A compliance team wants continuous visibility into whether every EBS volume in an account remains encrypted, with automatic flagging the moment a volume becomes non-compliant, plus a historical record of every configuration change made to that volume over time. Which service should they use?
- AWS Config, which continuously records configuration changes for supported resources and can evaluate them against managed or custom rules such as one that checks for encrypted volumes
- AWS CloudTrail, which logs the history of API calls made by users, roles, and services in the account
- Amazon Inspector, which scans EC2 instances and container images for known software vulnerabilities
- AWS Trusted Advisor, which provides a fixed set of best-practice checks refreshed on a set schedule
Why A? And why not the others?
Correct answer: A. AWS Config, which continuously records configuration changes for supported resources and can evaluate them against managed or custom rules such as one that checks for encrypted volumes
AWS Config continuously records the configuration state of supported resources, including EBS volumes, and maintains a timeline of every configuration change; it can also evaluate resources against managed rules, such as one that checks whether a volume is encrypted, flagging noncompliant resources automatically as their configuration changes. The option describing a log of API calls is wrong because that captures who called which API and when, not the resulting configuration state of a volume or whether it complies with an encryption requirement. The option describing vulnerability scanning of instances and container images is wrong because that checks for known software vulnerabilities and network exposure, an entirely different concern from tracking configuration state and evaluating a compliance rule. The option describing a fixed set of periodically refreshed checks is wrong because it does not provide continuous, resource-specific configuration history or rule-based compliance evaluation targeted at a particular setting like volume encryption.
Source: AWS Config documentation: What Is AWS Config? (https://docs.aws.amazon.com/config/latest/developerguide/WhatIsConfig.html)