Examkin

Question

Difficulty: MediumAWS Config Rules and Conformance Packs

A SysOps Administrator is configuring compliance monitoring for Amazon EC2 security groups. The administrator deploys the restricted-common-ports AWS Config rule to detect security groups that allow unrestricted ingress to common ports. The administrator wants to configure automated remediation to automatically revoke the non-compliant ingress rules using the AWS-DisablePublicAccessForSecurityGroup Systems Manager (SSM) Automation document. The administrator creates an Amazon EventBridge rule to detect when a security group changes to a non-compliant state and configures it to trigger the SSM Automation document directly. However, the automation fails to execute because the target configuration is not passing the specific security group ID from the event payload to the SSM document. How can the administrator resolve this issue with the least administrative effort?

  1. Configure the remediation action directly within the AWS Config rule, selecting the Systems Manager Automation document and mapping the security group ID parameter to the AWS Config Resource ID.Answer
  2. B
    Configure the EventBridge rule to target the AWS Config remediation action, and configure the target's input path to point to the Config rule's execution context.
  3. C
    Add the iam:PassRole permission to the AWS Config service-linked role, and update the EventBridge rule target to pass the role's Amazon Resource Name (ARN) in the input payload.
  4. D
    Create a custom AWS Config rule that triggers an Amazon SNS topic, and subscribe the Systems Manager Automation document to the SNS topic to automatically parse the security group ID.

Answer

Configure the remediation action directly within the AWS Config rule, selecting the Systems Manager Automation document and mapping the security group ID parameter to the AWS Config Resource ID.
The correct option is to configure remediation natively within the AWS Config rule itself. AWS Config has direct integration with AWS Systems Manager (SSM) Automation. By setting up remediation on the Config rule and mapping the required parameter (the security group ID) to the resource ID evaluated by Config, AWS Config will automatically pass the correct security group ID when a non-compliant resource is evaluated, without requiring any complex EventBridge configuration.

Step-by-Step Solution

1
Open the AWS Config console and select the restricted-common-ports Config rule.
Access the configuration page for the specific rule.
Remediation settings are managed at the individual rule level within AWS Config.
2
Choose to edit remediation settings, select AWS Systems Manager Automation as the remediation action, and select the AWS-DisablePublicAccessForSecurityGroup document.
The target document is associated with the rule.
This sets up the remediation action to be executed when a resource is evaluated as non-compliant.
3
Under the resource ID parameter mapping, map the security group ID parameter of the Systems Manager document to the AWS Config Resource ID.
The non-compliant resource's ID will be dynamically passed to the Systems Manager Automation document at execution time.
AWS Config automatically passes the ID of the non-compliant resource to the mapped parameter, eliminating the need for EventBridge input transformers.

Key Concept

AWS Config rules support native, automated remediation using AWS Systems Manager Automation documents, where the non-compliant resource's ID can be mapped directly to the SSM document's input parameters without requiring external EventBridge routing configurations.
Estimated Time:1m 30s
Rate this question

Topics

AWS Config Rules and Conformance Packs

More questions from this topic