AWS Certified SysOps Administrator – AssociateSecurity and ComplianceMedium
A company policy mandates that all EC2 instances must be automatically terminated if they are found to be non-compliant with security configurations, such as having an open security group port (e.g., SSH from 0.0.0.0/0). The SysOps administrator needs to implement an automated remediation action without manual intervention. Which combination of AWS services should be used?
- AAWS Trusted Advisor to identify security group misconfigurations and Amazon CloudWatch Alarms to trigger an EC2 auto-scaling policy.
- BAWS Config with a custom rule and an associated Systems Manager Automation document.
- CAmazon GuardDuty to detect non-compliant instances and an AWS Lambda function triggered by GuardDuty findings.
- DAWS Security Hub to aggregate findings and an Amazon EventBridge rule to trigger an AWS Step Functions workflow.
Show answer & explanationAnswer & explanation
Correct answer: B. AWS Config with a custom rule and an associated Systems Manager Automation document.
AWS Config is designed for continuously monitoring and assessing the compliance of AWS resources against desired configurations. A custom Config rule can detect the non-compliant security group. When the rule identifies a non-compliant resource, it can trigger an AWS Systems Manager Automation document to perform the remediation action, such as terminating the EC2 instance, without manual intervention.
Why the other options are wrong
- A. Trusted Advisor provides recommendations and identifies misconfigurations but does not offer automated remediation capabilities. CloudWatch Alarms trigger based on metrics, not configuration compliance, and auto-scaling policies manage instance counts, not individual instance termination based on security compliance.
- C. GuardDuty is a threat detection service, not primarily for continuous configuration compliance. While it might detect suspicious activity related to open ports, Config is the dedicated service for configuration compliance checks.
- D. Security Hub aggregates findings but doesn't perform the initial compliance check or direct remediation. EventBridge and Step Functions could orchestrate remediation, but Config is better for the initial detection of configuration non-compliance.
AWS Config Remediation
AWS Config continuously monitors resource configurations for compliance and can automatically trigger remediation actions using AWS Systems Manager Automation documents.
- Config detects non-compliant resources.
- Rules can be predefined or custom.
- Systems Manager Automation executes remediation.
- Enables automated compliance enforcement.
Memory trick: Config checks, Systems Manager fixes, automatically.