Examkin

Soru

Zorluk: OrtaAWS Systems Manager Configuration and Run Command Automation

A SysOps Administrator needs to schedule a weekly task that runs a custom configuration script on a fleet of Amazon EC2 instances by using an AWS Systems Manager Automation document. The EC2 instances are tagged with the key `Env` and the value `Production`. The instances have the SSM Agent installed and running, and they are associated with an IAM instance profile containing the `AmazonSSMManagedInstanceCore` managed policy.

The Administrator is using a custom IAM service role named `SSMAutomationServiceRole` to allow Systems Manager to execute the Automation workflow. However, when the Administrator attempts to run the Automation using their own IAM user account, the execution fails with an access denied error. What combination of steps must the Administrator perform to execute the Automation and target the correct instances? (Select TWO.)

  1. Add a policy to the SysOps Administrator's IAM user that grants the `iam:PassRole` permission for the `SSMAutomationServiceRole` ARN.Cevap
  2. Define the targets for the Automation execution by specifying resource tags with the key `Env` and the value `Production`.Cevap
  3. C
    Configure the trust policy of the `SSMAutomationServiceRole` to allow the SysOps Administrator's IAM user to perform the `sts:AssumeRole` action.
  4. D
    Assign a resource tag with the key `Patch Group` and value `Production` to the target instances, and configure the Automation document to execute against the patch group.
  5. E
    Enable the SysOps Administrator's IAM user to assume the EC2 instance profile role by granting the `sts:AssumeRole` permission on the instances.

Cevap

To run the Automation successfully, the Administrator must add an IAM policy to their user account granting the `iam:PassRole` permission for the `SSMAutomationServiceRole` ARN, and define the targets for the Automation execution by specifying resource tags with the key `Env` and the value `Production`.
To successfully execute a Systems Manager Automation document that uses a service role, the IAM user initiating the task must have the `iam:PassRole` permission for that service role. This ensures the user is authorized to delegate permissions to the service. Additionally, specifying target filters by tag key and value is the correct way to scope the execution to the production instances dynamically.

Adım Adım Çözüm

1
Analyze the IAM configuration error during the Automation execution.
Identify that the error is caused by the Administrator's IAM user lacking the ability to pass the `SSMAutomationServiceRole` to Systems Manager.
When an AWS service executes actions on a user's behalf using a service role, the user's IAM entity must have the `iam:PassRole` permission for that specific role.
2
Address the IAM permission gap.
Attach an IAM policy with the `iam:PassRole` permission for the role's ARN to the SysOps Administrator's IAM user.
This allows the user to authorize Systems Manager to use the service role to perform the configuration audit script execution.
3
Configure the target parameter for the Systems Manager Automation.
Use target tags under the Execution parameters to dynamically filter instances by key `Env` and value `Production`.
Selecting targets by resource tags is the standard, dynamic way to scope Run Command and Automation actions to a subset of managed nodes.

Anahtar Kavram

AWS Systems Manager Configuration and Run Command Automation
Bu soruyu puanla

Konular

AWS Systems Manager Configuration and Run Command Automation