Detect and Remediate Drift Using AWS Config and Automated Controls

Table of Contents

1. Challenge

   Identify the Non-Compliant EC2 Resource

   Verify the non-compliant EC2 resource exists:

   • Review the existing Amazon EC2 architecture in the console.
   • Identify and note the VPC security group ID allowing public access SSH from anywhere.
   • Validate that the pre-provisioned IAM ConfigAutoRemediation role was created.
2. Challenge

   Implement AWS Config for Monitoring All Security Group Resource Types

   You now need to leverage AWS Config to monitor and evaluate recorded resources:

   • Create a new AWS Config rule that records configuration history for AWS EC2 security groups using continuous monitoring.
   • Leverage the AWS-managed rule restricted-ssh to monitor security groups that allow public access from anywhere (0.0.0.0/0) via SSH.

   | NOTE: AWS Config can take several minutes to successfully update resource statuses, so please allow several minutes for the resource list to update.

3. Challenge

   Validate Automatic Detection and Remediation

   With all the pieces in place, you now need to detect non-compliant resources and automatically remediate them:

   • Verify that monitored resources get evaluated by AWS Config (NON_COMPLIANT)
   • Enable automatic remediation for any noncompliant security groups using the AWS-DisablePublicAccessForSecurityGroup automation, and use the pre-provisioned IAM role called ConfigAutoRemediation during configuration
   • Confirm the automatic remediation action successfully removed the offending rule in the security group
   • Review the configuration history for the remediated security group with AWS Config

   | NOTE: AWS Config can take several minutes to successfully update compliance status, so please allow several minutes for this update.