Examkin

Question

Difficulty: MediumSecurity Monitoring, Logging, and Compliance Auditing

A SysOps Administrator is configuring an AWS Config rule to monitor whether Amazon EC2 instances have public IP addresses. The administrator sets up automatic remediation using the AWS-StopEC2Instance Systems Manager (SSM) Automation document. The administrator creates an IAM role named ConfigRemediationRole that has a trust relationship with ssm.amazonaws.com and has the necessary permissions to stop EC2 instances. When the administrator attempts to associate this role with the AWS Config remediation configuration, the AWS Config console displays an error: 'Insufficient permissions to pass the remediation role.' Which action will resolve this issue?

  1. Attach an IAM policy to the administrator's IAM identity that grants the iam:PassRole permission for the ConfigRemediationRole resource.Answer
  2. B
    Update the trust policy of ConfigRemediationRole to allow the AWS Config service (config.amazonaws.com) to assume the role.
  3. C
    Add the iam:PassRole permission to the permissions policy of the ConfigRemediationRole itself, specifying the administrator's IAM identity as the resource.
  4. D
    Configure an Amazon EventBridge rule to monitor AWS Config compliance change events and target the Systems Manager Automation document directly.

Answer

Attach an IAM policy to the administrator's IAM identity that grants the iam:PassRole permission for the ConfigRemediationRole resource.
The correct answer is to grant the administrator the iam:PassRole permission. When configuring AWS services to act on your behalf using an IAM role, your IAM identity (user or role) must be authorized to pass that role. Without this permission, the AWS Config console and API prevent you from completing the configuration to protect against unauthorized privilege escalation.

Step-by-Step Solution

1
Identify the role delegation flow in AWS Config automated remediation.
AWS Config uses AWS Systems Manager (SSM) Automation to execute remediation. The user configuring this setup must pass an IAM execution role to the SSM service.
Understanding the service interaction helps pinpoint which permissions are required for the configuration step.
2
Analyze the error message 'Insufficient permissions to pass the remediation role'.
The error explicitly indicates a failure in the iam:PassRole authorization check for the administrator's identity.
When an AWS service or user associates an IAM role with a service, the user's IAM identity must be explicitly authorized to pass that role.
3
Determine the correct policy configuration to authorize role passage.
Attach a policy with iam:PassRole to the administrator's IAM user or role, targeting the ARN of ConfigRemediationRole.
This grants the administrator the necessary privilege to complete the configuration of the automated remediation.

Key Concept

AWS Config automated remediation and IAM role delegation (iam:PassRole requirements)
Rate this question

Topics

Security Monitoring, Logging, and Compliance Auditing

More questions from this topic