A company's security policy requires that all Amazon RDS DB instances must remain private. A SysOps administrator is configuring automated remediation to detect any RDS DB instance modified to be publicly accessible and immediately revert it to private. The administrator has created a custom AWS Systems Manager (SSM) Automation runbook that modifies the DB instance's public accessibility parameter to false. The administrator has also created an IAM role named RemediationExecutionRole that has permissions to modify RDS DB instances.
To establish this automated remediation workflow using Amazon EventBridge and Systems Manager, which two configuration steps must the administrator perform? (Select TWO.)
- Configure the EventBridge rule target to use an IAM role that contains the ssm:StartAutomationExecution permission for the custom runbook and the iam:PassRole permission targeting the RemediationExecutionRole ARN.Answer
- Configure the EventBridge rule target to invoke the custom Systems Manager Automation runbook, using an Input Transformer to extract the DBInstanceIdentifier from the event payload and passing the RemediationExecutionRole ARN as the AutomationAssumeRole parameter.Answer
- CAdd a trust relationship to the RemediationExecutionRole that allows the principal events.amazonaws.com to assume the role, and configure the EventBridge target without any iam:PassRole permissions.
- DConfigure an EventBridge API Destination targeting the Systems Manager Automation service endpoint, and associate an API Destination connection that uses the RemediationExecutionRole credentials.
- EConfigure the EventBridge rule with an event pattern matching Amazon RDS configuration compliance status changes, and configure the target as an AWS Config remediation action mapped to the RemediationExecutionRole.
Answer
The correct steps are to configure the EventBridge rule target to use an IAM role with ssm:StartAutomationExecution and iam:PassRole permissions for the RemediationExecutionRole, and to configure the EventBridge rule target to invoke the runbook while using an Input Transformer and passing the RemediationExecutionRole ARN as the AutomationAssumeRole parameter.
To remediate the public RDS instances automatically, the SysOps administrator must target the custom Systems Manager Automation runbook directly from EventBridge. Because Systems Manager runs the automation on the administrator's behalf using the RemediationExecutionRole, EventBridge must be allowed to pass this execution role to Systems Manager, which requires the iam:PassRole permission in the EventBridge execution role. In addition, the EventBridge rule target must be configured with an Input Transformer to map the database instance identifier from the event payload to the runbook's parameters, and pass the RemediationExecutionRole ARN as the AutomationAssumeRole parameter to ensure execution has correct permissions.
Step-by-Step Solution
Key Concept
Automating resource remediation using Amazon EventBridge and AWS Systems Manager Automation requires establishing a clear event flow, passing correct execution context parameters, and configuring proper IAM permissions including iam:PassRole to delegate execution rights to Systems Manager.