Use AWS Config with a restricted-ssh custom rule on the configuration-change trigger and Lambda remediation

Why the Answer Is Correct

The requirement is to detect and remediate unrestricted SSH access across all accounts as soon as possible. AWS Config provides continuous evaluation of resource configuration, and its configuration change trigger causes a rule to evaluate the moment a relevant resource such as a security group is modified, rather than waiting for a scheduled cycle (C). A custom rule is created using that trigger so that the evaluation happens immediately after any change to a security group, and the rule is configured to invoke an AWS Lambda function to remediate any noncompliant resource, which removes the offending rule automatically (C). Because Config is enabled in all accounts and is itself centrally governed, this gives organization-wide coverage with a single design, and the whole path from change to detection to remediation is event-driven, which satisfies the as soon as possible requirement. C is the correct answer.

Why the Other Options Are Wrong

A enables AWS Config for all accounts, uses a periodic trigger to activate the vpc-sg-port-restriction-check rule, and creates a Lambda function to remediate noncompliant rules. As phu0298 identified, this fails on two counts: the vpc-sg-port-restriction-check rule evaluates whether security groups restrict ports in general and is not specific to the SSH-from-0.0.0.0/0 condition described, and a periodic trigger does not provide real-time detection, so remediation can be delayed until the next evaluation cycle. That directly contradicts the as soon as possible requirement. B creates a Lambda function in each account to delete all security group rules, with an EventBridge rule matching security group update or creation events as the trigger. Deleting all rules rather than only the unrestricted SSH rule would strip every inbound rule from every security group in the account, breaking legitimate access to all workloads, which is a vastly destructive action for the stated problem; it also distributes a function into every account rather than relying on the organization's Config evaluation. D creates a Systems Manager Automation document in each account to inspect security groups and delete noncompliant rules, invoked by an EventBridge rule every hour. Both phu0298 and Slays stressed that the requirement is to act as soon as possible, and an hourly schedule leaves a security group exposing SSH to the internet for up to an hour after it appears, so this does not meet the requirement. C is correct.

Community Comment Notes

Community voted C unanimously. Srikantha characterized C as AWS Config plus real-time rule evaluation plus Lambda remediation, providing real-time security enforcement across all accounts. Slays explained that the option enables Config across all accounts, deploys the restricted-ssh rule, and sets up automatic remediation to address noncompliant security groups. phu0298 asked why not A and answered both objections precisely, that vpc-sg-port-restriction-check is not specific to this use case and that a periodic trigger delays remediation because it is not real-time. No alternative received support.