A bank must ensure no S3 buckets allow public access and must auto-fix violations within 15 minutes with alerts to the security team. Auditors require history of evaluations and fixes. Which compliance detection and remediation design meets the governance requirement?
Select an answer to reveal the explanation.
Short Explanation
You'll get continuous protection when AWS Config catches a public bucket, kicks off your automatic fix, and alerts your security team with history saved for auditors. You're covered like a smoke alarm that also locks the door and calls for help.
Full Explanation
The correct design works because the AWS Config managed rule for S3 public access provides continuous evaluation of every bucket against the no-public-access state, retains a timestamped configuration timeline and evaluation history that auditors can query, and integrates natively with auto-remediation through an SSM Automation document to revert public ACLs and policies within minutes while publishing to SNS for security team alerting, satisfying detection, speed, notification, and evidence together. A design using Config with SNS and manual remediation via ticketing preserves detection, alerting, and history but violates the governance SLA because human triage and queue time cannot guarantee consistent remediation within 15 minutes and breaks closed-loop compliance. A design using EventBridge matching S3 policy and ACL changes to trigger Lambda auto-remediation with SNS is a common event-driven pattern that achieves speed and notification, yet it fails auditability because without Config there is no centralized rule evaluation record or compliant versus noncompliant history across all resources. A design using Config with SSM remediation but only CloudWatch Logs review achieves detection, history, and auto-fix but fails the explicit notification requirement because logs require polling and do not push awareness to the security team. On exams, carefully distinguish continuous compliance history from point-in-time event handling and push notification from log storage, since stems often test whether Config is the system of record. In practice, confirm the Config recorder is enabled in all governed Regions, the remediation role has least-privilege permissions to update public access blocks, the SNS topic has confirmed subscriptions, and test with a non-production bucket to measure detection-to-remediation time and retain the evidence.