Examkin

Soru

Zorluk: ZorEvent-Driven Automation and Operational Responses

A SysOps administrator is configuring event-driven remediation for non-compliant resources. When an AWS Config rule detects a non-compliant Amazon S3 bucket, an Amazon EventBridge rule triggers. The EventBridge rule is configured to target an AWS Systems Manager (SSM) Automation runbook to enable bucket encryption. The administrator has created an IAM role named SSMAutomationServiceRole that SSM will assume to perform the S3 configuration, which has a trust relationship with ssm.amazonaws.com. The administrator also created an IAM role named EventBridgeExecutionRole with a trust relationship for events.amazonaws.com and a policy granting ssm:StartAutomationExecution. When the EventBridge rule triggers, the SSM Automation execution fails to start due to an authorization error. Which of the following explains why the automation execution failed to start?

  1. The EventBridgeExecutionRole does not have the iam:PassRole permission for the SSMAutomationServiceRole.Cevap
  2. B
    The EventBridgeExecutionRole must be modified to allow sts:AssumeRole for the ssm.amazonaws.com service principal.
  3. C
    The EventBridge rule is using an invalid trigger flow, as AWS Config compliance state changes must be remediated directly using AWS Config auto-remediation rather than EventBridge targets.
  4. D
    The AWS Config rule evaluation is running under standard monitoring mode, which prevents EventBridge from executing the runbook within the required temporal window.

Cevap

The EventBridgeExecutionRole does not have the iam:PassRole permission for the SSMAutomationServiceRole.
The correct answer is that the EventBridgeExecutionRole lacks the iam:PassRole permission. When configuring an Amazon EventBridge rule to invoke an AWS Systems Manager Automation runbook that runs with a designated service role, the EventBridge execution role must have the iam:PassRole permission for that service role. This ensures that EventBridge has authorization to pass the role to Systems Manager.

Adım Adım Çözüm

1
Analyze the IAM roles and trust relationships involved in the event-driven workflow.
The EventBridgeExecutionRole has a trust relationship with events.amazonaws.com and ssm:StartAutomationExecution permission. The SSMAutomationServiceRole has a trust relationship with ssm.amazonaws.com.
This establishes that EventBridge is authorized to assume its execution role and start the automation, and SSM is authorized to assume its service role.
2
Determine the required permissions when a service passes an IAM role to another service.
The calling service execution role (EventBridgeExecutionRole) must have the iam:PassRole permission for the target role (SSMAutomationServiceRole) that is passed to the executing service (ssm.amazonaws.com).
Security best practices in AWS require explicit permission to pass a service role to prevent privilege escalation.
3
Identify the missing permission leading to the authorization error.
Adding the iam:PassRole permission for the SSMAutomationServiceRole to the EventBridgeExecutionRole resolves the error.
This allows EventBridge to successfully invoke the automation runbook while specifying the service role that the runbook must assume.

Anahtar Kavram

IAM PassRole permissions in event-driven automation targets
Bu soruyu puanla

Konular

Event-Driven Automation and Operational Responses