Examkin

Question

Difficulty: MediumAWS Config Rules and Conformance Packs

A SysOps Administrator deploys an AWS Config conformance pack containing a rule that evaluates whether Amazon S3 buckets have public read access enabled. After deployment, the compliance status for the rule remains in the 'No Data Available' state, despite the presence of active S3 buckets in the AWS account. Which of the following troubleshooting actions should the administrator perform to resolve this issue? (Select TWO.)

  1. Verify that the AWS Config configuration recorder is turned on and is configured to record changes for the S3 bucket resource type (AWS::S3::Bucket).Answer
  2. Verify that the S3 bucket designated as the AWS Config delivery channel has a bucket policy that permits AWS Config to write configuration history and snapshot files.Answer
  3. C
    Create an Amazon EventBridge rule to trigger the AWS Config rule evaluation whenever an S3 bucket configuration changes.
  4. D
    Add the iam:PassRole permission to the administrator's IAM policy to allow AWS Config to assume the service-linked role.
  5. E
    Configure the AWS Config delivery channel to send notifications to an Amazon SNS topic with detailed CloudWatch monitoring enabled.

Answer

Verify that the AWS Config configuration recorder is turned on and is configured to record changes for S3 buckets, and verify that the S3 bucket designated as the AWS Config delivery channel has a bucket policy that permits AWS Config to write configuration files.
The correct actions are verifying that the configuration recorder is actively recording S3 buckets and that the delivery channel S3 bucket policy allows AWS Config to write files. Without the configuration recorder actively tracking S3 buckets, AWS Config cannot generate configuration items, which keeps the compliance status in a 'No Data Available' state. Similarly, delivery channel authorization issues halt the pipeline.

Step-by-Step Solution

1
Check the status and scope of the AWS Config configuration recorder.
Confirming the recorder is active and recording the AWS::S3::Bucket resource type.
If the recorder is off or S3 buckets are excluded, AWS Config will not generate configuration items for S3 buckets, resulting in a 'No Data Available' state.
2
Inspect the bucket policy of the S3 bucket used as the AWS Config delivery channel.
Confirming the policy contains the required permissions allowing the AWS Config service principal to write objects.
AWS Config needs permission to write configuration snapshots to the delivery channel bucket to function properly and complete evaluations.

Key Concept

AWS Config rules rely on the configuration recorder and delivery channel configuration to capture resource states before evaluating compliance rules.
Rate this question

Topics

AWS Config Rules and Conformance Packs

More questions from this topic