A SysOps Administrator deploys an AWS Config conformance pack containing a rule that evaluates whether Amazon S3 buckets have public read access enabled. After deployment, the compliance status for the rule remains in the 'No Data Available' state, despite the presence of active S3 buckets in the AWS account. Which of the following troubleshooting actions should the administrator perform to resolve this issue? (Select TWO.)
- Verify that the AWS Config configuration recorder is turned on and is configured to record changes for the S3 bucket resource type (AWS::S3::Bucket).Cevap
- Verify that the S3 bucket designated as the AWS Config delivery channel has a bucket policy that permits AWS Config to write configuration history and snapshot files.Cevap
- CCreate an Amazon EventBridge rule to trigger the AWS Config rule evaluation whenever an S3 bucket configuration changes.
- DAdd the iam:PassRole permission to the administrator's IAM policy to allow AWS Config to assume the service-linked role.
- EConfigure the AWS Config delivery channel to send notifications to an Amazon SNS topic with detailed CloudWatch monitoring enabled.
Cevap
Verify that the AWS Config configuration recorder is turned on and is configured to record changes for S3 buckets, and verify that the S3 bucket designated as the AWS Config delivery channel has a bucket policy that permits AWS Config to write configuration files.
The correct actions are verifying that the configuration recorder is actively recording S3 buckets and that the delivery channel S3 bucket policy allows AWS Config to write files. Without the configuration recorder actively tracking S3 buckets, AWS Config cannot generate configuration items, which keeps the compliance status in a 'No Data Available' state. Similarly, delivery channel authorization issues halt the pipeline.
Adım Adım Çözüm
Anahtar Kavram
AWS Config rules rely on the configuration recorder and delivery channel configuration to capture resource states before evaluating compliance rules.