Soru

Zorluk: OrtaEventBridge and Systems Manager Remediation

A SysOps administrator is configuring an automated remediation pipeline to stop any Amazon EC2 instance that is flagged as non-compliant by an AWS Config rule named `required-tags`. The remediation must execute the `AWS-StopEC2Instance` AWS Systems Manager Automation document automatically when compliance fails.

Which TWO configuration actions are required to successfully set up this automation pipeline? (Select TWO.)

  1. Configure an Amazon EventBridge rule with an event pattern that filters for AWS Config compliance change events, specifying the rule name `required-tags` and a compliance status of `NON_COMPLIANT`.Cevap
  2. Configure an IAM role for the EventBridge rule that includes `ssm:StartAutomationExecution` permissions for the target document and `iam:PassRole` permissions for the Systems Manager Automation service role.Cevap
  3. C
    Configure the EventBridge rule to use an Input Transformer to convert an EventBridge schedule payload into an AWS Config API query parameter.
  4. D
    Configure an IAM role for the Systems Manager Automation service role that contains `sts:AssumeRole` permissions for AWS Config, and configure AWS Config to trigger the execution directly without EventBridge.
  5. E
    Configure an IAM policy on the EC2 instance's IAM instance profile that grants `ssm:StartAutomationExecution` and `iam:PassRole` permissions to the Amazon EventBridge service principal.

Cevap

Configuring an EventBridge rule that filters for compliance changes with a status of `NON_COMPLIANT` for the `required-tags` rule, and creating an IAM role for the EventBridge rule with `ssm:StartAutomationExecution` and `iam:PassRole` permissions.
The correct actions involve configuring an EventBridge rule with an event pattern that filters for AWS Config compliance change events, specifying the rule name `required-tags` and a compliance status of `NON_COMPLIANT`. Additionally, the EventBridge rule execution role must be configured with `ssm:StartAutomationExecution` permissions to call the Systems Manager target, along with `iam:PassRole` permissions to pass the Systems Manager Automation service role during invocation.

Adım Adım Çözüm

1
Configure the EventBridge rule filtering criteria.
An EventBridge rule is created with an event pattern targeting AWS Config compliance status changes where the rule name matches `required-tags` and the compliance type is `NON_COMPLIANT`.
This establishes the real-time trigger condition for remediation when compliance fails.
2
Grant the necessary execution and role-passing permissions to EventBridge.
An IAM role is created for the EventBridge rule with policies allowing `ssm:StartAutomationExecution` on the remediation document and `iam:PassRole` on the Automation execution role.
EventBridge needs authorization to invoke the target automation document and to pass the role required to run the automation steps.

Anahtar Kavram

Automating resource remediation using EventBridge rules to trigger Systems Manager Automation documents, which requires specific event filtering patterns and IAM permissions (including ssm:StartAutomationExecution and iam:PassRole).
Bu soruyu puanla