Examkin

Question

Difficulty: HardEventBridge and Systems Manager Remediation

An organization wants to establish an automated response system when an Amazon EC2 instance's CPU utilization exceeds 95%95\% for more than 15 minutes, which indicates a runaway process. A SysOps administrator configures an Amazon EventBridge rule triggered by the corresponding Amazon CloudWatch alarm state change to `ALARM`. The remediation strategy is to trigger a custom AWS Systems Manager Automation runbook named `ResolveRunawayProcess` that will restart the problematic service on the instance. The runbook requires a service role (`SSMAutomationServiceRole`) to execute its steps. Which configuration and permission setup will successfully execute the remediation with the least privilege?

  1. Set the EventBridge rule target to Systems Manager Automation and select the ResolveRunawayProcess document. Assign an IAM role to the EventBridge target containing the ssm:StartAutomationExecution permission for the document and the iam:PassRole permission for the SSMAutomationServiceRole resource.Answer
  2. B
    Set the EventBridge rule target to Systems Manager Automation and select the ResolveRunawayProcess document. Assign an IAM role to the EventBridge target containing the ssm:StartAutomationExecution permission, and configure the trust relationship of the SSMAutomationServiceRole to trust the EventBridge service principal (events.amazonaws.com).
  3. C
    Set the EventBridge rule target to Systems Manager Run Command and select the ResolveRunawayProcess document. Assign an IAM role to the EventBridge target containing the ssm:SendCommand permission and the iam:PassRole permission for the instance profile role.
  4. D
    Set the EventBridge rule target to AWS Config, and configure an AWS Config remediation action to execute the ResolveRunawayProcess document. Assign an IAM role to AWS Config containing the ssm:StartAutomationExecution permission.

Answer

Set the EventBridge rule target to Systems Manager Automation and select the ResolveRunawayProcess document. Assign an IAM role to the EventBridge target containing the ssm:StartAutomationExecution permission for the document and the iam:PassRole permission for the SSMAutomationServiceRole resource.
The correct configuration establishes a path where EventBridge acts as the caller. It invokes the Systems Manager Automation target (`ResolveRunawayProcess` document) and passes the execution role (`SSMAutomationServiceRole`) to Systems Manager using `iam:PassRole` permissions. Without `iam:PassRole`, Systems Manager cannot execute the Automation runbook steps under the specified service role context.

Step-by-Step Solution

1
Identify the target orchestration service for the remediation.
The target must be Systems Manager Automation since the action requires executing a custom SSM Automation runbook.
Systems Manager Automation is the correct service for executing workflows/runbooks, unlike Run Command which executes scripts directly on managed instances.
2
Determine the necessary IAM permissions for EventBridge to invoke Systems Manager Automation.
The EventBridge execution role needs the ssm:StartAutomationExecution permission for the ResolveRunawayProcess document.
EventBridge must have explicit permission to trigger the execution of the target SSM document.
3
Configure the role-passing capability for the target execution.
Grant the EventBridge execution role iam:PassRole permission targeting the SSMAutomationServiceRole.
Since the Automation workflow executes steps using the SSMAutomationServiceRole, the calling service (EventBridge) must have permission to pass this execution role to Systems Manager.

Key Concept

EventBridge and Systems Manager Automation Remediation IAM Permissions
Rate this question

Topics

EventBridge and Systems Manager Remediation

More questions from this topic