AWS Config Rules and SSM Automation Remediation – SAP-C02 Study Guide

Purpose of This Lesson

This lesson demonstrates a compliance workflow that combines AWS Config and AWS Systems Manager Automation:

1. AWS Config evaluates security groups against a rule.
2. Noncompliant security groups are identified.
3. An SSM Automation runbook removes unauthorized ingress rules.
4. The security group is brought back into compliance without requiring manual rule changes.

The example allows unrestricted inbound access only to TCP port 80 and treats other unrestricted inbound ports as noncompliant.

Key Concepts

AWS Config managed rules

AWS Config continuously or periodically evaluates AWS resources against configuration rules. A managed rule can often be configured without writing custom Lambda code.

The example uses the managed rule named:

VPC_SG_OPEN_ONLY_TO_AUTHORIZED_PORTS

This rule evaluates EC2 security groups and checks whether unrestricted inbound TCP or UDP access is limited to the ports specified in the rule parameters.

For this scenario:

• Authorized TCP port: 80
• Authorized UDP ports: none
• Source considered unrestricted: 0.0.0.0/0
• Resource type: EC2 security groups

A security group allowing TCP port 80 from the internet can remain compliant. Unrestricted SSH, RDP, or other inbound TCP ports can be reported as noncompliant.

SSM Automation remediation

AWS Systems Manager Automation runs predefined or custom runbooks to perform operational actions. It can be configured as the remediation mechanism for an AWS Config rule.

The example uses the runbook:

AWS-DisablePublicAccessForSecurityGroup

The remediation receives values such as:

• GroupId: The ID of the noncompliant security group
• CidrIp: 0.0.0.0/0, representing unrestricted IPv4 access
• AutomationAssumeRole: The ARN of an IAM role that Systems Manager assumes to perform the action

The runbook removes the matching public ingress rule rather than changing the entire security group.

IAM permissions are central to remediation

The automation role needs permissions for both the Systems Manager workflow and the resource operation. In the demonstrated setup, the role includes an AWS-managed Systems Manager automation policy and an inline permission for the security group operation:

ec2:RevokeSecurityGroupIngress

The exact permissions should be reviewed against the selected runbook and constrained to the required resources and actions wherever possible.

The role trust relationship must also allow the relevant Systems Manager service to assume it. An ARN alone is not sufficient if the role’s trust policy is incorrect.

Detection and remediation are separate stages

AWS Config determines whether the resource is compliant. SSM Automation performs the corrective action. These services have different responsibilities:

Function	Service	Example
Configuration evaluation	AWS Config	Detect unrestricted ingress on unauthorized ports
Remediation execution	Systems Manager Automation	Revoke a public security group ingress rule
Authorization	IAM	Allow the automation role to perform the required EC2 action
Resource being changed	Amazon EC2	Security group ingress rules

A Config rule by itself does not necessarily correct a resource. Remediation must be configured separately.

Exam-Relevant Takeaways

• Use AWS Config to assess resource configuration and compliance.
• Use SSM Automation to execute repeatable remediation actions.
• A Config rule can be paired with a managed SSM Automation runbook.
• The remediation configuration requires an IAM role ARN that Automation can assume.
• Rule parameters matter. In this example, port 80 is allowed, while other unrestricted TCP ports are not.
• The rule targets TCP and UDP ports separately. An ICMP rule is not necessarily evaluated by a port-based TCP/UDP rule.
• 0.0.0.0/0 means unrestricted IPv4 access. IPv6 access uses ::/0 and may require separate consideration.
• AWS Config evaluation and remediation are not necessarily instantaneous. Allow time for evaluation, refresh the compliance result, and inspect the remediation execution status.
• Remediation can be initiated manually or configured for automatic execution, depending on the remediation settings and operational requirements.
• Removing the remediation configuration does not undo changes already made by the runbook.

Architecture Decision Guide

Requirement	Recommended approach	Important consideration
Detect publicly accessible security group ports	AWS Config managed rule	Configure the authorized TCP and UDP ports accurately
Remove a noncompliant ingress rule	SSM Automation runbook	Grant the automation role only the permissions it needs
Apply a custom or multi-step correction	Custom SSM Automation runbook	Validate inputs, error handling, and rollback behavior
Automatically correct drift	Config remediation with automatic execution	Test carefully because remediation changes production resources
Correct only selected findings	Manual remediation or controlled automation	Useful where exceptions require human review
Handle IPv6 public access	Configure rules and remediation for IPv6 as applicable	0.0.0.0/0 does not match ::/0
Enforce a security baseline across accounts	AWS Config aggregators, conformance packs, or AWS Organizations integration	Central governance and cross-account permissions may be required

Common Exam Traps

• Confusing detection with correction: AWS Config reports compliance; it does not automatically fix every violation unless remediation is configured.
• Using the wrong service for the requirement: Systems Manager Automation is appropriate for runbook-based operational actions. AWS Security Hub, Amazon Inspector, and AWS Config address different security and compliance use cases.
• Forgetting the automation role: The remediation configuration needs an assumable IAM role with permissions for the runbook’s actions.
• Assuming all protocols are evaluated: A rule configured for authorized TCP ports does not automatically mean ICMP or every other protocol is covered.
• Ignoring IPv6: Restricting 0.0.0.0/0 does not restrict ::/0.
• Allowing an overly broad remediation role: The role should not receive unrestricted administrator permissions when a narrowly scoped EC2 action is sufficient.
• Expecting immediate results: Config evaluations, remediation queuing, and resource updates can occur at different times.
• Deleting the rule as a fix: Removing the Config rule stops that compliance check; it does not remediate the existing security group and may reduce governance coverage.
• Forgetting exceptions: A legitimate administrative access path may be intentionally restricted to a corporate CIDR range or a bastion host. Removing all non-port-80 access can break operations if the policy is too simplistic.

Real-World Engineer Notes

A rule that allows TCP port 80 from the internet is intentionally permissive for the demonstration. In production, public web access is commonly terminated at an Application Load Balancer, CloudFront distribution, or another controlled ingress layer. Application instances can then accept traffic only from the appropriate load balancer security group rather than from 0.0.0.0/0.

Before enabling automatic remediation, consider:

• Whether the rule has approved exceptions
• Whether the remediation can interrupt administration or application traffic
• Whether the runbook removes only the offending rule or modifies broader security group state
• Whether IPv6, self-referencing rules, and security-group-to-security-group rules need separate controls
• Whether an audit trail is available through AWS Config history, Systems Manager execution history, and CloudTrail
• Whether remediation failures generate notifications through EventBridge, Amazon SNS, or an incident-management integration

For larger environments, use infrastructure as code and preventive controls in addition to detective remediation. Automatic correction is useful for drift, but it should not become the only way security group intent is maintained.

Quick Reference Summary

• AWS Config: Evaluates resource configuration against compliance rules.
• Managed rule: VPC_SG_OPEN_ONLY_TO_AUTHORIZED_PORTS
• Example authorized port: TCP 80
• Public IPv4 CIDR: 0.0.0.0/0
• Remediation service: AWS Systems Manager Automation
• Example runbook: AWS-DisablePublicAccessForSecurityGroup
• Automation input: Security group ID, public CIDR, and automation role ARN
• Example IAM action: ec2:RevokeSecurityGroupIngress
• Workflow: Evaluate → identify noncompliance → run remediation → verify resource state
• Operational caution: Test automatic remediation and account for legitimate exceptions.

Flashcards

1. Q: What is AWS Config responsible for in a compliance workflow?

A: Evaluating AWS resources against configuration rules and reporting compliance status.

1. Q: What service can remediate a noncompliant AWS Config finding using a runbook?

A: AWS Systems Manager Automation.

1. Q: What does 0.0.0.0/0 represent in a security group rule?

A: Unrestricted inbound IPv4 access.

1. Q: What does the VPC_SG_OPEN_ONLY_TO_AUTHORIZED_PORTS rule evaluate?

A: Whether security groups with unrestricted inbound traffic allow only configured authorized TCP or UDP ports.

1. Q: Which IAM permission is needed to remove an ingress rule in the example?

A: ec2:RevokeSecurityGroupIngress.

1. Q: Why is an Automation assume role required?

A: Systems Manager assumes the role to obtain permission to execute the remediation actions.

1. Q: Does deleting a Config rule remove an existing insecure security group rule?

A: No. Deleting the rule stops the evaluation but does not change the security group.

1. Q: Why might an ICMP rule not be removed by a TCP-port remediation workflow?

A: ICMP is not a TCP port and may not be covered by a rule configured to evaluate TCP or UDP ports.

1. Q: What is the difference between manual and automatic Config remediation?

A: Manual remediation requires an operator to initiate the action; automatic remediation runs when the configured noncompliance condition is detected.

1. Q: What additional public CIDR should be considered for IPv6?

A: ::/0.

Practice Questions

Question 1

A security team wants to detect EC2 security groups that allow unrestricted inbound traffic except for TCP port 80. When a violation is found, the team wants AWS to remove the offending ingress rule automatically. Which design best meets the requirement?

A. Use Amazon Inspector to scan the security groups and invoke an AWS Lambda function manually.

B. Use an AWS Config managed rule with authorized TCP port 80 and configure an SSM Automation remediation runbook.

C. Use AWS CloudTrail to detect AuthorizeSecurityGroupIngress events and configure an SNS notification.

D. Use AWS WAF to block all traffic except HTTP traffic.

Correct answer: B

Explanation: AWS Config evaluates the security group against the authorized-port policy, while SSM Automation can execute a remediation runbook to revoke the noncompliant ingress rule. The other services do not provide this exact configuration-compliance and remediation workflow.

Question 2

An AWS Config remediation action fails because the Systems Manager runbook cannot modify the target security group. Which issue is the most likely cause?

A. The security group has no outbound rule.

B. The automation role lacks the required EC2 permission or has an invalid trust policy.

C. AWS Config cannot evaluate security groups in a VPC.

D. The security group is attached to an EC2 instance.

Correct answer: B

Explanation: The remediation role must be assumable by Systems Manager and must have the permissions required by the runbook, such as ec2:RevokeSecurityGroupIngress.

Question 3

A Config rule is configured to allow TCP port 80 from 0.0.0.0/0. An administrator observes that an unrestricted ICMP rule remains after remediation. What is the best explanation?

A. Security groups cannot contain ICMP rules.

B. ICMP is not a TCP or UDP port and may not be evaluated or removed by this port-based rule and remediation.

C. AWS Config automatically ignores all public rules.

D. The remediation role can modify only outbound rules.

Correct answer: B

Explanation: The rule is based on authorized TCP and UDP ports. ICMP does not use TCP or UDP ports, so a separate control may be required.

Question 4

A company enables automatic remediation for all noncompliant public security group rules. A production operations team then loses SSH access because SSH from a corporate CIDR range was removed. What is the best improvement?

A. Grant the remediation role administrator access.

B. Delete AWS Config from the account.

C. Define approved exceptions or narrow the compliance rule so legitimate administrative access is not treated as a violation.

D. Allow SSH from 0.0.0.0/0 for all security groups.

Correct answer: C

Explanation: Compliance rules must reflect the organization’s intended access model. Approved CIDRs, dedicated administrative security groups, tags, or exception workflows can prevent valid access from being removed. Broadening access or disabling governance is not an appropriate solution.

Question 5

An engineer manually starts remediation for a noncompliant security group, but the Config console initially still shows the resource as noncompliant. What should the engineer expect?

A. The remediation always failed.

B. Config evaluation and SSM execution can be asynchronous, so the engineer should check the Automation execution and refresh or reevaluate the Config result.

C. A security group cannot be remediated while attached to an instance.

D. Config marks resources compliant only after the security group is deleted.

Correct answer: B

Explanation: Finding evaluation, remediation queuing, the security group update, and the next compliance evaluation may not complete simultaneously. Execution history and refreshed evaluation results should be checked before concluding that remediation failed.