A company runs applications on Amazon EC2 instances. The company wants to ensure that SSH ports on the EC2 instances are never open. The company has enabled AWS Config and has set up the…

Question

Options

• AConfigure the AWS Config rule to identify noncompliant security groups. Configure the rule to use
• BConfigure the AWS Config rule to identify noncompliant security groups. Configure the rule to use
• CMake an AWS Config API call to search for noncompliant security groups. Disable SSH access
• DConfigure the AWS Config rule to identify noncompliant security groups. Manually update each

• A
  4% (1)
• B
  80% (20)
• C
  12% (3)
• D
  4% (1)

Explanation

The AWS Cloud Operations and Governance documentation specifies that AWS Config can be paired with AWS Systems Manager Automation runbooks for automatic remediation of noncompliant resources. For SSH restrictions, the restricted-ssh managed rule detects any security group allowing inbound traffic on port 22. To automatically remediate these findings, AWS provides the AWS- DisableIncomingSSHOnPort22 runbook. This runbook programmatically removes inbound rules that allow port 22 traffic from affected security groups. This approach achieves continuous compliance with minimal human intervention. By contrast, sending notifications (Option A) does not enforce remediation, API-based scripts (Option C) add operational overhead, and manual remediation (Option D) violates automation best practices. Therefore, the most efficient CloudOps solution is Option B, using AWS Config with the AWS- DisableIncomingSSHOnPort22 automation runbook for automatic, scalable enforcement.

No community discussion yet for this question.