AWS Certified Advanced Networking – Specialty (ANS-C01)Network Management and OperationsMedium
A security engineer needs to ensure that all network configuration changes across multiple AWS accounts and Regions are audited and can be reverted if necessary. The solution should provide a centralized view of changes and prevent unauthorized modifications to critical network resources like VPCs, subnets, and route tables. Which AWS service combination should be used?
- AAmazon CloudWatch with AWS CloudFormation
- BAWS Control Tower with Service Catalog
- CAWS Systems Manager with AWS Organizations
- DAWS Config with AWS CloudTrail
Show answer & explanationAnswer & explanation
Correct answer: D. AWS Config with AWS CloudTrail
AWS Config tracks configuration changes to resources and evaluates them against desired configurations, enabling change auditing and compliance. AWS CloudTrail records API calls and events, providing a historical record of who did what, when, and from where, which is crucial for auditing and identifying unauthorized changes. Together, they provide comprehensive change management and audit capabilities.
Why the other options are wrong
- A. CloudWatch is for monitoring and logging, and CloudFormation is for infrastructure as code, which can prevent drift but doesn't inherently audit all manual changes or provide a historical change timeline.
- B. Control Tower sets up a secure multi-account environment, and Service Catalog allows users to provision approved products, but they don't directly track and audit network configuration changes in detail.
- C. Systems Manager helps manage instances and automate tasks, and Organizations helps manage multiple AWS accounts, but neither is primarily focused on auditing network configuration changes.
AWS Configuration and Audit
AWS Config and CloudTrail are foundational services for auditing configuration changes, ensuring compliance, and providing a historical record of actions taken on AWS resources.
- AWS Config records resource configurations and changes over time.
- CloudTrail logs API calls and events for auditing actions.
- Used together for comprehensive governance, compliance, and security.
Memory trick: To 'config'ure and 'trail' changes, use 'Config' and 'CloudTrail'.