Examkin

Question

Difficulty: MediumAutomating Deployment and Configuration Management

An organization deploys its application stack across multiple AWS accounts using AWS CloudFormation StackSets. The stack includes Amazon EC2 instances that must adhere to a strict security configuration baseline, such as running specific security agents and maintaining local firewall rules. Developers frequently bypass standard CI/CD pipelines to make manual configuration changes directly on the instances during troubleshooting, leading to configuration drift. The Solutions Architect needs to implement a solution to automatically enforce the baseline and remediate any drift on these instances with minimal operational overhead. Which strategy should the Solutions Architect implement to meet these requirements?

  1. A
    Configure AWS CloudFormation drift detection to run on the StackSets via a scheduled Amazon EventBridge rule. Set the StackSet parameters to automatically revert any detected drift, and encrypt the StackSets templates using the AWS-managed KMS key (aws/cloudformation) to allow cross-account remediation.
  2. Create an AWS Systems Manager State Manager association that applies a configuration document to the EC2 instances on a recurring schedule to enforce the baseline and automatically remediate local configuration drift.Answer
  3. C
    Create a Service Control Policy (SCP) at the AWS Organizations root that denies the execution of any commands on the EC2 instances that are not initiated by AWS CloudFormation, ensuring that this SCP automatically grants the required IAM permissions to member accounts for resource provisioning.
  4. D
    Configure a CI/CD pipeline using AWS CodePipeline and AWS CodeDeploy to perform a rolling update on the EC2 instances. Choose a linear deployment configuration that updates 10% of the instances every 10 minutes, and rely on manual console changes to trigger the automatic rollback of the deployment.

Answer

Create an AWS Systems Manager State Manager association that applies a configuration document to the EC2 instances on a recurring schedule to enforce the baseline and automatically remediate local configuration drift.
AWS Systems Manager State Manager is designed to define and maintain consistent operating system and software configurations on EC2 instances. By setting up an association that runs a configuration document on a schedule, any unauthorized configuration changes (drift) made on the EC2 instances will be automatically corrected during the next execution run, ensuring compliance without manual intervention.

Step-by-Step Solution

1
Define the target security configuration baseline in an AWS Systems Manager (SSM) document.
A reusable SSM document is created that contains instructions for installing required agents and setting firewall rules.
Establishes a defined target state for the EC2 instances.
2
Create an SSM State Manager association targeting the EC2 instances.
The association is scheduled to run at regular intervals (e.g., hourly or daily).
Enforces configuration compliance on a schedule and automatically reverts any manual adjustments made outside the standard pipeline.
3
Enable AWS Config in the accounts to monitor compliance.
Changes are recorded and compliance status is logged.
Provides visibility and auditing for compliance monitoring across the organization.

Key Concept

Continuous configuration enforcement and drift remediation using AWS Systems Manager State Manager
Rate this question

Topics

Automating Deployment and Configuration Management