Question

A SysOps administrator must automatically remediate any security group that is modified to allow unrestricted inbound SSH access (0.0.0.0/0 on port 22). The remediation must remove the offending rule within seconds of the change, without requiring manual intervention or scheduled scans. AWS Config is already recording configuration changes in the account. Which approach meets these requirements with the LEAST operational overhead?

Accepted Answer

Create an AWS Config managed rule to detect the noncompliant security group, and configure automatic remediation using an AWS Systems Manager Automation runbook that removes the offending ingress rule.

Answer

Create a CloudWatch alarm on a custom metric for security group changes and configure it to trigger a Lambda function that revokes the rule.

Answer

Schedule a Lambda function every 5 minutes with EventBridge to scan all security groups and revoke any rule allowing 0.0.0.0/0 on port 22.

Answer

Enable VPC Flow Logs and create a CloudWatch Logs metric filter that triggers an SNS notification when SSH traffic from 0.0.0.0/0 is observed.