Question

A CloudOps engineer must automatically remediate any security group rule that allows inbound SSH (port 22) from 0.0.0.0/0. When such a rule is created, the offending rule must be revoked within seconds without manual intervention. The company already logs all management events to CloudTrail. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Create an EventBridge rule that matches the AuthorizeSecurityGroupIngress API event from CloudTrail and targets a Lambda function that inspects the rule and calls RevokeSecurityGroupIngress if it matches port 22 from 0.0.0.0/0.

Answer

Configure a CloudWatch alarm on a metric filter that scans CloudTrail logs for AuthorizeSecurityGroupIngress and sends an SNS notification to the security team for manual review.

Answer

Schedule a Systems Manager Automation runbook to run every hour that lists all security groups and revokes any rule allowing SSH from 0.0.0.0/0.

Answer

Enable AWS Config with the restricted-ssh managed rule and rely on the Config dashboard to display noncompliant security groups for the team to fix.