Examkin

Question

Difficulty: MediumAWS Systems Manager Configuration and Run Command Automation

A SysOps Administrator is using AWS Systems Manager Run Command to execute a maintenance script on a fleet of Amazon EC2 instances. All target instances have the SSM Agent installed and running, and they are associated with an IAM instance profile containing the AmazonSSMManagedInstanceCore policy. The administrator configures the Run Command to output execution logs to an Amazon S3 bucket that is encrypted using an AWS KMS customer managed key. The command runs successfully on the instances, but the execution logs fail to appear in the S3 bucket. Which of the following is the most likely cause of this issue?

  1. A
    The S3 bucket policy does not grant the Systems Manager service principal (ssm.amazonaws.com) permissions to write objects to the bucket.
  2. B
    The IAM policy attached to the administrator's user lacks the iam:PassRole permission for the customer managed KMS key.
  3. The IAM instance profile role associated with the EC2 instances lacks permission to perform the kms:GenerateDataKey action on the KMS key.Answer
  4. D
    The target instances do not have the proper patch group tags aligned with the Systems Manager Patch Baseline to authorize log delivery.

Answer

The IAM instance profile role associated with the EC2 instances lacks permission to perform the kms:GenerateDataKey action on the KMS key.
When configuring AWS Systems Manager Run Command to send output logs to an Amazon S3 bucket encrypted with SSE-KMS using a customer managed key, the SSM Agent running on the EC2 instance writes the logs directly. Therefore, the IAM instance profile role attached to the EC2 instances must have permission to perform the kms:GenerateDataKey action on the KMS key to encrypt the log objects during upload.

Step-by-Step Solution

1
Analyze the log delivery path for Systems Manager Run Command.
The SSM Agent running locally on each EC2 instance writes the execution logs directly to the target Amazon S3 bucket.
This establishes that log delivery actions are performed using the credentials of the EC2 instance profile, not a service role or the Systems Manager service principal.
2
Identify the encryption requirements for writing to the S3 bucket.
Since the S3 bucket is encrypted with an AWS KMS customer managed key, any write operation must generate a data key using that KMS key.
Writing to an SSE-KMS encrypted bucket requires permissions to perform the kms:GenerateDataKey cryptographic action.
3
Determine the necessary IAM configuration to authorize the write operation.
The instance profile role must be explicitly granted the kms:GenerateDataKey action on the custom KMS key, as the default AmazonSSMManagedInstanceCore policy does not contain permissions for custom KMS keys.
Adding these permissions resolves the Access Denied issue when the SSM Agent attempts to upload the log files.

Key Concept

Systems Manager Run Command S3 log export permissions and KMS encryption
Estimated Time:1m 30s
Rate this question

Topics

AWS Systems Manager Configuration and Run Command Automation