A financial services corporation uses AWS Organizations to manage a multi-account environment. A security audit reveals that several development teams have temporarily modified Network Access Control Lists (NACLs) to allow public inbound traffic () on database ports (such as and ), violating compliance mandates. The security team requires a solution that continuously monitors all accounts, automatically reverts any unauthorized public NACL rules within minutes of creation, and aggregates these compliance findings into a central security account for audit reporting. Which solution meets these security and compliance requirements with the lowest operational overhead?
- AConfigure AWS CloudTrail across all accounts to log API events. Create an Amazon EventBridge rule that detects CreateNetworkAclEntry calls and invokes an AWS Lambda function. The function retrieves the compliance baseline configurations stored as plaintext parameters in AWS Systems Manager Parameter Store, compares them, and reverts unauthorized changes.
- Configure AWS Config in all member accounts and deploy an AWS Organizations conformance pack containing a custom Config rule that checks NACL rules. Link the Config rule to an AWS Systems Manager (SSM) Automation runbook as a remediation action to delete non-compliant inbound entries. Direct the Config findings to a delegated administrator AWS Security Hub account.Cevap
- CEnable VPC Flow Logs in all accounts and stream them to a centralized Amazon CloudWatch Logs log group. Set up a metric filter that triggers an AWS Lambda function to modify the Security Groups at the subnet level to block database ports, and send alerts to AWS Security Hub.
- DDeploy AWS Shield Advanced on all VPC routers and configure AWS WAF rules to inspect all subnet-level traffic. Configure a WAF rule to block unauthorized public inbound database connections at the subnet boundary and trigger an AWS Lambda function to update the route tables.
Cevap
The correct solution uses AWS Config in all member accounts, deployed via an AWS Organizations conformance pack, to run a Config rule evaluating NACL configurations. When non-compliant resources are found, an AWS Systems Manager Automation runbook is natively invoked as a remediation action to revert the NACL rule, and all findings are consolidated into the delegated administrator AWS Security Hub account.
The correct solution leverages AWS Config to monitor configuration changes in near real-time. By deploying an AWS Organizations conformance pack, the security rule and its remediation configuration are uniformly distributed across all member accounts. The AWS Systems Manager Automation runbook provides a low-overhead, native method to automatically revert unauthorized changes to Network Access Control Lists (NACLs). Aggregating findings into a delegated administrator account for AWS Security Hub allows the security team to centralize and visualize compliance violations without managing complex custom code.
Adım Adım Çözüm
Anahtar Kavram
AWS Config Rule Remediation and Multi-Account Security Centralization
Tahmini Süre:3m 0s