Question

A company runs 40 AWS accounts under AWS Organizations. The security team maintains a Config managed rule that flags any RDS instance with public accessibility enabled. They want a fully automated response: whenever a noncompliant RDS instance is detected in ANY member account, an SSM Automation document should run in that same member account to modify the instance and disable public accessibility. The remediation logic must be centrally defined and maintained in a single dedicated Security account, and the team wants to minimize per-account custom deployments. Which approach BEST meets these requirements?

Accepted Answer

Create an EventBridge rule in each member account that forwards Config compliance-change events to a custom event bus in the Security account, which triggers a central SSM Automation document that runs cross-account against the source member account.

Answer

In each member account, create an EventBridge rule on the default event bus matching Config compliance-change events and target a local Lambda function that calls the RDS ModifyDBInstance API.

Answer

Configure the organization's Config aggregator in the Security account, then create an EventBridge rule in the Security account that invokes a central SSM Automation document with an assumed cross-account role in each member account to modify the RDS instance.

Answer

Enable Config's built-in remediation action feature per account by attaching the AWS-managed SSM Automation document as an auto-remediation action on the Config rule, using EventBridge to trigger reruns.