Examkin

Question

Difficulty: Very hardAutomating Deployment and Configuration Management

An enterprise uses AWS CloudFormation StackSets with service-managed permissions to deploy a standardized security baseline—consisting of IAM roles, AWS Config rules, and Amazon VPC security groups—across all member accounts within an AWS Organization. The templates are stored in a centralized Amazon S3 bucket in a dedicated administration account. Over time, developers in member accounts have manually modified security groups and IAM roles, introducing configuration drift. The Solutions Architect must establish a fully automated solution to detect stack drift across all accounts and remediate the drifted resources to align with the StackSet template. The remediation must not disrupt the stack management lifecycle or cause subsequent stack updates to fail. Which combination of actions will meet these requirements while adhering to the principle of least privilege?

  1. Enable CloudFormation StackSets drift detection on a scheduled basis. Create an Amazon EventBridge rule in the administration account that filters for the CloudFormation StackSet Drift Detection Status Change event indicating a drifted state. Configure the rule to target an AWS Lambda function that initiates a StackSet update targeting the specific drifted accounts and regions using the baseline template. Encrypt the centralized S3 bucket using a Customer Managed Key (CMK) and update the KMS key policy to grant the cross-account AWSCloudFormationStackSetExecutionRole permissions to decrypt the template.Answer
  2. B
    Enable CloudFormation StackSets drift detection on a scheduled basis. Create an Amazon EventBridge rule in the administration account that filters for CloudFormation StackSet Drift Detection Status Change events. Set the target to an AWS Lambda function that initiates a StackSet update using the baseline template to remediate drift. Encrypt the centralized S3 bucket using the default AWS managed key for S3 (aws/s3) and update the key policy to grant the cross-account AWSCloudFormationStackSetExecutionRole permissions to decrypt the template.
  3. C
    Configure an AWS Config rule in each member account to detect configuration changes. When a drifted resource is identified, trigger an AWS Systems Manager Automation runbook that assumes a local administrator role, deletes the drifted IAM roles and security groups, and recreates them using AWS CLI commands to match the baseline. Encrypt the centralized S3 bucket using a Customer Managed Key (CMK) and grant the Systems Manager execution role cross-account decrypt permissions.
  4. D
    Apply a Service Control Policy (SCP) to the organization root that denies cloudformation:UpdateStack and cloudformation:DeleteStack actions to all users except the StackSets execution role to prevent manual drift. Set up an AWS Config rule to monitor the resources and trigger an AWS Systems Manager Automation runbook in the management account that uses the admin role to run DetectStackDrift and automatically apply the baseline template. Encrypt the S3 bucket using a Customer Managed Key (CMK) with cross-account access.

Answer

Enable CloudFormation StackSets drift detection on a scheduled basis, use an EventBridge rule to trigger a Lambda function that executes a StackSet update using the baseline template, and encrypt the S3 bucket with a Customer Managed Key (CMK) sharing decrypt permissions with the execution role.
The correct solution automates the remediation workflow by using CloudFormation StackSets drift detection to trigger an EventBridge rule, which executes an AWS Lambda function to update the drifted stack instances back to the baseline. It correctly uses a Customer Managed Key (CMK) to encrypt the centralized S3 template bucket, enabling the cross-account StackSet execution roles to access the template payload.

Step-by-Step Solution

1
Establish cross-account decryption permissions for templates.
The S3 bucket holding the templates is encrypted using a KMS Customer Managed Key (CMK). The key policy is configured to allow cross-account 'kms:Decrypt' actions for the 'AWSCloudFormationStackSetExecutionRole' in member accounts.
AWS-managed keys (aws/s3) cannot be shared cross-account, so a Customer Managed Key must be used for member accounts to fetch the templates during deployment.
2
Enable drift detection at the StackSet level.
CloudFormation periodically scans all stack instances across member accounts and regions to detect configuration variance against the baseline template.
StackSets drift detection natively determines which resources have been manually modified or deleted without relying on individual agent scripts.
3
Automate remediation using EventBridge and Lambda.
An EventBridge rule intercepts drift status changes and invokes a Lambda function that triggers an update on the drifted stack instances using the original baseline template.
Updating the stack instance with the original template restores the resources to their baseline state cleanly, preserving physical resource IDs and preventing subsequent CloudFormation lifecycle failures.

Key Concept

Continuous drift detection and automated remediation within multi-account environments using CloudFormation StackSets and cross-account KMS CMK policies.
Rate this question

Topics

Automating Deployment and Configuration Management