Examkin

Soru

Zorluk: OrtaEvent-Driven Automation and Operational Responses

A SysOps administrator is configuring automated, event-driven remediation for non-compliant Amazon S3 buckets using AWS Config. The administrator sets up the AWS Config rule 's3-bucket-public-read-prohibited' and configures the AWS Systems Manager (SSM) Automation runbook 'AWS-ConfigureS3BucketPublicAccessBlock' as the remediation action. However, when the Config rule identifies a non-compliant bucket, the automatic remediation fails to execute with an access denied error. Which combination of configuration actions is required to resolve this issue and ensure the remediation executes successfully? (Select TWO.)

  1. Grant the SysOps administrator the 'iam:PassRole' permission for the IAM service role specified in the remediation action configuration.Cevap
  2. Ensure the IAM service role specified in the remediation action configuration has a trust policy that allows the 'ssm.amazonaws.com' service principal to assume it, along with the permissions to modify S3 public access settings.Cevap
  3. C
    Create an Amazon EventBridge rule that detects AWS Config compliance status changes and directly invokes the SSM Automation runbook without an execution role.
  4. D
    Update the S3 bucket policy of the non-compliant buckets to allow the service principal 'config.amazonaws.com' to perform the 'sts:AssumeRole' action.
  5. E
    Enable CloudWatch detailed monitoring on the target S3 buckets to reduce the compliance status evaluation and remediation latency to 1-minute intervals.

Cevap

To resolve the access denied error during remediation, the SysOps administrator must be granted permission to pass the remediation execution role, and the role itself must trust the Systems Manager service principal and have S3 configuration permissions.
For AWS Config remediation via Systems Manager to function, the SysOps administrator must have 'iam:PassRole' permissions to pass the execution role, and the execution role must trust the Systems Manager service ('ssm.amazonaws.com') and have policies allowing the required modifications on S3.

Adım Adım Çözüm

1
Analyze the IAM service role trust policy and permissions.
Ensure the role trusts the Systems Manager principal ('ssm.amazonaws.com') and has policies permitting S3 write/update actions.
Systems Manager Automation executes the actual API calls to modify the S3 resource and requires temporary authorization via STS assume role.
2
Analyze the administrator's IAM permissions.
Ensure the user has an IAM policy allowing the 'iam:PassRole' action targeting the service role.
AWS services require validation that the user configuring the service has permission to delegate that specific role.

Anahtar Kavram

Configuring event-driven remediation in AWS Config using Systems Manager Automation with the appropriate trust relationships and passrole permissions.
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Event-Driven Automation and Operational Responses