Examkin

Question

Difficulty: MediumEvent-Driven Automation and Operational Responses

A SysOps administrator is configuring automated remediation in AWS Config for the managed rule `iam-user-mfa-enabled`. When an IAM user without Multi-Factor Authentication (MFA) is detected, the administrator wants to automatically deactivate the user's console access using the `AWS-DisableIAMUserAccess` Systems Manager (SSM) Automation document.

Which two configurations are required to successfully set up this event-driven remediation? (Select TWO.)

  1. Configure the remediation action in AWS Config to use the `AWS-DisableIAMUserAccess` document, and map the `AutomationAssumeRole` parameter to an IAM role that permits Systems Manager to execute the remediation.Answer
  2. Attach an IAM policy to the administrator's IAM identity that grants the `iam:PassRole` permission for the IAM role used by the Systems Manager Automation execution.Answer
  3. C
    Configure the IAM role used by the Systems Manager Automation document with a trust policy that includes the administrator's IAM identity as a trusted entity, which replaces the need for `iam:PassRole` permissions.
  4. D
    Create an Amazon EventBridge rule that triggers on AWS Config compliance changes, and configure a CloudWatch metric filter to execute the `AWS-DisableIAMUserAccess` document directly.
  5. E
    Enable detailed monitoring on AWS Config with a 1-minute interval to ensure the `iam-user-mfa-enabled` compliance status changes are evaluated and sent to Systems Manager without the standard 5-minute delay.

Answer

To configure the event-driven remediation, the administrator must configure the remediation action in AWS Config to use the `AWS-DisableIAMUserAccess` document with the `AutomationAssumeRole` parameter set to a service role, and grant the administrator's IAM identity the `iam:PassRole` permission for that execution role.
The correct configurations involve using AWS Config's remediation action to target the `AWS-DisableIAMUserAccess` Systems Manager Automation document, mapping the execution role parameter to an IAM role with the correct permissions. Additionally, the administrator's IAM identity must have `iam:PassRole` permissions to pass the execution role to Systems Manager.

Step-by-Step Solution

1
Identify the remediation execution role requirement.
Determine that the `AWS-DisableIAMUserAccess` SSM Automation document requires an IAM role with permissions to disable IAM console access, which is passed to the document via the `AutomationAssumeRole` parameter.
Systems Manager Automation needs permissions to interact with IAM and modify user credentials.
2
Identify the user permission requirements for setting up remediation.
Determine that the SysOps administrator's IAM identity must have `iam:PassRole` permissions for the Systems Manager execution role.
AWS IAM requires `iam:PassRole` to ensure users cannot pass roles with higher privileges to AWS services than they themselves possess.

Key Concept

Configuring automated remediation in AWS Config using Systems Manager Automation documents and IAM execution permissions.
Rate this question

Topics

Event-Driven Automation and Operational Responses