SAP-C02 Question 409
Select 2A financial services company wants to ensure compliance with its internal security policies by automatically monitoring and remediating non-compliant resources in its AWS environment. For example, all S3 buckets must have server-side encryption enabled. The company seeks a solution that minimizes manual intervention. Which combination of solutions can achieve this?
- A
Use AWS Config with a managed rule to check for S3 bucket encryption and configure an automatic remediation action.
- B
Create a CloudWatch Events rule to detect non-compliant S3 buckets and trigger an AWS Lambda function to enforce encryption.
- C
Manually review the compliance status in the AWS Config dashboard and apply corrections as needed.
- D
Use AWS Systems Manager Automation Documents (SSM Documents) to periodically scan and fix non-compliant S3 buckets.
- E
Enable S3 default encryption for all buckets during their creation to prevent future non-compliance.
Show answer and explanation
Correct answers: A, B
Explanation
To achieve automated monitoring and remediation for S3 bucket encryption compliance, AWS Config and CloudWatch Events (EventBridge) are the appropriate solutions. AWS Config can continuously evaluate resources against compliance rules and apply automatic remediation. Similarly, CloudWatch Events (EventBridge) can detect changes in resource configurations and trigger Lambda functions to enforce policies. Other options such as manual review or SSM Documents do not provide the required automation, and enabling S3 default encryption only prevents future non-compliance but does not address existing issues.
- A. Correct.
This is correct. AWS Config can be used with managed rules, such as ensuring S3 bucket encryption, and can be configured with automatic remediation actions to enforce compliance.
- B. Correct.
This is correct. A CloudWatch Events (now Amazon EventBridge) rule can detect configuration changes in S3 buckets and trigger a Lambda function to enforce encryption, providing an automated remediation mechanism.
- C. Incorrect.
This is incorrect. Manually reviewing compliance status does not align with the requirement for automated monitoring and remediation, as manual intervention is required.
- D. Incorrect.
This is incorrect. While AWS Systems Manager Automation Documents can automate tasks, they are not ideal for continuous compliance monitoring and remediation in this scenario. AWS Config or EventBridge is better suited.
- E. Incorrect.
This is incorrect. Enabling S3 default encryption during bucket creation only addresses future buckets and does not remediate existing non-compliant buckets or provide ongoing monitoring.