Examkin

Question

Difficulty: MediumEvent-Driven Automation and Operational Responses

An operations team is implementing event-driven compliance controls. They deploy an AWS Config rule to monitor that all Amazon SQS queues have Server-Side Encryption enabled. To automatically encrypt non-compliant queues, they designate the Systems Manager Automation document AWS-EnableSqsQueueEncryption. The team creates a dedicated IAM role named QueueEncryptionExecutionRole with the required SQS permissions, trusting Systems Manager to assume it. However, when the team tries to save this auto-remediation configuration, the operation fails with an authorization error. Which action will resolve this configuration failure?

  1. Assigning iam:PassRole permissions to the IAM identity performing the configuration, targeting the QueueEncryptionExecutionRole resource.Answer
  2. B
    Updating the trust policy of QueueEncryptionExecutionRole to allow the config.amazonaws.com service principal to assume it instead of ssm.amazonaws.com.
  3. C
    Configuring an Amazon EventBridge rule that intercepts the AWS Config compliance event to trigger a custom AWS Lambda function instead of using Systems Manager.
  4. D
    Enabling detailed CloudWatch monitoring on the Amazon SQS queues to verify the compliance state at one-minute intervals before the remediation runs.

Answer

Assigning iam:PassRole permissions to the IAM identity performing the configuration, targeting the QueueEncryptionExecutionRole resource.
When configuring automated remediation in AWS Config that uses an SSM Automation document, the AWS Config service associates a service execution role with Systems Manager. The IAM user or role performing this configuration must have the iam:PassRole permission for that execution role. This ensures the user is authorized to delegate the role's permissions to Systems Manager.

Step-by-Step Solution

1
Analyze the context of the auto-remediation authorization failure occurring at configuration time.
Determine that the failure happens while linking the AWS Config remediation rule with the SSM automation execution role.
This identifies that the configuring user lacks permission to associate the execution role with the Systems Manager service.
2
Identify the required IAM mechanism for passing roles to AWS services.
Identify that the iam:PassRole action must be permitted in the policy of the identity performing the setup.
AWS security best practices prevent users from configuring services to execute actions using roles they cannot pass.
3
Formulate the correct IAM policy change.
Add a policy granting iam:PassRole for the QueueEncryptionExecutionRole ARN to the administrator's IAM user or role.
This grants the necessary permission to complete the auto-remediation link in AWS Config.

Key Concept

AWS Config auto-remediation with Systems Manager Automation requires the configuring principal to possess iam:PassRole permission to pass the automation execution role to SSM.
Rate this question

Topics

Event-Driven Automation and Operational Responses