AWS Config marks a security group noncompliant because it allows a management port from anywhere. GuardDuty has no findings for the instances that use that group. What is the work?
Select an answer to reveal the explanation.
Short Explanation
A door propped open is a building problem even when the burglar alarm is silent. Config is telling you the security group allows a management port from anywhere, and GuardDuty having nothing to say does not make that rule safe. Close the port; deleting the Config rule or disabling GuardDuty leaves the same exposure in place.
Full Explanation
AWS Config is reporting the security group's configuration: a management port is open to anywhere, so the group is noncompliant. The work is to close that port, or to limit it to the admin path that should have it. GuardDuty looks for threat behavior. A quiet detector does not mean an open management port is acceptable, and it is not a reason to start with a malware hunt when the evidence in hand is the group rule. Deleting the Config rule stops the evaluation. The security group stays open, and the resource is not fixed just because nobody is scoring it. Disabling GuardDuty has no effect on Config compliance. The two services do not clear each other's results. Caveat: a quiet GuardDuty detector is not a permanent clean bill of health, but this item of work is the open port, and closing it is what changes the configuration Config is scoring. Operational check: after the rule change, confirm the group no longer allows that port from anywhere and that Config reports the group as compliant on the next evaluation.