A company manages a multi-account AWS environment using AWS Organizations. The central platform team maintains shared resources in a shared services account. The team needs to automate the deployment and configuration of a proprietary security agent on Amazon EC2 instances located in multiple production accounts. The agent requires a license key that must be stored securely in the shared services account. The deployment must automatically detect and remediate configuration drift on the production instances. Which two actions must the solutions architect take to meet these requirements? (Select two.)
- Store the license key in AWS Secrets Manager in the shared services account using a Customer Managed Key (CMK), configure the secret's resource-based policy to allow cross-account access, and update the KMS key policy to permit decryption by the production IAM roles.Cevap
- Use AWS CloudFormation StackSets to deploy an AWS Systems Manager State Manager association to the production accounts to install the agent and enforce configuration consistency.Cevap
- CStore the license key in AWS Secrets Manager in the shared services account using the default AWS-managed KMS key for Secrets Manager, and attach an IAM policy to the production instances' roles to permit decryption.
- DDeploy AWS Config rules in the production accounts that continuously monitor the instance operating systems and directly write the correct configuration files to the instances when drift is detected.
- EAttach a Service Control Policy (SCP) to the production Organizational Units (OUs) that permits the production EC2 instances to call the Secrets Manager API operations in the shared services account.
Cevap
Store the license key in AWS Secrets Manager in the shared services account using a Customer Managed Key (CMK) with appropriate cross-account permissions, and use AWS CloudFormation StackSets to deploy a Systems Manager State Manager association to the production accounts to enforce agent configuration consistency.
The correct solution involves storing the license key in AWS Secrets Manager using a Customer Managed Key (CMK), allowing the policies to be modified for cross-account access, and deploying a Systems Manager State Manager association via CloudFormation StackSets to enforce configuration consistency and remediate drift on the production EC2 instances.
Adım Adım Çözüm
Anahtar Kavram
Cross-account resource sharing with KMS encryption and automated drift remediation using Systems Manager State Manager.