A regular AWS Config rule, not a service-linked rule, reports security groups that expose TCP 22 to 0.0.0.0/0 as noncompliant. An approved custom Automation runbook accepts GroupId and AutomationAssumeRole.
Automatically remove only the violating rule for each group while retaining authorized management CIDRs. An operator may fix a group after evaluation, so the runbook must recheck its current configuration. Required execution permissions are prepared.
Which remediation configuration meets these requirements?
Enable automatic remediation with the evaluated SG ID and Automation execution role, then remove only the violation found in the current configuration.
Detailed explanation
Associating a remediation procedure and enabling automatic execution are separate. A manual remediation configuration with Automatic=false does not provide the required automatic response.
Associating a remediation procedure and enabling automatic execution are separate. A manual remediation configuration with Automatic=false does not provide the required automatic response.
Pass the evaluated SG ID dynamically and execute the approved operations with the specified role. Skip changes when the group is already compliant, avoiding unnecessary changes based on stale evaluation results.
Pass the evaluated SG ID dynamically and execute the approved operations with the specified role. Skip changes when the group is already compliant, avoiding unnecessary changes based on stale evaluation results.
A fixed ID can cause remediation to target a different group from the evaluated resource. Set ResourceValue.Value=RESOURCE_ID for GroupId to pass the resource being remediated.
A fixed ID can cause remediation to target a different group from the evaluated resource. Set ResourceValue.Value=RESOURCE_ID for GroupId to pass the resource being remediated.
Stale evaluation results can start automatic remediation for a group that is already compliant. Deleting all rules also removes authorized management CIDRs; recheck and remediate only the current violation.
Stale evaluation results can start automatic remediation for a group that is already compliant. Deleting all rules also removes authorized management CIDRs; recheck and remediate only the current violation.
Check official documentation
Compare the following points with the official documentation.
In an approved test group, verify detection and remediation, a manual fix after evaluation, and repeated execution on the same resource. Inspect DescribeRemediationExecutionStatus and Automation execution history.
Official references
What to confirm
The evaluated resource matches GroupId, only the violating rule is removed, and permissions on an already compliant group are preserved. Execution results and failure reasons are visible.
Key points
- AWS Config remediation
- AutomationAssumeRole
- RESOURCE_ID
Notes
- Environment: Official AWS Config and Systems Manager documentation and approved test security groups
- Reviewed against the linked AWS documentation on 2026-10-11.
Foundation review
Configure automatic execution, identity, and role
Associate the approved runbook with a regular Config rule. Set Automatic=true and GroupId ResourceValue.Value=RESOURCE_ID to pass the evaluated SG ID. Automatic remediation requires an AutomationAssumeRole value; check runbook parameters, the SSM trust relationship, and required EC2 permissions. Do not equate the Config evaluation role with the remediation execution role.
Do not treat stale evaluation as a current change request
Config auto remediation uses an evaluation snapshot and can start for a resource that has already become compliant. It does not guarantee execution only against currently noncompliant resources. Read the current SG inside the runbook and skip changes when no violation remains. Remove only violating TCP 22/0.0.0.0/0 permissions while retaining authorized management CIDRs and other permissions.
Verify repetition and outcomes
Make repeated execution idempotent by applying only required changes. Bound retry attempts, retry periods, and concurrency. Inspect resource IDs, steps, and errors with DescribeRemediationExecutionStatus and Automation execution history, then confirm reevaluation. Configuring automation alone does not guarantee compliance.