Systems Manager service.

Key Concept

AWS Config automatic remediation requires configuring a trust relationship allowing Systems Manager to assume the remediation role, and granting iam:PassRole permissions to the user or role setting up the remediation configuration.
Estimated Time:2m 0s
Rate this question

Topics

AWS Config Rules and Conformance Packs

More questions from this topic