Question

A DevOps team manages hundreds of EC2 instances that must all use a specific NTP server value stored in a Systems Manager Parameter Store parameter named /config/ntp-server. Occasionally, an operator manually edits this parameter, which breaks time synchronization fleet-wide. The team wants an automated response that detects any change to this specific parameter and immediately reverts it to the approved value from a governed source, with no manual intervention. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Create an EventBridge rule that matches the CloudTrail 'PutParameter' API event scoped to the /config/ntp-server parameter, targeting an SSM Automation runbook that overwrites the parameter with the approved value; guard the runbook against self-triggering loops.

Answer

Enable AWS Config with a custom rule that periodically evaluates the parameter value and sends an SNS notification to the team when drift is detected so an operator can fix it.

Answer

Schedule a Lambda function every 5 minutes using EventBridge Scheduler to read the parameter and rewrite it to the approved value if it differs.

Answer

Enable Parameter Store parameter policies with an expiration on the parameter so that stale values are automatically deleted and recreated from the approved source.