Examkin

Question

Difficulty: Very hardAutomating Deployment and Configuration Management

An enterprise uses AWS CloudFormation StackSets to deploy a baseline security configuration—consisting of an Amazon S3 bucket for security logging and AWS Systems Manager State Manager associations to enforce security agent installation on EC2 instances—across all member accounts in an AWS Organization. The baseline StackSet is deployed from a delegated administrator DevOps account. The S3 logging bucket in each member account must be encrypted using a Customer Managed Key (CMK) managed by the central security team in a dedicated Security account.

During an audit, the security team identifies that some member accounts have configuration drift: local administrators have detached the State Manager associations or manually altered the S3 bucket policies to allow external access, which went undetected. Additionally, recent deployments of the baseline StackSet to new member accounts are failing during the S3 bucket creation step with an Access Denied error.

Which two actions should a Solutions Architect take to resolve the deployment failure and automatically detect and remediate the configuration drift? (Select TWO.)

  1. In the central Security account, update the key policy of the Customer Managed Key to grant the member accounts' StackSet execution roles (AWSCloudFormationStackSetExecutionRole) permissions for kms:DescribeKey, kms:GenerateDataKey*, and kms:Decrypt operations. In the member accounts, ensure the StackSet execution role has IAM permissions to access the Security account's KMS key ARN.Answer
  2. B
    In the central Security account, update the key policy of the default AWS-managed KMS key for Amazon S3 (aws/s3) to grant access to the member accounts' StackSet execution roles, and use AWS Resource Access Manager (RAM) to share the key with the Organization's member accounts.
  3. Enable drift detection on the CloudFormation StackSet. Create an Amazon EventBridge rule in the delegated administrator DevOps account that triggers when a StackSet drift status changes to DRIFTED, and invokes an AWS Systems Manager Automation workflow to execute the UpdateStackInstances API targeting the drifted account and region to redeploy the baseline template.Answer
  4. D
    Configure a Service Control Policy (SCP) at the Organization root that denies s3:PutBucketPolicy, s3:DeleteBucketPolicy, and ssm:DeleteAssociation for all IAM principals except the AWSCloudFormationStackSetExecutionRole role. Rely on CloudFormation's automatic baseline synchronization feature to overwrite any local changes.
  5. E
    Enable CloudFormation drift detection in each member account. Configure AWS Config to trigger a custom remediation action that deletes the drifted S3 buckets and SSM associations, then runs a local script to re-execute the local CloudFormation stack creation using the default AWS-managed KMS key.
  6. F
    Create a daily AWS Systems Manager State Manager association in the delegated administrator DevOps account. Configure the association to run the AWS-UpdateCloudFormationStack Automation document across all instances in the organization to check for and remediate StackSet drift.

Answer

Update the key policy of the central Customer Managed Key in the Security account to grant the member accounts' StackSet execution roles the necessary KMS permissions, ensure the execution roles have matching IAM permissions, and enable StackSet drift detection integrated with an Amazon EventBridge rule and Systems Manager Automation workflow to trigger stack instance updates.
Resolving the cross-account StackSet deployment failure requires configuring explicit trust on the KMS Customer Managed Key in the Security account to permit the member accounts' execution roles to perform cryptographic operations, backed by local IAM permissions. To automatically detect and remediate drift, enabling StackSet drift detection generates EventBridge events. An EventBridge rule can then trigger a Systems Manager Automation workflow that updates the stack instances in the affected account and region, effectively overwriting manual changes and aligning them back to the baseline.

Step-by-Step Solution

1
Diagnose the S3 bucket creation Access Denied error.
Identify that the baseline template tries to encrypt S3 buckets using a cross-account Customer Managed Key (CMK) without appropriate permissions delegated on both the key policy and IAM sides.
AWS KMS cross-account operations require explicit permission grants in the key policy of the owning account and the IAM policy of the calling account.
2
Establish proper cross-account KMS permissions.
Update the CMK key policy in the Security account to grant access to the StackSet execution role (AWSCloudFormationStackSetExecutionRole) in the member accounts, and configure matching IAM policies for those roles.
This allows the CloudFormation stack execution process in the member accounts to successfully generate data keys and encrypt the S3 buckets during stack deployment.
3
Implement a drift detection mechanism.
Enable drift detection on the baseline CloudFormation StackSet.
Drift detection identifies when local administrators modify stack-managed resources, such as altering S3 bucket policies or deleting Systems Manager associations.
4
Automate drift remediation.
Create an Amazon EventBridge rule that detects the StackSet drift status change to DRIFTED and triggers a Systems Manager Automation document that runs the UpdateStackInstances API against the drifted account and region.
This automatically redeploys the baseline template, overwriting any unauthorized modifications and restoring compliance.

Key Concept

Cross-account AWS KMS key management and automated CloudFormation StackSet drift detection and remediation using Amazon EventBridge and AWS Systems Manager Automation.
Rate this question

Topics

Automating Deployment and Configuration Management