Examkin

Question

Difficulty: MediumEvent-Driven Automation and Operational Responses

An organization wants to automatically stop idle Amazon EC2 instances to reduce costs. A SysOps administrator configures an Amazon CloudWatch alarm that transitions to the ALARM state when CPU utilization remains below 5%5\% for 1 hour. The administrator then creates an Amazon EventBridge rule that detects the CloudWatch alarm state change and targets an AWS Systems Manager (SSM) Automation document using the `AWS-StopEC2Instance` template. During testing, the CloudWatch alarm enters the ALARM state, but the EC2 instance is not stopped. The EventBridge dead-letter queue (DLQ) indicates a delivery failure due to an authorization issue. Which action will resolve this issue?

  1. A
    Configure the CloudWatch alarm to trigger an Amazon CloudWatch Logs subscription filter that executes the SSM Automation document directly.
  2. Add the iam:PassRole permission to the EventBridge rule's IAM execution role to allow it to pass the SSM Automation execution role to Systems Manager.Answer
  3. C
    Enable detailed monitoring on the target EC2 instances to ensure CloudWatch metrics are evaluated at 1-minute intervals.
  4. D
    Modify the trust policy of the SSM Automation execution role to allow the EC2 service principal to assume the role.

Answer

Add the iam:PassRole permission to the EventBridge rule's IAM execution role to allow it to pass the SSM Automation execution role to Systems Manager.
The correct option is to add the `iam:PassRole` permission to the EventBridge rule's execution role. When an EventBridge rule triggers an AWS Systems Manager Automation document that requires an execution role, the EventBridge rule's role must have the `iam:PassRole` permission to pass that execution role to Systems Manager. Without this permission, EventBridge cannot initiate the automation execution, resulting in an authorization error in the DLQ.

Step-by-Step Solution

1
Analyze the error message from the EventBridge dead-letter queue (DLQ).
The error indicates a delivery failure due to an authorization issue, pointing to a permissions problem between EventBridge and the target service.
Before making modifications, the SysOps administrator needs to locate where the delivery failed in the event-driven workflow.
2
Verify the IAM role permissions assigned to the EventBridge rule.
The role has `ssm:StartAutomationExecution` but lacks the `iam:PassRole` permission for the SSM Automation execution role.
When EventBridge triggers Systems Manager Automation, it must pass a service role to Systems Manager to perform actions on the resources. This requires the `iam:PassRole` permission.
3
Add the `iam:PassRole` policy statement to the EventBridge execution role pointing to the SSM Automation role ARN.
The policy update allows EventBridge to successfully invoke the automation target with the required execution context.
This grants EventBridge the authorization to delegate execution permissions to Systems Manager Automation, resolving the DLQ delivery failure.

Key Concept

Configuring correct IAM permissions, specifically iam:PassRole, for event-driven targets like AWS Systems Manager Automation in EventBridge.
Rate this question

Topics

Event-Driven Automation and Operational Responses