DOP-C02 Question 322
Single answerYour organization uses AWS Config to ensure compliance with security and governance policies. You are tasked with ensuring that all EC2 instances have specific IAM roles attached for monitoring purposes. If an EC2 instance is found without the required IAM role, it should automatically be remediated by attaching the correct role. How should you achieve this using AWS Config?
- A
Create an AWS Config custom rule with a Lambda function that checks for the IAM role and uses the AWS SDK to attach the correct role when non-compliance is detected.
- B
Use the AWS Config managed rule 'ec2-instance-profile-check' and configure it to automatically attach the required IAM role upon non-compliance.
- C
Set up an AWS Config custom rule that triggers an AWS Systems Manager Automation document (SSM document) to remediate non-compliant resources by attaching the IAM role.
- D
Enable AWS CloudTrail to monitor EC2 instance changes and use EventBridge to trigger a Lambda function that ensures required IAM roles are always attached.
Show answer and explanation
Correct answer: A
Explanation
AWS Config custom rules allow you to define compliance rules for specific use cases that are not covered by managed rules. By using a Lambda function in the custom rule, you can programmatically check for compliance and implement automated remediation actions, such as attaching the required IAM role to non-compliant EC2 instances. This is the most effective and AWS-recommended approach for this scenario.
- A. Correct.
This option is correct because AWS Config custom rules allow you to define your own compliance checks and use a Lambda function for custom logic. The Lambda function can include logic to remediate non-compliance by using the AWS SDK to attach the IAM role to EC2 instances.
- B. Incorrect.
This option is incorrect because the AWS Config managed rule 'ec2-instance-profile-check' can only check for compliance. AWS Config managed rules do not support automatic remediation; you need custom rules or remediation actions for that.
- C. Incorrect.
This option is incorrect because while AWS Systems Manager Automation documents can be used for remediation, AWS Config does not directly trigger these documents. You would need to configure AWS Config to invoke a Lambda function, which in turn triggers an SSM document.
- D. Incorrect.
This option is incorrect because CloudTrail and EventBridge are not directly used for AWS Config compliance checks. While this solution could theoretically work, it is not the recommended approach for compliance management and remediation in AWS Config.