Examkin

Question

Difficulty: MediumAWS Systems Manager Configuration and Run Command Automation

An organization uses AWS Systems Manager State Manager to enforce configuration compliance across a fleet of Amazon EC2 instances. The SSM Agent is installed and running on all instances, and they have the AmazonSSMManagedInstanceCore role attached. A SysOps administrator is configuring a State Manager association that runs a custom automation runbook requiring an IAM service role to execute. When attempting to create the association, the administrator receives an access denied error stating that they are not authorized to perform the iam:PassRole action on the resource. Which action must the administrator take to successfully create the association?

  1. Attach an IAM policy to the administrator's IAM identity that grants the iam:PassRole permission for the automation service role's Amazon Resource Name (ARN).Answer
  2. B
    Add an IAM policy to the automation service role that grants the sts:AssumeRole permission to the administrator's IAM identity.
  3. C
    Update the AWS Key Management Service (AWS KMS) key policy for the default Systems Manager key to grant the ssm.amazonaws.com service principal the KMS Decrypt permission.
  4. D
    Change the resource tags on the target EC2 instances to align with the patch group specified in the default Systems Manager patch baseline.

Answer

Attach an IAM policy to the administrator's IAM identity that grants the iam:PassRole permission for the automation service role's Amazon Resource Name (ARN).
The correct action is to grant the administrator's IAM identity the iam:PassRole permission on the target automation service role. This permission allows the administrator to pass the role to Systems Manager so that State Manager can successfully execute the automation document using the designated role.

Step-by-Step Solution

1
Analyze the error message showing unauthorized access for the iam:PassRole action on the target role resource.
Identify that the administrator is attempting to pass an IAM service role to Systems Manager to execute the custom automation runbook.
AWS requires that the identity initiating the task has permission to pass the execution role to the service.
2
Locate the IAM policy associated with the administrator's IAM user, group, or role.
Determine that the policy lacks the iam:PassRole permission specifically targeted at the role ARN.
This permission must be assigned to the identity performing the configuration action, not to the target role itself.
3
Add the iam:PassRole action targeting the specific role ARN into the administrator's IAM policy.
Apply the policy and verify the creation of the State Manager association completes successfully.
This satisfies the authorization check, allowing Systems Manager to accept and assume the service role for automation tasks.

Key Concept

Configuring IAM PassRole permissions to allow AWS services to assume roles on behalf of users.
Rate this question

Topics

AWS Systems Manager Configuration and Run Command Automation