A SysOps Administrator needs to execute an AWS Systems Manager Run Command document on a fleet of Amazon EC2 instances. The administrator wants to store the execution command output in an Amazon S3 bucket and ensure the log files are encrypted using a customer managed AWS KMS key.
Arrange the configuration steps in the correct order to set up secure command execution logging.
- 1Create an Amazon S3 bucket to serve as the destination for Systems Manager Run Command output logs.
- 2Configure the customer managed KMS key policy to permit the EC2 instance IAM role to perform cryptographic operations.
- 3Attach an IAM policy to the EC2 instance profile granting permissions for S3 bucket access (s3:PutObject) and KMS key usage (kms:GenerateDataKey).
- 4Execute the SSM document using Run Command, specifying the S3 bucket name and the customer managed KMS key ID in the Output Options.
Cevap
To set up secure execution logging, first create the S3 bucket. Second, configure the KMS key policy to allow the EC2 role access. Third, attach an IAM policy to the EC2 instance profile granting s3:PutObject and kms:GenerateDataKey permissions. Finally, execute the Run Command, specifying the S3 bucket and KMS key ID.
Secure Run Command logging requires setting up the target S3 bucket and KMS key, granting the EC2 instance profile permissions to write to S3 and use the KMS key, and then executing the command with these parameters.
Adım Adım Çözüm
Anahtar Kavram
Systems Manager Run Command S3 logging with KMS encryption