Which combination of steps should the solutions architect take to meet these requirements while following best practices?
(Choose two.)
Use the AWS Systems Manager EC2 agent to run the CVE assessment on the EC2 instances launched from the AMIs that need to be scanned.
Use AWS Lambda to write automatic approval rules. Store the approved AMI list in AWS Systems Manager Parameter Store. Use Amazon EventBridge to trigger an AWS Systems Manager Automation document on all EC2 instances every 30 days.
Use Amazon Inspector to run the CVE assessment on the EC2 instances launched from the AMIs that need to be scanned.
Use AWS Lambda to write automatic approval rules. Store the approved AMI list in AWS Systems Manager Parameter Store. Use a managed AWS Config rule for continuous scanning on all EC2 instances, and use AWS Systems Manager Automation documents for remediation.
Use AWS CloudTrail to run the CVE assessment on the EC2 instances launched from the AMIs that need to be scanned.
Explanations:
The AWS Systems Manager EC2 agent is primarily used for managing instances, but it does not specifically handle vulnerability assessments or CVE scanning. This approach does not meet the requirement for automated assessment of AMIs for security compliance.
Using AWS Lambda to create automatic approval rules allows for dynamic processing of AMIs based on compliance checks. Storing the approved AMI list in AWS Systems Manager Parameter Store provides a centralized management point. Triggering an AWS Systems Manager Automation document through Amazon EventBridge ensures that AMIs are scanned automatically every 30 days. This setup aligns with the requirement for automated assessments and tracking.
Amazon Inspector is designed specifically for assessing the security of applications running on AWS, including vulnerability assessments and CVE scanning. Using Inspector to run the CVE assessment on EC2 instances launched from the AMIs meets the requirement for a security-approved assessment process before use by developers.
While this option includes some good practices such as using AWS Lambda and AWS Systems Manager Automation documents, it inaccurately suggests using a managed AWS Config rule for continuous scanning. AWS Config is generally used for compliance tracking and configuration management, not for running CVE assessments. Continuous scanning would require a dedicated tool like Amazon Inspector.
AWS CloudTrail is a logging service that records AWS API calls but does not perform vulnerability assessments or CVE scanning. This option does not align with the requirements for creating and scanning AMIs for security compliance.
From what I’ve heard, the answer is:
Use AWS Lambda to write automatic approval rules. Store the approved AMI list in AWS Systems Manager Parameter Store. Use Amazon EventBridge to trigger an AWS Systems Manager Automation document on all EC2 instances every 30 days.