Examkin

Question

Difficulty: HardAWS Config Rules and Conformance Packs

A SysOps Administrator is configuring automatic remediation for the AWS Config managed rule rds-instance-public-access-check. The remediation configuration is set to use the AWS-defined Systems Manager (SSM) Automation document AWS-DisablePublicAccessForRDSInstance. The administrator has created an IAM role named RDSRemediationRole with a trust policy that allows ssm.amazonaws.com to assume it. When attempting to save the remediation configuration in the AWS Config console, the operation fails with an authorization error. Which action should the SysOps Administrator take to resolve this issue?

  1. Add an IAM policy containing the iam:PassRole permission for the RDSRemediationRole to the administrator's IAM identity.Answer
  2. B
    Update the trust relationship of the RDSRemediationRole to allow the config.amazonaws.com service principal to assume the role.
  3. C
    Create an Amazon EventBridge rule that triggers on AWS Config compliance status changes to invoke the Systems Manager Automation document.
  4. D
    Attach the AWSServiceRoleForConfig service-linked role to the RDSRemediationRole trust policy to authorize the delegation.

Answer

Add an IAM policy containing the iam:PassRole permission for the RDSRemediationRole to the administrator's IAM identity.
The correct answer is to add an IAM policy containing the iam:PassRole permission for the RDSRemediationRole to the administrator's IAM identity. When configuring an AWS service like AWS Config to pass an IAM role to another service like Systems Manager Automation, AWS validates that the user or role making the configuration has the iam:PassRole permission. Without this permission, the console or API returns an authorization error.

Step-by-Step Solution

1
Identify the service executing the remediation and the role being passed.
The AWS Config service uses the RDSRemediationRole to execute the Systems Manager Automation document AWS-DisablePublicAccessForRDSInstance.
Systems Manager needs to assume this role to execute the remediation actions on RDS.
2
Determine the permission required by the administrator to configure the role delegation.
The administrator must have the iam:PassRole permission for the RDSRemediationRole resource.
AWS prevents unauthorized users from passing powerful IAM roles to services by enforcing the iam:PassRole policy checks on the configuring identity.
3
Attach the appropriate IAM policy to the administrator's identity.
The administrator can successfully save the AWS Config remediation configuration.
Providing iam:PassRole satisfies the authorization check during remediation setup.

Key Concept

Configuring automatic remediation in AWS Config requires the configuring identity to have the iam:PassRole permission to delegate the remediation execution role to Systems Manager.
Estimated Time:2m 0s
Rate this question

Topics

AWS Config Rules and Conformance Packs

More questions from this topic