Examkin

Soru

Zorluk: OrtaAWS Config Rules and Conformance Packs

A SysOps Administrator is setting up an AWS Config rule to evaluate whether Amazon DynamoDB tables have point-in-time recovery (PITR) enabled. The administrator wants to configure automated remediation using the AWS Systems Manager (SSM) Automation document AWS-EnableDynamoDbPointInTimeRecovery. Which of the following configuration steps are required to implement this automated remediation successfully? (Select TWO.)

  1. Grant the administrator's IAM identity the iam:PassRole permission for the Systems Manager Automation execution role.Cevap
  2. Configure the trust policy of the Systems Manager Automation execution role to trust ssm.amazonaws.com and attach a policy allowing dynamodb:UpdateContinuousBackups.Cevap
  3. C
    Configure the trust policy of the Systems Manager Automation execution role to trust config.amazonaws.com.
  4. D
    Create an Amazon EventBridge rule that triggers on AWS Config non-compliant events and routes them to the Systems Manager Automation execution role.
  5. E
    Grant the AWS Config service role the iam:PassRole permission for the Systems Manager Automation execution role.

Cevap

Grant the administrator's IAM identity the iam:PassRole permission for the Systems Manager Automation execution role, and configure the trust policy of the Systems Manager Automation execution role to trust ssm.amazonaws.com and attach a policy allowing dynamodb:UpdateContinuousBackups.
To set up automated remediation for AWS Config rules using Systems Manager (SSM) Automation, two key IAM configurations are required: First, the Systems Manager service must be trusted to assume the execution role (ssm.amazonaws.com) and must have appropriate permissions (such as updating continuous backups on DynamoDB). Second, the IAM identity of the administrator who is configuring the remediation must have the iam:PassRole permission to pass the execution role to Systems Manager.

Adım Adım Çözüm

1
Configure the execution role for the remediation action.
An IAM role is created with a trust policy allowing ssm.amazonaws.com to assume it, and a permission policy allowing dynamodb:UpdateContinuousBackups.
Systems Manager Automation requires permissions to modify the DynamoDB point-in-time recovery setting on the non-compliant tables.
2
Ensure the administrator configuring the remediation has permission to pass the role.
The administrator's IAM user or role is granted the iam:PassRole permission targeting the Systems Manager Automation execution role.
When associating an execution role with a remediation action, AWS requires the configuring user to have permissions to pass that role to the service.

Anahtar Kavram

AWS Config Rules automated remediation requires an execution role trusted by Systems Manager and iam:PassRole permissions granted to the administrator setting up the configuration.
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

AWS Config Rules and Conformance Packs

Bu konudan daha fazla soru