Examkin

Question

Difficulty: MediumEventBridge and Systems Manager Remediation

A SysOps administrator wants to automate the remediation of unencrypted Amazon EBS volumes. The administrator creates an Amazon EventBridge rule that triggers when an EBS volume is created. The target of the rule is the Systems Manager Automation document `AWS-DeleteVolume` to remove the unencrypted volume. The automation document requires an IAM service role to execute the deletion.

Which configuration and IAM permissions are required for the EventBridge rule to successfully trigger the remediation?

  1. Associate an IAM role with the EventBridge rule target that trusts `events.amazonaws.com`. Attach a policy to this role that grants `ssm:StartAutomationExecution` for the Systems Manager document and `iam:PassRole` for the Systems Manager service role.Answer
  2. B
    Associate an IAM role with the EventBridge rule target that trusts `ssm.amazonaws.com`. Attach a policy to this role that grants `ssm:StartAutomationExecution` for the Systems Manager document and `iam:AssumeRole` for the Systems Manager service role.
  3. C
    Configure the Systems Manager Automation document as the target directly. Attach a resource-based policy to the Systems Manager document that allows the `events.amazonaws.com` service principal to run the `ssm:StartAutomationExecution` action.
  4. D
    Associate an IAM role with the EventBridge rule target that trusts `events.amazonaws.com`. Attach a policy to this role that grants `ssm:StartAutomationExecution` for the Systems Manager document, and update the Systems Manager service role's trust policy to trust `events.amazonaws.com`.

Answer

Associate an IAM role with the EventBridge rule target that trusts `events.amazonaws.com`. Attach a policy to this role that grants `ssm:StartAutomationExecution` for the Systems Manager document and `iam:PassRole` for the Systems Manager service role.
The correct configuration requires associating an IAM role with the EventBridge rule target that trusts the EventBridge service principal (`events.amazonaws.com`). This role must have a policy attached that allows `ssm:StartAutomationExecution` to run the remediation document and `iam:PassRole` to pass the service role that Systems Manager will assume to perform the deletion.

Step-by-Step Solution

1
Configure the trust relationship for the EventBridge execution role.
The role's trust policy is configured to trust the `events.amazonaws.com` service principal.
This authorization permits the EventBridge service to assume the execution role when the rule is triggered.
2
Grant the execution role permission to start the automation.
An identity-based policy is attached to the EventBridge role permitting `ssm:StartAutomationExecution` on the `AWS-DeleteVolume` document.
This permission allows EventBridge to initiate the Systems Manager Automation execution.
3
Grant the execution role permission to pass the Systems Manager service role.
The identity-based policy includes `iam:PassRole` permission targeting the specific Systems Manager service role.
Because the Automation document requires a service role to perform the deletion, EventBridge must be allowed to pass that service role to the Systems Manager service.

Key Concept

To execute Systems Manager Automation from an EventBridge rule target, EventBridge requires an IAM execution role that trusts the `events.amazonaws.com` service principal. This role must have identity-based permissions allowing `ssm:StartAutomationExecution`. If the automation runbook specifies an IAM service role to execute its API calls, the EventBridge execution role must also have `iam:PassRole` permissions for that service role.
Estimated Time:1m 30s
Rate this question

Topics

EventBridge and Systems Manager Remediation

More questions from this topic