You are a DevOps engineer working in a big organization and you manage AWS resources including EC2 and RDS. One day, the security group of an EC2 bastion host has been modified to allow the inbound SSH traffic from any IP addresses. You notice this potential security risk after several days. Although this issue did not lead to any data leakage, you still want to enhance the AWS configurations so that whenever the IP addresses of the incoming SSH traffic in the security groups are not restricted, you will get a notification in time. Which option is the most suitable?

Answer options:

A.Create an AWS Config rule and select the AWS Managed rule "restricted-ssh" to check whether security groups disallow unrestricted incoming SSH traffic.
B.Add a rule in AWS Config and select the AWS Managed rule "restricted-common-ports" to check whether security groups disallow unrestricted incoming SSH traffic.
C.Enable Amazon Inspector and include the rule package "Common Vulnerabilities and Exposures-1.1" to check the security groups. Configure a notification through SNS.
D.Enable Amazon GuardDuty and check the security findings of security groups in AWS Security Hub.

Correct Answer: A
Option A is CORRECT because the rule can check if IP addresses of the incoming SSH traffic in the security groups are restricted. Please check the following screenshot
Option B is incorrect because this rule checks whether security groups disallow unrestricted incoming TCP traffic to the specified ports. It is not used only for SSH traffic.
Option A is more suitable than this one.
Option C is incorrect because Amazon Inspector is not able to check the security group configurations with the rule package "Common Vulnerabilities and Exposures-1.1". The rule package "Network Reachability-1.1" should be chosen. Besides, Amazon Inspector normally takes a longer time to scan so it may not provide a timely notification.
Option D is incorrect because Amazon GuardDuty is a continuous security monitoring service to identify unexpected and potentially unauthorized and malicious activity within your AWS environment. It cannot provide a notification when a security group has been changed.
Reference:
https://docs.aws.amazon.com/config/latest/developerguide/restricted-ssh.html