Every account in an organization must maintain standards for S3 encryption and public access.
Distribute the same Config rules and list noncompliant resources across accounts.
Which feature is most appropriate?
Deploy an AWS Config conformance pack across the organization to package and evaluate the standard rules.
Detailed explanation
Audit collection does not provide bundled configuration evaluation or remediation.
Audit collection does not provide bundled configuration evaluation or remediation.
A periodic inventory cannot continuously evaluate configuration changes or connect remediation.
A periodic inventory cannot continuously evaluate configuration changes or connect remediation.
Response headers do not evaluate S3 server-side encryption with Config.
Response headers do not evaluate S3 server-side encryption with Config.
A conformance pack packages multiple Config rules and remediation actions for account-wide evaluation.
A conformance pack packages multiple Config rules and remediation actions for account-wide evaluation.
Check official documentation
Compare the following points with the official documentation.
AWS Config conformance packs organization deploymentの公式説明を確認する。
What to confirm
単一Configルールとconformance packの適用範囲を区別できる。
Key points
- Conformance pack
- AWS Config rule
- Noncompliance
Notes
- Environment: AWS公式SOA-C03試験ガイドとAWS公式ドキュメントの確認
- Confirm current behavior in the official SOA-C03 guide and AWS service documentation.
Foundation review
Baseline distribution
Packaging rules makes a standard repeatable instead of manually recreating each check.
Evaluation versus remediation
A rule can detect a violation; a separate remediation action may be needed to correct it.