Examkin

Soru

Zorluk: KolayAWS Config Rules and Conformance Packs

A SysOps Administrator is configuring automatic remediation for an AWS Config rule. The remediation is designed to run an AWS Systems Manager Automation document. The administrator attempts to save the remediation configuration but receives an error stating that the action cannot be performed because of missing permissions. Which permission is missing from the administrator's IAM policy?

  1. A
    events:PutTargets permission to route the non-compliant Config rule evaluations to Systems Manager
  2. B
    sts:AssumeRole trust policy allowing AWS Config to assume the administrator's IAM user identity
  3. iam:PassRole permission for the remediation execution roleCevap
  4. D
    cloudwatch:PutMetricAlarm permission to trigger the remediation workflow

Cevap

iam:PassRole permission for the remediation execution role
To successfully configure automatic remediation in AWS Config, the IAM identity (user or role) setting up the remediation must have the iam:PassRole permission for the remediation execution role. This permission ensures that the administrator has the authority to delegate that execution role to AWS Config, which then passes it to Systems Manager to execute the automation document.

Adım Adım Çözüm

1
Analyze the remediation mechanism
The remediation uses AWS Config automatic remediation powered by AWS Systems Manager Automation.
AWS Config requires an execution role to perform remediation actions in Systems Manager on the resources.
2
Identify the role passing requirement
The identity configuring the remediation must have permission to pass the execution role to the service.
To prevent privilege escalation, AWS requires the iam:PassRole permission whenever a user passes an IAM role to a service.

Anahtar Kavram

AWS Config Automatic Remediation Permissions
Tahmini Süre:45s
Bu soruyu puanla

Konular

AWS Config Rules and Conformance Packs

Bu konudan daha fazla soru