AWS Certified CloudOps Engineer Associate SOA-C03 Practice Question

Trusted Advisor emits an EventBridge (formerly CloudWatch Events) event whenever the result of a check item changes. By creating a rule that filters for that specific check ID and a status of "Action recommended", you can invoke a Lambda function as soon as the finding is generated. The Lambda function can call PutBucketAcl and PutPublicAccessBlock to revoke public access and then publish a message to an Amazon SNS topic that emails the security team. This solution is fully managed, event-driven, requires no polling, and addresses the problem at the moment Trusted Advisor detects it.

Using an AWS Config managed rule could remediate public buckets, but the trigger is AWS Config, not Trusted Advisor, so it does not satisfy the requirement to act specifically on Trusted Advisor findings. While GuardDuty can generate findings for S3 policy or ACL changes (e.g., Policy:S3/BucketPublicAccessGranted), its primary purpose is threat detection, and it does not trigger based on Trusted Advisor check results. Using S3 ObjectCreated events would not guarantee that all existing objects and ACLs are covered or that the action is tied to the Trusted Advisor result.