Examkin

Question

Difficulty: MediumAutomating Deployment and Configuration Management

A company manages a multi-account AWS environment using AWS Organizations. The DevOps team uses AWS CloudFormation StackSets to deploy and manage application infrastructure, including EC2 instances and security groups, across multiple target accounts. The CloudFormation templates are stored in an Amazon S3 bucket within the administrator account. Recently, manual changes made to the security groups in a target account caused subsequent StackSet updates to fail due to configuration drift. Additionally, the DevOps team is planning to encrypt the S3 bucket containing the templates and needs to ensure that StackSets can still deploy resources cross-account. Which of the following actions should the DevOps engineer take to address these requirements? (Select TWO.)

  1. Encrypt the Amazon S3 bucket containing the templates using a Customer Managed Key (CMK) in the administrator account, and configure the key policy to grant the StackSet execution role (AWSCloudFormationStackSetExecutionRole) in the target accounts permissions for the kms:Decrypt and kms:GenerateDataKey actions.Answer
  2. Configure the AWS Config rule cloudformation-stack-drift-detection-check in the target accounts, and set up an Amazon EventBridge rule that detects non-compliant drift events and triggers an AWS Systems Manager Automation runbook to remediate the drifted resources.Answer
  3. C
    Encrypt the Amazon S3 bucket using the default AWS-managed KMS key for Amazon S3 (aws/s3) in the administrator account, and configure the S3 bucket policy to grant cross-account read access to the StackSet execution roles in the target accounts.
  4. D
    Attach a Service Control Policy (SCP) to the target Organizational Unit (OU) that explicitly grants kms:Decrypt and cloudformation:* permissions to automatically allow the target account roles to access templates and deploy resources.
  5. E
    Instruct administrators to manually modify the drifted resources back to their original state in the target accounts, and then use the AWS CLI to manually update the CloudFormation stack drift status to IN_SYNC.

Answer

The correct actions are to encrypt the S3 bucket using a Customer Managed Key (CMK) in the administrator account while granting cross-account KMS permissions to the StackSet execution role in the target accounts, and to configure the AWS Config stack drift detection rule combined with an Amazon EventBridge rule that triggers an AWS Systems Manager Automation runbook for remediation.
To support cross-account StackSet deployments from an encrypted S3 bucket, a Customer Managed Key (CMK) must be used because AWS-managed keys cannot be shared cross-account. The CMK's key policy must grant permissions to the execution role in the target accounts. Additionally, configuring AWS Config to detect CloudFormation stack drift and using EventBridge to trigger a Systems Manager Automation runbook provides a secure, automated way to detect and remediate configuration changes without manual intervention.

Step-by-Step Solution

1
Address the cross-account encryption requirement.
Identify that AWS-managed KMS keys cannot be shared cross-account. A Customer Managed Key (CMK) must be created in the administrator account, and its key policy must grant permissions to the cross-account role AWSCloudFormationStackSetExecutionRole.
This ensures the StackSets execution role in target accounts has permission to decrypt the CloudFormation templates stored in the encrypted S3 bucket.
2
Configure configuration drift detection and remediation.
Deploy the cloudformation-stack-drift-detection-check AWS Config rule in target accounts and configure an EventBridge rule that triggers an AWS Systems Manager Automation runbook upon drift detection.
This automates the detection of configuration changes and invokes the remediation process without manual CLI overrides or console interventions.
3
Evaluate and rule out incorrect options.
Discard the options proposing AWS-managed KMS keys (which cannot be shared cross-account), SCPs (which do not grant permissions directly), and manual CLI status overrides (which are unsupported).
This refines the choices to the two correct, scalable, and secure architecture patterns.

Key Concept

Automating cross-account infrastructure deployment using CloudFormation StackSets, managing configuration drift with AWS Config and Systems Manager, and configuring cross-account KMS permissions.
Rate this question

Topics

Automating Deployment and Configuration Management