Question

A financial services company requires that all EBS volumes be encrypted. A DevOps engineer must build automated remediation that detects when an unencrypted EBS volume is attached to a running EC2 instance and creates an encrypted copy, while ensuring the security team is notified for any volume that cannot be automatically remediated. AWS Config already has a rule (encrypted-volumes) evaluating compliance. The engineer wants the remediation to run only after Config marks a resource NON_COMPLIANT, and to gracefully handle failures without silently dropping them. Which approach BEST meets these requirements?

Accepted Answer

Create an EventBridge rule matching Config compliance-change events where complianceType is NON_COMPLIANT for the encrypted-volumes rule, target an SSM Automation document that snapshots and re-creates the volume as encrypted, and configure the Automation document with onFailure steps plus an EventBridge dead-letter queue on the rule target to capture undeliverable events, with SNS notification on failure.

Answer

Attach an AWS Config auto-remediation action to the encrypted-volumes rule using a custom SSM Automation document, and rely on Config's built-in retry to notify the security team when remediation fails.

Answer

Schedule an EventBridge rule every 5 minutes to invoke a Lambda function that scans all EBS volumes with DescribeVolumes, encrypts the unencrypted ones, and publishes to SNS if any encryption call fails.

Answer

Create an EventBridge rule on EC2 volume attachment API calls in CloudTrail, target a Lambda function that checks encryption status and re-creates the volume, and log failures to CloudWatch Logs for the security team to review.