A company wants any S3 bucket that becomes publicly readable to be detected and returned to a compliant state automatically. Which approach meets this need?
Show answer and explanation
Answer: D
AWS Config continuously evaluates resource configurations against rules. The managed rule for prohibiting public read access flags a noncompliant bucket, and a remediation action, such as a Systems Manager Automation document, can revert the change automatically. This covers both detection and correction. Block Public Access is a preventive guardrail that does not flag or report the attempted change, CloudTrail records events but does not act on them, and IAM restrictions reduce who can change policies without detecting a change that is made.
Why the other options are wrong
- A. Block Public Access stops public access from taking effect, but it does not detect or report attempts to change bucket policies, and it does not remediate the configuration itself.
- B. CloudTrail logs the API call, but nothing acts on the log automatically. Relying on a morning review leaves the bucket public for hours, so this fails the automatic remediation requirement.
- C. Restricting who can change policies lowers the risk but does not detect a change made through an allowed path, and it cannot revert a policy that is already public.