Examkin

Soru

Zorluk: ZorAWS Systems Manager Configuration and Run Command Automation

A SysOps Administrator is using AWS Systems Manager Run Command to execute a custom shell script on a group of Amazon EC2 instances to perform a security configuration change. The target instances are located in a private subnet, have the SSM Agent installed and running, and have an IAM instance profile with the AmazonSSMManagedInstanceCore managed policy attached. The administrator specifies an encrypted Amazon S3 bucket to store the command execution logs. The S3 bucket is encrypted using a Customer Managed Key (CMK) in AWS KMS. Although the Run Command completes successfully on the instances, the administrator finds that no logs are delivered to the S3 bucket. A check of the SSM Agent log on the instances reveals an access denied error when attempting to upload the log files. Which action should the SysOps Administrator take to resolve this issue?

  1. Attach a custom IAM policy to the EC2 instances' IAM role that grants kms:GenerateDataKey permissions for the Customer Managed Key, and verify that the KMS key policy permits these actions for the role.Cevap
  2. B
    Attach an IAM policy to the EC2 instances' IAM role that grants kms:GenerateDataKey permissions for the Customer Managed Key, without updating the KMS key policy which restricts key access to the account root.
  3. C
    Attach a custom IAM policy to the SysOps Administrator's IAM user that grants iam:PassRole permissions for the EC2 instances' IAM role to be passed to the Systems Manager service.
  4. D
    Configure a patch group tag key on the target instances that matches the custom SSM document and verify that the baseline is associated.

Cevap

Attach a custom IAM policy to the EC2 instances' IAM role that grants kms:GenerateDataKey permissions for the Customer Managed Key, and verify that the KMS key policy permits these actions for the role.
The correct answer is correct because when Amazon S3 buckets are encrypted using a Customer Managed Key (CMK) in AWS KMS, any IAM role attempting to write data (such as the SSM Agent uploading Run Command logs) must be granted kms:GenerateDataKey permissions in its IAM policy. In addition, the KMS key policy must explicitly allow the instance's IAM role to perform this action, as KMS key policies are the primary authorizers and cannot be bypassed solely by IAM policies.

Adım Adım Çözüm

1
Diagnose the log upload failure.
The SSM Agent on the EC2 instances successfully ran the script but failed to upload execution logs to the encrypted S3 bucket, resulting in an access denied message.
Determining where the access denied error originates helps narrow down the missing permissions.
2
Analyze bucket encryption requirements.
The destination S3 bucket is encrypted using a Customer Managed Key (CMK) in AWS KMS, which requires client-side encrypt/decrypt permissions.
Since the SSM Agent runs on the EC2 instance, the instance's IAM role must have explicit permission to generate data keys for the KMS key.
3
Verify and align IAM and KMS key policies.
Create a policy allowing kms:GenerateDataKey for the instance role and configure the KMS key policy to permit the role.
Unlike standard IAM policies, KMS key policy evaluation requires explicit permission on the key policy itself or proper delegation to IAM policies.

Anahtar Kavram

Systems Manager Run Command log encryption permissions
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

AWS Systems Manager Configuration and Run Command Automation