Exams / SCS-C03 / Study guide / Automated remediation (EventBridge, Systems Manager Automation, Step Functions, Lambda)
Automated remediation (EventBridge, Systems Manager Automation, Step Functions, Lambda): SCS-C03 study notes and practice questions
What to know about Automated remediation (EventBridge, Systems Manager Automation, Step Functions, Lambda) for the SCS-C03 exam, from the Incident Response domain (14% of the exam guide), then 2 free questions to test it. Part of the SCS-C03 study guide.
These questions describe a finding or policy violation that must be fixed without waiting for a person, such as an instance that GuardDuty flags, a bucket that becomes public or a security group that opens a port. You choose the trigger, the runner and the guardrails, and you decide whether a human must approve the change.
The building blocks
EventBridge matches a GuardDuty or Security Hub finding, an AWS Config compliance change or a CloudTrail API call and sends the event to a target.
Systems Manager Automation runs runbooks against AWS resources: isolate an instance, remove public access, rotate a credential or tag resources. Runbooks can include an approval step that waits for a person, and for multi-resource runs they support rate control and an error threshold, so a bad change stops early.
AWS Config remediation attaches a Systems Manager Automation document to a Config rule, so noncompliant resources are fixed automatically or on demand.
Step Functions coordinates multi-step workflows with branches, retries, waits and human callbacks. Use it when the response spans minutes or hours, or needs approval in the middle.
Lambda runs short code, up to 15 minutes per invocation. It suits small logic, such as enriching an event or calling one API. It is a poor fit for long waits or many dependent steps.
Guardrails
Give remediation a role limited to the actions it needs, and run each member account’s fix under a role in that account.
Log every automated change in CloudTrail, so responders can see what the automation did.
Add a dead-letter queue to EventBridge targets, so failed events are kept for retry.
Make each step safe to run twice.
Use SCPs or RCPs to prevent a risky change, and remediation to fix the changes that get through.
How to choose
Scenario wording
Pick
Isolate an instance within seconds of a GuardDuty finding
EventBridge rule to a Systems Manager Automation runbook
Fix a noncompliant bucket setting with a repeatable fix
AWS Config remediation with an Automation document
A multi-step response that waits for a manager’s approval
Step Functions with a callback task
Fix hundreds of instances safely
Automation with rate control and an error threshold
Transform one event in a few seconds
Lambda as an EventBridge target
Stop a risky change before it happens
SCP or RCP, not remediation
Common traps
Lambda for a workflow that waits for days. Lambda stops at 15 minutes per run; Step Functions handles the wait.
Remediation with an administrator role, so one bug can change anything in the account.
No approval step for a change that deletes data or affects production.
No dead-letter queue or retry, so a failed event disappears without a record.
Using Config remediation to prevent a change. Config finds and fixes drift after it happens.
Running a fix from the management account when the resource lives in a member account, without a role there.
A media streamer keeps unreleased episodes in Amazon S3 buckets. A developer's script sometimes applies a public-read setting to one of these buckets by mistake. Other buckets are public on purpose, because they host a static help website, and those buckets carry the tag public-site=true.
The security team wants any new public exposure of a bucket without that tag reversed within ten minutes, with an audit record of the change. The team has no budget for servers, and the fix must not touch the tagged website buckets.
Which solution meets these requirements?
Choose one answer.
AA. Create an EventBridge rule for bucket ACL and policy change events that starts an Automation runbook. The runbook skips buckets tagged public-site=true and turns on Block Public Access for the others.
BB. Run a Lambda function every hour that scans every bucket, removes public ACLs from buckets without the tag, records each change in a log file, and emails the team a summary of the changes.
CC. Turn on S3 Block Public Access at the account level, so that no bucket in the account can be made public, including the static help website buckets that the company serves to customers.
DD. Create an EventBridge rule that sends an email to the bucket owner whenever a public setting appears, and rely on the owner to restore the private settings of the bucket promptly.
Show the answer and explanation
Answer: A
A. Right: Correct. The rule reacts within minutes of the change, and the runbook reads the bucket tags, so the website buckets are left alone. Systems Manager keeps an execution history as the audit record, and no server is needed. Learn more: Systems Manager Automation (opens in a new tab)
B. Wrong: The hourly scan can take up to an hour to reverse a change, which misses the ten-minute requirement. The function must also be written to skip the tagged websites, which adds risk to the fix.
C. Wrong: This stops public exposure quickly, but it also breaks the static help website, which must stay public. The requirement says the fix must not touch the tagged website buckets.
D. Wrong: The alert is fast, but the owner must act by hand, and the requirement is an automatic reversal within ten minutes. An email also leaves no runbook record of the change.
Explanation
An event-driven runbook reacts within minutes, and checking the tag inside the runbook protects the public website buckets, because an event pattern cannot read bucket tags. Block Public Access on the exposed bucket reverses the change and leaves an execution record. A scheduled scan, an account-wide block and an email to the owner each fail a stated requirement.
An ACL or policy change event starts the runbook, which checks the bucket's tag and turns on Block Public Access.
A retailer runs AWS Config rules in 40 accounts. Two kinds of drift keep appearing: S3 buckets created without server access logging, and security groups that open SSH to the internet.
The SSH case needs care. Before the rule is changed, the team must snapshot the EBS volumes of the attached web servers and tag them for investigation.
Each fix must run automatically when a rule becomes noncompliant, and the team wants to maintain as little custom code as possible.
Which solution meets these requirements with the LEAST operational overhead?
Choose one answer.
AA. Write one AWS Lambda function that handles every noncompliant rule, including the logging fix and the security group case, and run it from a Config rule trigger in each account.
BB. Use Config automatic remediation with the managed AWS-ConfigureS3BucketLogging document for buckets, and with a short custom runbook that snapshots and tags the instances before removing the SSH rule.
CC. Turn on Config automatic remediation for both rules with managed documents only, using AWS-DisablePublicAccessForSecurityGroup for the SSH rule, so that no custom runbook is needed.
DD. Keep both rules noncompliant-only, and have an analyst open a ticket for each finding, so that the owning team reviews and fixes the drift by hand after the ticket is triaged.
Show the answer and explanation
Answer: B
A. Wrong: This works, but it puts custom code in charge of every fix, which is the maintenance the team wants to avoid. One function for every case also makes each change harder to review and test.
B. Right: Correct. The managed document fixes the bucket logging drift with no custom code. The security group case needs evidence first, so a short custom runbook takes the snapshots and tags before it removes the rule, and Config starts both fixes automatically. Learn more: Remediating noncompliant resources with AWS Config (opens in a new tab)
C. Wrong: The managed document closes the open SSH rule, but it takes no snapshot and adds no tag first. The team requires that evidence before any change, so it would be lost.
D. Wrong: Tickets are not automatic remediation, which the team requires. Manual fixes also delay the change, and the instance stays exposed while the ticket waits in a queue.
Explanation
Config automatic remediation with a managed Automation document fixes the logging drift with no code, and a short custom runbook handles the security group case so that the snapshots and tags come first. One custom function, managed documents alone and manual tickets each miss a requirement.
Want more on Automated remediation (EventBridge, Systems Manager Automation, Step Functions, Lambda)? The 5 full-length practice sets have 7 more Automated remediation (EventBridge, Systems Manager Automation, Step Functions, Lambda) questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →
Study Automated remediation (EventBridge, Systems Manager Automation, Step Functions, Lambda)