An auditor requires continuous detection of public S3 buckets and unencrypted EBS volumes, automatic remediation where safe, and Slack plus email alerts for owners. The platform team must prove history and compliance trends. Which compliance evaluation and notification design should the team deploy?
Select an answer to reveal the explanation.
Short Explanation
You need a smoke alarm that also calls the fire crew, and that's Config. Managed rules spot drift, SSM fixes it fast, and SNS pings owners while you'll keep tidy history.
Full Explanation
The correct design works because AWS Config managed rules for S3 public access and EBS encryption provide continuous compliance evaluation against desired state, not just raw API events, while the Config recorder preserves resource timelines and compliance history for auditor trend reports, SSM Automation documents enable safe automatic remediation such as restricting bucket policies or enabling encryption with guardrails, and SNS notifications for compliance changes can fan out to both email subscriptions and Slack via Amazon Q Developer in chat applications (formerly AWS Chatbot) to satisfy dual owner alerting. The Config-only alerting with history design fails by remediation concept because it evaluates correctly and retains trends but leaves response manual, violating the automatic remediation where safe mandate. The EventBridge-driven CloudTrail to Lambda design fails by assurance concept because although it reacts to S3 and EBS API calls quickly with remediation and owner alerts, it lacks managed rule baselines and persistent evaluation history, so compliance posture and trends cannot be proven. The Config with SSM and SES email design fails by notification concept because it evaluates, remediates, and retains history yet delivers only email to owners, missing the required Slack channel integration for joint visibility. Exam caveat is to distinguish continuous Config evaluation plus history from real-time event reaction, and to map SNS plus Amazon Q Developer in chat applications (formerly AWS Chatbot) to multi-channel delivery versus SES email-only. Practical check is to confirm the Config recorder is enabled in all audited Regions, required managed rules are compliant-evaluating, SSM remediation runs in selective safe mode, SNS topics have email subscriptions and chat applications Slack wiring, and Config advanced queries show noncompliant timelines.