DOP-C02 Question 308
Single answerYour company uses AWS CloudFormation to manage infrastructure as code. A recent security audit reveals that an IAM policy attached to a critical Lambda function allows overly permissive actions. To address this, a new security event monitoring system detects when an IAM policy is overly permissive and sends an event to an Amazon EventBridge rule. The EventBridge rule triggers an AWS Lambda function that must automatically remediate this issue by updating the IAM policy to follow the principle of least privilege. What is the best approach to implement this configuration change?
- A
Use the AWS SDK within the triggered Lambda function to modify the IAM policy and update the CloudFormation stack directly.
- B
Configure the Lambda function to use the AWS CLI to remove the IAM policy and redeploy the stack through the CloudFormation CLI.
- C
Use the AWS SDK within the triggered Lambda function to fetch the existing CloudFormation stack template, modify the IAM policy in the template, and update the stack using the updated template.
- D
Configure the Lambda function to delete and recreate the IAM policy directly using AWS SDK, without interacting with CloudFormation.
Show answer and explanation
Correct answer: C
Explanation
The principle of automated remediation with infrastructure as code should be followed to ensure consistency and prevent stack drift. By fetching the stack template, making the necessary changes to the IAM policy, and updating the stack through CloudFormation, the setup remains aligned with the defined infrastructure code. This approach also ensures that the remediation is automated and aligns with best practices for managing configuration changes in response to events.
- A. Incorrect.
Using the AWS SDK to modify the IAM policy and directly update the CloudFormation stack could cause drift between the stack and the actual infrastructure if not carefully designed. This approach is less reliable.
- B. Incorrect.
Using the AWS CLI to remove the IAM policy and redeploy the stack is not a recommended practice since it introduces manual steps and increases downtime risk. This does not align with automated remediation.
- C. Correct.
Fetching the existing CloudFormation stack template, modifying the IAM policy in the template, and updating the stack ensures that the change is applied through infrastructure as code, maintaining stack integrity and avoiding drift.
- D. Incorrect.
Directly deleting and recreating the IAM policy bypasses CloudFormation, introducing stack drift and breaking the infrastructure as code paradigm. This is not a best practice.