A logistics company manages a multi-account environment using AWS Organizations. The central Operations team must enforce a security patch compliance baseline across all Amazon EC2 instances in all member accounts. The patches must be installed during weekly maintenance windows using AWS Systems Manager Patch Manager. The Operations team wants to:
1. Aggregate patch compliance data from all member accounts into a central Amazon S3 bucket in a Security account.
2. Automate the quarantine of any EC2 instance that is flagged as non-compliant by changing its attached security group.
3. Secure the S3 bucket using encryption with a Customer Managed Key (CMK) stored in the Security account, while preventing local administrators in member accounts from altering the Patch Manager configuration.
Which combination of actions will meet these requirements? (Select two.)
- Create an AWS Systems Manager Resource Data Sync in each member account to aggregate compliance and inventory data into the central Amazon S3 bucket. Configure the KMS Customer Managed Key (CMK) policy in the Security account to grant kms:GenerateDataKey* and kms:Decrypt permissions to the member account IAM roles.Cevap
- Deploy an AWS Config organizational rule to evaluate patch compliance across all accounts. Associate the rule with an AWS Systems Manager Automation runbook that removes existing security groups and applies a restrictive quarantine security group to instances identified as non-compliant.Cevap
- CConfigure Resource Data Sync in all member accounts using the default AWS-managed KMS key (aws/s3) of the Security account, and modify the key policy of the AWS-managed key to allow cross-account access from the member accounts.
- DAttach a Service Control Policy (SCP) at the Organization root that explicitly allows the ssm:CreateResourceDataSync and ssm:PutComplianceItems actions to automatically grant these permissions to all member account IAM users and roles.
- EConfigure AWS CodePipeline to monitor the S3 compliance data and trigger an automated linear deployment rollback to replace non-compliant EC2 instances with the previous week's Amazon Machine Image (AMI).