Examkin

Question

Difficulty: HardEvent-Driven Automation and Operational Responses

A SysOps administrator is configuring event-driven remediation to automatically stop any Amazon EC2 instance that is flagged as non-compliant by an AWS Config rule. The administrator plans to use AWS Systems Manager Automation to execute the remediation runbook. The configuration must follow the principle of least privilege. Which two actions must the administrator take to ensure the auto-remediation executes successfully? (Select two.)

  1. Create an IAM role for Systems Manager with a trust policy that allows ssm.amazonaws.com to assume the role, and attach a policy allowing the ec2:StopInstances action.Answer
  2. Attach an IAM policy to the administrator's identity that allows the iam:PassRole action targeting the Systems Manager Automation role.Answer
  3. C
    Attach an IAM policy to the administrator's identity that allows the sts:AssumeRole action targeting the Systems Manager Automation role.
  4. D
    Create an Amazon EventBridge rule that detects Config compliance state changes and configure its target to trigger the AWS Config remediation configuration.
  5. E
    Enable CloudWatch detailed monitoring on all EC2 instances to trigger the AWS Config rule evaluations at 1-minute intervals.

Answer

To configure event-driven auto-remediation in AWS Config using Systems Manager, the administrator must create an IAM role for Systems Manager with a trust policy that allows ssm.amazonaws.com to assume the role (along with ec2:StopInstances permissions), and attach an IAM policy to the administrator's identity that allows the iam:PassRole action targeting the Systems Manager Automation role.
To implement auto-remediation in AWS Config using Systems Manager Automation, two critical IAM configurations are needed: first, an IAM service role (with a trust policy for ssm.amazonaws.com) containing the necessary permissions (such as ec2:StopInstances) to perform the remediation action on the target resource; second, the configuring administrator needs iam:PassRole permission on that service role to grant Systems Manager the authority to assume the role and execute the tasks.

Step-by-Step Solution

1
Define the remediation role for Systems Manager Automation.
An IAM role is created with a trust policy allowing ssm.amazonaws.com to assume it, and an inline or managed policy allowing the ec2:StopInstances action.
Systems Manager needs permissions to stop the EC2 instance on behalf of the administrator.
2
Configure the administrator's permissions to delegate the role.
The iam:PassRole permission is added to the administrator's IAM user or role policy, referencing the ARN of the Systems Manager Automation role.
This allows the administrator to pass the role to Systems Manager when setting up the remediation action.
3
Configure the remediation action in AWS Config.
The AWS Config rule is updated with an automatic remediation action that specifies the target as the Systems Manager Automation runbook and passes the SSM role.
To automate the response immediately upon detecting non-compliance.

Key Concept

Configuring event-driven remediation in AWS Config using Systems Manager Automation requires establishing a service trust relationship, granting the service permissions to take action, and authorizing the administrative user to pass the execution role using the iam:PassRole permission.
Estimated Time:2m 30s
Rate this question

Topics

Event-Driven Automation and Operational Responses