Examkin

Question

Difficulty: MediumAutomating Deployment and Configuration Management

A retail company uses AWS Systems Manager State Manager to continuously apply and enforce software configuration templates on a fleet of Amazon EC2 instances deployed across multiple member accounts in an AWS Organization. Some of these configuration templates contain database connection strings that must be decrypted locally using an AWS Key Management Service (KMS) key hosted in a centralized security account. The Operations team discovers that local administrators in some member accounts have manually modified the configuration files directly on the EC2 instances, introducing operational drift. Which of the following is the most secure and operationally efficient solution to automatically remediate this drift while allowing the instances to decrypt the connection strings?

  1. A
    Configure the State Manager association to execute periodically on a schedule to re-apply the configuration document. Encrypt the credentials using the default AWS-managed KMS key for Systems Manager (aws/ssm), and attach an IAM policy to the EC2 instance profile roles in the member accounts allowing cross-account decryption.
  2. B
    Implement an AWS Config rule to monitor the configuration files on the EC2 instances. When configuration drift is detected, configure an AWS Config remediation action to trigger an AWS Lambda function that uses SSH to connect to the EC2 instances and restore the configuration files from an Amazon S3 bucket.
  3. Configure the State Manager association to execute periodically on a schedule to re-apply the configuration document. Encrypt the credentials using a Customer Managed Key (CMK) in the central security account, updating the key policy to delegate decrypt permissions to the member accounts' IAM roles, and grant the corresponding decryption permissions in the local IAM policies.Answer
  4. D
    Configure the State Manager association to execute periodically on a schedule to re-apply the configuration document. Attach a Service Control Policy (SCP) at the root of the AWS Organization that explicitly grants kms:Decrypt permissions for the KMS key to the EC2 instance profile roles in all member accounts.

Answer

Configure the State Manager association to execute periodically on a schedule to re-apply the configuration document. Encrypt the credentials using a Customer Managed Key (CMK) in the central security account, updating the key policy to delegate decrypt permissions to the member accounts' IAM roles, and grant the corresponding decryption permissions in the local IAM policies.
The correct solution utilizes Systems Manager State Manager to periodically apply configuration documents. State Manager naturally remediates drift by running on a schedule to restore the desired state on instances. For KMS decryption across accounts, a Customer Managed Key (CMK) is required as its key policy can be modified to trust external member accounts, and the local IAM policies in the member accounts must grant the corresponding decrypt action to complete permissions.

Step-by-Step Solution

1
Select the correct mechanism for configuration drift remediation.
Choose Systems Manager State Manager with scheduled execution to periodically re-apply configuration documents.
State Manager automatically overwrites manual configuration changes on managed instances whenever its scheduled run occurs, thereby correcting drift.
2
Determine the KMS key type required for cross-account access.
Select a Customer Managed Key (CMK) instead of an AWS-managed key.
AWS-managed keys (like aws/ssm) cannot be used cross-account because their key policies cannot be modified. A CMK is required to allow key policy customization.
3
Configure the required permissions for cross-account KMS decryption.
Update the CMK key policy in the central security account to trust the member accounts, and attach an IAM policy to the local EC2 roles allowing decryption.
Cross-account access to KMS requires permission from both the resource owner (key policy) and the principal owner (IAM policy).

Key Concept

Configuration drift remediation using Systems Manager State Manager paired with cross-account access using KMS Customer Managed Keys.
Rate this question

Topics

Automating Deployment and Configuration Management