A company has a fleet of Amazon EC2 instances that must maintain a specific security configuration. A Solutions Architect needs to implement a solution to automatically detect and remediate any configuration drift on these instances. Which of the following approaches should the Solutions Architect use to achieve this goal? (Select TWO.)
- Use AWS Systems Manager State Manager to define and enforce the desired configuration on the instances at regular intervals.Answer
- Use AWS Config with an AWS Systems Manager Automation runbook as a remediation action to automatically correct non-compliant resource configurations.Answer
- CModify the AWS Organizations Service Control Policy (SCP) attached to the account to prevent local IAM users from making manual configuration changes within the EC2 operating systems.
- DEnable AWS CloudFormation drift detection with automatic stack rollback to revert manual changes made to the instances.
- EConfigure AWS Key Management Service (AWS KMS) with an AWS-managed key to automatically intercept and override configuration changes on the instances.
Answer
Use AWS Systems Manager State Manager to define and enforce configurations, and use AWS Config with an AWS Systems Manager Automation runbook as a remediation action.
The correct options are using AWS Systems Manager State Manager and using AWS Config with SSM Automation. State Manager enforces defined configuration states at regular intervals. AWS Config detects non-compliant resource states and triggers SSM Automation runbooks to remediate them.
Step-by-Step Solution
Key Concept
Continuous compliance and drift remediation utilizing AWS Systems Manager and AWS Config.