Examkin

Soru

Zorluk: OrtaAWS Config Rules and Conformance Packs

A company manages its multi-account environment using AWS Organizations. A SysOps administrator is deploying an organization conformance pack to enforce Amazon EBS volume encryption. The conformance pack template contains an AWS Config rule and a remediation configuration that executes an AWS Systems Manager (SSM) Automation document to delete any non-compliant volumes.

While testing the deployment in a member account, the administrator finds that the AWS Config rule successfully marks unencrypted volumes as non-compliant, but the remediation status displays an execution failure due to a permissions issue.

How should the administrator resolve this execution failure?

  1. Grant the AWS Config service role the iam:PassRole permission for the SSM Automation execution role, and verify that the execution role's trust policy allows ssm.amazonaws.com to assume it.Cevap
  2. B
    Modify the trust policy of the SSM Automation execution role to allow config.amazonaws.com to assume it, and remove the iam:PassRole permission from the AWS Config service role.
  3. C
    Create an Amazon EventBridge rule that triggers whenever AWS Config detects a non-compliant resource, and configure the rule to run the SSM Automation document using an IAM role that trusts config.amazonaws.com.
  4. D
    Attach an IAM policy to the AWS Config service role that allows access to the KMS key used to encrypt the EBS volumes, and omit the execution role trust policy configuration.

Cevap

Grant the AWS Config service role the iam:PassRole permission for the SSM Automation execution role, and verify that the execution role's trust policy allows ssm.amazonaws.com to assume it.
The correct answer correctly addresses the permission flow required for AWS Config automatic remediations. When AWS Config initiates remediation, it passes the specified execution role to AWS Systems Manager. For this to succeed, the AWS Config service role must have the iam:PassRole permission for the execution role. Concurrently, the execution role's trust policy must allow ssm.amazonaws.com to assume it, as Systems Manager is the service executing the API actions.

Adım Adım Çözüm

1
Inspect the remediation configuration in the conformance pack to identify the IAM role specified for SSM Automation execution.
Identified the target execution role ARN used by the SSM Automation document.
Before making permission changes, you must know which execution role is assigned to the remediation action.
2
Add the iam:PassRole permission to the AWS Config service role policy, targeting the execution role identified in the previous step.
The AWS Config service is granted permission to pass the execution role to Systems Manager.
AWS Config requires iam:PassRole to hand off the execution role to the Systems Manager service for document execution.
3
Update the trust policy of the SSM Automation execution role to allow the Systems Manager service principal (ssm.amazonaws.com) to perform the sts:AssumeRole action.
Systems Manager is authorized to assume the execution role.
Since Systems Manager performs the actual resource remediation, it must have permission to assume the execution role.

Anahtar Kavram

AWS Config rules remediation relies on Systems Manager Automation, which requires the AWS Config service role to have iam:PassRole permissions for the execution role, and the execution role to trust ssm.amazonaws.com.
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

AWS Config Rules and Conformance Packs

Bu konudan daha fazla soru