A security engineer needs to implement a solution to monitor for unauthorized modifications to critical AWS CloudFormation stacks. Specifically, they want to be alerted immediately if a CloudFormation stack's resources are updated, deleted, or if a stack operation fails. The solution should be near real-time and allow for automated response actions. Which AWS service combination is most appropriate for this task?
- AAmazon EventBridge (CloudWatch Events) with AWS Lambda
- BAWS CloudTrail with Amazon S3 lifecycle policies
- CAWS Config rules with remediation
- DAmazon GuardDuty with AWS Security Hub
Show answer & explanationAnswer & explanation
Correct answer: A. Amazon EventBridge (CloudWatch Events) with AWS Lambda
Amazon EventBridge (formerly CloudWatch Events) can be configured to react to specific AWS API calls recorded by CloudTrail. CloudFormation stack events (updates, deletions, failures) generate CloudTrail events. By setting up an EventBridge rule to filter for these specific CloudFormation events, an immediate alert can be triggered, and an AWS Lambda function can be invoked for automated response actions, fulfilling the near real-time and automated response requirements.
Why the other options are wrong
- B. AWS CloudTrail records API calls, and S3 lifecycle policies manage object retention. This combination provides auditing but not near real-time alerting and automated response for CloudFormation events.
- C. AWS Config monitors resource configurations and can remediate non-compliant resources, but it's not primarily designed for near real-time alerting on specific API call failures or modifications to CloudFormation stacks for immediate response.
- D. Amazon GuardDuty provides threat detection, and Security Hub aggregates security findings. Neither is specifically designed for monitoring CloudFormation stack modifications or triggering automated responses based on those events.
EventBridge for CloudFormation Monitoring
Using Amazon EventBridge to monitor AWS CloudTrail events related to CloudFormation stack operations for real-time alerting and automated responses.
- Listens for specific CloudTrail API calls.
- Can filter events based on criteria.
- Triggers targets like Lambda, SNS, SQS for actions.
Memory trick: EventBridge listens to CloudTrail events about CloudFormation, then rings the alarm.