Examkin

Soru

Zorluk: OrtaEvent-Driven Automation and Operational Responses

A SysOps administrator is configuring automatic remediation in AWS Config for a managed rule that checks whether Amazon RDS DB instances have deletion protection enabled. The administrator wants to use the AWS Systems Manager (SSM) Automation document `AWS-EnableRdsDbInstanceDeletionProtection` as the remediation action. During configuration, the administrator receives an 'Access Denied' error when trying to associate the IAM execution role with the remediation action in AWS Config.

Which of the following is the most likely cause of this error?

  1. The administrator's IAM user or role lacks the `iam:PassRole` permission for the SSM Automation execution role.Cevap
  2. B
    The SSM Automation execution role's trust policy does not explicitly trust the AWS Config service (`config.amazonaws.com`).
  3. C
    The remediation action must be triggered via an Amazon EventBridge rule rather than directly within AWS Config, which requires a trust policy for EventBridge.
  4. D
    The RDS DB instances do not have detailed monitoring enabled, preventing AWS Config from evaluating the deletion protection configuration status in real time.

Cevap

The administrator's IAM user or role lacks the `iam:PassRole` permission for the SSM Automation execution role.
When configuring automated remediation in AWS Config using Systems Manager Automation, AWS Config must pass the execution role (specified by the assume role ARN) to the Systems Manager service. To do this, the IAM user or role performing the configuration must have the `iam:PassRole` permission for the execution role. Without this permission, the administrator receives an Access Denied error when trying to associate the role with the remediation configuration.

Adım Adım Çözüm

1
Analyze the error message and the configuration context.
The SysOps administrator is configuring AWS Config automatic remediation with an SSM Automation document and receives an 'Access Denied' error.
To identify which action or service is failing authorization.
2
Evaluate the IAM workflow for passing roles to AWS services.
The administrator is attempting to associate an execution role that Systems Manager will assume. Since the administrator is passing this role to the service, the administrator's own IAM entity must have the `iam:PassRole` permission.
To verify if the administrator has the required authorization to delegate the execution role to Systems Manager.
3
Examine the trust relationship requirements for the execution role.
The execution role needs to trust `ssm.amazonaws.com` because Systems Manager is the service executing the remediation. The error is an Access Denied error on the administrator's association attempt, which points to the missing `iam:PassRole` permission on the administrator's identity.
To confirm the root cause of the error during association.

Anahtar Kavram

Configuring automatic remediation in AWS Config with Systems Manager Automation requires the administrator configuring the action to have the `iam:PassRole` permission for the execution role, which must trust `ssm.amazonaws.com`.
Bu soruyu puanla

Konular

Event-Driven Automation and Operational Responses