An enterprise manages its multi-account environment using AWS Organizations. The central platform team uses AWS CloudFormation StackSets to deploy standardized security groups and Amazon EC2 instances from a central administrative account into multiple member accounts. The deployment artifacts and templates are stored in an Amazon S3 bucket within the administrative account.
A security audit identifies two main issues:
1. Authorized users in member accounts are manually modifying the security group rules and disabling mandatory OS-level security agents on the EC2 instances, creating configuration drift.
2. Attempts to update the StackSet to deploy new versions fail in several member accounts because the member accounts' CloudFormation execution roles are denied access to the S3 bucket and cannot decrypt the deployment artifacts.
The solutions architect must implement an automated configuration management strategy that remediates drift on security groups and EC2 instances, and ensures that cross-account StackSet updates succeed.
Which combination of actions should the solutions architect take to meet these requirements?
- Configure AWS Config in the member accounts with a managed rule to monitor the security groups, and associate an AWS Systems Manager (SSM) Automation document to automatically revert unauthorized modifications. Set up an SSM State Manager association targeting the EC2 instances to continuously enforce the OS-level security agent configuration. Update the S3 bucket policy in the administrative account to allow read access from the member accounts, and encrypt the bucket using a KMS Customer Managed Key (CMK) with a key policy that grants the member accounts' roles permission to use the key.Cevap
- BEnable AWS CloudFormation drift detection on the StackSets, and configure an Amazon EventBridge rule that triggers an AWS Lambda function to redeploy the drifted stacks in the target accounts. Enable default S3 encryption on the administrative account's S3 bucket using the AWS managed key (aws/s3), and attach a Service Control Policy (SCP) at the Organization root that allows the member account roles to perform KMS decryption operations on the AWS managed key.
- CConfigure an AWS Systems Manager State Manager association to run an Ansible playbook every hour that directly overwrites both the security group rules and the OS-level EC2 configurations. To resolve the cross-account deployment failures, use AWS Resource Access Manager (RAM) to share the administrative S3 bucket with the organization, and configure CloudFormation to use the default AWS managed S3 key for object decryption during stack execution.
- DAttach a Service Control Policy (SCP) to the member accounts' Organizational Unit (OU) that explicitly denies member account IAM roles the ability to modify security groups or EC2 settings, assuming this provides the necessary permissions to secure the configurations. To resolve the deployment issues, create a cross-account IAM role in the administrative account that the member accounts' CloudFormation service roles can assume to download and decrypt the templates.