Examkin

Question

Difficulty: HardEvent-Driven Automation and Operational Responses

An organization requires that any newly created Amazon EBS volume without encryption be immediately detached and deleted. A SysOps administrator sets up an Amazon EventBridge rule that triggers when an Amazon EC2 `CreateVolume` API call is recorded. The rule is configured with an AWS Systems Manager (SSM) Automation custom document as the target. The custom document uses an IAM service role named `RemediationExecutionRole` to perform the detachment and deletion. Although EventBridge detects the `CreateVolume` events, the SSM Automation workflow fails to start. Which of the following configuration adjustments will resolve this execution failure?

  1. A
    Attach an IAM policy with `ssm:StartAutomationExecution` permissions to the instance profile of the EC2 instances.
  2. B
    Configure detailed monitoring on the EC2 instances to ensure that events are processed with a 1-minute granularity instead of 5-minute granularity.
  3. Add the `iam:PassRole` permission to the EventBridge execution role, targeting the `RemediationExecutionRole` Amazon Resource Name (ARN).Answer
  4. D
    Modify the trust policy of the `RemediationExecutionRole` to allow the `events.amazonaws.com` service principal to assume the role.

Answer

Add the `iam:PassRole` permission to the EventBridge execution role, targeting the `RemediationExecutionRole` Amazon Resource Name (ARN).
The correct answer is to add the `iam:PassRole` permission to the EventBridge execution role, targeting the `RemediationExecutionRole` ARN. When Amazon EventBridge triggers an AWS Systems Manager (SSM) Automation execution that specifies a service role to perform its actions, the execution role of the EventBridge rule must have the permission to pass that service role to Systems Manager. Without `iam:PassRole` permission, the API call to start the automation execution will fail with an AccessDenied exception.

Step-by-Step Solution

1
Analyze the execution flow of the event-driven remediation setup.
Identify that the event flow is: EC2 CreateVolume -> CloudTrail API log -> EventBridge Rule -> EventBridge Execution Role -> Systems Manager Automation -> RemediationExecutionRole.
Understanding the execution chain helps isolate where the authorization failure occurs.
2
Determine the permissions required for EventBridge to pass a role to a target service.
Recognize that because the SSM Automation document executes using a specific IAM role (RemediationExecutionRole), the triggering service (EventBridge) must have the explicit authorization to pass this role.
AWS services require the `iam:PassRole` permission to associate an IAM role with a resource or job.
3
Select the correction that satisfies the `iam:PassRole` requirement.
Add `iam:PassRole` targeting the `RemediationExecutionRole` ARN to the EventBridge execution role.
This grants EventBridge the authority to pass the remediation role to Systems Manager, enabling the automation workflow to start successfully.

Key Concept

AWS Systems Manager Automation remediation triggers via Amazon EventBridge require correct execution role configuration including `iam:PassRole` for the SSM Automation assume role.
Rate this question

Topics

Event-Driven Automation and Operational Responses