Examkin

Question

Difficulty: Very hardAWS Config Rules and Conformance Packs

A SysOps Administrator is configuring automatic remediation for a custom AWS Config rule that checks whether Amazon EBS volumes are encrypted. The remediation is configured to use the AWS-EncryptVolume Systems Manager (SSM) Automation document. The administrator has created an IAM role named EbsRemediationRole to perform the remediation. However, when AWS Config detects a non-compliant volume, the automatic remediation fails to execute, and a permissions error is displayed in the AWS Config console. Which of the following configuration changes must the administrator make to resolve this issue and allow the remediation to run successfully? (Select TWO.)

  1. Add the iam:PassRole permission to the administrator's IAM identity policy, specifying EbsRemediationRole as the resource.Answer
  2. Configure the trust policy of EbsRemediationRole to allow the ssm.amazonaws.com service principal to perform the sts:AssumeRole action.Answer
  3. C
    Add the sts:AssumeRole permission to the administrator's IAM policy, and configure the trust policy of EbsRemediationRole to trust the administrator's IAM identity.
  4. D
    Modify the trust policy of EbsRemediationRole to allow the config.amazonaws.com service principal to perform the sts:AssumeRole action.
  5. E
    Create an Amazon EventBridge rule that triggers on AWS Config non-compliant evaluation events and set the target of the rule directly to the EBS volume.
  6. F
    Configure an Amazon EventBridge rule to intercept AWS Config compliance changes and trigger a Systems Manager Run Command execution to run the encryption script on the target volume.

Answer

To resolve the permissions error and successfully run the automatic remediation, the administrator must add the iam:PassRole permission to their own IAM policy for the EbsRemediationRole, and configure the trust policy of EbsRemediationRole to allow the ssm.amazonaws.com service principal to assume the role.
The correct actions require ensuring the correct service principal (ssm.amazonaws.com) can assume the remediation role, and the administrator has the iam:PassRole permission to pass that role to the service. When AWS Config triggers remediation via SSM Automation, it passes the specified role to the Systems Manager service. This operation requires the configuring user to have the iam:PassRole permission for the role. The SSM service must then assume this role to perform actions on the resources, which requires a trust relationship allowing ssm.amazonaws.com to perform sts:AssumeRole.

Step-by-Step Solution

1
Analyze the execution path of the AWS Config remediation.
AWS Config triggers Systems Manager Automation to run the AWS-EncryptVolume document, passing the EbsRemediationRole as the execution role.
Understanding the path helps identify which service is assuming the role and which identity is passing it.
2
Verify user/administrator permissions for configuration.
The identity configuring the remediation requires the iam:PassRole permission for the EbsRemediationRole.
AWS Config requires the configuring user to have iam:PassRole to delegate authority to Systems Manager.
3
Verify the trust policy of the remediation role.
The EbsRemediationRole must trust ssm.amazonaws.com.
Since Systems Manager Automation executes the document, it must be allowed to assume the role using sts:AssumeRole.

Key Concept

AWS Config remediation requires proper iam:PassRole permissions for the administrator to delegate the execution role, and the execution role must trust the ssm.amazonaws.com service principal.
Rate this question

Topics

AWS Config Rules and Conformance Packs

More questions from this topic