Exam AWS Certified DevOps Engineer - Professional DOP-C02 topic 1 question 17 discussion

C is correct: A: lambda should be invoked by Eventbridge B: we need to act when there is events, not schedully D: subscribing to events from ALL AWS services incurs a huge cost

C of course. But A seems working, and does Aws Config work in this situation?

By creating an EventBridge event rule with the appropriate event pattern and configuring it to invoke the Lambda function, the DevOps engineer can effectively detect security group rule changes in near real-time, remove unrestricted rules, and send notifications to the security team. This solution leverages the event-driven architecture of EventBridge and the serverless execution of AWS Lambda, providing a scalable and efficient way to meet the company's security requirements.

selected answer:C

C the default bus includes events from AWS services. https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-event-bus.html

Wrong answers: A. SNS is used here to send a notification post-facto B. The question requires "near real time", an hour is not "near real time" D. AWS events come on the default event bus, you do not need a custom event bus

To meet the requirements, the DevOps engineer should create an Amazon EventBridge event rule that has the default event bus as the source. The rule's event pattern should match EC2 security group creation and modification events, and it should be configured to invoke the Lambda function. This solution will allow for near real-time detection of security group rule changes and will trigger the Lambda function to remove any unrestricted rules and send email notifications to the security team.

C is the answer

C. Create an Amazon EventBridge event rule that has the default event bus as the source. Define the rule’s event pattern to match EC2 security group creation and modification events. Configure the rule to invoke the Lambda function. The solution requires near real-time detection of changes to security group rules and immediate action to remove unrestricted rules and send email notifications to the security team. The AWS Lambda function created by the DevOps engineer can perform these actions, but it needs to be invoked whenever a security group rule is modified. Amazon EventBridge is a serverless event bus service that can receive and process events from various AWS services, including Amazon EC2 and Amazon SNS. An EventBridge event rule with the default event bus as the source can be created to match EC2 security group creation and modification events. This rule can then be configured to invoke the Lambda function, which can remove unrestricted rules and send email notifications to the security team.

https://repost.aws/knowledge-center/monitor-security-group-changes-ec2