Question
A security engineer wants to evaluate configuration changes to a specific AWS resource to ensure that the resource meets compliance standards. However, the security engineer is concerned about a situation in which several configuration changes are made to the resource in quick succession. The security engineer wants to record only the latest configuration of that resource to indicate the cumulative impact of the set of changes.
Which solution will meet this requirement in the MOST operationally efficient way?
- A. Use AWS CloudTrail to detect the configuration changes by filtering API calls to monitor the changes. Use the most recent API call to indicate the cumulative impact of multiple calls.
- B. Use AWS Config to detect the configuration changes and to record the latest configuration in case of multiple configuration changes. Correct
- C. Use Amazon CloudWatch to detect the configuration changes by filtering API calls to monitor the changes. Use the most recent API call to indicate the cumulative impact of multiple calls.
- D. Use AWS Cloud Map to detect the configuration changes. Generate a report of configuration changes from AWS Cloud Map to track the latest state by using a sliding time window.
Explanation
Option B is correct. AWS Config detects configuration changes to supported resources and records them as configuration items. With the recording frequency set to daily recording, AWS Config records one configuration item that represents the most recent state of the resource over the last 24 hours (only if it differs from the previous one), so several quick changes are captured as their cumulative result, and rules can evaluate that state for compliance. CloudTrail and CloudWatch (options A and C) record individual API calls, so the engineer would have to work out the resulting configuration. AWS Cloud Map (option D) is a service discovery registry and does not track resource configuration.
