Examkin

Soru

Zorluk: OrtaAWS Config Rules and Conformance Packs

A SysOps Administrator is setting up automated compliance remediation within an AWS Config Conformance Pack. The conformance pack includes a custom rule that checks for unencrypted Amazon EBS volumes. The administrator wants to configure automatic remediation for this rule using an AWS Systems Manager (SSM) Automation document that encrypts the EBS volumes. Which of the following configuration steps are required to ensure the remediation executes successfully? (Select TWO.)

  1. Specify an IAM execution role in the remediation configuration that has permissions to encrypt EBS volumes and has a trust policy allowing the Systems Manager service (ssm.amazonaws.com) to assume it.Cevap
  2. Grant the IAM identity deploying the conformance pack the iam:PassRole permission for the specified IAM execution role.Cevap
  3. C
    Configure the trust policy of the IAM execution role to trust the AWS Config service (config.amazonaws.com) instead of the Systems Manager service.
  4. D
    Configure an Amazon EventBridge rule to detect AWS Config compliance changes and invoke the Systems Manager Automation document directly.
  5. E
    Attach an IAM policy directly to the EBS volumes that grants the AWS Config service role permission to execute KMS encryption.

Cevap

Specify an IAM execution role in the remediation configuration that has a trust policy allowing Systems Manager to assume it, and grant the deploying IAM identity the iam:PassRole permission for that execution role.
For automatic remediation to work natively within AWS Config, the remediation action specifies a Systems Manager Automation document. The Systems Manager service must assume the specified IAM execution role to perform the remediation, requiring the role's trust policy to allow ssm.amazonaws.com. Additionally, the identity configuring or deploying the remediation must have iam:PassRole permissions to pass this execution role to Systems Manager.

Adım Adım Çözüm

1
Configure the IAM execution role with the required permissions to perform the EBS encryption remediation actions and edit its trust policy.
The trust policy allows the service principal ssm.amazonaws.com to assume the role.
Since Systems Manager Automation executes the remediation workflow, the SSM service must be allowed to assume the role.
2
Ensure the administrator or service role deploying the conformance pack has the necessary permissions.
The deployment role has the iam:PassRole permission for the execution role configured in step 1.
AWS security requires the deploying identity to have iam:PassRole to delegate permissions to another AWS service via the execution role.
3
Define the remediation configuration within the AWS Config Conformance Pack template, specifying the target SSM Automation document and the execution role ARN.
The conformance pack is successfully deployed with active automated remediation.
This links the AWS Config rule evaluation directly to the Systems Manager remediation workflow.

Anahtar Kavram

Configuring automatic remediation in AWS Config Conformance Packs requires setting up an IAM execution role that trusts Systems Manager (ssm.amazonaws.com), and the deploying identity must have iam:PassRole permissions for that execution role.
Bu soruyu puanla

Konular

AWS Config Rules and Conformance Packs

Bu konudan daha fazla soru