Examkin

Question

Difficulty: MediumAWS Systems Manager Configuration and Run Command Automation

A SysOps Administrator is configuring an AWS Systems Manager Automation workflow to automate administrative tasks across a fleet of Amazon EC2 instances. The administrator creates a custom IAM role named SSMAutomationServiceRole to grant Systems Manager permissions to perform actions on other AWS resources. When the administrator attempts to start the execution of the Automation workflow using the AWS Command Line Interface (AWS CLI), the execution fails immediately with an access denied error indicating that the user is not authorized to perform iam:PassRole on the service role resource.

The administrator's user account already has the AmazonSSMFullAccess policy attached. The SSM Agent is running on all target EC2 instances, and the AmazonSSMManagedInstanceCore policy is attached to the instance profiles.

Which of the following actions will resolve this failure?

  1. A
    Modify the trust policy of the SSMAutomationServiceRole to allow the administrator's IAM user to perform the sts:AssumeRole action.
  2. B
    Configure a patch group tag key named Patch Group on the target EC2 instances and associate it with the default patch baseline.
  3. Attach an IAM policy to the administrator's IAM user that permits the iam:PassRole action on the SSMAutomationServiceRole resource.Answer
  4. D
    Associate the SSMAutomationServiceRole with the IAM instance profile of the target Amazon EC2 instances.

Answer

Attach an IAM policy to the administrator's IAM user that permits the iam:PassRole action on the SSMAutomationServiceRole resource.
To resolve the failure, the administrator's IAM user must be granted the iam:PassRole permission. When starting a Systems Manager Automation workflow that uses a service role, AWS requires the initiating user to have permission to pass that IAM role to the Systems Manager service. This prevents users from escalating their privileges by passing roles with more permissions than their own user account.

Step-by-Step Solution

1
Identify the cause of the failure from the error message.
The failure is due to a missing iam:PassRole permission on the administrator's IAM account when attempting to use the service role.
AWS services require a user to have the iam:PassRole permission to pass a service role to the AWS service that will assume it.
2
Locate the target service role ARN.
The service role is arn:aws:iam::111122223333:role/SSMAutomationServiceRole.
The IAM policy must reference this specific role ARN in the resource element.
3
Create and attach an IAM policy to the administrator's IAM user or group.
An IAM policy with Effect: Allow, Action: iam:PassRole, and Resource: arn:aws:iam::111122223333:role/SSMAutomationServiceRole is attached.
This grants the administrator the necessary permission to pass the service role to Systems Manager, allowing the Automation execution to proceed.

Key Concept

AWS Systems Manager service roles and the iam:PassRole permission requirement for service execution.
Rate this question

Topics

AWS Systems Manager Configuration and Run Command Automation