Automated Compliance for Security Groups with AWS Config

SAA-C03 By islever Editorial Last updated

Design secure access to AWS resources.

Short answer

B Enable the restricted-ssh AWS Config managed rule and generate an Amazon Simple Notification Service (Amazon SNS) notification when a noncompliant rule is created.

Question

A solutions architect must provide an automated solution for a company's compliance policy that states security groups cannot include a rule that allows SSH from 0.0.0.0/0. The company needs to be notified if there is any breach in the policy. A solution is needed as soon as possible. What should the solutions architect do to meet these requirements with the LEAST operational overhead?
  1. Write an AWS Lambda script that monitors security groups for SSH being open to 0.0.0.0/0 addresses and creates a notification every time it finds one.
  2. Enable the restricted-ssh AWS Config managed rule and generate an Amazon Simple Notification Service (Amazon SNS) notification when a noncompliant rule is created. Correct Answer
  3. Create an IAM role with permissions to globally open security groups and network ACLs. Create an Amazon Simple Notification Service (Amazon SNS) topic to generate a notification every time the role is assumed by a user.
  4. Configure a service control policy (SCP) that prevents non-administrative users from creating or editing security groups. Create a notification in the ticketing system when a user requests a rule that needs administrator permissions.

Key Takeaways

The core concept is using AWS Config managed rules for continuous compliance, with the common trap being the choice of writing custom Lambda functions which increases operational overhead.

This question addresses automated compliance monitoring for AWS security groups to prevent unauthorized SSH access from 0.0.0.0/0. It establishes that AWS Config managed rules offer the least operational overhead compared to custom scripts or IAM-based notifications.

Common mistake: Many candidates incorrectly choose Option A (Lambda) because they believe it offers more control, failing to realize that managed rules are fully automated and require zero maintenance, thus having less operational overhead.

Expert Analysis

Why the Answer Is Correct

Option B is the correct answer because AWS Config provides a managed rule specifically named 'restricted-ssh' that automatically detects if security groups allow SSH (port 22) from 0.0.0.0/0. By integrating this with an Amazon SNS topic, the solution achieves automated notification of non-compliance without any code maintenance. This aligns perfectly with the requirement for the 'LEAST operational overhead.'

Why the Other Options Are Wrong

Option A requires writing, deploying, and maintaining a custom Lambda function, which introduces significant operational overhead compared to a managed service. Option C relies on IAM role assumption notifications, which only detect when a role is assumed, not whether a security group rule was actually created or modified, making it ineffective for this specific compliance check. Option D uses Service Control Policies (SCPs) to restrict permissions, which prevents users from creating/editing security groups entirely rather than allowing them but notifying on breach, failing the functional requirement.

Community Comment Notes

The community consensus strongly supports Option B, with multiple users noting that the other options are either too complex or functionally incorrect. As one user noted, "The others sound 'silly'... to say the least," highlighting the obvious superiority of the managed rule approach for this scenario.

Official Reference

https://docs.aws.amazon.com/config/latest/developerguide/restricted-ssh.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

When asked for the 'least operational overhead' in AWS compliance scenarios, always prioritize managed services (like AWS Config, GuardDuty, or Security Hub) over custom solutions (like Lambda or CloudFormation). Managed rules are pre-built, maintained by AWS, and integrate natively with event systems like SNS.

Frequently Asked Questions

Why is AWS Config preferred over Lambda for this task?

AWS Config managed rules are pre-built and maintained by AWS, requiring zero code maintenance. Lambda requires you to write, deploy, and maintain the script, increasing operational overhead.

Can SCPs be used to enforce this policy?

SCPs can deny the creation of insecure rules, but they do not provide the notification mechanism requested. The question asks for notification upon breach, which SCPs alone cannot do.

More SAA-C03 FAQ →

Community Votes

B
100%

100% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

  1. Naveena_Devanga 👍 4
    Option B https://docs.aws.amazon.com/config/latest/developerguide/restricted-ssh.html
  2. sandordini 👍 2 Answered B
    The others sound 'silly'... to say the least
  3. Andy_09 👍 8
    Option B
  4. asdfcdsxdfc 👍 2 Answered B
    B looks correct

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide