During a security audit, a company discovered that some security groups allow SSH traffic from 0.0.0.0/0. A security team must implement a solution to detect and remediate this issue as soon as possib

Question

Options

• AEnable AWS Config for all AWS accounts. Use a periodic trigger to activate the vpe-sg-port-
• BCreate an AWS Lambda function in each AWS account to delete all the security group rules.
• CEnable AWS Config for all AWS accounts. Create a custom AWS Config rule to run on the
• DCreate an AWS Systems Manager Automation document in each account to inspect all security

• A
  79% (27)
• B
  3% (1)
• C
  6% (2)
• D
  12% (4)

Explanation

AWS Config is a service designed to track and evaluate the configuration of AWS resources, including security groups. By enabling AWS Config across all AWS accounts in your organization, you can continuously monitor the configuration of security groups and detect misconfigurations like security groups allowing SSH access from 0.0.0.0/0. AWS provides managed Config rules that automatically check security configurations. The vpc- sg-open-only-to-authorized-ports rule checks for security group rules that allow unrestricted access to specific ports, including SSH (port 22). This rule simplifies the detection of security group misconfigurations without needing to create custom rules. Once a noncompliant security group is detected, you can use an AWS Lambda function to automatically remediate the issue. This can involve removing or updating the noncompliant security group rules, ensuring that your environment is quickly secured without manual By using a periodic trigger, AWS Config regularly evaluates the resources and ensures that any new noncompliant configurations are detected and remediated as soon as possible. This ensures prompt detection and mitigation of security vulnerabilities.

No community discussion yet for this question.