Examkin

Question

Difficulty: HardAutomating Deployment and Configuration Management

A global retail company runs a containerized microservices application on Amazon ECS (with Amazon EC2 launch type) across a multi-account environment managed by AWS Organizations. The EC2 container instances are configured and maintained using AWS Systems Manager (SSM) State Manager associations. Recently, local SRE teams in the spoke accounts have been manually modifying the SSM State Manager associations and direct EC2 configurations to troubleshoot issues, leading to widespread compliance violations and deployment failures due to configuration drift. The Solutions Architect must implement a strategy to automate drift remediation for these associations and prevent unauthorized local modifications. Which strategy should the Solutions Architect implement to meet these requirements with the least operational overhead?

  1. Deploy an AWS Config organization conformance pack containing the ssm-association-compliance-status rule. Associate an AWS Systems Manager Automation runbook as the remediation target to automatically update the association back to its defined state when non-compliance is detected. Implement a Service Control Policy (SCP) at the organizational unit (OU) level that denies ssm:UpdateAssociation and ssm:DeleteAssociation actions, unless the calling principal is the central CloudFormation administration IAM role.Answer
  2. B
    Deploy an AWS Config organization conformance pack that includes the ssm-association-compliance-status rule. Attach a Service Control Policy (SCP) to the spoke accounts' OU that denies ssm:UpdateAssociation and ssm:DeleteAssociation for all IAM identities to prevent local drift, and configure AWS Config to trigger a Lambda function that logs the non-compliant events to a central Amazon S3 bucket.
  3. C
    Store the SSM association parameters in Systems Manager Parameter Store encrypted with the default AWS-managed KMS key (aws/ssm). Edit the key policy of the aws/ssm key to deny decrypt permissions to all local spoke account administrators, and configure a State Manager association to poll the Parameter Store every 15 minutes to overwrite local changes.
  4. D
    Configure AWS CodePipeline to run an AWS CodeDeploy deployment with a linear deployment strategy that redeploys the ECS container instances on a daily schedule. Use a CloudFormation drift detection action linked to an Amazon EventBridge rule to delete and recreate the CloudFormation stack in the spoke accounts if any configuration drift is reported.

Answer

Deploying an AWS Config organization conformance pack containing the ssm-association-compliance-status rule, associating an AWS Systems Manager Automation runbook as the remediation target, and implementing a Service Control Policy (SCP) at the OU level that denies modification of SSM associations unless the principal is the central CloudFormation administration IAM role.
The correct strategy combines automated drift detection using AWS Config conformance packs, automated self-healing remediation via SSM Automation runbooks, and preventive controls via SCPs with specific exceptions for the central deployment role. This ensures compliance without breaking automated pipelines or causing service disruptions.

Step-by-Step Solution

1
Configure drift detection and centralized monitoring.
Create an AWS Config organization conformance pack with the ssm-association-compliance-status rule to detect when SSM State Manager associations are modified locally in spoke accounts.
AWS Config provides a standardized way to continuously evaluate configurations and trigger automated actions upon non-compliance.
2
Establish automated remediation.
Associate an AWS Systems Manager Automation runbook that executes the association update back to compliance once AWS Config reports a non-compliant state.
This automatically corrects manual drift in spoke accounts without requiring manual SRE intervention.
3
Enforce preventive governance controls using Service Control Policies.
Apply an SCP denying ssm:UpdateAssociation and ssm:DeleteAssociation to the OUs, adding a StringNotEquals condition for the Arn of the central deployment/administration IAM role.
This prevents local administrators from introducing drift while ensuring that the central automation pipelines can still perform authorized updates.

Key Concept

Continuous drift detection, automated remediation using AWS Config and Systems Manager Automation, and Organization-level governance via Service Control Policies.
Estimated Time:2m 30s
Rate this question

Topics

Automating Deployment and Configuration Management