Evaluate whether S3 buckets in an organization are public.
List noncompliant resources and connect findings to remediation.
Which service is most appropriate?
Use an AWS Config managed rule to continuously evaluate S3 bucket settings and record compliance.
Detailed explanation
Config rules continuously evaluate resource configuration and record noncompliant results.
Config rules continuously evaluate resource configuration and record noncompliant results.
CDN settings do not continuously evaluate an S3 bucket's public configuration.
CDN settings do not continuously evaluate an S3 bucket's public configuration.
Login events do not evaluate the current S3 configuration against a compliance rule.
Login events do not evaluate the current S3 configuration against a compliance rule.
DNS records do not indicate S3 configuration compliance.
DNS records do not indicate S3 configuration compliance.
Check official documentation
Compare the following points with the official documentation.
AWS Config managed rules and remediationの公式説明を確認する。
What to confirm
CloudTrailイベント監査とConfigの設定準拠評価を区別できる。
Key points
- AWS Config
- Managed rule
- Noncompliance
Notes
- Environment: AWS公式SOA-C03試験ガイドとAWS公式ドキュメントの確認
- Confirm current AWS service behavior in the official documentation.
Foundation review
Configuration versus activity
Config checks the desired setting; CloudTrail records changes and API calls.
Remediation path
A noncompliant result can trigger notification or a separate remediation action.