A retailer runs AWS Config rules in 40 accounts. Two kinds of drift keep appearing: S3 buckets created without server access logging, and security groups that open SSH to the internet.
The SSH case needs care. Before the rule is changed, the team must snapshot the EBS volumes of the attached web servers and tag them for investigation.
Each fix must run automatically when a rule becomes noncompliant, and the team wants to maintain as little custom code as possible.
Which solution meets these requirements with the LEAST operational overhead?
Choose one answer.
AA. Write one AWS Lambda function that handles every noncompliant rule, including the logging fix and the security group case, and run it from a Config rule trigger in each account.
BB. Use Config automatic remediation with the managed AWS-ConfigureS3BucketLogging document for buckets, and with a short custom runbook that snapshots and tags the instances before removing the SSH rule.
CC. Turn on Config automatic remediation for both rules with managed documents only, using AWS-DisablePublicAccessForSecurityGroup for the SSH rule, so that no custom runbook is needed.
DD. Keep both rules noncompliant-only, and have an analyst open a ticket for each finding, so that the owning team reviews and fixes the drift by hand after the ticket is triaged.
Show the answer and explanation
Answer: B
A. Wrong: This works, but it puts custom code in charge of every fix, which is the maintenance the team wants to avoid. One function for every case also makes each change harder to review and test.
B. Right: Correct. The managed document fixes the bucket logging drift with no custom code. The security group case needs evidence first, so a short custom runbook takes the snapshots and tags before it removes the rule, and Config starts both fixes automatically. Learn more: Remediating noncompliant resources with AWS Config (opens in a new tab)
C. Wrong: The managed document closes the open SSH rule, but it takes no snapshot and adds no tag first. The team requires that evidence before any change, so it would be lost.
D. Wrong: Tickets are not automatic remediation, which the team requires. Manual fixes also delay the change, and the instance stays exposed while the ticket waits in a queue.
Explanation
Config automatic remediation with a managed Automation document fixes the logging drift with no code, and a short custom runbook handles the security group case so that the snapshots and tags come first. One custom function, managed documents alone and manual tickets each miss a requirement.
Want more on Automated remediation (EventBridge, Systems Manager Automation, Step Functions, Lambda)? The 5 full-length practice sets have 7 more Automated remediation (EventBridge, Systems Manager Automation, Step Functions, Lambda) questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →