Examkin

Soru

Zorluk: ZorEvent-Driven Automation and Operational Responses

A SysOps administrator is configuring event-driven remediation for non-compliant security groups using AWS Config. The administrator selects the AWS Config rule `restricted-common-ports` and sets up an automatic remediation action using the AWS Systems Manager (SSM) Automation document `AWS-CloseSecurityGroup`.

The administrator creates an IAM role named `SSMRemediationRole` that has the required permissions to modify security groups and a trust relationship allowing the Systems Manager service (`ssm.amazonaws.com`) to assume the role.

When the administrator attempts to save the remediation configuration in AWS Config with the `SSMRemediationRole` ARN specified in the `AutomationAssumeRole` parameter, the operation fails with an 'Access Denied' error.

Which action will resolve this error?

  1. Attach an IAM policy to the administrator's IAM identity that grants the iam:PassRole permission for the SSMRemediationRole.Cevap
  2. B
    Update the trust relationship of the SSMRemediationRole to allow the AWS Config service (config.amazonaws.com) to assume the role.
  3. C
    Create an Amazon EventBridge rule that triggers the Systems Manager Automation document directly, bypassing AWS Config remediation.
  4. D
    Enable detailed monitoring on the target EC2 instances and configure a CloudWatch Logs metric filter to trigger the SSM document.

Cevap

Attach an IAM policy to the administrator's IAM identity that grants the iam:PassRole permission for the SSMRemediationRole.
To configure automatic remediation in AWS Config, the user setting up the remediation must have permission to pass the role that AWS Systems Manager Automation will assume. This is done by adding the iam:PassRole permission for the target role resource to the administrator's IAM policy. Without this permission, the console or API prevents the user from assigning that role to the service, resulting in an 'Access Denied' error.

Adım Adım Çözüm

1
Analyze the error message and context.
The configuration fails with 'Access Denied' when trying to assign the SSMRemediationRole as the AutomationAssumeRole in the AWS Config remediation configuration.
This error occurs because the active IAM user/role (the administrator) does not have permission to pass the SSMRemediationRole to the Systems Manager service.
2
Identify the required IAM permission.
The iam:PassRole action is required to delegate permissions to another AWS service.
When configuring AWS services (like AWS Config or Systems Manager) to perform actions using a specific role, AWS requires the configuring user to have iam:PassRole for that target role to prevent privilege escalation.
3
Apply the remediation to the administrator's policy.
Add iam:PassRole for the SSMRemediationRole ARN to the administrator's IAM user or role policy.
This allows the administrator to delegate the SSMRemediationRole to Systems Manager, enabling the remediation configuration to save successfully.

Anahtar Kavram

Delegating permissions to AWS services using the iam:PassRole permission for event-driven automation remediation.
Bu soruyu puanla

Konular

Event-Driven Automation and Operational Responses