SCS-C02 Question 470
Single answerAn organization uses AWS Config to monitor compliance of its resources with internal security policies. The security team has been notified that several Amazon S3 buckets are publicly accessible, violating the organization's compliance requirements. Which AWS Config feature or approach should be used to automatically remediate this issue?
- A
Set up an AWS Config rule to detect S3 bucket public access and configure an auto-remediation action to remove public access.
- B
Use AWS Config to create a custom compliance dashboard and manually review S3 bucket settings.
- C
Enable AWS Config advanced queries to list all non-compliant resources and write a custom script to remove public access from S3 buckets.
- D
Integrate AWS Config with Amazon CloudWatch Logs to monitor compliance and trigger a Lambda function to enforce private bucket settings.
Show answer and explanation
Correct answer: A
Explanation
AWS Config provides managed rules and supports automatic remediation actions to enforce compliance. In this scenario, setting up an AWS Config rule to detect public S3 buckets and configuring an auto-remediation action to remove public access ensures compliance in an automated and efficient manner, which aligns with best practices for managing compliance in AWS environments.
- A. Correct.
This is the correct answer. AWS Config supports automatic remediation actions for specific rules. By configuring an AWS Config rule to detect public access on S3 buckets and enabling auto-remediation, public access can be automatically removed without manual intervention.
- B. Incorrect.
This is incorrect because manually reviewing S3 bucket settings does not provide an automated solution to enforce compliance or remediate the issue.
- C. Incorrect.
This is incorrect because advanced queries in AWS Config only help in listing non-compliant resources. Writing a custom script adds unnecessary complexity compared to AWS Config's built-in auto-remediation capabilities.
- D. Incorrect.
This is incorrect because integrating AWS Config with CloudWatch Logs and triggering a Lambda function adds extra complexity and is not the recommended or streamlined method for automatically remediating S3 bucket public access issues.