A company wants to standardize its Amazon Elastic Block Store (Amazon EBS) volume encryption strategy. The company also wants to minimize the cost and configuration effort required to operate the…

Question

Options

• AWrite API calls to describe the EBS volumes and to confirm the EBS volumes are encrypted. Use
• BWrite API calls to describe the EBS volumes and to confirm the EBS volumes are encrypted. Run
• CCreate an AWS Identity and Access Management (IAM) policy that requires the use of tags on
• DCreate an AWS Config rule for Amazon EBS to evaluate if a volume is encrypted and to flag the

• A
  3% (1)
• B
  6% (2)
• C
  12% (4)
• D
  79% (27)

Explanation

AWS Config is a service that enables you to assess, audit, and evaluate the configurations of your AWS resources. By creating a Config rule, you can automatically check whether your Amazon EBS volumes are encrypted and flag those that are not, with minimal cost and configuration effort. AWS Config Rule: AWS Config provides managed rules that you can use to automatically check the compliance of your resources against predefined or custom criteria. In this case, you wouldcreate a rule to evaluate EBS volumes and determine if they are encrypted. If a volume is not encrypted, the rule will flag it, allowing you to take corrective action. Operational Overhead: This approach significantly reduces operational overhead because once the rule is in place, it continuously monitors your EBS volumes for compliance, and there's no need for manual checks or custom scripting. Why Not Other Options? Option A (Lambda with API calls and EventBridge): While this can work, it involves writing and maintaining custom code, which increases operational overhead compared to using a managed AWS Config rule. Option B (API calls on Fargate): Running API calls on Fargate is more complex and costly compared to using AWS Config, which provides a simpler, managed solution. Option C (IAM policy with Cost Explorer): This option does not directly enforce encryption compliance and involves manual intervention, making it less efficient and more prone to errors.

No community discussion yet for this question.