A compliance officer wants to detect when AWS resources drift from approved settings — for example, when a security group or S3 bucket configuration no longer matches policy. Which service records and evaluates resource configurations for that purpose?
Select an answer to reveal the explanation.
Short Explanation
Config is like a continuous inventory clipboard that also flags when a truck’s safety sticker expires — it remembers how resources are set up and checks them against rules. Shield and Route 53 are about DDoS and DNS health, not configuration compliance. Amplify Hosting is an app hosting path, not a posture recorder.
Full Explanation
AWS Config records resource configurations and can evaluate them against rules, which is the foundational service when a compliance officer wants to detect drift — for example when a security group or S3 bucket configuration no longer matches approved municipal policy. Config acts like a continuous inventory clipboard that also flags expired safety stickers on the fleet. AWS Shield Advanced concerns DDoS-related protection, not general configuration drift scoring as its primary mission. Amazon Route 53 health checks monitor endpoint health for DNS routing patterns; they do not inventory IAM and storage configurations. AWS Amplify Hosting is an application hosting path, not the recommended configuration compliance engine for all accounts. Distractors fail by mislabeling DDoS, DNS health, and app hosting products as configuration posture recorders. Exam caveat: Config identifies noncompliance against rules; remediation actions and exception governance remain customer operational duties under shared responsibility. Operational check: enable Config in accounts hosting citizen data, deploy rules for encryption, public access, and security group baselines, assign owners to noncompliant resources with due dates, and trend open findings in monthly governance reviews before external auditors arrive.