Examkin

Soru

Zorluk: OrtaAWS Systems Manager Configuration and Run Command Automation

An enterprise uses AWS Systems Manager State Manager to enforce security configurations across all EC2 instances. Every instance has the SSM Agent running and is assigned an IAM instance profile with the `AmazonSSMManagedInstanceCore` policy. To automate compliance checks, a SysOps administrator is configuring a State Manager association that will execute a custom SSM document using a service role. When creating the association, the administrator receives an 'Access Denied' error. Which of the following IAM configurations is required to successfully create this association?

  1. Attach an IAM policy to the administrator's IAM user that grants the `iam:PassRole` action for the Systems Manager service role.Cevap
  2. B
    Update the trust policy of the service role to grant the administrator's IAM user permission to execute the `sts:AssumeRole` action.
  3. C
    Configure a custom tag with the key `Patch Group` on the target EC2 instances that matches the patch group name in the Systems Manager Patch Baseline.
  4. D
    Add a route to the subnet route table targeting an Internet Gateway to allow IAM policy validation requests to reach the AWS STS endpoint.

Cevap

Attach an IAM policy to the administrator's IAM user that grants the `iam:PassRole` action for the Systems Manager service role.
To create a Systems Manager State Manager association that uses a service role to run commands or automation on instances, the IAM user configuring the association must have the `iam:PassRole` permission for that service role. This ensures that the administrator is authorized to assign the service role to Systems Manager.

Adım Adım Çözüm

1
Analyze the error message and context.
The administrator receives an 'Access Denied' error when creating a State Manager association that uses a service role.
This indicates that the administrator's identity lacks the permission required to associate the service role with the Systems Manager resource.
2
Determine the required IAM permission for passing a role to an AWS service.
The identity configuring the resource must have the `iam:PassRole` permission.
AWS prevents unauthorized users from assigning high-privileged roles to services by requiring the explicit `iam:PassRole` permission.
3
Identify the correct option that addresses the user policy requirement.
Grants the `iam:PassRole` permission to the administrator's IAM identity.
This allows the administrator to pass the Systems Manager service role to State Manager.

Anahtar Kavram

IAM PassRole permissions for AWS Systems Manager configurations
Bu soruyu puanla

Konular

AWS Systems Manager Configuration and Run Command Automation