Examkin

Question

Difficulty: HardAutomating Deployment and Configuration Management

A media streaming company uses AWS Organizations to manage its multi-account environment. The security team enforces that all VPC security groups in member accounts are deployed and updated exclusively via a centralized CI/CD pipeline using AWS CloudFormation StackSets from a central Administration account. The security team must implement a solution to detect any manual modifications to these security groups, automatically revert the resources to their template-defined state, and log the remediation details to a centralized Amazon S3 bucket in a Security account. The S3 bucket must be encrypted, and all operations must adhere to the principle of least privilege. Which strategy should a solutions architect implement to meet these requirements?

  1. A
    Apply a Service Control Policy (SCP) at the Organizational Unit (OU) level that denies ec2:AuthorizeSecurityGroupIngress and ec2:RevokeSecurityGroupIngress for all IAM identities except the CloudFormation execution role, assuming this SCP will automatically revert any unauthorized manual changes to the security groups and write log entries to the central S3 bucket.
  2. B
    Deploy an AWS Config rule to monitor the security groups for drift. Configure the AWS Config rule to trigger an AWS Systems Manager (SSM) Automation runbook. Store the SSM execution logs in the Security account's Amazon S3 bucket encrypted with the default AWS-managed KMS key (aws/s3), and configure the bucket policy to delegate cross-account access to the member account roles.
  3. Deploy an AWS Config rule to monitor the security groups for drift. Configure the AWS Config rule to trigger an AWS Systems Manager (SSM) Automation runbook. The runbook assumes a cross-account IAM role to execute remediation. Store the SSM execution logs in the Security account's Amazon S3 bucket encrypted with a KMS Customer Managed Key (CMK) whose key policy grants kms:GenerateDataKey and kms:Decrypt permissions to the member account roles.Answer
  4. D
    Configure an Amazon EventBridge rule that detects manual security group modifications in AWS CloudTrail logs, and trigger an AWS Systems Manager Run Command script to run local AWS CLI commands in the member accounts to overwrite rules, bypassing the CloudFormation stack's state.

Answer

Deploy an AWS Config rule to monitor the security groups for drift. Configure the AWS Config rule to trigger an AWS Systems Manager (SSM) Automation runbook. The runbook assumes a cross-account IAM role to execute remediation. Store the SSM execution logs in the Security account's Amazon S3 bucket encrypted with a KMS Customer Managed Key (CMK) whose key policy grants kms:GenerateDataKey and kms:Decrypt permissions to the member account roles.
Deploying an AWS Config rule to monitor security groups and triggering an AWS Systems Manager Automation runbook enables automated detection and remediation of configuration drift. For the cross-account logging to succeed, the target Amazon S3 bucket must be encrypted with a Customer Managed Key (CMK). A Customer Managed Key's policy can be modified to grant the necessary KMS permissions to external member accounts. This satisfies both the automated remediation and security requirements.

Step-by-Step Solution

1
Detect configuration drift using AWS Config rules.
Active monitoring detects when any VPC security group deviates from the CloudFormation StackSets template configuration.
AWS Config provides a managed way to continuously evaluate compliance of resources against declared configurations.
2
Automate remediation using Systems Manager Automation.
An SSM Automation runbook is triggered to restore the security group back to the template state using a cross-account IAM role.
Ensures drift is resolved quickly and programmatically without manual operator intervention.
3
Configure a Customer Managed Key (CMK) for cross-account S3 bucket logging.
Allows external member accounts to write execution logs to the central Security account S3 bucket.
AWS-managed KMS keys do not support policy modifications and cannot be shared across account boundaries, requiring a CMK instead.

Key Concept

Cross-account drift remediation and secure log aggregation using Customer Managed Keys (CMKs).
Estimated Time:2m 30s
Rate this question

Topics

Automating Deployment and Configuration Management