Examkin

Question

Difficulty: MediumAutomating Deployment and Configuration Management

An enterprise manages its multi-account environment under AWS Organizations. A central platform team uses AWS CloudFormation StackSets to deploy and update web application stacks across all member accounts. Recently, security audits revealed that local administrators in several member accounts have manually added inbound rules to their Application Load Balancer (ALB) security groups to troubleshoot connectivity, introducing security vulnerabilities and causing configuration drift.

The platform team wants to prevent unauthorized changes to the security groups while allowing CloudFormation StackSets to update them. Additionally, any existing drift on the security groups must be detected and automatically reverted without redeploying the entire application stack.

Which two actions should the Solutions Architect take to meet these requirements? (Select two.)

  1. Configure AWS Config in each member account with the vpc-sg-open-only-to-authorized-ports managed rule, and specify an AWS Systems Manager Automation runbook as a remediation action to automatically remove unauthorized rules.Answer
  2. Implement a Service Control Policy (SCP) at the organizational level that denies ec2:AuthorizeSecurityGroupIngress and ec2:RevokeSecurityGroupIngress actions unless the caller principal is the CloudFormation StackSets execution role.Answer
  3. C
    Enable AWS CloudFormation drift detection on the StackSets and configure an Amazon EventBridge rule that triggers an automatic stack update using the UpdateStack API with the previously deployed template whenever drift is detected.
  4. D
    Apply a Service Control Policy (SCP) to the member account Organizational Units (OUs) that explicitly grants the AWS CloudFormation StackSets execution role permission to modify security groups, assuming this overrides local IAM policies.
  5. E
    Create a custom KMS key policy using the AWS-managed KMS key for Amazon EC2 (aws/ec2) in the management account to allow cross-account access for the CloudFormation StackSets execution role, securing the templates during deployment.

Answer

The correct actions are implementing an AWS Config rule with Systems Manager Automation remediation to remove unauthorized security group rules, and applying a Service Control Policy (SCP) to restrict security group modifications to the CloudFormation StackSets execution role.
Configuring AWS Config with Systems Manager Automation allows for automated detection and targeted remediation of unauthorized security group changes without full stack redeployments. Applying a Service Control Policy (SCP) that restricts security group modifications to the CloudFormation StackSets execution role establishes a preventive guardrail against manual configurations by local administrators.

Step-by-Step Solution

1
Configure preventative controls at the organization level using a Service Control Policy.
Local administrators are blocked from modifying security groups, while the CloudFormation StackSets role remains permitted.
This establishes a security boundary that prevents future configuration drift without impacting automated deployments.
2
Deploy AWS Config managed rules across all target accounts to monitor security group compliance.
Any out-of-band changes to security groups are flagged as non-compliant.
AWS Config is designed to continuously record and evaluate AWS resource configurations.
3
Link an AWS Systems Manager Automation runbook to the AWS Config rule.
Non-compliant security groups are automatically remediated to their authorized state.
Targeted remediation corrects the specific configuration drift without requiring a complete stack update or redeployment.

Key Concept

Combining preventative organization-level guardrails with automated detection and remediation tools to manage configuration drift in a multi-account environment.
Estimated Time:2m 0s
Rate this question

Topics

Automating Deployment and Configuration Management