Examkin

Soru

Zorluk: OrtaEventBridge and Systems Manager Remediation

An organization wants to automatically remediate Amazon SQS queues that are created without server-side encryption (SSE). An AWS Config rule evaluates the queues and generates compliance change events. A SysOps administrator wants to use Amazon EventBridge to detect these compliance changes and trigger the AWS-provided AWS-EnableSQSQueueEncryption Systems Manager Automation document to encrypt the non-compliant queues.

Which two configuration actions must the administrator perform to successfully set up this automated remediation pipeline? (Select TWO.)

  1. Configure the EventBridge rule target to use the Input Transformer to extract the SQS queue URL from the AWS Config event details and map it to the Systems Manager Automation document parameters.Cevap
  2. Create an IAM role for EventBridge that grants ssm:StartAutomationExecution permissions for the Systems Manager Automation document and iam:PassRole permissions for the Systems Manager Automation service role.Cevap
  3. C
    Configure the Systems Manager Automation service role trust policy to trust the SQS service principal, and attach the sqs:SetQueueAttributes permission directly to the EventBridge execution role.
  4. D
    Configure the EventBridge rule target to point directly to the non-compliant SQS queue, and apply an SQS resource policy that grants the EventBridge service principal permissions to alter queue settings.
  5. E
    Configure the AWS Config rule to use an EventBridge rule pattern to directly invoke the SQS queue's API without using Systems Manager.

Cevap

To configure the remediation pipeline, the administrator must configure the EventBridge rule target to use the Input Transformer to extract the SQS queue URL from the AWS Config event details and map it to the Systems Manager Automation document parameters, and create an IAM role for EventBridge that grants ssm:StartAutomationExecution permissions for the Systems Manager Automation document and iam:PassRole permissions for the Systems Manager Automation service role.
To set up the automated remediation pipeline, two main components must be configured: event data mapping and IAM permissions. First, since the Systems Manager Automation document requires the SQS queue URL as an input, and this URL is nested inside the AWS Config event payload, the administrator must configure the EventBridge target with an Input Transformer to map the SQS queue URL from the event payload to the automation document's parameters. Second, the EventBridge rule needs permissions to invoke the Systems Manager Automation document via the ssm:StartAutomationExecution API, and it must have the iam:PassRole permission to pass the Systems Manager Automation service role to the Systems Manager service for execution.

Adım Adım Çözüm

1
Configure the IAM execution role for Amazon EventBridge.
EventBridge is granted permissions to start Systems Manager Automation executions and pass the required execution role.
EventBridge needs the ssm:StartAutomationExecution permission to run the document, and the iam:PassRole permission to safely delegate the Systems Manager Automation service role.
2
Map the resource payload using the EventBridge Input Transformer.
The target parameters of the automation document are correctly populated with the non-compliant SQS queue's URL.
Since the AWS Config compliance event contains the SQS queue URL in its detail payload, the Input Transformer must extract this value and map it to the document's input parameter.

Anahtar Kavram

Configuring event-driven automated remediation pipelines using AWS Config compliance change events, Amazon EventBridge, and AWS Systems Manager Automation.
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

EventBridge and Systems Manager Remediation

Bu konudan daha fazla soru