Question

A CloudOps engineer must ensure that all newly created RDS instances in a production account automatically have their public accessibility setting disabled if a developer accidentally enables it. The remediation must run without human intervention and must be triggered by the configuration change. Which approach best meets this requirement?

Accepted Answer

Create an AWS Config managed rule to detect publicly accessible RDS instances and attach an automatic remediation action that invokes an SSM Automation document to disable public access.

Answer

Enable the AWS Foundational Security Best Practices standard in Security Hub and rely on its findings to disable public access on the RDS instances.

Answer

Create a CloudWatch alarm on the RDS PubliclyAccessible metric and send an SNS notification to the operations team to manually disable access.

Answer

Enable Amazon GuardDuty and create a filter for RDS public access findings that triggers an EventBridge rule to notify administrators.