Examkin

Question

Difficulty: MediumAutomating Deployment and Configuration Management

A financial services firm manages application hosting environments across multiple member accounts in AWS Organizations. The baseline EC2 instance configurations, security group rules, and IAM roles are deployed and managed using AWS CloudFormation StackSets from a centralized tooling account.

Recently, local administrators have made manual, out-of-band modifications to security group rules and instance settings in the target accounts, causing configuration drift. Additionally, the centralized pipeline in the tooling account is unable to complete deployments because the target accounts cannot read the deployment artifacts stored in an Amazon S3 bucket, which is currently encrypted using the default AWS-managed S3 key (aws/s3).

Which combination of actions should a Solutions Architect take to remediate the configuration drift and resolve the cross-account deployment failures? (Select TWO.)

  1. Configure a Customer Managed Key (CMK) in the tooling account to encrypt the S3 artifact bucket, and update the CMK key policy to allow the CloudFormation execution roles in the target member accounts to perform decryption operations.Answer
  2. Deploy an AWS Config rule to monitor the resources for configuration changes, and set up an AWS Systems Manager Automation runbook as a remediation action to automatically revert unauthorized changes.Answer
  3. C
    Modify the key policy of the default AWS-managed KMS key (aws/s3) in the tooling account to grant kms:Decrypt permissions to the CloudFormation execution roles in the target member accounts.
  4. D
    Create a Service Control Policy (SCP) at the Organization root that restricts local IAM users from making manual modifications, and configure it to automatically roll back any unauthorized configuration changes to the baseline CloudFormation state.
  5. E
    Enable automatic drift detection on the CloudFormation StackSet in the tooling account, and set the StackSet execution policy to automatically execute a stack rollback whenever drift is detected.

Answer

The correct actions are to encrypt the S3 artifact bucket with a Customer Managed Key (CMK) and grant cross-account decryption access in its key policy, and to deploy AWS Config rules combined with an AWS Systems Manager Automation runbook to automatically detect and revert unauthorized resource changes.
The correct solution resolves the cross-account S3 access error by replacing the default AWS-managed KMS key (aws/s3) with a Customer Managed Key (CMK), whose key policy can be updated to delegate read permissions to the CloudFormation execution roles in the target member accounts. Additionally, the configuration drift is automatically remediated by deploying AWS Config rules that evaluate the compliance of target resources and trigger an AWS Systems Manager Automation runbook to revert manual configurations back to the desired baseline state.

Step-by-Step Solution

1
Analyze the cross-account KMS decryption failure.
Identify that the default AWS-managed KMS key (aws/s3) cannot be shared across accounts because its key policy cannot be modified.
AWS-managed keys are restricted to the local account and cannot be delegated to external entities or other accounts in the organization.
2
Resolve cross-account S3 bucket access.
Configure a Customer Managed Key (CMK) in the tooling account and update its policy to allow decryption access to the CloudFormation execution roles in the target member accounts.
Customer Managed Keys allow modification of their key policies to grant cross-account permissions.
3
Design drift detection and remediation.
Deploy an AWS Config rule to monitor target resources for configuration changes, and set up an AWS Systems Manager Automation runbook to automatically revert any detected changes.
AWS Config rules can detect resource compliance state changes and trigger remediation actions via Systems Manager Automation, enforcing continuous baseline configurations without manual intervention.

Key Concept

Automating configuration management, drift detection and remediation using AWS Config and Systems Manager, and enabling cross-account deployment pipeline access using Customer Managed Keys (CMKs) in AWS Key Management Service (KMS).
Rate this question

Topics

Automating Deployment and Configuration Management