Examkin

Soru

Zorluk: ZorAutomating Deployment and Configuration Management

A financial services firm utilizes AWS Organizations to manage a multi-account environment. A central tooling account hosts an AWS CodePipeline that deploys infrastructure updates using AWS CloudFormation StackSets to multiple member accounts. Security audits have highlighted two major issues:

1. When the pipeline runs, member accounts fail to retrieve the CloudFormation template artifacts from the central Amazon S3 bucket in the tooling account because the bucket is encrypted using an AWS Key Management Service (AWS KMS) key.
2. Developers are making manual modifications (such as changing security group rules and EC2 instance types) directly in the member accounts, resulting in configuration drift that is not captured by the central templates.

Which of the following actions should a Solutions Architect implement to resolve the cross-account pipeline failures and establish automated drift detection? (Select TWO.)

  1. Encrypt the central S3 bucket using an AWS KMS Customer Managed Key (CMK) in the tooling account, and configure its key policy to grant the StackSet execution role in the member accounts permissions for the kms:Decrypt and kms:GenerateDataKey actions, while updating the S3 bucket policy to allow cross-account read access.Cevap
  2. Deploy the cloudformation-stack-drift-detection-check AWS Config rule across all member accounts using an AWS Organizations conformance pack, and configure an Amazon EventBridge rule in each member account to detect non-compliant events and trigger an AWS Systems Manager Automation runbook that runs drift detection.Cevap
  3. C
    Encrypt the central S3 bucket using the default AWS-managed KMS key for Amazon S3 (aws/s3) in the tooling account, and configure the bucket policy to grant read access to the IAM execution roles in the member accounts.
  4. D
    Attach a Service Control Policy (SCP) to the member accounts' Organizational Unit (OU) that grants kms:Decrypt and kms:GenerateDataKey permissions on the tooling account's KMS key to all principals in the organization.
  5. E
    Configure the StackSets deployment options to automatically override local resource states during pipeline execution by using the CloudFormation console to manually import drifted resources back into each individual stack before running the deployment.

Cevap

Encrypt the central S3 bucket using a Customer Managed Key (CMK) with appropriate key and S3 bucket policies to allow cross-account access, and deploy the cloudformation-stack-drift-detection-check AWS Config rule via Organizations conformance packs to trigger drift alerting through EventBridge and Systems Manager.
Resolving cross-account decryption requires using a Customer Managed Key (CMK) in the tooling account because its key policy can be modified to trust external member account roles. The S3 bucket policy must also explicitly allow read access to the member accounts. Automated drift detection is best achieved centrally using AWS Config conformance packs across the Organization, allowing individual member accounts to flag deviations and trigger automated event workflows via Systems Manager Automation.

Adım Adım Çözüm

1
Address the cross-account encryption requirements.
Transition the S3 bucket encryption from an AWS-managed key to a Customer Managed Key (CMK) in the tooling account.
AWS-managed keys (aws/s3) cannot be shared across different accounts because their key policies cannot be modified to trust external accounts.
2
Configure permissions for the S3 bucket and the CMK.
Grant the StackSet execution role in the member accounts permission to decrypt and generate data keys in the CMK policy, and allow read access in the S3 bucket policy.
For cross-account access to encrypted S3 objects, the accessing principal needs permissions granted in both the destination account (via the KMS key policy and S3 bucket policy) and local IAM policies.
3
Set up automated configuration monitoring.
Deploy the AWS Config rule cloudformation-stack-drift-detection-check to all accounts in the organization via conformance packs.
Using Organization-level conformance packs ensures that every member account automatically conforms to compliance monitoring standards.
4
Automate notifications and drift handling.
Set up Amazon EventBridge rules to target NON_COMPLIANT events from the Config rule, directing them to Systems Manager Automation.
This establishes a hands-free alerting and remediation trigger when resource drift occurs.

Anahtar Kavram

Cross-account KMS authorization patterns combined with multi-account AWS Config compliance automation.
Bu soruyu puanla

Konular

Automating Deployment and Configuration Management