Examkin

Soru

Zorluk: OrtaEventBridge and Systems Manager Remediation

A company requires all Amazon S3 buckets to have default encryption enabled. A SysOps administrator has configured an AWS Config rule named s3-bucket-default-encryption-enabled to detect non-compliant buckets. The administrator wants to use Amazon EventBridge and AWS Systems Manager Automation to automatically enable server-side encryption on non-compliant buckets. Which of the following actions must the administrator perform to configure this remediation pipeline? (Select TWO.)

  1. Create an Amazon EventBridge rule that triggers on AWS Config compliance status changes, and configure the target as the Systems Manager Automation document AWS-EnableS3BucketEncryption.Cevap
  2. Configure the EventBridge rule target with an IAM execution role that has permissions to execute ssm:StartAutomationExecution on the target document and iam:PassRole for the Systems Manager Automation assume role.Cevap
  3. C
    Create an AWS Config remediation action that routes events directly to an Amazon EventBridge API destination, using an Input Transformer to map the AWS Config event payload into an SSM Automation API call.
  4. D
    Configure the Systems Manager Automation service role to assume the EventBridge service role, and add events.amazonaws.com as a trusted principal in the S3 bucket policy.
  5. E
    Configure an Amazon EventBridge rule to detect S3 PutBucketEncryption API calls in AWS CloudTrail, and select a Systems Manager Run Command target to execute a script that enables encryption.

Cevap

To configure this automated remediation pipeline, the administrator must create an Amazon EventBridge rule that triggers on AWS Config compliance status changes and targets the AWS-EnableS3BucketEncryption Systems Manager Automation document. Additionally, the administrator must configure the EventBridge rule target with an IAM execution role that has permissions to execute ssm:StartAutomationExecution on the target document and iam:PassRole for the Systems Manager Automation assume role.
The correct response involves creating an EventBridge rule that triggers when AWS Config detects a non-compliant resource and targets the Systems Manager Automation document for enabling S3 encryption. It also requires granting the EventBridge execution role the necessary ssm:StartAutomationExecution and iam:PassRole permissions to initiate the remediation.

Adım Adım Çözüm

1
Create an EventBridge rule that monitors compliance changes.
The rule detects when AWS Config evaluates an S3 bucket as non-compliant under the s3-bucket-default-encryption-enabled rule.
AWS Config sends compliance status change events to the default EventBridge event bus, which serves as the trigger mechanism.
2
Set the EventBridge target to the SSM Automation document.
EventBridge will route matching events to target the AWS-EnableS3BucketEncryption document.
This document natively enables server-side encryption on the non-compliant S3 bucket identified by the event.
3
Configure the execution role for the EventBridge target.
The execution role is granted ssm:StartAutomationExecution on the remediation document and iam:PassRole for the Systems Manager service role.
EventBridge requires permissions to initiate the automation workflow and must pass the execution role to Systems Manager so it can perform actions on the S3 bucket.

Anahtar Kavram

Configuring automated remediation of non-compliant resources using AWS Config compliance status events, Amazon EventBridge rules, and AWS Systems Manager Automation targets.
Bu soruyu puanla

Konular

EventBridge and Systems Manager Remediation

Bu konudan daha fazla soru