A company manages its multi-account environment using AWS Organizations. A central DevOps account contains an AWS CodePipeline pipeline that deploys application infrastructure to multiple production target accounts using AWS CloudFormation StackSets. The pipeline stores its build artifacts in an Amazon S3 bucket within the DevOps account. During a deployment, target accounts are unable to retrieve artifacts from the S3 bucket. Additionally, security audits reveal that local administrators in target accounts are manually modifying security groups, causing configuration drift and subsequent deployment failures.
Which of the following actions should the Solutions Architect take to resolve the artifact access issue and automatically remediate the configuration drift? (Select TWO.)
- Configure an AWS Key Management Service (AWS KMS) Customer Managed Key to encrypt the S3 artifact bucket, and update the key policy to allow the deployment roles in the target accounts to decrypt artifacts.Cevap
- Deploy an AWS Config rule across all target accounts using AWS Organizations conformance packs to monitor security group configurations, and associate an AWS Systems Manager (SSM) Automation runbook to automatically revert unauthorized changes.Cevap
- CEnable default encryption on the S3 artifact bucket using the AWS-managed KMS key (aws/s3), and attach a bucket policy that grants cross-account read access to the target account IAM roles.
- DAttach a Service Control Policy (SCP) to the target accounts' Organization Unit (OU) that explicitly grants read permissions for the DevOps S3 bucket to bypass local IAM policy checks in the target accounts.
- EConfigure the CloudFormation StackSet deployment parameters with the IgnoreDrift flag enabled to automatically overwrite manual modifications in target accounts without triggering rollbacks.