Examkin

Soru

Zorluk: Çok zorAutomating Deployment and Configuration Management

A financial services company manages its infrastructure across multiple AWS accounts within an AWS Organization. A central operations account is used to deploy and manage a standardized baseline of VPC security groups across all member accounts using AWS CloudFormation StackSets. The templates are stored in an Amazon S3 bucket in the operations account, which is encrypted using an AWS KMS key. The security policy requires that any manual modifications to these managed security groups in the member accounts must be automatically detected and remediated within one hour. Additionally, updates to the security group baseline templates must be rolled out incrementally; if a deployment fails in any single member account, the rollout must stop immediately and the affected account must be rolled back, without impacting other compliant accounts. Which combination of actions will meet these requirements in the most secure and automated manner?

  1. Encrypt the S3 bucket using a Customer Managed Key (CMK) and configure its key policy to allow cross-account access for the member accounts. Deploy the AWS Config managed rule 'cloudformation-stack-drift-detection-check' across all member accounts using an organization conformance pack. In the operations account, configure an Amazon EventBridge rule that triggers on compliance status change events from an AWS Config aggregator. Set the rule target to an AWS Systems Manager Automation document that executes the 'UpdateStackInstances' API with deployment targeting parameters set to the specific drifted account and region. During template updates, set the StackSet deployment preferences FailureToleranceCount to 0 and MaxConcurrentCount to 1.Cevap
  2. B
    Encrypt the S3 bucket using the default AWS-managed key for Amazon S3 (aws/s3). Deploy the AWS Config managed rule 'cloudformation-stack-drift-detection-check' in each member account. Configure an Amazon EventBridge rule in each member account that triggers a local AWS Lambda function to delete the drifted security groups and recreate them via the AWS CLI. During template updates, configure the StackSet deployment preferences to use an AWS CodeDeploy linear canary deployment strategy with dynamic rollback alarms.
  3. C
    Encrypt the S3 bucket using a Customer Managed Key (CMK) and configure its key policy to allow cross-account access. Attach a Service Control Policy (SCP) to the root of the AWS Organization that denies the 'ec2:AuthorizeSecurityGroupIngress' and 'ec2:RevokeSecurityGroupIngress' actions for all IAM roles except for the CloudFormation service-linked role. Use an AWS Config rule to monitor the configuration. During template updates, deploy the StackSets with a FailureToleranceCount of 0 and a MaxConcurrentCount of 100% to ensure simultaneous updates and rapid validation.
  4. D
    Encrypt the S3 bucket using a Customer Managed Key (CMK) and configure its key policy to allow cross-account access. Configure AWS CloudFormation drift detection at the StackSet level and set up an AWS Systems Manager State Manager association to trigger drift detection daily. If drift is detected, configure the automation to run the 'DeleteStackInstances' API for the drifted account and region, followed by 'CreateStackInstances' to recreate them. During template updates, set the StackSet deployment preferences FailureToleranceCount to 5 and MaxConcurrentCount to 1.

Cevap

Encrypt the S3 template bucket using a KMS Customer Managed Key with cross-account access. Use AWS Config Conformance Packs to deploy stack drift detection rules. Aggregate compliance events using an AWS Config aggregator, and use an EventBridge rule to trigger an AWS Systems Manager Automation document that runs the UpdateStackInstances API. Set the StackSet deployment preferences FailureToleranceCount to 0 and MaxConcurrentCount to 1.
The correct solution uses a Customer Managed Key (CMK) with appropriate key policies to allow cross-account access, which is a prerequisite for cross-account S3 template reading. Auto-remediation is accomplished via AWS Config drift detection rules deployed through conformance packs, which centralize drift alerts via an aggregator. Amazon EventBridge catches these events and triggers a Systems Manager Automation run of the UpdateStackInstances API, which safely reconciles the drift. Setting FailureToleranceCount to 0 and MaxConcurrentCount to 1 guarantees that updates are applied sequentially and halt immediately upon a single failure, ensuring safe deployments.

Adım Adım Çözüm

1
Configure a KMS Customer Managed Key (CMK) with a key policy allowing cross-account decryption for member account roles.
Member accounts can successfully read and decrypt CloudFormation templates stored in the centralized Amazon S3 bucket.
AWS-managed KMS keys (like aws/s3) cannot be shared cross-account, so a Customer Managed Key is required.
2
Deploy the 'cloudformation-stack-drift-detection-check' managed rule to all member accounts using an AWS Config Organization Conformance Pack.
AWS Config automatically monitors CloudFormation stacks in all member accounts for configuration drift.
This detects manual changes to the security groups managed by CloudFormation within the required time window.
3
Set up an AWS Config aggregator in the central operations account, and configure an Amazon EventBridge rule that triggers on compliance change events.
Events indicating a stack has transitioned to a NON_COMPLIANT state are captured centrally.
Centralizing events allows a unified automation point for remediation across the organization.
4
Direct the EventBridge rule to target an SSM Automation document that executes the 'UpdateStackInstances' API with targeting parameters for the drifted account and region.
CloudFormation automatically updates the specific stack instance, overwriting manual drift and restoring the configuration baseline.
This automates the remediation back to the template state without deleting the resources or disrupting their associations.
5
For template updates, configure StackSet deployment preferences with FailureToleranceCount set to 0 and MaxConcurrentCount set to 1.
Updates are deployed to one account at a time. If any single deployment fails, the entire operation halts immediately.
This prevents failed updates from cascading to other accounts and meets the strict rollback requirement.

Anahtar Kavram

Multi-account configuration drift detection, cross-account KMS resource access, and safe AWS CloudFormation StackSets deployment policies.
Tahmini Süre:3m 0s
Bu soruyu puanla

Konular

Automating Deployment and Configuration Management