AWS Certified SysOps Administrator – AssociateMonitoring, Logging, and RemediationMedium
A SysOps administrator needs to ensure that all Amazon S3 buckets containing sensitive customer data are encrypted at rest. If a new bucket is created without encryption, the administrator wants it to be automatically remediated to enforce encryption. Which AWS service combination should be used to achieve this auto-remediation?
- AAWS Security Hub and AWS Systems Manager Automation
- BAWS CloudTrail and Amazon EventBridge
- CAmazon S3 Event Notifications and AWS Lambda
- DAWS Config, AWS Lambda, and Amazon EventBridge
Show answer & explanationAnswer & explanation
Correct answer: D. AWS Config, AWS Lambda, and Amazon EventBridge
AWS Config can monitor S3 buckets for compliance with an encryption rule. If a non-compliant bucket is detected, AWS Config can trigger an EventBridge event. This EventBridge event can then invoke an AWS Lambda function to automatically apply the necessary encryption configuration to the S3 bucket, thus achieving auto-remediation.
Why the other options are wrong
- A. Security Hub aggregates findings and provides security posture management, and Systems Manager Automation can perform actions, but Config is the core service for detecting resource configuration non-compliance to trigger this specific type of auto-remediation.
- B. CloudTrail records API calls, and EventBridge can react to them, but CloudTrail doesn't directly assess resource compliance or trigger remediation actions for non-compliant resources.
- C. S3 Event Notifications are for object-level events (e.g., PUT, DELETE) within a bucket, not for detecting bucket configuration compliance and remediating the bucket itself.
AWS Config Auto-Remediation
A mechanism to automatically detect and correct non-compliant AWS resource configurations using AWS Config rules, EventBridge, and Lambda functions.
- AWS Config detects non-compliance based on defined rules.
- EventBridge triggers an action when a non-compliant resource is detected.
- AWS Lambda functions are commonly used to perform the remediation steps.
Memory trick: Config 'checks' and 'fixes' with Lambda's help, triggered by EventBridge.