Examkin

Soru

Zorluk: OrtaAutomating Deployment and Configuration Management

A multinational retail company uses a centralized CI/CD pipeline in a Tooling AWS account to deploy and update infrastructure across multiple target accounts in an AWS Organization. The pipeline uses AWS CloudFormation StackSets to deploy standard Amazon EC2 instances and associated security groups. Recently, developers in target accounts have manually modified security group ingress rules to troubleshoot connectivity issues. These manual changes have created security vulnerabilities and caused subsequent CI/CD pipeline updates to fail due to undetected configuration drift. The company needs a solution that prevents manual modifications to resources managed by CloudFormation, ensures that deployment templates are securely shared and accessible cross-account, and automatically alerts the DevOps team if drift is detected. Which solution should the solutions architect implement to meet these requirements?

  1. Store the CloudFormation templates in an S3 bucket in the Tooling account encrypted with a Customer Managed Key (CMK). Configure the CMK key policy and S3 bucket policy to allow read access from the target accounts. Implement a Service Control Policy (SCP) that denies all IAM users and roles in target accounts from modifying resources containing the tag 'aws:cloudformation:stack-name', unless the caller is the CloudFormation service role or the CI/CD pipeline role. Configure AWS Config in the target accounts to run the 'cloudformation-stack-drift-detection-check' rule and send alerts via Amazon SNS.Cevap
  2. B
    Store the CloudFormation templates in an S3 bucket in the Tooling account encrypted with the default AWS-managed KMS key ('aws/s3'). Configure the S3 bucket policy and the target accounts' IAM policies to allow cross-account access to read the templates. Configure AWS Config in the target accounts to monitor security groups and automatically delete any drifted resources to force them back to the template state.
  3. C
    Store the CloudFormation templates in an S3 bucket in the Tooling account encrypted with a Customer Managed Key (CMK). Attach a Service Control Policy (SCP) to the target OUs that explicitly grants read and write permissions to the CI/CD pipeline role and denies modification of security groups for all other roles. Rely on this SCP to grant the necessary deployment permissions in the target accounts without configuring local IAM policies.
  4. D
    Store the CloudFormation templates in an S3 bucket in the Tooling account. Allow developers to modify security groups manually. Configure AWS Config rules in target accounts to detect drift. When drift is detected, trigger an AWS Systems Manager State Manager association to run a script that uses the AWS CLI to force the CloudFormation stack status to 'UPDATE_COMPLETE' in the target account, and then manually run 'aws ec2 authorize-security-group-ingress' to align the configuration.

Cevap

Store templates in an S3 bucket encrypted with a Customer Managed Key (CMK) while sharing it cross-account, use an SCP to deny modifications to resources containing the CloudFormation stack tag unless performed by the deployment roles, and configure AWS Config to detect and alert on stack drift.
The correct option correctly uses a Customer Managed Key (CMK) to allow cross-account access, which is required because default AWS-managed KMS keys do not support key policy modifications for cross-account sharing. It also applies an SCP with a condition on the 'aws:cloudformation:stack-name' tag to prevent manual drift while allowing the deployment roles to perform updates. Finally, it uses the native AWS Config stack drift detection rule for automated compliance monitoring.

Adım Adım Çözüm

1
Select the correct KMS key type for cross-account artifact sharing.
Use a Customer Managed Key (CMK) instead of the default AWS-managed KMS key, since the default key's policy cannot be modified to grant cross-account permissions.
Target accounts need to decrypt and read the CloudFormation templates stored in the Tooling account's S3 bucket.
2
Enforce infrastructure-as-code configuration limits using Service Control Policies (SCPs).
Implement an SCP that denies resource modifications for resources tagged with 'aws:cloudformation:stack-name', with an exception for the CloudFormation service role and the pipeline execution role.
This prevents manual modifications in target accounts that cause configuration drift, while allowing authorized CI/CD deployment roles to update the infrastructure.
3
Configure compliance monitoring and alerting.
Deploy the AWS Config rule 'cloudformation-stack-drift-detection-check' to automatically monitor stack drift and alert via SNS.
This ensures the DevOps team receives immediate notifications when configuration drift is detected, allowing for investigation and remediation.

Anahtar Kavram

Cross-account deployment automation, KMS key sharing constraints, and configuration drift prevention using SCPs and AWS Config.
Bu soruyu puanla

Konular

Automating Deployment and Configuration Management