Examkin

Soru

Zorluk: ZorAWS Systems Manager Configuration and Run Command Automation

A SysOps Administrator needs to automate the deployment of an application database password to a fleet of Amazon EC2 instances. The password must be stored securely and decrypted only during the execution of a Systems Manager Run Command script. The administrator wants to adhere to the principle of least privilege, ensuring the IAM policy limits access to only the specific resources involved. The SSM Agent is already installed and running on the target EC2 instances, but they do not yet have any IAM roles or instance profiles attached.

What is the correct sequence of steps to configure this secure parameter access and execute the script on the instances?

  1. 1Create a customer managed key (CMK) in AWS KMS to be used for encrypting the database password.
  2. 2Create a SecureString parameter in Systems Manager Parameter Store, specifying the customer managed KMS CMK for encryption.
  3. 3Create a custom IAM policy granting ssm:GetParameters and kms:Decrypt permissions restricted to the specific parameter and KMS CMK ARNs, and attach it to an IAM role.
  4. 4Attach the IAM role as an instance profile to the target EC2 instances to register them as Systems Manager managed nodes.
  5. 5Execute the Run Command using an SSM document that retrieves and decrypts the SecureString parameter value on the managed instances.

Cevap

First, create a customer managed key (CMK) in AWS KMS. Second, create a SecureString parameter in Systems Manager Parameter Store using the KMS CMK. Third, create an IAM policy with ssm:GetParameters and kms:Decrypt permissions restricted to the specific parameter and KMS CMK ARNs and attach it to an IAM role. Fourth, attach the IAM role as an instance profile to the target EC2 instances. Finally, execute the Run Command using an SSM document that retrieves and decrypts the parameter.
The correct sequence starts with creating the KMS key because it is required to encrypt the Parameter Store parameter. Next, the SecureString parameter is created. With both resource ARNs available, a least-privilege IAM policy can be defined and attached to an IAM role. The role is then attached to the EC2 instances as an instance profile to register them as managed nodes with the necessary decryption permissions. Finally, Run Command is executed to run the retrieval script.

Adım Adım Çözüm

1
Create the customer managed key (CMK) in AWS Key Management Service (AWS KMS).
A unique KMS CMK and its ARN are created, which will be used for encryption and decryption operations.
You must have the KMS key available before you can configure a SecureString parameter to use it for encryption.
2
Create a SecureString parameter in Systems Manager Parameter Store.
The database password is saved securely under a specific parameter path, encrypted using the KMS CMK.
The parameter must exist to establish its ARN, which is required to write a least-privilege IAM policy.
3
Create a custom IAM policy and attach it to an IAM role.
An IAM role is configured with explicit ssm:GetParameters and kms:Decrypt permissions targeting only the parameter and KMS key ARNs.
Restricting permissions to specific resource ARNs ensures the principle of least privilege is maintained.
4
Attach the IAM role as an instance profile to the EC2 instances.
The EC2 instances register as online managed nodes in Systems Manager and gain the identity needed to perform decryption.
The instances must be managed nodes and have the instance profile attached to communicate with Systems Manager and retrieve parameters.
5
Execute the Systems Manager Run Command.
The script runs on the instances, successfully fetches the parameter, decrypts it using the role's KMS permissions, and uses it for the database deployment.
Executing the command is the final step once all preconditions, permissions, and security configurations are in place.

Anahtar Kavram

To execute Run Command tasks that securely retrieve and decrypt parameters under the principle of least privilege, the underlying KMS key and Parameter Store parameter must be created first to obtain their specific ARNs. These ARNs are then locked down in an IAM policy attached to the EC2 instance role before the role is attached to the instances and the Run Command is executed.
Bu soruyu puanla

Konular

AWS Systems Manager Configuration and Run Command Automation