Examkin

Soru

Zorluk: Çok zorAWS Systems Manager Configuration and Run Command Automation

A SysOps Administrator is setting up an AWS Systems Manager (SSM) Automation execution to run a custom document. The document will execute a series of diagnostic scripts on a target group of EC2 instances using SSM Run Command. The SSM Agent is installed and running on all target EC2 instances, and an IAM instance profile with the AmazonSSMManagedInstanceCore policy is attached to each instance. A custom IAM service role named SSMAutomationServiceRole has been created with the AmazonSSMAutomationRole policy attached, and its trust policy allows ssm.amazonaws.com to assume the role. The administrator's IAM user policy contains permissions for ssm:StartAutomationExecution and ssm:DescribeDocument. When the administrator attempts to start the automation execution using the AWS CLI and specifies the SSMAutomationServiceRole as the execution role, the execution fails immediately with an access denied error. What action must the administrator take to resolve this failure and allow the automation to run?

  1. Attach an IAM policy to the administrator's IAM user that allows the iam:PassRole action on the SSMAutomationServiceRole resource.Cevap
  2. B
    Update the trust policy of the SSMAutomationServiceRole to allow the administrator's IAM user to perform the sts:AssumeRole action.
  3. C
    Attach the SSMAutomationServiceRole as a secondary IAM instance profile to the target EC2 instances.
  4. D
    Add the ssm:StartAutomationExecution permission to the EC2 instances' IAM instance profile.

Cevap

Attach an IAM policy to the administrator's IAM user that allows the iam:PassRole action on the SSMAutomationServiceRole resource.
To start an AWS Systems Manager Automation execution that uses a service role (an AssumeRole for Automation), the IAM identity (user or role) initiating the execution must have permissions to pass that service role to the Systems Manager service. This is achieved by granting the iam:PassRole permission on the specific service role resource in the administrator's IAM policy. Without this, Systems Manager cannot assume the role on behalf of the user, resulting in an access denied error during initiation.

Adım Adım Çözüm

1
Analyze the IAM permission requirements for AWS Systems Manager Automation.
Identify that AWS Systems Manager requires an administrative IAM user to pass an execution service role to the SSM service using the PassRole permission.
Since the SSM service assumes the role on behalf of the user to run the automation steps, the user must have explicit permission to delegate that role.
2
Differentiate between AssumeRole and PassRole permissions.
Determine that sts:AssumeRole is used in trust relationships for a service or role to assume another role, while iam:PassRole is a user-level permission allowing the user to configure a service with a role.
Correcting the trust relationship of the service role to trust the user directly is a common error; it must trust the service itself (ssm.amazonaws.com).
3
Formulate the correct IAM policy to apply to the administrator's identity.
Add an IAM policy statement granting the iam:PassRole action, specifying the ARN of the SSMAutomationServiceRole as the resource.
This grants the administrator permission to configure the Automation execution with the designated service role.

Anahtar Kavram

IAM PassRole Requirements for AWS Systems Manager Automation Roles
Tahmini Süre:3m 0s
Bu soruyu puanla

Konular

AWS Systems Manager Configuration and Run Command Automation