Examkin

Soru

Zorluk: ZorEvent-Driven Automation and Operational Responses

A SysOps administrator is configuring an automated remediation workflow to enable Amazon S3 Block Public Access on any S3 bucket when a PutBucketPolicy API call is detected. The administrator creates an Amazon EventBridge rule that filters CloudTrail API events for PutBucketPolicy and targets the AWS Systems Manager Automation document AWS-ConfigureS3BucketPublicAccessBlock. The Automation document requires an execution role (AutomationAssumeRole) to perform the configuration changes. However, the execution fails to start when a policy changes.

Which of the following configuration steps must the SysOps administrator perform to successfully implement this automated remediation? (Select TWO.)

  1. Configure the EventBridge target to use an IAM service role that contains ssm:StartAutomationExecution permissions for the target Systems Manager Automation document.Cevap
  2. Grant the EventBridge execution role iam:PassRole permissions for the Systems Manager Automation execution role.Cevap
  3. C
    Modify the trust relationship of the Systems Manager Automation execution role to allow the EventBridge service role to call sts:AssumeRole directly instead of passing the role.
  4. D
    Create a CloudWatch metric filter for PutBucketPolicy events and configure it to trigger the Systems Manager Automation document as a CloudWatch alarm action.
  5. E
    Enable detailed monitoring on the S3 buckets to reduce event delivery latency and trigger the EventBridge rule.

Cevap

Configure the EventBridge target to use an IAM service role that contains ssm:StartAutomationExecution permissions for the target Systems Manager Automation document, and grant the EventBridge execution role iam:PassRole permissions for the Systems Manager Automation execution role.
To successfully execute automated remediation using Amazon EventBridge and AWS Systems Manager Automation, two authorization steps are necessary: first, the EventBridge rule must assume a role that permits starting the automation execution (ssm:StartAutomationExecution). Second, because Systems Manager must assume an execution role to perform the S3 bucket configuration change, the EventBridge role must be permitted to pass this execution role (iam:PassRole) to Systems Manager.

Adım Adım Çözüm

1
Ensure EventBridge is authorized to trigger the Systems Manager execution.
EventBridge target is associated with an IAM service role containing the ssm:StartAutomationExecution action for the AWS-ConfigureS3BucketPublicAccessBlock document.
By default, EventBridge does not have permissions to execute Systems Manager Automation documents unless explicitly granted via a service role.
2
Ensure the Systems Manager Automation execution role can be passed to the Systems Manager service.
The EventBridge target execution role has iam:PassRole permissions targeting the SSM Automation execution role (AutomationAssumeRole).
When a target service executes using a specified role, the calling service (EventBridge) must have permission to pass that role to the target service.

Anahtar Kavram

Configuring correct IAM permissions and service integration targets for event-driven Systems Manager Automation via Amazon EventBridge.
Bu soruyu puanla

Konular

Event-Driven Automation and Operational Responses