Examkin

Question

Difficulty: MediumEventBridge and Systems Manager Remediation

A company is using AWS Config to monitor security compliance. A SysOps administrator needs to automate the remediation of publicly accessible Amazon Redshift clusters. The administrator has verified that the AWS Config rule redshift-cluster-public-access-check is active. An AWS Systems Manager Automation document named AWS-RevokeRedshiftClusterPublicAccess will be used to remediate non-compliant clusters.

Which two configuration actions must the SysOps administrator perform to establish this automated remediation pipeline? (Select TWO.)

  1. Create an Amazon EventBridge rule that triggers when an AWS Config Rules compliance change event has a complianceType of NON_COMPLIANT for the redshift-cluster-public-access-check rule.Answer
  2. Configure the Systems Manager Automation document as the target for the EventBridge rule, specifying an IAM role that grants EventBridge permission to start the automation.Answer
  3. C
    Create an Amazon EventBridge rule that triggers when a CloudWatch metric alarm for Redshift public access goes into the ALARM state, using an input transformer to extract the cluster identifier.
  4. D
    Configure an AWS Systems Manager State Manager association to query AWS Config compliance status hourly and invoke the Automation document on non-compliant clusters.
  5. E
    Attach an IAM policy to the AWS Config service role that allows sts:AssumeRole to directly execute the Systems Manager Automation document without using EventBridge.

Answer

Create an EventBridge rule that triggers on AWS Config non-compliant compliance change events, and target the Systems Manager Automation document using an IAM role that grants EventBridge permission to execute the automation.
To automate compliance remediation, an Amazon EventBridge rule must be configured to capture compliance status changes from AWS Config. When the Config rule for Redshift public access evaluates a resource as non-compliant, it generates a 'Config Rules Compliance Change' event with a complianceType of NON_COMPLIANT. The EventBridge rule matches this event pattern. The target of this EventBridge rule must be the Systems Manager Automation document. To invoke this target, EventBridge requires an IAM service role with permission to execute the automation document, which is specified when setting up the target.

Step-by-Step Solution

1
Define an Amazon EventBridge rule pattern that filters for 'Config Rules Compliance Change' events originating from the source 'aws.config'.
The rule will capture compliance state transitions for the redshift-cluster-public-access-check rule.
This ensures the remediation workflow is only initiated when a Redshift cluster is evaluated as NON_COMPLIANT.
2
Configure the rule's event pattern to match only compliance updates where detail.newEvaluationResult.complianceType is set to NON_COMPLIANT.
The EventBridge rule will ignore COMPLIANT state updates and only execute for non-compliant resources.
This prevents unnecessary executions of the remediation automation.
3
Set the target of the EventBridge rule to the Systems Manager Automation document AWS-RevokeRedshiftClusterPublicAccess, and select or create an IAM role for the target that allows ssm:StartAutomationExecution.
EventBridge will have the required permission to invoke the Automation document on the non-compliant resource.
By default, AWS services cannot access resources in your account without an IAM role granting explicit execution permissions.

Key Concept

Event-driven remediation using AWS Config compliance events, Amazon EventBridge rules, and AWS Systems Manager Automation.
Rate this question

Topics

EventBridge and Systems Manager Remediation

More questions from this topic