Exam AWS Certified Security - Specialty topic 1 question 466 discussion

keywords: MOST operationally efficient manner So A should be better

answer C is better than A. Question asks for "when an unencrypted DB instance or DB cluster is CREATED"

Its A, according to this: https://aws.amazon.com/blogs/aws/new-aws-config-rules-now-support-proactive-compliance/

The question states: "when an unencrypted DB instance or DB cluster is created.". Answer A doesn't fulfill that requirement. It could take up to an hour before the AWS config rule triggers. By that time the RDS cluster could be live and have unencrypted data. Even worse, the AWS config rule will then terminate a online RDS cluster, causing downtime. Answer C fires when the db instance / cluster is created. So before there is a chance it could be used. So answer A might be more efficient, it doesn't meet the requirements.

https://docs.aws.amazon.com/config/latest/developerguide/rds-storage-encrypted.html C possible but not MOST efficient https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/rds-cloud-watch-events.html

Create an Amazon EventBridge rule that evaluates RDS event patterns and is initiated by the creation of DB instances or DB clusters. Configure the rule to publish messages to an Amazon Simple Notification Service (Amazon SNS) topic that includes an AWS Lambda function and an email delivery target as subscribers. Configure the Lambda function to delete the unencrypted resource. This solution is operationally efficient because it uses EventBridge to detect the creation of DB instances or DB clusters, which will trigger the rule. When the rule is triggered, it publishes messages to an SNS topic. The Lambda function can then analyze the event data to check for unencrypted storage and delete the unencrypted resource if necessary. The email delivery target ensures that an email alert will be sent when an unencrypted DB instance or DB cluster is created.

ANSWER - A

Answer A A or B, but B is manual!

automatic configuration changes -> AWS Config Answer A is correct

MOST operationally efficient manner - use aws config managed rule "rds-storage-encrypted" to trigger sns and lambda function would be a better approach. A seems a correct answer.