Examkin

Soru

Zorluk: Çok zorEventBridge and Systems Manager Remediation

A company implements automated compliance monitoring. An AWS Config rule named restricted-ssh is configured to evaluate security groups. When a security group is flagged as non-compliant, an Amazon EventBridge rule detects the compliance change and targets a Systems Manager Automation runbook named AWS-CloseSecurityGroup to close port 22.

The configuration details are as follows:
- The EventBridge rule uses an Input Transformer to map the non-compliant security group ID to the runbook's GroupId parameter.
- A dedicated IAM role named RemediationExecutionRole exists with a trust policy for ssm.amazonaws.com and permissions to modify EC2 security groups.
- The EventBridge rule is configured with an IAM service role named EventBridgeTargetRole that trusts events.amazonaws.com and has permissions to execute ssm:StartAutomationExecution on the runbook.

When the EventBridge rule is triggered, the Systems Manager Automation execution fails to start. Which of the following is the correct configuration change to resolve this issue?

  1. Add the iam:PassRole permission for the RemediationExecutionRole to the EventBridgeTargetRole policy, and specify the RemediationExecutionRole ARN as the AutomationAssumeRole parameter in the EventBridge target input template.Cevap
  2. B
    Modify the trust policy of the RemediationExecutionRole to trust events.amazonaws.com, and add the iam:PassRole permission for the EventBridgeTargetRole to the RemediationExecutionRole policy.
  3. C
    Add the iam:PassRole permission for the EventBridgeTargetRole to the policy attached to the RemediationExecutionRole, and modify the trust policy of the EventBridgeTargetRole to trust ssm.amazonaws.com.
  4. D
    Change the EventBridge rule target from Systems Manager Automation to Systems Manager Run Command, and associate the RemediationExecutionRole with the EC2 instances directly.

Cevap

Add the iam:PassRole permission for the RemediationExecutionRole to the EventBridgeTargetRole policy, and specify the RemediationExecutionRole ARN as the AutomationAssumeRole parameter in the EventBridge target input template.
The correct configuration change is to add the iam:PassRole permission to the EventBridgeTargetRole policy for the RemediationExecutionRole, and configure the AutomationAssumeRole parameter. For EventBridge to successfully initiate a Systems Manager Automation execution that utilizes a specific service role (RemediationExecutionRole), the principal calling the ssm:StartAutomationExecution API (EventBridgeTargetRole) must have authorization to pass the role. This is achieved via iam:PassRole. Additionally, specifying AutomationAssumeRole in the parameters tells Systems Manager to assume this role when executing.

Adım Adım Çözüm

1
Verify the role that invokes the Systems Manager Automation runbook from Amazon EventBridge.
The EventBridge rule is associated with EventBridgeTargetRole, which has trust relationships for events.amazonaws.com and permission for ssm:StartAutomationExecution.
EventBridge needs these permissions to trigger the target runbook when the event pattern matches.
2
Configure delegation for the automation execution role.
The EventBridgeTargetRole must be granted the iam:PassRole permission for the RemediationExecutionRole.
When triggering an automation that specifies an execution role (AutomationAssumeRole), the calling entity (EventBridge) must have the authority to pass that role to the Systems Manager service.
3
Pass the execution role parameter in the EventBridge target configuration.
The input transformer template must include the AutomationAssumeRole parameter set to the ARN of the RemediationExecutionRole.
This tells Systems Manager which role to assume when executing the runbook steps to close the security group rules.

Anahtar Kavram

To execute automated remediation using Systems Manager Automation triggered by EventBridge, the EventBridge invocation role must have iam:PassRole permissions for the Systems Manager Automation execution role.
Bu soruyu puanla

Konular

EventBridge and Systems Manager Remediation

Bu konudan daha fazla soru