Examkin

Question

Difficulty: HardAuto Scaling and Elasticity

A SysOps administrator is updating an Amazon EC2 Auto Scaling group (ASG) to launch instances with a new IAM role that provides access to an Amazon DynamoDB table. When the administrator attempts to update the ASG to use a new launch template version containing the new IAM role, the operation fails with a permission error stating that the user is not authorized to perform `iam:PassRole`.

Additionally, the application hosted on the ASG experiences sudden spikes in CPU utilization. The administrator notices that the dynamic scaling policy is slow to respond because the CPU utilization metric is only evaluated at 5-minute intervals.

Which two actions should the SysOps administrator take to resolve the launch template update failure and reduce the scaling response time? (Select TWO.)

  1. Attach an IAM policy to the administrator's IAM identity that grants the `iam:PassRole` permission for the Amazon Resource Name (ARN) of the new IAM role.Answer
  2. Enable detailed monitoring in the launch template, and configure the CloudWatch alarm used by the scaling policy to have an evaluation period of 60 seconds.Answer
  3. C
    Modify the trust policy of the new IAM role to allow the Auto Scaling service principal (`autoscaling.amazonaws.com`) to assume the role.
  4. D
    Create a CloudWatch metric filter for CPU utilization, and set the metric evaluation period to 60 seconds.
  5. E
    Decrease the default cooldown period of the Auto Scaling group to 0 seconds to allow the alarm to evaluate metrics more frequently.

Answer

Attach an IAM policy to the administrator's IAM identity that grants the `iam:PassRole` permission for the new IAM role, and enable detailed monitoring in the launch template while configuring the CloudWatch alarm used by the scaling policy to have a period of 60 seconds.
The correct options are to grant `iam:PassRole` to the administrator's identity and to enable detailed monitoring in the launch template while adjusting the alarm period. To attach an IAM role to EC2 instances, the user initiating the launch or template update must be authorized to pass the role. Standard EC2 monitoring only reports metrics every 5 minutes; enabling detailed monitoring increases the frequency to 1-minute intervals, allowing a 60-second CloudWatch alarm to trigger scaling actions much faster.

Step-by-Step Solution

1
Identify the cause of the `iam:PassRole` error.
The administrator's IAM user or role lacks permissions to pass the new IAM role to the EC2 service via the launch template.
AWS security requires that any identity that associates an IAM role with an AWS resource must have explicit `iam:PassRole` permissions for that role to prevent privilege escalation.
2
Resolve the permission issue.
Add an IAM policy to the administrator's IAM user or role granting `iam:PassRole` for the target role's ARN.
This allows the administrator to successfully update the Auto Scaling group's launch template version.
3
Identify the cause of the 5-minute metric evaluation delay.
EC2 instances by default report standard CPU utilization metrics at 5-minute intervals.
Standard monitoring provides metric resolution at 5-minute intervals. To react within 1-minute intervals, detailed monitoring must be enabled.
4
Enable detailed monitoring and adjust the alarm.
Enable detailed monitoring in the launch template and configure the alarm to use a 60-second period.
Detailed monitoring publishes CPU utilization metrics at 1-minute intervals. Setting the CloudWatch alarm period to 60 seconds aligns the evaluation frequency with the new data frequency.

Key Concept

Auto Scaling Instance Configuration and CloudWatch Metric Resolution
Rate this question

Topics

Auto Scaling and Elasticity

More questions from this topic