Question

A CloudOps engineer must ensure that any S3 bucket created without default encryption is automatically remediated within minutes, with no human intervention. AWS Config already has a managed rule (s3-bucket-server-side-encryption-enabled) evaluating bucket compliance. The team wants a low-maintenance, event-driven solution that applies default encryption to noncompliant buckets. Which approach best meets these requirements?

Accepted Answer

Configure the AWS Config rule with an automatic remediation action that invokes the AWS-EnableS3BucketEncryption Systems Manager Automation document.

Answer

Create a CloudWatch alarm on the AWS Config compliance metric that triggers an SNS notification to the security team for manual remediation.

Answer

Enable S3 Event Notifications for bucket creation events and forward them to an SQS queue polled by an EC2 instance running a remediation script.

Answer

Schedule a Lambda function every 5 minutes using EventBridge to scan all buckets and enable encryption on those missing it.