AWS Config for compliance - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to enable AWS Config recording for all supported resource types.

AWS

aws configservice start-configuration-recorder --configuration-recorder-name [1]

Drag options to blanks, or click blank then click option'

Aconfig-recorder

Bdefault

Call-resources

Dresource-tracker

Attempts:

3 left

💡 Hint

Common Mistakes

Using a generic name like 'default' which may not exist.

Confusing resource types with recorder names.

The configuration recorder name must match the one created in AWS Config setup, commonly 'config-recorder'.

2fill in blank

medium

Complete the code to create an AWS Config rule that checks whether S3 buckets have versioning enabled.

AWS

aws configservice put-config-rule --config-rule file://[1]

Drag options to blanks, or click blank then click option'

As3-versioning-check.json

Bec2-instance-check.json

Ciam-password-policy.json

Dvpc-flow-logs-check.json

Attempts:

3 left

💡 Hint

Common Mistakes

Using a rule file unrelated to S3 buckets.

Mistyping the file name or path.

The JSON file 's3-versioning-check.json' contains the rule definition for checking S3 bucket versioning compliance.

3fill in blank

hard

Fix the error in the AWS Config delivery channel creation command by completing the missing parameter.

AWS

aws configservice put-delivery-channel --delivery-channel '{"name":"default","s3BucketName":"[1]"}'

Drag options to blanks, or click blank then click option'

Abucket-config

Bconfig-bucket-123

Caws-config-bucket

Dmy-config-bucket

Attempts:

3 left

💡 Hint

Common Mistakes

Using a bucket name that does not exist.

Using a generic or placeholder bucket name.

The S3 bucket name must be the exact bucket created for AWS Config delivery, here 'config-bucket-123'.

4fill in blank

hard

Fill both blanks to create a compliance summary command filtering by resource type and compliance status.

AWS

aws configservice get-compliance-summary --compliance-types [1] --resource-types [2]

Drag options to blanks, or click blank then click option'

ANON_COMPLIANT

BCOMPLIANT

CAWS::S3::Bucket

DAWS::EC2::Instance

Attempts:

3 left

💡 Hint

Common Mistakes

Mixing compliance types or resource types incorrectly.

Using resource types not supported by AWS Config.

The command filters for non-compliant S3 buckets to check compliance status.

5fill in blank

hard

Fill all three blanks to create a command that lists all AWS Config rules with a specific tag key and value.

AWS

aws configservice describe-config-rules --filters Key=[1],Value=[2],Values=[3]

Drag options to blanks, or click blank then click option'

Atag-key

BEnvironment

CProduction

Drule-name

Attempts:

3 left

💡 Hint

Common Mistakes

Using incorrect filter keys.

Mixing tag keys and rule names in filters.

The filter uses 'tag-key' with key 'Environment' and value 'Production' to list matching config rules.