AWS Certified SysOps Administrator – AssociateMonitoring, Logging, and RemediationMedium
A company operates a critical application on AWS. They need to ensure that specific AWS resources (e.g., EC2 instances, S3 buckets, RDS databases) conform to internal security policies, such as having encryption enabled, specific tags applied, or not being publicly accessible. They also need to be alerted automatically if any resource deviates from these policies. Which AWS service is best suited for continuous auditing and compliance enforcement in this scenario?
- AAWS Config
- BAWS CloudTrail
- CAmazon GuardDuty
- DAWS Security Hub
Show answer & explanationAnswer & explanation
Correct answer: A. AWS Config
AWS Config provides a detailed inventory of your AWS resources, their configurations, and how they change over time. It allows you to define rules to assess, audit, and evaluate the configurations of your AWS resources for compliance, and it can trigger alerts when resources deviate from desired configurations.
Why the other options are wrong
- B. CloudTrail records API calls and events; it's an audit log, not a continuous configuration compliance auditor.
- C. GuardDuty is a threat detection service that monitors for malicious activity and unauthorized behavior, not for auditing resource configuration compliance.
- D. Security Hub aggregates security findings from various AWS services and partners, but AWS Config is the underlying service for defining and evaluating resource configurations for compliance against specific rules.
AWS Config for Compliance
AWS Config continuously monitors and records your AWS resource configurations and allows you to automate the evaluation of recorded configurations against desired configurations, triggering alerts for non-compliance.
- Tracks resource configuration changes.
- Evaluates resource configurations against defined rules.
- Identifies non-compliant resources.
- Supports remediation actions and alerts.
Memory trick: Config checks if your AWS setup is 'configured' correctly for compliance.