An ops team wants non-compliant resources remediated automatically — e.g., when an S3 bucket becomes public, a runbook removes the public access within minutes. What's the standard event-driven pattern?
A.CloudWatch Logs subscription filter invoking Lambda every hour
Log subscriptions stream logs — they don't detect config compliance state.
B.AWS Config rule detecting the violation + EventBridge/SSM Automation remediation
Correct. Config + EventBridge + SSM Automation is the textbook auto-remediation chain.
C.CloudTrail lookup run manually each morning
Manual lookups aren't remediation and don't scale.
D.An S3 lifecycle rule to delete the bucket
Lifecycle rules manage object retention, not bucket permissions.
Why this answer
Config rules detect non-compliance continuously; EventBridge routes the compliance event to an SSM Automation runbook (or Lambda) for auto-remediation — the designed closed-loop pattern for operational compliance.
Correct answer: B · Last reviewed 2026-10-26
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Monitoring & Remediation practice session.
Practice Monitoring & Remediation