SOA-C02 Question 45
Select 3Your organization uses AWS Config rules to enforce compliance by identifying non-compliant resources. You need to ensure that remediation actions are automatically triggered for these non-compliant resources. For example, if an Amazon S3 bucket is found to have public read permissions, it should automatically apply a remediation action to remove the public access. Which of the following steps must you take to achieve this using AWS Systems Manager Automation runbooks?
- A
Create an AWS Config rule and associate it with a pre-defined Systems Manager Automation runbook for remediation.
- B
Attach an IAM role to the AWS Config rule that has permissions to execute the Systems Manager Automation runbook.
- C
Create a CloudWatch alarm to monitor non-compliant resources and trigger remediation using the runbook.
- D
Ensure that the Systems Manager Automation runbook has the required parameters for remediation actions.
- E
Manually execute the Systems Manager Automation runbook whenever a resource is non-compliant.
Show answer and explanation
Correct answers: A, B, D
Explanation
To automatically remediate non-compliant resources using AWS Config and Systems Manager Automation runbooks, you must associate the AWS Config rule with the appropriate runbook. The rule also needs an IAM role with permissions to execute the runbook. Additionally, the runbook must be properly configured with the required parameters for the remediation action. This setup ensures that compliance is maintained without manual intervention.
- A. Correct.
Correct. AWS Config rules can be associated with Systems Manager Automation runbooks to automatically take remediation actions when resources are found to be non-compliant.
- B. Correct.
Correct. The AWS Config rule must have an IAM role attached that grants it permissions to invoke the Systems Manager Automation runbook.
- C. Incorrect.
Incorrect. CloudWatch alarms are not required in this scenario as AWS Config rules can directly trigger remediation actions using the runbook.
- D. Correct.
Correct. The Systems Manager Automation runbook must be correctly configured with the required parameters to perform the remediation actions.
- E. Incorrect.
Incorrect. The remediation action can be automated, and manual execution is not necessary when AWS Config rules are used with runbooks.