A SysOps Administrator needs to automate a multi-step patching and reboot sequence across a fleet of Amazon EC2 instances using a custom AWS Systems Manager Automation runbook. The SSM Agent is already installed and running on all target instances. The administrator wants to follow security best practices by using a service role to perform these actions.
Arrange the steps in the correct order to configure, authorize, and run this Automation workflow.
- 1Create an IAM service role for Systems Manager with a trust relationship for ssm.amazonaws.com and attach policies granting permissions to start and stop EC2 instances.
- 2Attach an IAM policy to the administrator's IAM identity that grants the iam:PassRole permission for the Systems Manager service role.
- 3Author a custom Systems Manager document of type Automation containing the patch and reboot steps.
- 4Start the Automation execution, specifying the custom runbook, target instances, and the service role ARN.
- 5Monitor the status of the execution steps and resource compliance in the Systems Manager console.
Cevap
The correct sequence requires first configuring the IAM service role for Systems Manager, followed by granting the administrator the iam:PassRole permission. Next, the custom Automation runbook document must be created. Once these prerequisites are met, the administrator can execute the Automation runbook referencing the service role and targets, and finally monitor the execution progress in the console.
The correct sequence begins with setting up the necessary IAM permissions: first, the service role itself must exist, and second, the executing identity must have permission to pass it. Next, the Automation runbook must be defined. Finally, the execution is initiated using the runbook and service role, and its progress is monitored.
Adım Adım Çözüm
Anahtar Kavram
Authorizing and executing Systems Manager Automation runbooks using service roles and PassRole permissions.
Tahmini Süre:2m 0s