A multi-account municipality repeatedly discovers S3 buckets accidentally marked public. Which automated monitoring and remediation approach should they prioritize?
Select an answer to reveal the explanation.
Short Explanation
Public buckets show up like unlocked file cabinets in the lobby—Config is the guard that notices and relocks them. Pair detection with auto-remediation so the fix does not wait for somebody's Monday. Manual screenshot hunts do not scale across municipal accounts.
Full Explanation
Prioritizing automated responses to misconfigurations is a Domain 3 security improvement pattern. AWS Config rules can detect public S3 access continuously across accounts, and remediation actions or Automation runbooks can reapply Block Public Access or restrictive policies quickly. Manual screenshot reviews lag discovery; widening ACL permissions or disabling Block Public Access increases exposure. Architects should wire detection to automated containment for recurring municipal misconfigurations.