SOA-C02 Question 47
Select 3Your organization uses AWS Config to evaluate compliance of resources based on defined rules. One of the rules checks for unencrypted Amazon S3 buckets. Upon detection of a non-compliant bucket, you need to automatically encrypt the bucket using AWS Systems Manager Automation runbooks. Which combination of steps should you implement to achieve this?
- A
Create an AWS Config rule to identify non-compliant S3 buckets and set an automatic remediation action using an SSM Automation document.
- B
Use an AWS Lambda function to manually trigger encryption of non-compliant S3 buckets whenever AWS Config detects non-compliance.
- C
Attach an IAM role with necessary permissions to the AWS Config rule for invoking the SSM Automation runbook.
- D
Use the pre-defined SSM Automation runbook 'AWS-EnableS3BucketEncryption' as the remediation action.
- E
Manually encrypt the non-compliant S3 buckets using the AWS Management Console.
Show answer and explanation
Correct answers: A, C, D
Explanation
To automatically remediate non-compliant S3 buckets detected by AWS Config, you need to configure an AWS Config rule with an automatic remediation action. This action can invoke a pre-defined SSM Automation runbook, such as 'AWS-EnableS3BucketEncryption,' to enforce bucket encryption. An IAM role must also be attached to the rule with permissions to execute the Automation runbook. This solution leverages AWS-native automation and ensures compliance without manual intervention.
- A. Correct.
Correct. AWS Config can identify non-compliance and trigger an automatic remediation action using an SSM Automation document (runbook).
- B. Incorrect.
Incorrect. While Lambda can be used for custom automation, it is not required here since AWS Config and SSM Automation natively support this workflow.
- C. Correct.
Correct. The AWS Config rule must have an associated IAM role with permissions to invoke the SSM Automation runbook for remediation.
- D. Correct.
Correct. The pre-defined SSM Automation runbook 'AWS-EnableS3BucketEncryption' can automatically enforce bucket encryption.
- E. Incorrect.
Incorrect. Manual encryption is not an automated or scalable solution and does not leverage AWS Config or SSM Automation.