DOP-C02 · Question #448
A company runs hundreds of EC2 instances with new instances launched/terminated hourly. Security requires all running instances to have an instance profile attached. A default profile exists and…
The correct answer is B. AWS Config with ec2-instance-profile-attached managed rule, automatic remediation using. AWS Config's ec2-instance-profile-attached managed rule checks for attached instance profiles. Config supports automatic remediation via Systems Manager Automation runbooks. This provides continuous compliance with minimal operational overhead. EventBridge and Lambda (A)…
Question
A company runs hundreds of EC2 instances with new instances launched/terminated hourly. Security requires all running instances to have an instance profile attached. A default profile exists and must be attached automatically to any instance missing one. Which solution meets this requirement?
Options
- AEventBridge rule for RunInstances API calls, invoke Lambda to attach default profile.
- BAWS Config with ec2-instance-profile-attached managed rule, automatic remediation using
- CEventBridge rule for StartInstances API calls, invoke Systems Manager Automation runbook to
- DAWS Config iam-role-managed-policy-check managed rule, automatic remediation with Lambda
How the community answered
(39 responses)- A8% (3)
- B85% (33)
- C3% (1)
- D5% (2)
Explanation
AWS Config's ec2-instance-profile-attached managed rule checks for attached instance profiles. Config supports automatic remediation via Systems Manager Automation runbooks. This provides continuous compliance with minimal operational overhead. EventBridge and Lambda (A) require custom coding and risk missing existing instances. StartInstances (C) does not cover RunInstances and new instances. IAM-role managed policy check (D) does not check instance profile attachments.
Topics
Community Discussion
No community discussion yet for this question.