A municipal band-shell helper’s bucket that holds prompts must stay encrypted and blocked from public access. Which service watches that configuration over time?
Select an answer to reveal the explanation.
Short Explanation
Think of a prompt bucket that must stay encrypted and off the public internet. AWS Config watches that setting over time. A one-time screenshot does not catch drift.
Full Explanation
The band-shell helper’s bucket that holds prompts must stay encrypted and blocked from public access over time—not merely on launch day. AWS Config rules continuously evaluate resource configuration against policy, such as encryption enabled and public access blocked, and flag drift when someone changes the bucket. That ongoing configuration watch is the right service role for ensuring the resource stays set the way municipal policy requires.
Amazon SageMaker Model Cards fail by concept: a model card documents model details and intended use; it does not encrypt buckets or enforce public-access blocks on prompt storage. Amazon Polly fails because speech synthesis is unrelated to configuration compliance and cannot watch bucket settings. A one-time screenshot fails because configuration drifts after the photo is taken; screenshots do not re-evaluate encryption or public access as the environment changes week to week.
Exam caveat: Config reports noncompliance; remediation still needs automation or an operations runbook—detection alone does not re-encrypt a bucket or remove a public ACL. Operational check: enable a Config rule for the prompt bucket’s encryption and public-access settings, deliberately flip a test setting in a non-production account, confirm the rule reports noncompliant, restore encryption and block public access, and only then trust the band-shell helper in production.