Examkin

Soru

Zorluk: Çok zorEvent-Driven Automation and Operational Responses

A SysOps administrator is configuring automated, event-driven remediation for non-compliant resources. The administrator sets up the AWS Config managed rule `rds-snapshots-public-prohibited` to detect public Amazon RDS DB snapshots. To automatically remediate non-compliant snapshots, the administrator configures AWS Config to trigger the Systems Manager Automation document `AWS-DisablePublicAccessForRDSSnapshot`.

The administrator creates an IAM role named `ConfigRemediationExecutionRole` with a trust policy that allows `config.amazonaws.com` to assume the role. The role has an identity-based policy that allows `ssm:StartAutomationExecution` and `rds:ModifyDBSnapshotAttribute`. The administrator also creates a separate IAM role named `SSMAutomationAssumeRole` with a trust policy that allows `ssm.amazonaws.com` to assume it. This role has the permissions required to modify RDS snapshot attributes.

When configuring the remediation action in AWS Config, the administrator specifies `ConfigRemediationExecutionRole` as the remediation execution role, and passes the ARN of `SSMAutomationAssumeRole` as the `AutomationAssumeRole` parameter for the Systems Manager document. During testing, AWS Config detects a public snapshot, but the remediation fails with an execution error indicating authorization failure.

What configuration adjustment must the administrator make to resolve this issue?

  1. A
    Modify the trust policy of ConfigRemediationExecutionRole to allow the ssm.amazonaws.com service principal to assume the role.
  2. Add iam:PassRole permission to ConfigRemediationExecutionRole targeting the resource SSMAutomationAssumeRole.Cevap
  3. C
    Create an Amazon EventBridge rule that triggers on AWS Config compliance changes to invoke the Systems Manager Automation document directly, as AWS Config cannot initiate remediation actions natively.
  4. D
    Enable detailed monitoring on the Amazon RDS instances and configure the AWS Config recorder to perform evaluations at one-minute intervals.

Cevap

Add iam:PassRole permission to ConfigRemediationExecutionRole targeting the resource SSMAutomationAssumeRole.
The correct answer states that the administrator must add the iam:PassRole permission to ConfigRemediationExecutionRole targeting the resource SSMAutomationAssumeRole. When AWS Config starts a Systems Manager Automation execution that specifies a service role (AutomationAssumeRole), the role assumed by AWS Config (ConfigRemediationExecutionRole) must have permission to pass that service role to Systems Manager. Without iam:PassRole, the delegation fails with an authorization error.

Adım Adım Çözüm

1
Analyze the event-driven automation flow.
AWS Config acts as the detection mechanism, which triggers AWS Systems Manager (SSM) Automation as the target to perform remediation.
Understanding the interaction between AWS Config remediation and Systems Manager Automation is key to identifying permission gaps.
2
Identify the role delegation chain.
AWS Config assumes ConfigRemediationExecutionRole to call the ssm:StartAutomationExecution API. During execution, SSM Automation assumes SSMAutomationAssumeRole to perform the actual remediation steps.
Since AWS Config is instructing Systems Manager to execute a document using a specific service role, AWS Config must be authorized to pass that service role to Systems Manager.
3
Determine the missing IAM permission.
The execution role assumed by AWS Config (ConfigRemediationExecutionRole) requires the iam:PassRole permission to pass SSMAutomationAssumeRole to Systems Manager.
Without iam:PassRole on the initiating role, any attempt by that role to start an automation execution specifying an AutomationAssumeRole parameter will fail with an authorization error.

Anahtar Kavram

Delegating permissions between services in automated remediations requires the calling service's role to possess the iam:PassRole permission for the role being assumed by the target service.
Bu soruyu puanla

Konular

Event-Driven Automation and Operational Responses