Examkin

Question

Difficulty: HardAutomating Deployment and Configuration Management

An enterprise manages its multi-account environment using AWS Organizations. The central DevOps team uses AWS CloudFormation StackSets to deploy and update a standard security baseline OU-wide, which includes configuration for an Amazon S3 logging bucket and approved EC2 instance types. A security audit reveals that several member accounts have manually disabled S3 Block Public Access and launched unauthorized EC2 instance types. The enterprise wants to implement a solution that detects and automatically remediates this configuration drift without affecting other resources, and prevents future unauthorized changes while allowing local administrators to manage approved services. Which two actions should the Solutions Architect take to meet these requirements? (Select TWO.)

  1. Deploy AWS Config managed rules for S3 public access and approved instance types across the organization using an AWS Config organizational conformance pack, and configure an AWS Systems Manager Automation runbook as the automatic remediation target.Answer
  2. Apply a Service Control Policy (SCP) to the Organizational Unit (OU) that denies s3:PutBucketPublicAccessBlock and s3:DeleteBucketPolicy actions unless the caller is the StackSets execution role, and denies ec2:RunInstances for unauthorized instance types.Answer
  3. C
    Create an OU-level Service Control Policy (SCP) that grants the AWS CloudFormation StackSets execution role permissions to manage the S3 buckets and EC2 instances, thereby overriding any local IAM policies that restrict these administrative operations.
  4. D
    Enable AWS CloudFormation native drift detection on the StackSet, and configure an Amazon EventBridge rule that detects a DRIFTED status to trigger a Lambda function that executes UpdateStackInstances to automatically overwrite manual configuration changes.
  5. E
    Encrypt the S3 logging buckets in each member account using the default AWS-managed KMS key (aws/s3) and attach a custom key policy to grant the central DevOps role cross-account access to verify configuration compliance.

Answer

Deploy AWS Config managed rules across the organization with Systems Manager Automation remediation, and apply a Service Control Policy (SCP) to deny unauthorized S3 and EC2 changes unless performed by the StackSets execution role.
Deploying AWS Config rules across the Organization via conformance packs coupled with Systems Manager Automation provides automatic drift detection and target remediation. Applying an SCP with explicit deny rules restricts unauthorized manual configurations on S3 public access and EC2 instance types while allowing the baseline pipeline (via the StackSets execution role) to manage the resources.

Step-by-Step Solution

1
Identify the mechanism for Org-wide drift detection and compliance monitoring.
AWS Config managed rules deployed via conformance packs across the Organization monitor baseline configurations.
Config conformance packs ensure consistent compliance checks across all accounts under the OU.
2
Select an automated remediation method that reverts specific non-compliant resources.
Associate AWS Systems Manager Automation runbooks as remediation targets with the AWS Config rules.
SSM Automation can remediate specific drifted configurations (like public access settings or instance types) without deleting or altering unaffected resources.
3
Determine the preventive control (guardrail) to restrict manual drift while preserving deployment pipelines.
Deploy a Service Control Policy (SCP) at the OU level that denies modification of these settings unless the principal is the StackSets execution role.
SCPs block local administrative modifications of public access blocks and instance types, acting as a guardrail while keeping the pipeline's CloudFormation StackSets role exempt.

Key Concept

Continuous compliance and drift remediation in a multi-account AWS environment using AWS Config, AWS Systems Manager, and Service Control Policies.
Rate this question

Topics

Automating Deployment and Configuration Management