Examkin

Soru

Zorluk: OrtaPatch Management and OS Compliance Automation

An organization uses AWS Systems Manager Patch Manager to automate security updates on a fleet of Amazon EC2 instances running Red Hat Enterprise Linux (RHEL). A SysOps administrator is setting up a Maintenance Window to run a custom OS patching automation. The administrator creates a custom SSM Automation document and an IAM service role named PatchingExecutionRole that allows Systems Manager to perform actions on the instances. When the administrator attempts to register the SSM Automation task within the Maintenance Window using the AWS CLI, the operation fails with an AccessDenied exception stating that the user is not authorized to perform iam:PassRole on the resource PatchingExecutionRole.

What is the correct action to resolve this issue and successfully register the task?

  1. Attach an IAM policy to the SysOps administrator's IAM identity that grants the iam:PassRole permission for the PatchingExecutionRole Amazon Resource Name (ARN).Cevap
  2. B
    Modify the trust policy of the PatchingExecutionRole to allow the Systems Manager service principal (ssm.amazonaws.com) to perform the sts:AssumeRole action.
  3. C
    Update the target instances' tags with a key of Patch Group and a value of Production to associate them with the custom patching execution role.
  4. D
    Modify the default KMS key policy to permit the SysOps administrator's IAM identity to perform the kms:Decrypt and kms:GenerateDataKey actions.

Cevap

Attach an IAM policy to the SysOps administrator's IAM identity that grants the iam:PassRole permission for the PatchingExecutionRole Amazon Resource Name (ARN).
The correct action is to attach an IAM policy to the SysOps administrator's IAM identity that grants the iam:PassRole permission for the PatchingExecutionRole Amazon Resource Name (ARN). This is because the AWS CLI registration command requires the administrator to pass the service role to Systems Manager, which requires explicit iam:PassRole permissions on the user side.

Adım Adım Çözüm

1
Analyze the error message to locate the missing permission and the resource it applies to.
The administrator lacks the iam:PassRole permission on the PatchingExecutionRole resource.
This identifies that the issue is an authorization failure for the user, not a trust configuration issue on the role itself.
2
Create or modify an IAM policy to grant the missing permission.
An IAM policy is created with the action 'iam:PassRole' targeting the ARN of PatchingExecutionRole.
The user attempting to register the task must be explicitly authorized to pass the role to Systems Manager.
3
Attach the policy to the SysOps administrator's IAM identity (user, group, or role).
The administrator successfully registers the task with the Maintenance Window using the AWS CLI.
Applying the policy provides the necessary credentials for the CLI call to succeed.

Anahtar Kavram

IAM PassRole Permission for Systems Manager Tasks
Bu soruyu puanla

Konular

Patch Management and OS Compliance Automation

Bu konudan daha fazla soru