A company's application development team uses Linux-based Amazon EC2 instances as bastion hosts. Inbound SSH access to the bastion hosts is restricted to specific IP addresses, as defined in the associated security groups. The company's security team wants to receive a notification if the security group rules are modified to allow SSH access from any IP address. What should a DevOps engineer do to meet this requirement?
Select one answer.
Marked answer: A
Community Discussion
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
Chose A1
It is A config managed rule only checks 0.0.0.0/0
Chose A1
A is right
2
Why not A: this could catch changes to security groups, it wouldn't analyze the actual rule content to determine if it's an unrestricted SSH rule (0.0.0.0/0 on port 22).you’d need extra custom logic to parse events and check the CIDR and port range.
Keyboard:←→previous / next·A–Echoose·Entercheck, then next
