AWS › AWS Systems Manager
How can Systems Manager be integrated with AWS Config and Security Hub to build a comprehensive automated compliance remediation pipeline?
AdvancedAnswer
AWS Config can detect a non compliant resource configuration and trigger a Systems Manager Automation document as a remediation action, which then executes the necessary corrective steps, such as closing an overly permissive security group rule, and the results of both the detection and remediation can flow into Security Hub for centralized visibility, creating an end to end pipeline where compliance issues are automatically detected, corrected, and tracked without requiring constant manual intervention from a security or operations team.
aws configservice put-remediation-configurations --remediation-configurations '[{"ConfigRuleName":"restricted-ssh","TargetType":"SSM_DOCUMENT","TargetId":"AWS-DisablePublicAccessForSecurityGroup"}]'Real-world example A company builds an automated pipeline where AWS Config detects any security group accidentally allowing unrestricted SSH access, triggers a Systems Manager Automation document that immediately removes the offending rule, and logs the entire detection and remediation event into Security Hub for the security team's ongoing visibility.