Examkin

Soru

Zorluk: OrtaEvent-Driven Automation and Operational Responses

A SysOps administrator is tasked with configuring automated remediation to delete unencrypted Amazon EBS volumes immediately after they are created. The administrator decides to use AWS Config to evaluate compliance and run the remediation. Which two steps must the administrator perform to configure this automated operational response? (Select TWO.)

  1. Configure a remediation action within the AWS Config rule that targets the AWS-DeleteVolume Systems Manager Automation document.Cevap
  2. Create an IAM service role for Systems Manager Automation that contains permissions for ec2:DeleteVolume and trusts ssm.amazonaws.com to assume the role.Cevap
  3. C
    Create an Amazon EventBridge rule that detects non-compliant evaluation results from AWS Config and targets the Systems Manager Automation document directly.
  4. D
    Add sts:AssumeRole permissions to the IAM user policy of the administrator setting up the remediation to grant access to the remediation execution role.
  5. E
    Enable Amazon CloudWatch detailed monitoring to decrease the detection latency of the AWS Config rule evaluations to one minute.

Cevap

Configure a remediation action within the AWS Config rule that targets the AWS-DeleteVolume Systems Manager Automation document, and create an IAM service role for Systems Manager Automation that contains permissions for ec2:DeleteVolume and trusts ssm.amazonaws.com to assume the role.
To automate the deletion of non-compliant EBS volumes, the administrator must configure a remediation action directly in the AWS Config rule using the AWS-DeleteVolume Systems Manager document. Additionally, the Systems Manager service needs permissions to delete the volume on the user's behalf. This is achieved by creating an IAM service role containing the ec2:DeleteVolume action and configuring the trust policy to allow ssm.amazonaws.com to assume the role.

Adım Adım Çözüm

1
Define the remediation target.
The AWS Config rule for EBS volume encryption is associated with the AWS-DeleteVolume Systems Manager Automation document as its remediation action.
This establishes the link between a non-compliant event (unencrypted volume) and the execution runbook.
2
Configure the execution permissions for the remediation action.
An IAM role is created with a policy allowing ec2:DeleteVolume, and its trust policy is configured to trust ssm.amazonaws.com.
Systems Manager Automation needs an IAM role to perform the ec2:DeleteVolume action on the administrator's behalf.
3
Grant the administrator PassRole permission.
The administrator's IAM policy is updated to include iam:PassRole for the created SSM execution role.
This allows the administrator to delegate the execution role to the Systems Manager service during configuration.

Anahtar Kavram

AWS Config native remediation allows SysOps administrators to associate AWS-managed or custom Systems Manager Automation documents directly with AWS Config rules. This requires configuring a service execution role with appropriate permissions and trust relationships.
Bu soruyu puanla

Konular

Event-Driven Automation and Operational Responses