Examkin

Question

Difficulty: HardAutomating Deployment and Configuration Management

A logistics company manages a multi-account environment using AWS Organizations. The central Operations team must enforce a security patch compliance baseline across all Amazon EC2 instances in all member accounts. The patches must be installed during weekly maintenance windows using AWS Systems Manager Patch Manager. The Operations team wants to:

1. Aggregate patch compliance data from all member accounts into a central Amazon S3 bucket in a Security account.
2. Automate the quarantine of any EC2 instance that is flagged as non-compliant by changing its attached security group.
3. Secure the S3 bucket using encryption with a Customer Managed Key (CMK) stored in the Security account, while preventing local administrators in member accounts from altering the Patch Manager configuration.

Which combination of actions will meet these requirements? (Select two.)

  1. Create an AWS Systems Manager Resource Data Sync in each member account to aggregate compliance and inventory data into the central Amazon S3 bucket. Configure the KMS Customer Managed Key (CMK) policy in the Security account to grant kms:GenerateDataKey* and kms:Decrypt permissions to the member account IAM roles.Answer
  2. Deploy an AWS Config organizational rule to evaluate patch compliance across all accounts. Associate the rule with an AWS Systems Manager Automation runbook that removes existing security groups and applies a restrictive quarantine security group to instances identified as non-compliant.Answer
  3. C
    Configure Resource Data Sync in all member accounts using the default AWS-managed KMS key (aws/s3) of the Security account, and modify the key policy of the AWS-managed key to allow cross-account access from the member accounts.
  4. D
    Attach a Service Control Policy (SCP) at the Organization root that explicitly allows the ssm:CreateResourceDataSync and ssm:PutComplianceItems actions to automatically grant these permissions to all member account IAM users and roles.
  5. E
    Configure AWS CodePipeline to monitor the S3 compliance data and trigger an automated linear deployment rollback to replace non-compliant EC2 instances with the previous week's Amazon Machine Image (AMI).

Answer

The correct combination of actions is to configure Systems Manager Resource Data Sync using a Customer Managed Key (CMK) in the Security account with cross-account access, and deploy an AWS Config organizational rule associated with an Systems Manager Automation runbook for quarantine remediation.
The solution requires configuring Systems Manager Resource Data Sync in member accounts, which aggregates compliance information into a centralized S3 bucket. Because cross-account access is required, a KMS Customer Managed Key (CMK) must be configured in the Security account with a key policy allowing access to the member accounts. To automate quarantining non-compliant instances, an AWS Config organizational rule evaluates patch compliance and uses an SSM Automation runbook as remediation to replace the instance's security groups with a quarantine security group.

Step-by-Step Solution

1
Set up centralized data aggregation using Systems Manager Resource Data Sync.
Aggregated patch compliance and inventory data are sent from member accounts to a central S3 bucket.
Resource Data Sync is the native mechanism to aggregate Systems Manager compliance data from multiple accounts into a single S3 bucket.
2
Configure a KMS Customer Managed Key (CMK) for cross-account S3 encryption.
Member accounts can successfully write encrypted inventory files to the central S3 bucket.
AWS-managed KMS keys cannot be shared cross-account, so a CMK is required with key policy permissions granted to the member accounts.
3
Deploy an AWS Config organizational rule with an SSM Automation remediation target.
Non-compliant instances are detected and automatically isolated using a quarantine security group.
AWS Config evaluates compliance and natively supports triggering SSM Automation runbooks to modify security groups on non-compliant resources.

Key Concept

Multi-account configuration management, patch compliance aggregation, and automated remediation using AWS Systems Manager and AWS Config.
Rate this question

Topics

Automating Deployment and Configuration Management