Examkin

Question

Difficulty: MediumAutomating Deployment and Configuration Management

An enterprise utilizes AWS CloudFormation to manage its web application infrastructure, which includes Amazon EC2 Auto Scaling groups and Amazon VPC security groups. To comply with security policies, the security team requires that any configuration drift—specifically unauthorized manual modifications to security groups and EC2 instances—must be automatically detected and remediated. The operations team also requires that remediation actions must not disrupt existing application traffic and must be audit-compliant. Which two of the following options should the Solutions Architect recommend to automate drift detection and remediation while maintaining operational stability? (Select TWO.)

  1. Implement AWS Config rules to monitor security group configurations, and associate an AWS Systems Manager Automation runbook to automatically revert unauthorized rule changes.Answer
  2. Use AWS CloudFormation drift detection on a scheduled basis via Amazon EventBridge, and configure notifications to alert administrators to reconcile legitimate configuration changes via stack updates.Answer
  3. C
    Configure AWS CloudFormation to perform an automatic rolling update deployment of the stack whenever drift is detected, ensuring immediate restoration of the desired state with minimal downtime.
  4. D
    Configure AWS Systems Manager State Manager to execute a script that directly modifies the running EC2 instances and security groups in the live environment to match the target configuration, bypassing updates to the CloudFormation template.
  5. E
    Attach a Service Control Policy (SCP) at the Organizational Unit (OU) level that explicitly permits AWS Config and Systems Manager to modify security groups, assuming this grants the necessary execution permissions across all member accounts without local IAM policies.

Answer

The correct options are: implementing AWS Config rules paired with Systems Manager Automation runbooks to revert changes, and utilizing scheduled AWS CloudFormation drift detection to alert administrators to reconcile legitimate modifications via stack updates.
Implementing AWS Config rules paired with Systems Manager Automation runbooks allows for non-disruptive, automated detection and remediation of specific resources like security groups. Furthermore, setting up scheduled CloudFormation drift detection ensures that any changes to managed stacks are identified, allowing administrators to reconcile them through proper template updates instead of out-of-band manual changes.

Step-by-Step Solution

1
Analyze the drift detection requirements for CloudFormation-managed resources.
Identify that manual resource modifications bypass the CloudFormation control plane, and configuration drift must be resolved via template updates to prevent future deployment failures.
Standard practice dictates that resources managed by CloudFormation should only be modified through the CloudFormation template to maintain state consistency.
2
Evaluate mechanisms for automated configuration compliance and remediation.
Determine that AWS Config rules can continuously evaluate resources (such as security groups) and trigger Systems Manager Automation runbooks to safely revert unauthorized changes.
AWS Config integrates natively with Systems Manager Automation to provide automated, resource-level compliance remediation.
3
Design the permissions boundary and execution roles required for remediation.
Define local IAM roles inside member accounts to delegate permissions to the remediation services, recognizing that SCPs only restrict rather than grant permissions.
SCPs act as guardrails and do not replace IAM policies for granting access to AWS services.

Key Concept

Automating configuration drift detection and remediation using AWS Config, AWS Systems Manager, and AWS CloudFormation while maintaining stack integrity.
Rate this question

Topics

Automating Deployment and Configuration Management