What should the Solutions Architect do to MOST quickly mitigate the risk of compliance deviations?

By:
In: SAP-C01
Tagged:
With: 1 Comment
A company has a requirement that only allows specially hardened AMIs to be launched into public subnets in a VPC, and for the AMIs to be associated with a specific security group.Allowing non-compliant instances to launch into the public subnet could present a significant security risk if they are allowed to operate.A mapping of approved AMIs to subnets to security groups exists in an Amazon DynamoDB table in the same AWS account.The company created an AWSLambda function that, when invoked, will terminate a given Amazon EC2 instance if the combination of AMI, subnet, and security group are not approved in theDynamoDB table.

What should the Solutions Architect do to MOST quickly mitigate the risk of compliance deviations?

Create an Amazon CloudWatch Events rule that matches each time an EC2 instance is launched using one of the allowed AMIs, and associate it with the Lambda function as the target.

For the Amazon S3 bucket receiving the AWS CloudTrail logs, create an S3 event notification configuration with a filter to match when logs contain the ec2:RunInstances action, and associate it with the Lambda function as the target.

Enable AWS CloudTrail and configure it to stream to an Amazon CloudWatch Logs group. Create a metric filter in CloudWatch to match when the ec2:RunInstances action occurs, and trigger the Lambda function when the metric is greater than 0.

Create an Amazon CloudWatch Events rule that matches each time an EC2 instance is launched, and associate it with the Lambda function as the target.

Explanations:

While this option monitors the launching of instances using allowed AMIs, it does not consider all instances launched, regardless of the AMI used. Therefore, it might miss instances that are launched with non-compliant AMIs, potentially leading to security risks.

This option involves using S3 event notifications based on CloudTrail logs, which would introduce delays and additional complexity. It relies on the S3 bucket receiving the logs and may not provide real-time monitoring needed for immediate action.

Although this option uses CloudTrail and metric filters to monitor theec2:RunInstancesaction, it introduces latency since it triggers the Lambda function based on metrics rather than real-time events. This could lead to non-compliant instances running temporarily before the function is invoked.

This option creates a CloudWatch Events rule that triggers immediately when any EC2 instance is launched. This allows the Lambda function to run in real-time to check the AMI, subnet, and security group against the DynamoDB table, enabling prompt termination of any non-compliant instances.

2025-10-09

1 Comment

  1. Ann
    Author

    From what I’ve seen, the answer is:
    Create an Amazon CloudWatch Events rule that matches each time an EC2 instance is launched, and associate it with the Lambda function as the target.

Leave a Reply

Your email address will not be published. Required fields are marked *

four × three =