AWS Certified SysOps Administrator – Associate — Question 375

A company needs to enforce tagging requirements for Amazon DynamoDB tables in its AWS accounts. A SysOps administrator must implement a solution to identify and remediate all DynamoDB tables that do not have the appropriate tags.

Which solution will meet these requirements with the LEAST operational overhead?

Answer options

• A. Create a custom AWS Lambda function to evaluate and remediate all DynamoDB tables. Create an Amazon EventBridge scheduled rule to invoke the Lambda function.
• B. Create a custom AWS Lambda function to evaluate and remediate ail DynamoDB tables. Create an AWS Config custom rule to invoke the Lambda function.
• C. Use the required-tags AWS Config managed rule to evaluate all DynamoDB tables for the appropriate tags. Configure an automatic remediation action that uses an AWS Systems Manager Automation custom runbook.
• D. Create an Amazon EventBridge managed rule to evaluate all DynamoDB tables for the appropriate tags. Configure the EventBridge rule to run an AWS Systems Manager Automation custom runbook for remediation.

Correct answer: C

Explanation

Using the 'required-tags' AWS Config managed rule minimizes operational overhead because it eliminates the need to write and maintain custom code for evaluation. Combining this built-in rule with an AWS Systems Manager Automation runbook allows for automated remediation of non-compliant tables with minimal effort. Options A, B, and D are incorrect because they involve writing custom Lambda functions or using EventBridge features that do not natively support managed compliance evaluation.