SOA-C02 Question 163
Select 2A company wants to automatically remediate non-compliant AWS resources identified by AWS Config rules. For example, if an Amazon S3 bucket is found to have public access enabled, the company wants to disable public access automatically. Which combination of AWS services can be used to achieve this?
- A
AWS Config and AWS Systems Manager Automation
- B
AWS Config and Amazon EventBridge
- C
AWS Config and AWS Lambda
- D
Amazon CloudWatch and AWS Lambda
- E
Amazon EventBridge and AWS Systems Manager Run Command
Show answer and explanation
Correct answers: A, C
Explanation
AWS Config is designed to evaluate the compliance of AWS resources against predefined rules. When non-compliance is detected, automated remediation workflows can be implemented using services like AWS Systems Manager Automation or AWS Lambda. EventBridge can serve as a bridge to trigger these remediation workflows based on AWS Config compliance events. This makes AWS Config, EventBridge, and a remediation service such as Lambda or Systems Manager Automation the correct combination for this use case.
- A. Correct.
Correct. AWS Config can identify non-compliant resources based on its rules, and AWS Systems Manager Automation can execute remediation actions to fix the non-compliance.
- B. Incorrect.
Correct. AWS Config detects non-compliance, and Amazon EventBridge can trigger the necessary remediation workflows.
- C. Correct.
Correct. AWS Config identifies non-compliant resources, and AWS Lambda can execute custom remediation logic using code.
- D. Incorrect.
Incorrect. While Amazon CloudWatch can monitor metrics and events, it is not directly involved in AWS Config compliance workflows.
- E. Incorrect.
Incorrect. Although Amazon EventBridge and AWS Systems Manager Run Command can work together, they are not directly used for automated remediation triggered by AWS Config.