Examkin

Question

Difficulty: HardAWS Systems Manager Configuration and Run Command Automation

A SysOps Administrator is configuring an AWS Systems Manager State Manager association to execute a custom Automation document that runs on a fleet of Amazon EC2 instances. The target instances have the Systems Manager (SSM) Agent installed and active, and they are targeted using the tag `Environment: Production`. The instances also have the necessary IAM instance profile attached. During the creation of the State Manager association, the administrator specifies a custom IAM service role to allow Systems Manager to execute the Automation workflow. However, the creation of the association fails immediately with an AccessDenied error.

Which of the following is the most likely root cause of this failure?

  1. A
    The Gateway VPC Endpoint for S3 is not associated with the route tables of the subnets where the target EC2 instances reside.
  2. B
    The target EC2 instances have a patch group tag misalignment, preventing the State Manager association from registering them as managed nodes.
  3. The administrator's IAM user policy does not grant the `iam:PassRole` permission for the custom IAM service role.Answer
  4. D
    The customer managed KMS key policy lacks permission to allow the administrator to encrypt the State Manager association metadata.

Answer

The administrator's IAM user policy does not grant the `iam:PassRole` permission for the custom IAM service role.
The correct answer is that the administrator's IAM user policy does not grant the `iam:PassRole` permission for the custom IAM service role. When setting up a State Manager association or Automation workflow that uses a service role to perform actions, the IAM user creating the association must have permission to pass that role to the Systems Manager service.

Step-by-Step Solution

1
Analyze the timing of the failure.
The failure occurs immediately during the creation of the State Manager association, not during runtime execution on the target EC2 instances.
Identifying the error timing helps isolate issues related to IAM role configuration/creation permissions from runtime resource access issues.
2
Evaluate the permissions required by the administrator to create the association using a service role.
Creating an association that executes a workflow via a service role requires the user to have the `iam:PassRole` permission for that service role.
IAM requires the `iam:PassRole` permission to prevent unauthorized users from passing highly privileged roles to AWS services.
3
Differentiate between the correct answer and the distractors.
The other options involve runtime execution issues (such as S3 VPC endpoint routing, KMS key policies, or patch group misalignment) that do not block association creation API calls.
This confirms that only the IAM PassRole omission explains the immediate creation failure with an AccessDenied error.

Key Concept

IAM PassRole Permission for Systems Manager Automation and State Manager
Rate this question

Topics

AWS Systems Manager Configuration and Run Command Automation