Examkin

Soru

Zorluk: Çok zorEvent-Driven Automation and Operational Responses

A company uses AWS Config to monitor compliance across its AWS infrastructure. A SysOps administrator is configuring automatic, event-driven remediation for Amazon RDS DB instances that are identified as publicly accessible by the rds-instance-public-access-check AWS Config managed rule. The administrator intends to use the AWS Systems Manager Automation runbook AWS-ModifyRDSInstance to modify the non-compliant RDS DB instances and disable public accessibility.

The administrator wants to configure the remediation directly within AWS Config. Which two actions must the administrator perform to ensure that the remediation executes successfully?

  1. Create an IAM role for the Systems Manager Automation runbook that includes the rds:ModifyDBInstance permission and configure the role's trust policy to trust the ssm.amazonaws.com service principal.Cevap
  2. Attach an IAM policy to the administrator's IAM identity that grants the iam:PassRole permission for the Systems Manager Automation role.Cevap
  3. C
    Attach an IAM policy to the AWS Config service role that grants the iam:PassRole permission for the rds.amazonaws.com service principal.
  4. D
    Configure the trust policy of the Systems Manager Automation role to trust the config.amazonaws.com service principal and specify this role in the remediation configuration.
  5. E
    Enable Amazon CloudWatch detailed monitoring on all RDS DB instances to ensure AWS Config can detect compliance status changes with a one-minute granularity.

Cevap

To successfully configure the remediation, the administrator must create an IAM role for Systems Manager Automation that permits the rds:ModifyDBInstance action and trusts ssm.amazonaws.com, and they must grant their own IAM identity the iam:PassRole permission for that execution role.
For event-driven auto-remediation to operate correctly when initiated by AWS Config, the remediation action runs as an AWS Systems Manager Automation. The SSM Automation requires a service role that has permission to modify the target resource (in this case, rds:ModifyDBInstance) and must trust the Systems Manager service principal (ssm.amazonaws.com) to assume it. Additionally, the administrator who configures the remediation rule needs the iam:PassRole permission to allow AWS Config to pass this execution role to the Systems Manager service.

Adım Adım Çözüm

1
Create an IAM role that will act as the Automation execution role.
An IAM role is created with the rds:ModifyDBInstance policy attached, and its trust relationship is configured to allow the ssm.amazonaws.com service principal to assume it.
Systems Manager Automation requires permissions to modify the RDS instances, and it must be allowed to assume the designated execution role.
2
Attach the iam:PassRole permission to the administrator's IAM policy.
The administrator's IAM user or role gains the permission to pass the newly created Automation execution role to the Systems Manager service.
AWS security requires that any user who associates a service role with an automation or service must have explicit permissions to pass that role.

Anahtar Kavram

IAM role delegation and service trust relationships for event-driven Systems Manager Automation remediation via AWS Config.
Bu soruyu puanla

Konular

Event-Driven Automation and Operational Responses