Examkin

Soru

Zorluk: ZorAWS Config Rules and Conformance Packs

An organization uses AWS Config Conformance Packs to evaluate Amazon EBS volume encryption compliance across multiple AWS Regions. After deploying the conformance pack, a SysOps Administrator notices that for one specific region, the AWS Config rules show a compliance status of 'No data available' for all EBS volumes, even though several volumes are present in that region. The conformance pack deployment status itself is 'Completed' in the region.

Which two options would explain why the rules are not evaluating the EBS volumes? (Select TWO.)

  1. The AWS Config configuration recorder in the target region is not configured to record the AWS::EC2::Volume resource type.Cevap
  2. The AWS Config configuration recorder is not started (active) in the target region.Cevap
  3. C
    The AWS Config delivery channel in the target region has an invalid S3 bucket policy that prevents the delivery of configuration history files.
  4. D
    The IAM role assigned to AWS Config in the target region lacks the iam:PassRole permission required to execute the conformance pack rules.
  5. E
    An Amazon EventBridge rule is missing in the target region to trigger the AWS Config rules when a configuration change occurs on the EBS volumes.

Cevap

The correct answers are that the AWS Config configuration recorder in the target region is not configured to record the AWS::EC2::Volume resource type, and the configuration recorder is not started (active) in the target region.
The correct options represent the two fundamental requirements for AWS Config to perform rule evaluations on resources. First, the configuration recorder must be active (started) in the target region. Second, the configuration recorder must be configured to record the specific resource type being evaluated (in this case, EBS volumes, represented by AWS::EC2::Volume). If either requirement is not met, AWS Config will not generate configuration items for those resources, and the rules will show a compliance status of 'No data available'.

Adım Adım Çözüm

1
Analyze the symptom.
The conformance pack template successfully deployed ('Completed'), meaning the rules exist in the region, but they display 'No data available' for existing EBS volumes.
This isolates the issue from template syntax errors or deployment failures, pointing to rule evaluation execution issues.
2
Examine rule evaluation mechanics.
AWS Config rules require configuration items (CIs) captured by the configuration recorder to perform compliance evaluations.
Understanding that rules do not query resources directly; they rely on the recording history database generated by the configuration recorder.
3
Identify recording scope and state prerequisites.
If the configuration recorder is stopped or is not configured to record AWS::EC2::Volume resource types, no CIs will be generated for evaluations to run.
This establishes that both the running state of the recorder and the resource inclusion list are critical prerequisites for rule evaluation.
4
Evaluate the distractors.
Delivery channel configuration issues, missing EventBridge rules, and iam:PassRole permissions do not cause rule evaluation to result in 'No data available'.
This confirms that the other options represent different parts of the configuration lifecycle (delivery, automated remediation, event routing) and are not execution dependencies for Config rules.

Anahtar Kavram

AWS Config Rule Evaluation Prerequisites
Bu soruyu puanla

Konular

AWS Config Rules and Conformance Packs

Bu konudan daha fazla soru