Examkin

Soru

Zorluk: ZorAutomating Deployment and Configuration Management

A global financial enterprise manages a multi-account environment using AWS Organizations. The central security team mandates that a security monitoring agent must run continuously on all Amazon EC2 instances across all member accounts. The installation and configuration of this agent are automated using AWS Systems Manager State Manager associations. Recently, the security team discovered that local administrators in several member accounts have manually disabled the Systems Manager agent on their instances or deleted the State Manager associations to bypass monitoring. A solutions architect must design an automated solution to detect and remediate this configuration drift while restricting member accounts from tampering with the security configurations. Which TWO actions should the solutions architect take to meet these requirements? (Select TWO.)

  1. Deploy a Service Control Policy (SCP) at the organization root level that denies the actions ssm:DeleteAssociation, ssm:UpdateAssociation, and ssm:CreateAssociation unless the principal is the central security administration role.Cevap
  2. Deploy an AWS Config organization rule using the systems-manager-association-compliance-status managed rule, and configure an AWS Systems Manager Automation runbook as the remediation target to reapply the association and restart the Systems Manager agent.Cevap
  3. C
    Store the Systems Manager State Manager configurations in a centralized Amazon S3 bucket encrypted with the AWS-managed KMS key (aws/s3), and modify the key policy to allow cross-account decryption permissions for member account IAM roles.
  4. D
    Attach a Service Control Policy (SCP) to the member account Organizational Units (OUs) that explicitly allows the AmazonSSMManagedInstanceCore role permissions to execute State Manager documents, bypassing the need for local IAM role configurations.
  5. E
    Instruct member account administrators to manually re-run the CloudFormation templates in the local console to remediate any configuration drift detected, ensuring they perform a rolling update to avoid downtime.
  6. F
    Configure an AWS CodeDeploy deployment group with a Canary 10% 5 Minutes deployment strategy to redeploy the State Manager configuration, and set up a CloudWatch alarm to trigger a rollback if any instance agent becomes inactive.

Cevap

Deploy a Service Control Policy (SCP) at the organization root level that denies the actions ssm:DeleteAssociation, ssm:UpdateAssociation, and ssm:CreateAssociation unless the principal is the central security administration role; and deploy an AWS Config organization rule using the systems-manager-association-compliance-status managed rule, and configure an AWS Systems Manager Automation runbook as the remediation target to reapply the association and restart the Systems Manager agent.
The correct options implement a robust control loop for security configurations. Denying association changes via an SCP enforces organizational boundaries, ensuring local admins cannot modify security settings. Concurrently, using the AWS Config organization rule 'systems-manager-association-compliance-status' paired with an SSM Automation runbook provides automated detection and remediation of configuration drift at the OS level.

Adım Adım Çözüm

1
Evaluate access control mechanisms to prevent local modifications of Systems Manager State Manager associations.
Identify that a Service Control Policy (SCP) attached to the organization root can restrict member accounts from executing ssm:DeleteAssociation, ssm:UpdateAssociation, or ssm:CreateAssociation, while allowing the central team to manage configurations.
This guarantees that member account administrators cannot disable or alter the State Manager security baselines.
2
Determine the optimal drift detection and automated remediation strategy for a multi-account organization.
Use AWS Config organization rules, specifically the systems-manager-association-compliance-status managed rule, to monitor compliance status across all accounts.
AWS Config organization rules centralize compliance reporting and trigger automatic remediations at scale.
3
Configure the automated remediation action using AWS Systems Manager.
Link the AWS Config rule to an AWS Systems Manager Automation runbook that targets the non-compliant EC2 instances to restart the agent and reapply the association.
SSM Automation runbooks are the native and scalable mechanism for executing remediation scripts in response to AWS Config non-compliance findings.

Anahtar Kavram

Automated Drift Detection and Remediation in Multi-Account Governance
Tahmini Süre:3m 0s
Bu soruyu puanla

Konular

Automating Deployment and Configuration Management