AWS SOA-C02 Drill: EC2 Compliance Enforcement - Automating Near Real-Time Instance Termination

Jeff’s Note

#

Unlike generic exam dumps, ADH analyzes this scenario through the lens of a Real-World Site Reliability Engineer (SRE).

For SOA-C02 candidates, the confusion often lies in how to enforce near real-time resource compliance without introducing operational overhead or false positives.
In production, this is about knowing exactly which AWS native services can detect noncompliance fast and trigger automatic remediation with minimal latency. Let’s drill down.

The Certification Drill (Simulated Question)

#

Scenario

#

NimbusTech, a mid-sized SaaS firm, manages a fleet of Amazon EC2 instances across multiple departments. To maintain strict corporate governance, NimbusTech mandates that every EC2 instance must have a department tag (e.g., Department=Finance or Department=Engineering). Instances missing this tag are considered noncompliant and must be terminated promptly to reduce governance risks.

The Site Reliability Engineering team needs a solution that automatically detects EC2 instances lacking the required Department tag and terminates them as close to real-time as possible, minimizing manual intervention and operational lag.

The Requirement:

#

Design an automated, near real-time process to identify and terminate EC2 instances missing the required department tag to enforce corporate tagging policies effectively.

The Options

#

• A) Create an AWS Config rule using the required-tags managed rule to evaluate EC2 instances for the Department tag. Configure automatic remediation by associating the AWSTerminateEC2Instance Systems Manager Automation document to terminate noncompliant instances.
• B) Create an Amazon EventBridge rule that triggers on EC2 instance launch events. Send notifications to an SNS topic for manual review and remediation.
• C) Enforce IAM permissions so all users can create EC2 instances and add tags simultaneously with ec2:CreateTags and ec2:DescribeTags permissions, and modify instance shutdown behavior to terminate instead of stop.
• D) Use AWS Systems Manager Compliance to evaluate EC2 instances and invoke the AWSStopEC2Instances Automation document to stop noncompliant instances.

Google adsense

#

leave a comment:

Correct Answer

#

A.

Quick Insight: The SysOps Imperative

#

Near real-time tagging compliance enforcement leverages AWS Config’s continuous evaluation coupled with Systems Manager Automation runbooks for remediation. EventBridge + SNS (Option B) is slow and manual. IAM policy enforcement (Option C) lacks automation and prevents existing noncompliances. Stopping instances (Option D) doesn’t meet the termination requirement.

Content Locked: The Expert Analysis

#

You’ve identified the answer. But do you know the implementation details that separate a Junior from a Senior?

The Expert’s Analysis

#

Correct Answer

#

Option A

The Winning Logic

#

AWS Config’s required-tags managed rule provides continuous compliance evaluation of EC2 instances based on the specified tag key Department. This rule emits evaluation results near real-time (within minutes). When combined with an automatic remediation action using Systems Manager Automation documents—specifically, the AWSTerminateEC2Instance runbook—this forms a seamless pipeline to terminate noncompliant instances immediately after detection, requiring zero manual intervention. This setup aligns perfectly with NimbusTech’s corporate governance requirements.

• Continuous evaluation vs periodic checks enables proactive enforcement.
• Systems Manager Automation provides mature remediation capabilities.
• Termination rather than stopping ensures full resource deallocation and cost savings.

The Trap (Distractor Analysis):

#

• Why not B? EventBridge can detect EC2 instance launch events but does not natively evaluate tagging compliance; sending notifications to SNS only alerts administrators but doesn’t automate termination, causing operational delays and reliance on manual steps.
• Why not C? IAM permission enforcement for tagging at creation reduces the chance of untagged instances but cannot fix existing noncompliance. Additionally, modifying instance shutdown behavior does not automatically terminate resources missing tags.
• Why not D? Using Systems Manager Compliance and the AWSStopEC2Instances document only stops noncompliant instances but does not terminate them, which doesn’t meet the explicit business requirement for termination, potentially leading to lingering stopped instances and ongoing cost.

The Technical Blueprint

#

# Sample AWS CLI command to setup remediation for AWS Config required-tags rule

# Create the Config rule for required tags (Department in this case)
aws config put-config-rule --config-rule file://required-tags-rule.json
# Sample required-tags-rule.json:
# {
#   "ConfigRuleName": "required-tags",
#   "Source": {
#     "Owner": "AWS",
#     "SourceIdentifier": "REQUIRED_TAGS"
#   },
#   "InputParameters": "{\"tag1Key\":\"Department\"}",
#   "Scope": {
#     "ComplianceResourceTypes": ["AWS::EC2::Instance"]
#   }
# }

# Associate the Automation document AWSTerminateEC2Instance for remediation
aws config put-remediation-configurations --remediation-configurations file://remediation-config.json
# remediation-config.json:
# [
#     {
#       "ConfigRuleName": "required-tags",
#       "TargetType": "SSM_DOCUMENT",
#       "TargetId": "AWSTerminateEC2Instance",
#       "Automatic": true,
#       "MaximumAutomaticAttempts": 1
#     }
# ]

The Comparative Analysis

#

Real-World Application (Practitioner Insight)

#

Exam Rule

#

For the exam, always pick AWS Config with automated remediation when the requirement includes continuous compliance evaluation and near real-time enforcement.

Real World

#

In practice, combining AWS Config managed rules with Systems Manager Automation documents reduces operational toil and ensures strict compliance enforcement without user manual intervention, a key principle in mature SRE practice.

(CTA) Stop Guessing, Start Mastering

#

Disclaimer

This is a study note based on simulated scenarios for the AWS SOA-C02 exam.