EventBridge, Config and automated remediation
Operations teams are expected to detect drift and fix it automatically. The exam tests which service detects, which one reacts, and which one performs the fix.
Who does what
| Service | Role |
|---|---|
| CloudTrail | Records API activity (who did what) |
| AWS Config | Records resource configuration history and evaluates it against rules |
| EventBridge | Routes events to targets based on rules and schedules |
| Systems Manager Automation | Runs runbooks that change resources |
| Security Hub | Aggregates findings from other security services |
AWS Config
Config tracks configuration items for supported resources. A Config rule evaluates them and marks each resource compliant or noncompliant. Rules can be AWS managed (for example s3-bucket-versioning-enabled, required-tags, restricted-ssh) or custom using Lambda or Guard.
A rule can be triggered by a configuration change or on a periodic schedule. A conformance pack deploys a set of rules and remediations together. An aggregator gives a multi-account, multi-Region view.
Remediation
Config can attach a remediation action to a rule. It uses a Systems Manager Automation document, such as AWS-EnableS3BucketEncryption or one you write. Choose:
- Manual: an operator starts it from the console.
- Automatic: Config runs it for every noncompliant resource, with retry settings.
The remediation runs with an Automation assume role that must allow the fix, for example s3:PutBucketVersioning.
EventBridge for event-driven fixes
When an event should trigger work immediately, create an EventBridge rule with an event pattern. Typical sources:
- CloudTrail management events (
detail-type: AWS API Call via CloudTrail). - Config compliance change events.
- Security Hub findings, for example an open management port.
- Service events such as EC2 state changes.
Targets include Lambda, SNS, SQS, Step Functions and SSM Automation. A schedule rule replaces cron for periodic jobs, for example a Lambda that publishes a weekly SNS message.
A small pattern example:
{
"source": ["aws.ec2"],
"detail-type": ["EC2 Instance State-change Notification"],
"detail": { "state": ["stopped"] }
}Choosing the pattern
- Need a fix for any noncompliant resource, including ones that already exist: Config rule plus remediation.
- Need to react to one specific event within seconds: EventBridge rule plus target.
- Need to notify a team: add SNS as a target.
Exam traps
- CloudTrail does not evaluate compliance. Config does. CloudTrail shows who made the call.
- Config alone does not fix anything. Remediation needs an Automation document and an IAM role.
- Rules evaluate existing resources, but preventive controls such as SCPs or IAM conditions stop the action before it happens.
- EventBridge was formerly named CloudWatch Events. They are the same service.
- Config needs a recorder turned on in each Region, otherwise rules have nothing to evaluate.
Practice questions
Choose an answer, then review the explanation to check your understanding.
1. Every S3 bucket must have versioning enabled, and noncompliant buckets must be fixed without human action. Which design fits best?
Show answer
Answer: B.AWS Config evaluates configuration against rules and can attach automatic remediation that runs a Systems Manager Automation runbook.
2. A team wants an immediate notification and a Lambda function run when a security group is changed to allow port 22 from anywhere. What should trigger the function?
Show answer
Answer: B.EventBridge receives CloudTrail management events and Config compliance changes, and can target Lambda, SNS or SSM Automation.
3. Which service records who called the API that terminated an EC2 instance?
Show answer
Answer: B.CloudTrail records API calls (who, when, from where). Config records what the resource configuration looked like over time.
4. Instances without a Department tag must be found across all accounts in an organization. Which feature gives one view?
Show answer
Answer: A.A Config aggregator collects configuration and compliance data from multiple accounts and Regions into one place.