Examkin

Question

Difficulty: MediumAWS Systems Manager Configuration and Run Command Automation

An enterprise uses AWS Systems Manager State Manager to enforce security configurations across all EC2 instances. Every instance has the SSM Agent running and is assigned an IAM instance profile with the `AmazonSSMManagedInstanceCore` policy. To automate compliance checks, a SysOps administrator is configuring a State Manager association that will execute a custom SSM document using a service role. When creating the association, the administrator receives an 'Access Denied' error. Which of the following IAM configurations is required to successfully create this association?

  1. Attach an IAM policy to the administrator's IAM user that grants the `iam:PassRole` action for the Systems Manager service role.Answer
  2. B
    Update the trust policy of the service role to grant the administrator's IAM user permission to execute the `sts:AssumeRole` action.
  3. C
    Configure a custom tag with the key `Patch Group` on the target EC2 instances that matches the patch group name in the Systems Manager Patch Baseline.
  4. D
    Add a route to the subnet route table targeting an Internet Gateway to allow IAM policy validation requests to reach the AWS STS endpoint.

Answer

Attach an IAM policy to the administrator's IAM user that grants the `iam:PassRole` action for the Systems Manager service role.
To create a Systems Manager State Manager association that uses a service role to run commands or automation on instances, the IAM user configuring the association must have the `iam:PassRole` permission for that service role. This ensures that the administrator is authorized to assign the service role to Systems Manager.

Step-by-Step Solution

1
Analyze the error message and context.
The administrator receives an 'Access Denied' error when creating a State Manager association that uses a service role.
This indicates that the administrator's identity lacks the permission required to associate the service role with the Systems Manager resource.
2
Determine the required IAM permission for passing a role to an AWS service.
The identity configuring the resource must have the `iam:PassRole` permission.
AWS prevents unauthorized users from assigning high-privileged roles to services by requiring the explicit `iam:PassRole` permission.
3
Identify the correct option that addresses the user policy requirement.
Grants the `iam:PassRole` permission to the administrator's IAM identity.
This allows the administrator to pass the Systems Manager service role to State Manager.

Key Concept

IAM PassRole permissions for AWS Systems Manager configurations
Rate this question

Topics

AWS Systems Manager Configuration and Run Command Automation