AWS Certified DevOps Engineer - Professional DOP-C02 Exam - Question 42

Question

A company's application development team uses Linux-based Amazon EC2 instances as bastion hosts. Inbound SSH access to the bastion hosts is restricted to specific IP addresses, as defined in the associated security groups. The company's security team wants to receive a notification if the security group rules are modified to allow SSH access from any IP address.

What should a DevOps engineer do to meet this requirement?

Examice · Accepted Answer

To meet the requirement of receiving a notification if the security group rules are modified to allow SSH access from any IP address, the best solution is to create an AWS Config rule using the restricted-ssh managed rule. This rule checks whether security groups disallow unrestricted incoming SSH traffic (i.e., it verifies that the security group does not allow SSH access from 0.0.0.0/0). If a security group is found to be non-compliant with this rule (allowing SSH access from any IP address), it can trigger an automatic remediation to publish a message to an Amazon Simple Notification Service (Amazon SNS) topic. This precisely matches the need to be notified only when SSH access is allowed from any IP address, ensuring specific and targeted alerting.

ixdb · Answer

A is right.
The Config rule restricted-ssh will not check the ingress rule that use the CIDR other than 0.0.0.0/0 and not notify anyone.

MarDog · Answer

I'm going to have to go with A on this one:
https://aws.plainenglish.io/detecting-modifications-to-aws-ec2-security-groups-2ef8989a3350

https://repost.aws/knowledge-center/monitor-security-group-changes-ec2

tartarus23 · Answer

Explanation:

AWS Config provides a wide range of predefined rules that evaluate whether your AWS resources comply with common best practices. The restricted-ssh managed rule checks whether security groups that are in use disallow unrestricted incoming SSH traffic.

MozzyRZA · Answer

Using an Amazon EventBridge rule with a source of aws.cloudtrail and event name AuthorizeSecurityGroupIngress would indeed detect changes to security group rules. However, it would notify for any change, not specifically when the rule allows SSH access from any IP address.

AWS Config allows you to assess, audit, and evaluate the configurations of your AWS resources. The restricted-ssh managed rule specifically checks whether security groups disallow unrestricted incoming SSH traffic, which is exactly what the requirement is. Configuring automatic remediation to publish a message to an Amazon SNS topic would notify the security team when this non-compliant change is detected.

Diego1414 · Answer

Answer : C
Keyword "allow SSH access from any IP address"
A will send notification for any change made to the SG not just SSH

Anonymous · Answer

A is not meet the following requirements:
`if the security group rules are modified to allow ssh access FROM ANY IP ADDRESS`

alce2020 · Answer

I'll go for C although A could work too

2pk · Answer

Option A is the correct solution, Creating an AWS Config rule using the restricted-ssh managed rule (option C) focuses on checking whether security groups disallow unrestricted incoming SSH traffic. So not C

TroyMcLure · Answer

I'm not sure of what's wrong with C, but I'd go with A because of this:
"Create an EventsBridge rule to trigger when an API call is made to modify your security groups. Then, configure an Amazon SNS notification for events that match your rule."

https://repost.aws/knowledge-center/monitor-security-group-changes-ec2

hanbj · Answer

aws config's restricted-ssh is check 0.0.0.0/0 any open ssh port.
https://docs.aws.amazon.com/config/latest/developerguide/restricted-ssh.html

madperro · Answer

C, AWS Config is the tool to check and manage configuration.

jason7 · Answer

Option C: AWS Config is a service that can be used to audit AWS resources for compliance with security and compliance policies. However, the restricted-ssh managed rule only checks whether security groups disallow unrestricted incoming SSH traffic. It does not check whether security groups are modified to allow SSH access from any IP address.

vortegon · Answer

only send notification if allow traffic from any address.

CloudHandsOn · Answer

I'll go with C. AWS config can help with that SG change detection. Then, we can just send a notification.

herohiro · Answer

A is correct. C is incorrect because the restricted-ssh managed rule checks for the presence of unrestricted incoming SSH traffic, not changes to security group rules.
https://docs.aws.amazon.com/config/latest/developerguide/restricted-ssh.html

Akaza · Answer

I'll go A
C creating an AWS Config rule using the restricted-ssh managed rule would help check if security groups disallow unrestricted incoming SSH traffic, but it does not specifically notify when changes occur to allow SSH access from any IP address

Anonymous · Answer

I think C is the correnct answer, let's see the restricted-ssh rule documentation:
"Checks if the incoming SSH traffic for the security groups is accessible. The rule is COMPLIANT when IP addresses of the incoming SSH traffic in the security groups are restricted (CIDR other than 0.0.0.0/0). This rule applies only to IPv4.

Identifier: INCOMING_SSH_DISABLED

Resource Types: AWS::EC2::SecurityGroup

Trigger type: Configuration changes"

Why not A? well, A would catch an event and trigger it on any modification of a security group inbound rules. The question wants to be notified only about SSH unrestricted. While there are ways to do it with EventBridge, the answer does not contain any detail. However, C is a complete solution to the problem.

rdoty · Answer

It is definitely C: https://docs.aws.amazon.com/config/latest/developerguide/restricted-ssh.html#:~:text=Checks%20if%20the%20incoming%20SSH%20traffic%20for%20the%20security%20groups%20is%20accessible.%20The%20rule%20is%20COMPLIANT%20when%20IP%20addresses%20of%20the%20incoming%20SSH%20traffic%20in%20the%20security%20groups%20are%20restricted%20(CIDR%20other%20than%200.0.0.0/0).%20This%20rule%20applies%20only%20to%20IPv4.

s50600822 · Answer

From a security perspective, C is not safe enough since it's looking for 0.0.0.0/0
https://docs.aws.amazon.com/config/latest/developerguide/restricted-ssh.html
Though A potentially is better if the check look for IPs that are outside of allowed address, it doesn't clearly say that either... so no idea.

cocegas · Answer

I think it is C.

This statement "The company's security team wants to receive a notification if the security group rules are modified to allow SSH access from any IP address." means an entry lfrom 0.0.0.0/0, which the AWS config checks.

RVivek · Answer

Please ginore my earlier comments
The anwer is C.   
1. A will send email notification for any security group change. Requirement is notification of unrestricted ssh access
2.  SSH access from  any IP address means entire internet ( 0.0.0.0/0)

Geetar · Answer

Config does this out of the box. It seems some people don't get what 0.0.0.0/0 means in networking terms. It is the cidr for 'any' IP address.

YR4591 · Answer

C, "any" means 0.0.0.0/0

zolthar_z · Answer

C: Because this link shows the changes with Event Bridge but the source is EC2 no cloudtrail https://repost.aws/knowledge-center/monitor-security-group-changes-ec2

a54b16f · Answer

keyword: "ANY"

Cervus18 · Answer

restricted-ssh : The rule is COMPLIANT if the IP addresses of the incoming SSH traffic in the security groups are restricted (CIDR other than 0.0.0.0/0 or ::/0). Otherwise, NON_COMPLIANT.

https://docs.aws.amazon.com/config/latest/developerguide/restricted-ssh.html

That addresses exactly the requirement !

jamesf · Answer

keywords: Inbound SSH access
C restricted for SSH port (22) only from ANY address

anuvindhs · Answer

C is the answer : https://docs.aws.amazon.com/config/latest/developerguide/notifications-for-AWS-Config.html

Impromptu · Answer

A: Would send a message to SNS for every change, so not only SSH but all other ports/services. This would be too much.

I do get the other comments that C would only notify for 0.0.0.0/0 but I think that is what the question is trying to state with "any IP".

teo2157 · Answer

The key point here is "allow SSH access from any IP address" which is exactly "the restricted-ssh managed rule", said that, it's C

vherman · Answer

C is correct

Anonymous · Answer

C works better, as A will trigger for any inbound rule, while asks is for 22 only

rhinozD · Answer

I think A could work but AuthorizeSecurityGroupIngress is a little bit wider. if someone modifies(or adds a rule) the inbound rule to non-0.0.0.0/0, it'll send a notification too.
So, I'll go with C.

RVivek · Answer

A alerts if any IP address is added to allowed IP address.
C- Alerts only if SSH is allowed to entire internet 0.0.0.0/0

bugincloud · Answer

IMO A should be the answer,
https://docs.aws.amazon.com/config/latest/developerguide/restricted-ssh.html
Option C is only correct if the CIDR for ssh is 0.0.0.0/0.
(Although in option A the eventbridge rule source should be aws.ec2)

Dushank · Answer

1
The best solution to meet this requirement is to create an Amazon EventBridge rule with a source of aws.cloudtrail and the event name AuthorizeSecurityGroupIngress. This will allow you to receive a notification whenever a security group ingress rule is created or modified.

Coffeinerd · Answer

C. Formulation and wording points to ANY IP adress (0.0.0.0/0) CIDR block. So A will notify on all changes.

kyuhuck · Answer

a is right~~~~
https://aws.amazon.com/premiumsupport/knowlege-center/monitor-security-group-cahnge-ec2/

4555894 · Answer

https://aws.amazon.com/premiumsupport/knowledge-center/monitor-security-group-changes-ec2/

zijo · Answer

Answer is C 
The restricted-ssh managed rule in AWS Config helps ensure your bastion host security groups are locked down for SSH access. It specifically checks if incoming SSH traffic is accessible for the security groups.
The rule is considered COMPLIANT if:
SSH access is not open to the public (meaning the rule doesn't find a security group allowing 0.0.0.0/0 for port 22).
SSH access is restricted to specific IP addresses or security groups using CIDR notation (e.g., 10.0.0.0/16).
If the rule detects a security group allowing SSH access from anywhere (0.0.0.0/0), it triggers a NON_COMPLIANT status.

c3518fc · Answer

A. This is the correct solution because it leverages Amazon EventBridge to monitor for changes to the security group rules, specifically the AuthorizeSecurityGroupIngress event, which indicates that the security group rules have been modified to allow SSH access from any IP address.

By creating an EventBridge rule with the appropriate event pattern and defining an Amazon SNS topic as the target, the DevOps engineer can ensure that the security team receives a notification whenever the security group rules are modified in an undesirable way.

seetpt · Answer

i vote for c

liuyomz · Answer

C makes way more sense from the way AWS wants us to do it

Sodev · Answer

I think keyword for C must be "ALL".
ANY means when new IP is added to security group, so SNS will be triggered

steli0 · Answer

A would be right if the "ANY" word describing all IPs (0.0.0.0/0) wasn't there. CloudTrail will notify you for any SG rule change.

Geetar · Answer

I'm going with C, as the config rule checks for ssh access from 'any' aka 0.0.0.0/0 which is the requirement. A will notify on any action on a security group.

shehenshah14 · Answer

A should be right
C would not change to non-compliant if someone modifies the IP address to their own IP address, it only makes non-compliant when IP chosen to be 0.0.0.0/0

helloworld_2024 · Answer

a is right

thanhnv142 · Answer

C is correct: only send noti if allow traffic from any address.

TioChico · Answer

A is right

shammous · Answer

A! "AWS Config provides rules such as restricted-ssh that can be used to detect Security Groups that have SSH access open for any IP".

BrusingWayne · Answer

Option C (Incorrect):

AWS Config rules are good for ongoing compliance checks, but they don't provide real-time notifications for changes.
    Config rules run periodically, which could result in a delay between the change and the notification.
    The automatic remediation aspect is not required in this scenario and could potentially interfere with legitimate changes.

Hence, it is Option A.

teo2157 · Answer

Very, very, very hard question. I think the key point here is the ANY, based on that, it's C

AWS Certified DevOps Engineer - Professional DOP-C02 Exam - Question 42

Discussion