A SysOps administrator is configuring an automated remediation pipeline to stop any Amazon EC2 instance that is flagged as non-compliant by an AWS Config rule named `required-tags`. The remediation must execute the `AWS-StopEC2Instance` AWS Systems Manager Automation document automatically when compliance fails.
Which TWO configuration actions are required to successfully set up this automation pipeline? (Select TWO.)
- Configure an Amazon EventBridge rule with an event pattern that filters for AWS Config compliance change events, specifying the rule name `required-tags` and a compliance status of `NON_COMPLIANT`.Cevap
- Configure an IAM role for the EventBridge rule that includes `ssm:StartAutomationExecution` permissions for the target document and `iam:PassRole` permissions for the Systems Manager Automation service role.Cevap
- CConfigure the EventBridge rule to use an Input Transformer to convert an EventBridge schedule payload into an AWS Config API query parameter.
- DConfigure an IAM role for the Systems Manager Automation service role that contains `sts:AssumeRole` permissions for AWS Config, and configure AWS Config to trigger the execution directly without EventBridge.
- EConfigure an IAM policy on the EC2 instance's IAM instance profile that grants `ssm:StartAutomationExecution` and `iam:PassRole` permissions to the Amazon EventBridge service principal.
Cevap
Configuring an EventBridge rule that filters for compliance changes with a status of `NON_COMPLIANT` for the `required-tags` rule, and creating an IAM role for the EventBridge rule with `ssm:StartAutomationExecution` and `iam:PassRole` permissions.
The correct actions involve configuring an EventBridge rule with an event pattern that filters for AWS Config compliance change events, specifying the rule name `required-tags` and a compliance status of `NON_COMPLIANT`. Additionally, the EventBridge rule execution role must be configured with `ssm:StartAutomationExecution` permissions to call the Systems Manager target, along with `iam:PassRole` permissions to pass the Systems Manager Automation service role during invocation.
Adım Adım Çözüm
Anahtar Kavram
Automating resource remediation using EventBridge rules to trigger Systems Manager Automation documents, which requires specific event filtering patterns and IAM permissions (including ssm:StartAutomationExecution and iam:PassRole).