An enterprise manages a multi-account environment using AWS Organizations. The security team uses AWS CloudFormation StackSets to deploy baseline IAM roles and security groups to all member accounts from a central administrator account. Recently, security audits revealed that local administrators in member accounts have manually modified these baseline resources, creating configuration drift and security vulnerabilities. A solutions architect must implement an automated governance solution that detects configuration drift on these baseline resources and automatically remediates it. The solution must prevent local administrators from disabling or bypassing the remediation controls.
Which two actions should the solutions architect take to meet these requirements? (Select two.)
- Deploy an AWS Config organizational rule using the cloudformation-stack-drift-detection-check managed rule to identify drifted stacks. Associate the rule with an AWS Systems Manager Automation document that executes a remediation script using a custom execution role to update the drifted resources back to their defined template states.Answer
- Create a Service Control Policy (SCP) at the Organization root that denies member account principals the ability to delete or modify AWS Config configurations, Systems Manager associations, and the deployed baseline resources, unless the action is performed by the StackSet execution role.Answer
- CEnable the native auto-remediation property on the CloudFormation StackSet to automatically trigger a StackSet update using the RollbackConfiguration parameter when drift is detected by the StackSet administration agent.
- DApply a Service Control Policy (SCP) to the organizational units (OUs) that explicitly grants permission for baseline resource updates to the local administrators while denying all other CloudFormation actions, assuming the SCP will override any restrictive local IAM policies.
- EStore AWS Config history files in a centralized Amazon S3 bucket located in a logging account. Encrypt the bucket using the AWS managed key aws/s3 and update its key policy to grant cross-account KMS decrypt and encrypt permissions to the member account execution roles.