A SaaS company with 200 accounts must detect publicly readable S3 buckets and unencrypted EBS volumes, auto-remediate them, and notify platform teams within minutes. Audits demand evidence of rule evaluations and change history across the organization. Which compliance detection and remediation design meets these notification needs?
Select an answer to reveal the explanation.
Short Explanation
You want a rulebook that fixes drift and pings you instantly. AWS Config evaluates, remediates, and notifies with full audit history.
Full Explanation
The correct design succeeds because AWS Config managed rules for S3 public access and EBS encryption continuously evaluate desired state, record evaluation results and resource configuration timelines for audit evidence, trigger SSM Automation for auto-remediation on noncompliance, publish state changes to SNS for notification within minutes, and bundle rules plus remediations in Conformance Packs for consistent deployment and aggregated compliance across 200 accounts. The manual-execution design fails on automation because retaining effective Config detection and SNS alerting while requiring humans to approve and run SSM documents cannot meet the within-minutes auto-remediation mandate at scale and leaves exposure windows open. The CloudTrail EventBridge Lambda design fails on compliance evidence because although event-driven remediation with immediate SNS alerts is responsive, API activity monitoring is not policy evaluation and lacks Config rule evaluation history, configuration timelines, and centralized compliance proof auditors require. The daily-export design fails on timeliness because keeping Config evaluation and SSM remediation but replacing real-time SNS fan-out with S3 compliance exports for daily review breaks the explicit within-minutes notification requirement. Exam caveat: do not confuse event recording, threat detection, or vulnerability scanning with managed-state compliance evaluation, and remember Conformance Packs imply governed deployment at scale while aggregators imply centralized visibility. Practical check: verify a noncompliant bucket or volume triggers SSM execution within minutes, SNS delivery to the platform topic succeeds, and both resource history and the aggregator show linked evaluation records across member accounts.