Examkin

Soru

Zorluk: OrtaAWS Config Rules and Conformance Packs

A SysOps Administrator is configuring automated remediation within an AWS Config conformance pack to address non-compliant, unencrypted Amazon EBS volumes. The administrator plans to use the standard AWS-EncryptElasticBlockStoreVolume Systems Manager (SSM) Automation document as the remediation target. Which of the following configuration actions are required to ensure that the automated remediation successfully executes when a non-compliant volume is detected? (Select TWO.)

  1. Configure the AWS Config remediation action with the SSM Automation document and provide an IAM execution role ARN that has permissions to modify and encrypt EBS volumes.Cevap
  2. Ensure that the IAM identity configuring the remediation has the iam:PassRole permission for the Systems Manager Automation execution role.Cevap
  3. C
    Configure the trust policy of the AWS Config service role to allow sts:AssumeRole for the Systems Manager Automation service principal.
  4. D
    Create an Amazon EventBridge rule that triggers on AWS Config rule compliance state changes and configure the target of the EventBridge rule to be the AWS Config rule itself.
  5. E
    Configure a CloudWatch logs metric filter to detect Config compliance logs and trigger an Amazon SNS topic to execute the SSM Automation document.

Cevap

Configure the AWS Config remediation action with the SSM Automation document and provide an IAM execution role ARN that has permissions to modify and encrypt EBS volumes, and ensure that the IAM identity configuring the remediation has the iam:PassRole permission for the Systems Manager Automation execution role.
To set up native remediation in AWS Config, the administrator must define a remediation configuration targeting an SSM Automation document. The automation requires an IAM service role with permissions to perform the actual resource modifications (e.g., encrypting EBS volumes). Furthermore, because AWS Config passes this execution role to the Systems Manager service, the identity setting up the configuration must have the iam:PassRole permission for the execution role. Without it, the pass role action will fail.

Adım Adım Çözüm

1
Define the remediation execution role.
An IAM role is created with a trust policy allowing Systems Manager (ssm.amazonaws.com) to assume it, and attached policies that allow modifying and encrypting EBS volumes.
SSM Automation needs permissions to interact with EC2/EBS resources to perform the remediation.
2
Grant the iam:PassRole permission.
The administrator or service role configuring the remediation is granted iam:PassRole for the SSM Automation execution role.
AWS Config requires iam:PassRole permissions to successfully pass the execution role to Systems Manager Automation.
3
Configure the remediation action in AWS Config.
The AWS Config rule's remediation configuration is set to target the SSM document with the execution role specified as a parameter.
This establishes the link between the compliance state of the AWS Config rule and the automation workflow that remediates the resource.

Anahtar Kavram

Configuring AWS Config Rules native remediation requires linking to an SSM Automation document, providing an SSM execution role, and granting iam:PassRole permissions to pass that role to Systems Manager.
Bu soruyu puanla

Konular

AWS Config Rules and Conformance Packs

Bu konudan daha fazla soru