Exam AWS DevOps Engineer Professional topic 1 question 151 discussion

A for me.https://aws.amazon.com/ru/premiumsupport/knowledge-center/config-resource-non-compliant/

The correct answer is A. Create an Amazon EventBridge (Amazon CloudWatch Events) rule that matches an AWS Config evaluation result of NON_COMPLIANT for the restricted-ssh rule. Configure an input transformer for the EventBridge (CloudWatch Events) rule. Configure the EventBridge (CloudWatch Events) rule to publish a notification to the SNS topic. This approach uses Amazon EventBridge (previously known as Amazon CloudWatch Events) to filter AWS Config evaluation results based on the restricted-ssh rule and its compliance status (NON_COMPLIANT). An input transformer can be used to customize the information contained in the notification, such as the name and ID of the noncompliant security group. The EventBridge (CloudWatch Events) rule can then be configured to publish a notification to the SNS topic, which will notify the appropriate personnel in real-time.

The difference between A and D is: A: matches an AWS Config evaluation result of NON_COMPLIANT for the restricted-ssh rule. D: matches all AWS Config evaluation results of NON_COMPLIANT --> Configure an input transformer for the restricted-ssh rule We do need to match all results first, then configure a specific input transformer.

A is correct as this is the most efficient way to deliver customized NON_COMPLIANT evaluation results to the subscriber. B is another roundabout way of doing the same but the way it describes is not enough. It will require more complex filtering logic on not just NON_COMPLIANT text but also other attributes of the message since all config change events occurring across all resources are sent to the SNS Topic and filtering only the ones for a specific config rule involves much more than just searching for NON_COMPLIANT text. https://stackoverflow.com/questions/64146609/how-to-configure-aws-config-to-send-compliance-change-notification-to-sns-topic

Short description Use an EventBridge rule with a custom event pattern and an input transformer to match an AWS Config evaluation rule output as NON_COMPLIANT. Then, route the response to an Amazon Simple Notification Service (Amazon SNS) topic.

I go with A

i agree