AWS Certified Advanced Networking - Specialty
Get started today
Ultimate access to all questions.
Ultimate access to all questions.
A company has enforced a security policy that restricts developers from deploying VPC network infrastructure. The policy mandates that whenever a NAT gateway is launched in a VPC, the network security team must be promptly alerted to terminate it. The team requires a solution that can be deployed across AWS accounts with minimal administrative effort and provides an easy way to monitor compliance history.
Which solution fulfills these requirements?
Explanation:
The question requires a solution that can be deployed across AWS accounts with minimal administrative overhead, provides immediate alerts for NAT gateway creation, and offers a simple way to view compliance history. Option A involves deploying a script on an EC2 instance in each account, which introduces significant administrative overhead and does not scale well. Option B suggests using AWS Lambda and AWS SAM for deployment, which reduces administrative overhead, but storing results in an Amazon OpenSearch Service cluster in each account complicates compliance history viewing. Option C leverages Amazon GuardDuty and Amazon EventBridge for detection and response, which is efficient, but storing runtime logs as text files in S3 is not the simplest way to view compliance history. Option D proposes using AWS Config and AWS Systems Manager Automation, which can be deployed across accounts using AWS CloudFormation StackSets, providing a scalable solution with minimal administrative overhead. AWS Config also offers a straightforward way to view compliance history. Therefore, Option D is the best solution as it meets all the requirements efficiently.