Examkin

Question

Difficulty: HardAWS Systems Manager Configuration and Run Command Automation

To automate package deployment, an operations team uses AWS Systems Manager Run Command to execute the `AWS-RunShellScript` document across multiple Amazon EC2 instances. The SysOps administrator wants to monitor the execution progress by configuring Amazon Simple Notification Service (Amazon SNS) notifications for command status changes. The administrator creates a dedicated IAM role named `SSM-SNS-Notification-Role` that trusts the Systems Manager service principal and has permissions to publish to the target SNS topic. When executing the `aws ssm send-command` CLI command with the `--service-role-arn` parameter set to the `SSM-SNS-Notification-Role` ARN, the command execution fails immediately with an `AccessDenied` exception before running on any targets. The EC2 instances are online in Systems Manager with the SSM Agent running and have a valid instance profile. Which configuration change is required to successfully run the command with SNS notifications enabled?

  1. Attach an IAM policy to the SysOps administrator's identity that grants the `iam:PassRole` permission for the `SSM-SNS-Notification-Role` resource.Answer
  2. B
    Modify the trust policy of the `SSM-SNS-Notification-Role` to allow the SysOps administrator's IAM identity to assume the role.
  3. C
    Assign a tag with the key `PatchGroup` to the target Amazon EC2 instances to register them with the maintenance window.
  4. D
    Update the customer managed KMS key policy for the SNS topic to grant key usage permissions to the EC2 instances' IAM instance profile.

Answer

Attach an IAM policy to the SysOps administrator's identity that grants the `iam:PassRole` permission for the `SSM-SNS-Notification-Role` resource.
To send execution status notifications, the Systems Manager service must assume the specified service role (`SSM-SNS-Notification-Role`) to publish updates to the target SNS topic. To enable this, the IAM identity of the administrator executing the `send-command` API call must have explicit authorization to pass the role. This is achieved by attaching a policy granting the `iam:PassRole` permission targeting the service role to the administrator's IAM user or role.

Step-by-Step Solution

1
Analyze the error context.
The `AccessDenied` exception occurs immediately upon calling `aws ssm send-command` before command dispatch.
This indicates an IAM authorization failure on the API caller (the SysOps administrator) rather than a failure on the EC2 instances or within the Run Command execution itself.
2
Evaluate the role delegation mechanism.
The SysOps administrator passes the `SSM-SNS-Notification-Role` using the `--service-role-arn` parameter so that the AWS Systems Manager service can publish notifications to SNS.
Passing an IAM role to an AWS service requires the calling user to have authorization to pass that role to the specified service principal.
3
Identify the missing permission.
The SysOps administrator's IAM policy must contain the `iam:PassRole` action targeting the `SSM-SNS-Notification-Role` ARN.
Granting `iam:PassRole` ensures the administrator is authorized to delegate permissions to the service role, which resolves the `AccessDenied` exception.

Key Concept

Delegating IAM roles to AWS services using the PassRole permission
Rate this question

Topics

AWS Systems Manager Configuration and Run Command Automation