SOA-C02 · Question #655
A company has an AWS Config rule that identifies open SSH ports in security groups. The rule has an automatic remediation action to delete the SSH inbound rule for noncompliant security groups. The…
The correct answer is B. Create a new AWS Systems Manager Automation runbook that updates the security group's. AWS Systems Manager Automation runbooks allow for automated, repeatable, and auditable operational tasks, making them a good fit for modifying security group rules. Since the business units provide a list of trusted IP addresses, the best approach is to update the existing…
Question
A company has an AWS Config rule that identifies open SSH ports in security groups. The rule has an automatic remediation action to delete the SSH inbound rule for noncompliant security groups. The remediation action is causing a problem because some business units require SSH access to their Amazon EC2 instances. The business units can provide a list of trusted IP addresses to reduce the number of source IP addresses that are allowed to connect. A SysOps administrator must modify the remediation action to change the SSH inbound rule instead of delete the rule. Which solution will meet these requirements?
Options
- ACreate a new AWS Systems Manager Automation runbook that adds an IP set to the security
- BCreate a new AWS Systems Manager Automation runbook that updates the security group's
- CCreate an AWS Lambda function that adds an IP set to the security group's inbound rule. Update
- DCreate an AWS Lambda function that updates the security group's inbound rule with the IP
How the community answered
(33 responses)- A3% (1)
- B79% (26)
- C6% (2)
- D12% (4)
Explanation
AWS Systems Manager Automation runbooks allow for automated, repeatable, and auditable operational tasks, making them a good fit for modifying security group rules. Since the business units provide a list of trusted IP addresses, the best approach is to update the existing inbound rule instead of deleting it. A new Systems Manager Automation runbook can be created to modify the security group's SSH rule with the approved IP addresses. The AWS Config rule's automatic remediation action is then updated to use this runbook, ensuring compliance while allowing necessary access.
Topics
Community Discussion
No community discussion yet for this question.