A governance group needs S3 buckets that drift out of compliance to be corrected automatically, with the security distribution list alerted each time. The rules must be deployed uniformly across every account in the organization. Which approach fits?
Show answer and explanation
Answer: C
AWS Config evaluates resources against rules and records noncompliance. Remediation actions can call SSM Automation documents to correct the setting, and EventBridge can relay the compliance change to an SNS topic for the mailing list. An organization conformance pack deploys the same rules and remediations across member accounts, giving consistent detective and corrective coverage. The other options lack automatic remediation or uniform rollout.
Why the other options are wrong
- A. GuardDuty detects threats such as suspicious bucket access but does not evaluate configuration state against a rule set. Without Config rules, misconfigurations are neither flagged nor corrected automatically.
- B. Disabling Config removes the compliance record and any remediation trigger. Saving that cost sacrifices the continuous detective control the governance team needs.
- D. A quarterly manual review is slow and inconsistent, and drift can persist for months. It cannot meet the requirement for automatic correction and immediate alerts.