Deploy an org-wide Config aggregator and remediate noncompliant S3 buckets with a Lambda function

SCS-C02 By islever Editorial Last updated

Evaluate the compliance of AWS resources.

Short answer

A Deploy an org-wide Config aggregator and use a Lambda remediation to fix existing and future noncompliant S3 buckets.

Question

A company uses AWS Config rules to identify Amazon S3 buckets that are not compliant with the company’s data protection policy. The S3 buckets are hosted in several AWS Regions and several AWS accounts. The accounts are in an organization in AWS Organizations. The company needs a solution to remediate the organization’s existing noncompliant S3 buckets and any noncompliant S3 buckets that are created in the future. Which solution will meet these requirements?
  1. Deploy an AWS Config aggregator with organization-wide resource data aggregation. Create an AWS Lambda function that responds to AWS Config findings of noncompliant S3 buckets by deleting or reconfiguring the S3 buckets. Correct Answer
  2. Deploy an AWS Config aggregator with organization-wide resource data aggregation. Create an SCP that contains a Deny statement that prevents the creation of new noncompliant S3 buckets. Apply the SCP to all OUs in the organization.
  3. Deploy an AWS Config aggregator that scopes only the accounts and Regions that the company currently uses. Create an AWS Lambda function that responds to AWS Config findings of noncompliant S3 buckets by deleting or reconfiguring the S3 buckets.
  4. Deploy an AWS Config aggregator that scopes only the accounts and Regions that the company currently uses. Create an SCP that contains a Deny statement that prevents the creation of new noncompliant S3 buckets. Apply the SCP to all OUs in the organization.

Key Takeaways

The requirement covers existing AND future noncompliant buckets. An org-wide Config aggregator gives the centralized view, and a Lambda remediation reacts to findings to fix existing buckets—something SCPs cannot do (SCPs only prevent new ones). A scopes the aggregator org-wide (better than C/D's limited scope) and includes the remediation Lambda, so A meets both parts. B's SCP-only approach fails the existing-bucket remediation.

To fix both existing and future noncompliant S3 buckets across many accounts and Regions, deploy an AWS Config aggregator with organization-wide aggregation for full visibility, and use a Lambda function triggered by Config findings to delete or reconfigure noncompliant buckets. SCPs alone only prevent future violations and cannot remediate what already exists, so the Lambda is required for the 'existing' part of the requirement.

Common mistake: Using only an SCP (B/D)—SCPs prevent future noncompliant buckets but cannot remediate the existing ones the requirement also mentions. Scoping the aggregator to only current accounts/Regions (C/D)—the org is multi-account/multi-Region, so an org-wide aggregator (A) gives complete visibility. A is the complete answer.

Expert Analysis

Why the Answer Is Correct

An AWS Config aggregator with organization-wide aggregation provides a single view of compliance across all accounts and Regions, and a Lambda function responding to Config findings can delete or reconfigure noncompliant S3 buckets—remediating existing violations. Because the requirement explicitly includes fixing already-existing noncompliant buckets, the Lambda remediation is necessary; SCPs alone cannot retroactively fix them.

Why the Other Options Are Wrong

B and D rely on SCPs, which prevent future noncompliant buckets but do nothing for the existing ones the requirement also covers. C and D scope the aggregator to only currently used accounts/Regions, missing the org-wide visibility an organization aggregator (A) provides. A is the complete solution.

Community Comment Notes

Community voted A (75), with B a 25 minority. Commenters noted SCPs only prevent future violations and cannot remediate existing noncompliant buckets, so the Lambda remediation plus org-wide aggregator (A) is required. A confirmed.

Official Reference

https://docs.aws.amazon.com/config/latest/developerguide/aggregate-data.html

This link opens the official vendor documentation in a new tab.

Community Votes

A
75%
B
25%

75% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

  1. Pmktechno 👍 1 Answered A
    AWS Config Aggregator: This allows you to aggregate AWS Config data from multiple accounts and Regions into a single account, providing a comprehensive view of compliance status across the organization. AWS Lambda Function: By creating a Lambda function that responds to noncompliant findings, you can automate the remediation process. This function can be configured to either delete or reconfigure noncompliant S3 buckets, ensuring they meet the company's data protection policy. This approach ensures that both existing and future noncompliant S3 buckets are addressed automatically, maintaining compliance across the organization.
  2. Pat9595 👍 1 Answered A
    SCPs only prevent future violations but do not remediate existing noncompliant S3 buckets. The requirement includes fixing already existing noncompliant S3 buckets, which SCPs alone cannot address.
  3. phmeeeee 👍 1 Answered A
    A - Ensures visibility across all AWS accounts and Regions in the org and Lambda to remidiation non-complicnce resource. SCP is for prevention not remediation such a thing.
  4. Bachhu 👍 1 Answered B
    Seems like B as full AWS organisation.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Preserve EC2 forensic evidence by isolating first, then capturing memory before stopping the instance

S-grade

Grant the report Lambda Security Hub read-only access because findings are already in Security Hub

S-grade

Deny inbound MySQL 3306 and allow outbound TLS 443 with ephemeral return in a custom NACL

S-grade

Prepare a PHI/public-bucket audit with Macie, Audit Manager, and Security Hub FSBP

S-grade

← Back to SCS-C02 Study Guide