Examkin

Question

Difficulty: EasyEvent-Driven Automation and Operational Responses

A SysOps administrator wants to automatically remediate non-compliant Amazon S3 buckets that allow public read access using AWS Config. The administrator plans to use the AWS-ConfigureS3BucketPublicAccessBlock Systems Manager Automation document to perform the remediation. Which of the following configurations are required to set up this automated remediation? (Select TWO.)

  1. Configure a remediation action within the AWS Config rule that targets the AWS-ConfigureS3BucketPublicAccessBlock Systems Manager Automation document.Answer
  2. Specify an IAM service role (remediation role) that grants Systems Manager Automation permission to modify S3 bucket settings, and ensure the administrator has iam:PassRole permission for this role.Answer
  3. C
    Create an Amazon EventBridge rule that directly invokes the Systems Manager Automation document when any S3 bucket is created, bypassing AWS Config evaluation.
  4. D
    Rely on the Systems Manager Automation document to automatically inherit the IAM permissions of the administrator configuring the rule, without specifying an execution role.
  5. E
    Enable detailed CloudWatch monitoring on the S3 buckets to reduce the latency of the AWS Config rule evaluation to 1 minute.

Answer

Configure a remediation action within the AWS Config rule targeting the Systems Manager Automation document, and specify an IAM service role with permissions to modify S3 settings along with the iam:PassRole permission for the configuring administrator.
Setting up automatic remediation in AWS Config requires linking the compliance rule to a remediation target, such as a Systems Manager Automation document. Because Systems Manager performs the modification on the resource, it must be granted permission through an IAM service role. Additionally, the administrator setting up this remediation must possess the iam:PassRole permission to pass the role to Systems Manager.

Step-by-Step Solution

1
Associate the AWS Config rule with the Systems Manager Automation remediation target.
The AWS Config rule will automatically trigger the specified Systems Manager Automation document when a compliance change detects a public S3 bucket.
This establishes the event flow between the compliance check and the automated remediation.
2
Create and configure the IAM service role for Systems Manager.
An IAM role is established that allows Systems Manager to update the public access block configuration on the S3 buckets.
Systems Manager requires authorization to interact with and modify S3 bucket settings.
3
Ensure the administrator configuring the rule has iam:PassRole permissions.
The administrator can successfully assign the IAM service role to the remediation rule without authorization errors.
To prevent privilege escalation, AWS requires administrators to have the PassRole permission when associating execution roles with services.

Key Concept

Configuring automatic remediation for compliance violations in AWS Config using Systems Manager Automation and appropriate IAM service roles.
Rate this question

Topics

Event-Driven Automation and Operational Responses