Examkin

Question

Difficulty: MediumEventBridge and Systems Manager Remediation

An organization relies on AWS Config to verify that Amazon DynamoDB tables have point-in-time recovery (PITR) enabled. To automate the response for non-compliant tables, a SysOps administrator plans to use an Amazon EventBridge rule to execute the AWS Systems Manager (SSM) Automation document `AWS-EnableDynamoDbPointInTimeRecovery`. The SSM Automation execution requires a specific IAM service role to perform the remediation steps. Which configuration must the administrator implement to ensure the remediation process triggers successfully?

  1. Configure the EventBridge rule to target the SSM Automation document. Associate an IAM role with the EventBridge target that has a trust relationship with events.amazonaws.com and grants permissions for ssm:StartAutomationExecution and iam:PassRole for the SSM Automation service role.Answer
  2. B
    Configure the EventBridge rule to target the SSM Automation document. Associate an IAM role with the EventBridge target that has a trust relationship with ssm.amazonaws.com and grants permissions for ssm:StartAutomationExecution and iam:PassRole for the SSM Automation service role.
  3. C
    Configure the EventBridge rule to target the AWS Config rule. Configure the AWS Config rule to use the SSM Automation document as a remediation action, relying on AWS Config to automatically trigger the SSM Automation upon compliance state changes.
  4. D
    Configure the EventBridge rule to target the SSM Automation document. Associate an IAM role with the EventBridge target that has a trust relationship with events.amazonaws.com and grants permissions for ssm:StartAutomationExecution, but omit the iam:PassRole permission as the role is only needed at document runtime.

Answer

Configure the EventBridge rule to target the SSM Automation document. Associate an IAM role with the EventBridge target that has a trust relationship with events.amazonaws.com and grants permissions for ssm:StartAutomationExecution and iam:PassRole for the SSM Automation service role.
The correct configuration targets the Systems Manager Automation document from the EventBridge rule. The IAM role assigned to the EventBridge target must trust the EventBridge service (events.amazonaws.com) to allow assumption of the role. Additionally, the role policy must grant the ssm:StartAutomationExecution permission to run the document and the iam:PassRole permission to pass the Systems Manager Automation service role that executes the underlying remediation commands.

Step-by-Step Solution

1
Set the EventBridge rule target to the Systems Manager Automation document.
The EventBridge rule is directed to execute the specified remediation document when triggered by the compliance change event.
EventBridge needs to invoke the Automation document directly to initiate the remediation.
2
Configure the IAM role associated with the EventBridge target to trust the EventBridge service principal.
EventBridge is successfully authorized to assume the role to trigger the target.
Without a trust relationship for events.amazonaws.com, EventBridge cannot assume the role to run the target.
3
Attach a policy to the IAM role that allows starting the automation and passing the SSM Automation service role.
EventBridge can execute the SSM document and pass the required execution role to Systems Manager.
ssm:StartAutomationExecution is required to invoke the document, and iam:PassRole is required to delegate the execution role to Systems Manager.

Key Concept

Configuring Amazon EventBridge rule targets for Systems Manager Automation remediation requires proper IAM trust relationships and permissions, including iam:PassRole to delegate the execution role to Systems Manager.
Rate this question

Topics

EventBridge and Systems Manager Remediation

More questions from this topic