Examkin

Question

Difficulty: Very hardAWS Config Rules and Conformance Packs

A technology company implements compliance monitoring using AWS Config. The security team deploys a conformance pack containing a custom Config rule that monitors security group configurations. The conformance pack template specifies an automatic remediation configuration that calls a custom Systems Manager (SSM) Automation document to modify non-compliant security groups. The Config remediation execution configuration uses a dedicated IAM role (ConfigRemediationRole) to initiate the remediation. The custom SSM Automation document contains a parameter AutomationAssumeRole, which requires passing a separate IAM role (SSMExecutionRole) to perform the actual resource modifications. Although AWS Config marks the security groups as non-compliant, the automated remediation consistently fails to execute. The execution logs show that the Config remediation role is unable to trigger the SSM Automation. Which action must the administrator take to resolve this issue?

  1. A
    Update the trust policy of the SSMExecutionRole to allow the config.amazonaws.com service principal to assume it.
  2. B
    Create an Amazon EventBridge rule that triggers on AWS Config compliance change events and targets the SSMExecutionRole to run the automation.
  3. Attach an IAM policy to the ConfigRemediationRole that grants the iam:PassRole permission for the SSMExecutionRole.Answer
  4. D
    Attach a policy to the AWS Config service-linked role that grants the sts:AssumeRole permission on the SSMExecutionRole.

Answer

Attach an IAM policy to the ConfigRemediationRole that grants the iam:PassRole permission for the SSMExecutionRole.
The correct action is to grant iam:PassRole permissions for the SSM execution role to the Config remediation role. When AWS Config triggers the Systems Manager Automation, the Config remediation role must pass the SSM execution role to the Systems Manager service so that Systems Manager can assume it and run the automation steps. Without iam:PassRole permissions, the API call to start the automation fails because the caller does not have permission to delegate the role.

Step-by-Step Solution

1
Identify the service delegation boundary in AWS Config automatic remediation.
Recognize that AWS Config assumes the configured remediation role (ConfigRemediationRole) to initiate the Systems Manager Automation document.
To understand which IAM entity initiates the API call and where permissions must be configured.
2
Analyze the role of AutomationAssumeRole inside the SSM document execution.
Determine that the ConfigRemediationRole must pass the SSMExecutionRole to the Systems Manager service during the StartAutomationExecution API call.
Systems Manager needs to assume SSMExecutionRole to execute the steps, requiring a delegation permission from the caller.
3
Apply the iam:PassRole permission requirement.
Formulate an IAM policy granting iam:PassRole on SSMExecutionRole and attach it to the ConfigRemediationRole.
An AWS service principal cannot assume or use a role passed by an API caller unless the caller's IAM entity is explicitly permitted to pass that role.

Key Concept

Delegating IAM roles to AWS Services using PassRole in Config Remediation

Alternative Method

Instead of passing a separate execution role, you can grant the ConfigRemediationRole direct permissions to modify the security group and omit the AutomationAssumeRole parameter in the SSM document. However, using a dedicated execution role for SSM remains the best practice for principal separation.
Estimated Time:3m 0s
Rate this question

Topics

AWS Config Rules and Conformance Packs

More questions from this topic