SAP-C02 Question 411
Single answerAn organization wants to ensure that no EC2 instances are launched without being tagged with both 'Environment' and 'Owner' tags. They want to implement an automated strategy to monitor and remediate any instances that do not comply with this tagging policy. Which solution should you recommend?
- A
Use AWS Config with a managed rule to check for required tags and configure an AWS Systems Manager Automation document to terminate non-compliant instances.
- B
Enable AWS Trusted Advisor and configure it to monitor EC2 tags, then use AWS Lambda to remediate instances that are non-compliant.
- C
Set up an EventBridge rule to detect EC2 instance launches, trigger an AWS Lambda function to verify tags, and terminate non-compliant instances.
- D
Use an AWS Config custom rule to check for required tags, and configure an EventBridge rule to stop non-compliant instances.
Show answer and explanation
Correct answer: A
Explanation
AWS Config is the ideal service for monitoring resource configurations and compliance. It provides managed rules for common compliance requirements, such as ensuring specific tags are applied to resources. Using AWS Config with a managed rule like 'required-tags' allows for automatic detection of non-compliant resources. Additionally, AWS Config supports automatic remediation actions, such as invoking an AWS Systems Manager Automation document to terminate non-compliant instances, making it a simpler and more integrated solution for this scenario.
- A. Correct.
This is the correct solution. AWS Config provides a managed rule 'required-tags' that can check if EC2 instances have specific tags. You can associate a remediation action, such as an AWS Systems Manager Automation document, to terminate instances that are non-compliant.
- B. Incorrect.
AWS Trusted Advisor does not have built-in functionality for monitoring EC2 tags, and it cannot trigger automated remediation actions like instance termination.
- C. Incorrect.
While this solution could work, manually setting up an EventBridge rule and Lambda function adds unnecessary complexity. AWS Config provides a more straightforward way to enforce tag compliance with built-in rules and remediation actions.
- D. Incorrect.
Custom AWS Config rules can indeed check for compliance. However, setting up an EventBridge rule to stop instances adds redundancy and is not the recommended approach for this use case since AWS Config can handle both detection and remediation natively.