AWS Certified DevOps Engineer – ProfessionalIncident and Event ResponseMedium
A DevOps team manages a fleet of Amazon EC2 instances running a critical web application. They need to ensure that all EC2 instances automatically have specific security agents installed and are configured correctly upon launch and throughout their lifecycle. Manual intervention for each instance is not scalable or compliant. Which AWS service combination should the team use to achieve this automated, continuous enforcement?
- AAmazon CloudWatch Events to trigger Lambda functions for instance state changes.
- BAWS Config rules with AWS Systems Manager Automation documents for remediation.
- CAWS Systems Manager Run Command for manual execution of installation scripts.
- DAWS CloudFormation templates to provision instances with pre-baked AMIs.
Show answer & explanationAnswer & explanation
Correct answer: B. AWS Config rules with AWS Systems Manager Automation documents for remediation.
AWS Config continuously assesses compliance against defined rules. When a non-compliant instance is detected (e.g., missing security agents), an AWS Config rule can trigger an AWS Systems Manager Automation document to automatically install the agents or correct the configuration, providing continuous enforcement.
Why the other options are wrong
- A. CloudWatch Events can trigger actions, but without Config rules and SSM Automation, it lacks the built-in compliance assessment and structured remediation capabilities.
- C. Run Command is for on-demand execution, not continuous, automated enforcement of configuration compliance.
- D. CloudFormation with AMIs ensures initial configuration, but does not provide continuous enforcement against drift or agent failures after launch.
AWS Config with SSM Automation
A powerful combination for continuous compliance and automated remediation: AWS Config detects non-compliant resources, and SSM Automation executes corrective actions.
- AWS Config continuously evaluates resource configurations.
- SSM Automation documents define remediation steps.
- Enables self-healing infrastructure and compliance enforcement.
Memory trick: Config checks the rules, SSM fixes the tools.