Examkin

Question

Difficulty: Very hardAutomating Deployment and Configuration Management

An enterprise manages its application infrastructure across multiple AWS accounts within an AWS Organization. A central DevOps team uses AWS CloudFormation StackSets to deploy standard security tooling, which includes an Amazon EC2 Auto Scaling group and an associated launch template in each member account. Recently, local administrators in several member accounts have manually modified the launch templates and associated security groups to troubleshoot network connectivity, introducing configuration drift that violates compliance baselines. The enterprise needs to establish an automated, zero-touch solution to detect this drift and remediate the resources back to the template-defined state. The solution must support cross-account operations, use encrypted parameter storage, and follow the principle of least privilege. Which combination of actions should the Solutions Architect implement to meet these requirements? (Select two.)

  1. Configure an AWS Config organization rule using the cloudformation-stack-drift-detection-check managed rule. Configure an Amazon EventBridge rule in the organization's delegated administrator account to detect compliance changes and trigger an AWS Systems Manager Automation runbook that assumes a cross-account IAM role to remediate the drifted resource.Answer
  2. Create a Customer Managed Key (CMK) in AWS KMS in the central DevOps account, and configure its key policy to grant cross-account usage permissions to the IAM roles in the member accounts. Configure the cross-account IAM roles in the member accounts to trust the central DevOps account's Automation execution role.Answer
  3. C
    Modify the Service Control Policy (SCP) at the root of the AWS Organization to explicitly grant the ssm:StartAutomationExecution and cloudformation:UpdateStack permissions to all member account root principals, ensuring that the central automation runner has execution permissions across all accounts.
  4. D
    Use AWS Resource Access Manager (RAM) to share the central DevOps account's KMS AWS-managed key (aws/ssm) with the member accounts to allow cross-account decryption of SSM parameters during the automated drift remediation workflow.
  5. E
    Configure AWS Systems Manager State Manager associations in each member account targeting the CloudFormation stack ARN to automatically re-deploy the stack whenever a compliance change is detected.

Answer

To establish automated drift detection and remediation under least privilege: 1. Deploy an AWS Config organization rule using the cloudformation-stack-drift-detection-check managed rule, and trigger an AWS Systems Manager Automation runbook via EventBridge in the delegated administrator account. The runbook must assume cross-account IAM roles. 2. Use a Customer Managed Key (CMK) in the central account with cross-account access enabled in the key policy, as AWS-managed keys cannot be shared cross-account.
The correct architecture uses an AWS Config organization rule (using the cloudformation-stack-drift-detection-check managed rule) to monitor drift across all accounts in the organization. When drift occurs, EventBridge triggers AWS Systems Manager Automation. The automation runbook assumes a cross-account IAM role in the member account to perform remediation. To retrieve secure parameters cross-account, a Customer Managed Key (CMK) must be created in the central account, and its key policy must explicitly allow cross-account access, because AWS-managed keys cannot be shared cross-account.

Step-by-Step Solution

1
Configure centralized drift detection
AWS Config organization rule evaluates stack drift status across all member accounts.
Ensures drift is detected in a scalable, multi-account manner without requiring local configuration in each member account.
2
Set up the automation trigger and cross-account execution
An EventBridge rule matches non-compliant stack compliance state events and starts Systems Manager Automation, which assumes a trusted role in the drifted account.
Triggers the zero-touch remediation workflow automatically and securely.
3
Configure cross-account key sharing for parameter decryption
A Customer Managed Key is configured with a key policy allowing target roles to decrypt configurations.
AWS KMS AWS-managed keys cannot be modified or shared cross-account, necessitating a Customer Managed Key (CMK) for cross-account operational decryption.

Key Concept

Cross-account automated drift detection and remediation using AWS Config, EventBridge, Systems Manager, and KMS cross-account access policies.
Rate this question

Topics

Automating Deployment and Configuration Management