AWS Certified SysOps Administrator – Associate — Question 386
A company has a list of pre-approved Amazon Machine Images (AMIs) for developers to use to launch Amazon EC2 instances. However, developers are still launching EC2 instances from unapproved AMIs.
A SysOps administrator must implement a solution that automatically terminates any instances that are launched from unapproved AMIs.
Which solution will meet this requirement?
Answer options
- A. Set up an AWS Config managed rule to check if instances are running from AMIs that are on the list of pre-approved AMIs. Configure an automatic remediation action so that an AWS Systems Manager Automation runbook terminates any instances that are noncompliant with the rule.
- B. Store the list of pre-approved AMIs in an Amazon DynamoDB global table that is replicated to all AWS Regions that the developers use. Create Regional EC2 launch templates. Configure the launch templates to check AMIs against the list and to terminate any instances that are not on the list.
- C. Select the Amazon CloudWatch metric that shows all running instances and the AMIs that the instances were launched from. Create a CloudWatch alarm that terminates an instance if the metric shows the use of an unapproved AMI.
- D. Create a custom Amazon Inspector finding to compare a running instance's AMI against the list of pre-approved AMIs. Create an AWS Lambda function that terminates instances. Configure Amazon Inspector to report findings of unapproved AMIs to an Amazon Simple Queue Service (Amazon SQS) queue to invoke the Lambda function.
Correct answer: A
Explanation
AWS Config provides a managed rule (approved-amis-by-id) that continuously monitors EC2 instances to ensure they are launched from authorized AMIs. When an instance fails this check, AWS Config can automatically initiate a remediation action using an AWS Systems Manager Automation runbook to terminate the non-compliant resource. The other options are incorrect because Amazon Inspector, CloudWatch metrics, and EC2 launch templates do not natively support this continuous compliance check and automatic remediation workflow.