Examkin

Question

Difficulty: Very hardAutomating Deployment and Configuration Management

An enterprise manages its multi-account environment using AWS Organizations. The central DevOps team uses AWS CloudFormation StackSets to deploy baseline logging infrastructure, which consists of an Amazon S3 bucket and an AWS KMS Customer Managed Key (CMK) used to encrypt the bucket, to all member accounts in a specific Organizational Unit (OU). Recently, local administrators in member accounts have manually modified the S3 bucket policies and KMS key policies to grant permissions to local application roles, causing security configuration drift and audit failures. The Solutions Architect must design a solution that automatically detects this configuration drift, remediates the resources to match the approved CloudFormation baseline, and prevents local administrators from disabling the detection or remediation mechanisms. Which two of the following configuration and governance actions should the Solutions Architect implement to achieve this goal?

  1. Deploy an AWS Config Organization Conformance Pack from the management account containing rules that check S3 bucket and KMS key compliance, and configure auto-remediation using an AWS Systems Manager (SSM) Automation document that executes using a local IAM role with permissions to restore the policies.Answer
  2. Attach a Service Control Policy (SCP) to the member accounts' OU that denies any actions to delete or modify AWS Config recorders, delivery channels, conformance packs, and the local IAM role used for Systems Manager remediation, except when performed by a federated administrator role.Answer
  3. C
    Attach a Service Control Policy (SCP) to the member accounts' OU that explicitly allows the Systems Manager service to perform cross-account remediation of the S3 bucket and KMS key policies, granting the required permissions directly without local IAM role configurations.
  4. D
    Modify the CloudFormation template to use an AWS managed key instead of a Customer Managed Key (CMK) for encrypting the S3 bucket, and use the central DevOps account to update the key policy to delegate permission management to the local applications.
  5. E
    Enable AWS CloudFormation automatic drift detection on the StackSet, and configure an Amazon EventBridge rule in each member account that triggers on stack status changes to run a Systems Manager (SSM) Automation document that executes a local stack update with a ForceUpdate parameter.

Answer

To resolve the configuration drift and protect the compliance baseline, the Solutions Architect should deploy an AWS Config Organization Conformance Pack with auto-remediation using an AWS Systems Manager (SSM) Automation document running under a local IAM execution role, and attach a Service Control Policy (SCP) to the OU that denies modifications to the AWS Config and IAM remediation resources.
Deploying an AWS Config Organization Conformance Pack allows the centralized deployment of compliance rules and SSM Automation remediation configurations across all member accounts. The SSM Automation runs in the target account using a local IAM execution role that has permissions to revert the S3 and KMS policy changes. To protect this monitoring and remediation baseline from local administrators, a Service Control Policy (SCP) must be attached to the member accounts' OU. This SCP denies any deletion or modification of the AWS Config resources and the local IAM execution role, securing the enforcement loop.

Step-by-Step Solution

1
Determine the mechanism for compliance monitoring and remediation at scale.
Identify AWS Config Conformance Packs deployed at the organization level as the ideal tool for pushing standardized config rules and remediation configurations (SSM Automation) to member accounts.
This ensures consistent drift detection and automated remediation across all accounts within the Organizational Unit.
2
Design the permissions model for the remediation tool.
Create a local IAM role in the member accounts that the SSM Automation document can assume to perform policy updates on S3 and KMS.
SSM Automation requires active IAM permissions to modify target resources, which must be granted in the local account context.
3
Formulate a policy to secure the compliance baseline from local tampering.
Draft an SCP with a Deny effect on the deletion or modification of AWS Config resources, conformance packs, and the remediation IAM role.
This establishes a governance guardrail that prevents local administrators from bypassing the drift remediation system.

Key Concept

Multi-account configuration drift detection and remediation using Organization Conformance Packs, coupled with SCP guardrails to prevent local tampering.
Rate this question

Topics

Automating Deployment and Configuration Management