SOA-C02 Question 48
Single answerYour organization has configured an AWS Config rule to ensure that all Amazon S3 buckets are encrypted. You now need to automate remediation by enabling default encryption on non-compliant S3 buckets whenever the rule detects a violation. How can you implement this using AWS Systems Manager Automation runbooks?
- A
Create an AWS Config rule and set it to invoke an AWS Systems Manager Automation document (runbook) when a non-compliance event is detected.
- B
Manually execute an AWS Systems Manager Automation runbook whenever an AWS Config rule detects a non-compliance event.
- C
Use an AWS Lambda function triggered by the AWS Config rule to invoke an AWS Systems Manager Automation runbook for remediation.
- D
Schedule the AWS Systems Manager Automation runbook to run periodically, regardless of AWS Config rule violations.
Show answer and explanation
Correct answer: A
Explanation
To automate remediation for AWS Config rule violations, you can associate an AWS Systems Manager Automation runbook with the rule. This allows AWS Config to trigger the runbook whenever a non-compliant resource is identified, streamlining the remediation process without requiring manual intervention or additional Lambda functions.
- A. Correct.
Correct. AWS Config allows you to associate remediation actions with rules. By attaching an AWS Systems Manager Automation runbook to the rule, you can automate remediation for non-compliant resources.
- B. Incorrect.
Incorrect. Manually executing the runbook defeats the purpose of automation. The goal is to link the AWS Config rule with the Automation document for automatic remediation.
- C. Incorrect.
Incorrect. While Lambda could invoke the runbook, this approach introduces unnecessary complexity since AWS Config natively supports remediation actions via AWS Systems Manager Automation.
- D. Incorrect.
Incorrect. Scheduling the runbook to run periodically does not align with the event-driven nature of AWS Config rules, which trigger remediation actions only when non-compliance is detected.