Examkin

Question

Difficulty: HardAutomating Deployment and Configuration Management

An e-commerce corporation hosts its microservices across multiple AWS accounts structured under an AWS Organization. To automate resource provisioning, the DevOps team utilizes AWS CloudFormation StackSets initiated from a central release account. The templates and software packages are stored in a shared Amazon S3 bucket in this central release account. Recently, engineering teams in individual production accounts have performed ad-hoc manual adjustments to their VPC configuration and security group rules, causing subsequent automated stack updates to fail. The security compliance guidelines demand that the shared S3 bucket must be encrypted at rest, and cross-account access must adhere strictly to the principle of least privilege. Which two actions should a solutions architect perform to establish automated drift remediation and ensure secure, seamless cross-account deployment pipeline execution?

  1. Encrypt the shared Amazon S3 bucket in the central release account using a Customer Managed Key (CMK), and configure the key policy to grant the AWS CloudFormation StackSet execution roles in the target member accounts permissions to perform the kms:Decrypt action.Answer
  2. Implement an AWS Config organizational rule across all accounts to detect resource non-compliance, and configure an AWS Systems Manager Automation runbook to automatically remediate any unauthorized changes.Answer
  3. C
    Encrypt the shared Amazon S3 bucket in the central release account using the default AWS-managed S3 key (aws/s3), and apply an Organization-level Service Control Policy (SCP) that allows target member account execution roles to perform KMS decryption operations on the key.
  4. D
    Establish an Organization-level Service Control Policy (SCP) that overrides local IAM policies in target member accounts, directly granting the central release account pipeline identity permission to provision resources without local cross-account execution roles.
  5. E
    Configure AWS Systems Manager State Manager in the target member accounts to execute an Ansible playbook that forcibly deletes and recreates any drift-detected resources hourly, ensuring compatibility with the StackSet templates without triggering CloudFormation stack updates.
  6. F
    Set up AWS CodeDeploy in the central release account to manage CloudFormation template deployments using a linear deployment strategy, and trigger automated rollbacks using AWS Config alerts when configuration changes occur.

Answer

Encrypt the shared Amazon S3 bucket using a Customer Managed Key (CMK) in the central release account with a cross-account decryption key policy, and deploy an AWS Config organizational rule with an AWS Systems Manager Automation runbook for automatic remediation.
To support cross-account CloudFormation deployments, the deployment artifacts stored in the S3 bucket of the central release account must be decryptable by execution roles in the target member accounts. A Customer Managed Key (CMK) must be used because AWS-managed keys (like aws/s3) cannot be configured with cross-account permissions. Additionally, manual configuration changes introduce drift that blocks CloudFormation updates. Implementing an AWS Config organizational rule with an AWS Systems Manager Automation runbook allows the organization to detect and automatically revert manual modifications (drift) back to the compliant state without altering physical resource IDs, ensuring that subsequent CloudFormation deployments proceed successfully.

Step-by-Step Solution

1
Provision a Customer Managed Key (CMK) in the central release account.
A customizable KMS key is created that supports cross-account key policies.
AWS-managed KMS keys do not allow policy modifications and cannot grant access to roles in other AWS accounts.
2
Update the KMS key policy of the CMK to grant kms:Decrypt permissions to the IAM execution roles in the target member accounts, and enable S3 default encryption on the bucket using this key.
The deployment artifacts are securely encrypted, and the StackSet execution roles in member accounts can successfully read and decrypt templates during deployment.
Enforces the principle of least privilege by specifying exactly which target execution roles can decrypt the deployment artifacts.
3
Deploy an AWS Config organizational rule across all target member accounts to monitor security groups and VPC configurations.
Continuous compliance monitoring is established, triggering alerts whenever manual changes to managed resources occur.
Provides organization-wide detection of configuration drift on the resources managed by CloudFormation.
4
Associate an AWS Systems Manager Automation runbook as the remediation target for the AWS Config rule.
When non-compliance or drift is detected, the runbook automatically corrects the resource attributes back to the target baseline.
Remediates the configuration drift programmatically, ensuring future StackSet deployments do not fail due to conflicting manually applied settings.

Key Concept

Automated drift remediation and secure cross-account deployment using CloudFormation StackSets, AWS Config, and KMS Customer Managed Keys.
Rate this question

Topics

Automating Deployment and Configuration Management