Examkin

Soru

Zorluk: OrtaEventBridge and Systems Manager Remediation

A SysOps administrator is setting up automated remediation for security groups that allow unrestricted inbound SSH traffic. An AWS Config rule detects non-compliant security groups and publishes compliance change events. The administrator configures an Amazon EventBridge rule to match these compliance changes and target the `AWS-DisablePublicAccessForSecurityGroup` Systems Manager Automation document. During testing, the AWS Config rule successfully marks a security group as non-compliant, but the Systems Manager Automation execution is not initiated. Which configuration change will resolve this issue?

  1. A
    Configure the EventBridge rule to send events to an AWS Config rule remediation target rather than invoking the Systems Manager API directly.
  2. B
    Add a resource-based policy to the Systems Manager Automation document that allows the EventBridge service principal to execute the document.
  3. Attach an IAM policy to the EventBridge rule's execution role that grants the `iam:PassRole` permission for the Systems Manager Automation service role.Cevap
  4. D
    Modify the trust policy of the Systems Manager Automation service role to allow the AWS Config service principal to assume the role.

Cevap

Attach an IAM policy to the EventBridge rule's execution role that grants the `iam:PassRole` permission for the Systems Manager Automation service role.
The correct solution is to attach an IAM policy to the EventBridge rule's execution role granting the `iam:PassRole` permission for the Systems Manager Automation service role. This allows EventBridge to pass the execution role to Systems Manager, enabling the service to assume that role and perform the required remediation actions on the security group.

Adım Adım Çözüm

1
Identify the failure point where AWS Config detects the compliance change and the EventBridge rule matches the event but fails to start the Systems Manager Automation execution.
The failure is due to EventBridge not having sufficient authorization to delegate the Automation Assume Role to Systems Manager.
When EventBridge triggers an Automation execution that runs with a service role, it must have permission to pass that role to the Systems Manager service.
2
Add the `iam:PassRole` permission to the EventBridge rule's IAM execution role, targeting the Amazon Resource Name (ARN) of the Systems Manager Automation service role.
EventBridge is successfully authorized to pass the role.
This satisfies the security requirement for cross-service role delegation in AWS.
3
Test the automation by triggering a new non-compliant event in AWS Config.
The EventBridge rule successfully initiates the Systems Manager Automation execution, which disables public access on the target security group.
The remediation action now completes since the correct permissions are established.

Anahtar Kavram

IAM PassRole permissions for EventBridge to trigger Systems Manager Automation remediation
Bu soruyu puanla

Konular

EventBridge and Systems Manager Remediation

Bu konudan daha fazla soru