Examkin

Question

Difficulty: MediumAutomating Deployment and Configuration Management

A company needs to ensure that a security logging agent's configuration file is kept synchronized and compliant across all Amazon EC2 instances in an Auto Scaling group. The configuration contains sensitive database connection strings and must be protected. If any manual modifications are made to this configuration file on a running instance, the changes must be detected and corrected within an hour to ensure compliance. Which of the following solutions meets these requirements with the least operational overhead?

  1. A
    Use an AWS CloudFormation template to deploy the instances, passing the configuration file via EC2 User Data. Configure AWS Config with a managed rule to monitor drift on the CloudFormation stack and trigger a custom AWS Lambda function to rebuild the stack if drift is detected.
  2. Store the configuration file in AWS Systems Manager Parameter Store. Create an AWS Systems Manager State Manager association targeting the instances by their Auto Scaling group tags. Configure the association to run a custom SSM document every 30 minutes that retrieves the configuration from Parameter Store and applies it to the instances.Answer
  3. C
    Deploy the configuration file to the instances using AWS CodeDeploy with a linear deployment configuration. Configure an Amazon EventBridge rule that detects manual SSH or RDP access to the instances and automatically triggers the CodeDeploy pipeline to redeploy the application.
  4. D
    Define an AWS Organizations Service Control Policy (SCP) that denies root and Administrator-level access to the EC2 instances' filesystems to prevent manual changes. Use AWS Systems Manager Run Command to push the configuration updates to the instances on a daily schedule.

Answer

The correct solution is to store the configuration file in AWS Systems Manager Parameter Store and use an AWS Systems Manager State Manager association targeting the instances by their Auto Scaling group tags to run a custom SSM document every 30 minutes to fetch and apply the configuration.
The correct solution uses AWS Systems Manager State Manager, which is designed to maintain and enforce consistent OS-level configurations on EC2 instances. By targeting instances using Auto Scaling group tags, any new instances launched by the Auto Scaling group are automatically registered and configured. Running the association every 30 minutes ensures that any configuration drift caused by manual modifications is remediated within the required one-hour window. Storing the configuration file in Parameter Store allows secure, centralized management of the database connection strings.

Step-by-Step Solution

1
Store the configuration file securely.
The configuration file is stored in Systems Manager Parameter Store as a SecureString parameter.
This centralizes configuration management and protects sensitive connection strings.
2
Create a Systems Manager State Manager association.
An association is configured to run an SSM document every 30 minutes, targeting instances using Auto Scaling group tags.
This automates the execution of the configuration enforcement document on all current and future instances.
3
Enforce state and remediate drift.
The SSM document runs, compares the local configuration with Parameter Store, and overwrites any manual modifications.
This ensures that any configuration drift is automatically corrected within the required one-hour compliance window.

Key Concept

Continuous configuration management and drift remediation using AWS Systems Manager State Manager
Rate this question

Topics

Automating Deployment and Configuration Management