A security team must guarantee that every "Amazon S3" bucket across a busy account always has default encryption enabled, and that any bucket created or changed to a non-compliant state is corrected automatically without an engineer being paged. They already record resource configuration centrally and want the detection and the fix to be managed AWS features rather than custom code. Which combination BEST satisfies this continuous compliance requirement?
- AUse an "AWS Config" managed rule to evaluate bucket encryption and attach an "AWS Systems Manager" Automation document as the remediation action to re-enable encryption automatically. Correct
- BSchedule an "AWS Lambda" function that lists every bucket, checks its encryption setting and re-applies the encryption configuration whenever it finds a bucket without it.
- CCreate an "Amazon GuardDuty" detector so that buckets lacking default encryption raise a finding that the security team can review and remediate during their next sweep.
- DEnable "AWS CloudTrail" and build an "Amazon EventBridge" rule that emails the team whenever a bucket is created so they can confirm encryption is switched on.
Why A is correct: An AWS Config rule continuously evaluates whether each bucket is encrypted and flags non-compliant ones, and an attached Systems Manager Automation remediation runs a managed runbook to fix them automatically, which is the managed detect-and-correct loop required.
Why B is wrong: A hand-written Lambda can detect and fix the issue but it is custom code the team must build, test and maintain, which contradicts the stated preference for managed AWS features doing the work.
Why C is wrong: GuardDuty detects threats from logs and behaviour rather than evaluating configuration compliance, and it only produces findings for humans to action, so it neither reliably detects missing encryption nor fixes it automatically.
Why D is wrong: An event-driven email notifies a human at creation time but does not continuously evaluate existing buckets or automatically restore encryption, so the compliance state still depends on manual action.