Examkin

Soru

Zorluk: OrtaAutomating Deployment and Configuration Management

A company manages a large fleet of Amazon EC2 instances across multiple AWS accounts in an AWS Organization. A recent security audit reveals that several instances are running without a required third-party logging agent, and some instances have had their configurations manually modified after deployment. A Solutions Architect must design an automated, continuous compliance solution to ensure the logging agent is installed, running, and configured identically on all instances, and that any configuration drift is automatically corrected.

Which two of the following actions should the Solutions Architect take to meet these requirements?

  1. Create an AWS Systems Manager State Manager association targeting the target EC2 instances to install and configure the logging agent, and configure it to run on a regular schedule to apply the desired configuration state.Cevap
  2. Configure an AWS Config rule across all accounts to check for the presence of the logging agent, and associate the rule with an AWS Systems Manager Automation runbook as a remediation action to install the agent when non-compliance is detected.Cevap
  3. C
    Deploy a CloudFormation StackSet across all accounts to install the logging agent, and configure an AWS Lambda function triggered by CloudFormation drift detection events to execute SSH commands on the instances to remediate OS-level drift.
  4. D
    Use AWS Systems Manager Distributor to deploy the logging agent packages encrypted with the AWS-managed KMS key (aws/ssm), and configure cross-account sharing of this key to all member accounts.
  5. E
    Apply a Service Control Policy (SCP) at the root of the AWS Organization that blocks users from stopping the logging agent service within the EC2 instance operating systems.

Cevap

Create an AWS Systems Manager State Manager association to install the agent and run on a schedule, and configure an AWS Config rule with an AWS Systems Manager Automation runbook as a remediation action.
The solution requires enforcing OS-level compliance and remediating changes. AWS Systems Manager State Manager is designed to enforce OS configurations on a schedule, correcting manual alterations. Additionally, an AWS Config rule can monitor compliance and initiate remediation via an AWS Systems Manager Automation runbook, satisfying both requirements securely and natively.

Adım Adım Çözüm

1
Enforce the desired operating system configuration state.
An AWS Systems Manager State Manager association is created to install and configure the logging agent on a regular schedule.
This automatically overwrites any manual modifications made to the agent or its configuration directly inside the OS.
2
Monitor compliance and configure automatic remediation.
An AWS Config rule is configured to audit the presence of the agent, backed by an AWS Systems Manager Automation runbook.
If an instance drifts or is deployed without the agent, AWS Config flags it as non-compliant and triggers the SSM runbook to install the agent automatically.

Anahtar Kavram

Automating operating system configuration compliance, drift detection, and remediation using AWS Systems Manager and AWS Config.
Bu soruyu puanla

Konular

Automating Deployment and Configuration Management