SAP-C02 Question 372
Select 2A company has a multi-account setup in AWS and uses AWS Organizations. The security team wants to ensure that if an EC2 instance in any account is exposed to the internet via a Security Group with an open SSH port (22), it is automatically remediated by removing the rule and an alert is sent to their Slack channel. How can this be achieved using AWS features?
- A
Use AWS Config with a custom Config rule to detect open SSH ports and trigger an AWS Lambda function to remove the Security Group rule. Configure the Lambda function to send an alert to Slack using an API call.
- B
Use AWS CloudWatch Alarms to monitor Security Group changes and trigger an Amazon SNS topic that invokes an AWS Lambda function for remediation and sends an alert to Slack.
- C
Use AWS Security Hub to identify open SSH ports and configure an automated remediation action using AWS Systems Manager Automation Documents (SSM Documents). Use an SNS topic to send Slack alerts.
- D
Enable AWS GuardDuty to monitor for open SSH ports and configure it to automatically remediate by removing the Security Group rule and sending an alert to Slack.
- E
Create an EventBridge rule to detect changes to Security Groups with open SSH ports and trigger an AWS Lambda function for remediation. Use a Slack integration within the Lambda function to send alerts.
Show answer and explanation
Correct answers: A, E
Explanation
To address this scenario, you need a combination of monitoring, detection, and automated remediation. AWS Config with a custom rule or EventBridge with an appropriate rule can detect Security Group changes, including open SSH ports. AWS Lambda can handle the remediation process by removing the offending rule and sending Slack alerts. Other options, such as GuardDuty and CloudWatch Alarms, are not suitable for monitoring Security Group configuration changes directly.
- A. Correct.
This is a valid approach. AWS Config can be used to create a custom Config rule that monitors for open SSH ports. When the rule is non-compliant, it can trigger an AWS Lambda function to remediate the issue by removing the Security Group rule. The Lambda function can also send alerts to Slack using an HTTP API call.
- B. Incorrect.
This is not a valid approach because CloudWatch Alarms are not designed to monitor Security Group changes directly. They are used to monitor metrics, not configuration changes. Detecting open SSH ports requires a service like AWS Config or EventBridge.
- C. Incorrect.
While AWS Security Hub can detect security issues, it is not directly capable of taking remediation actions like removing Security Group rules. Automated remediation would require integration with services like AWS Lambda or Systems Manager Automation Documents, but this option does not describe that integration clearly.
- D. Incorrect.
AWS GuardDuty is used for threat detection and monitoring malicious activity, but it does not monitor Security Group configurations, such as open SSH ports. It is not suitable for this scenario.
- E. Correct.
This is a valid approach. Amazon EventBridge can be configured to detect changes to Security Groups, such as the addition of a rule allowing open SSH ports. It can trigger an AWS Lambda function to remove the rule and send alerts to Slack via an integration.