AWS Certified Developer Associate DVA-C02 (DVA-C02) — Questions 826–900

When accessing S3, using HTTPS (TLS/SSL) encrypts the data as it travels between the client and the S3 service endpoints. This prevents eavesdropping and man-in-the-middle attacks, ensuring the confidentiality and integrity of sensitive data during transmission over public networks. AWS S3 supports HTTPS by default, and it is a fundamental security best practice for protecting data in transit.

.ebextensions/*.config files are the correct and recommended approach for customizing and configuring AWS Elastic Beanstalk environments. These YAML or JSON formatted files, placed within the .ebextensions directory at the root of the application source bundle, enable developers to define environment properties, modify EC2 instance settings, install packages, and execute custom commands. Specifically, application environment variables are configured under the 'option_settings' section using the 'aws:elasticbeanstalk:application:environment' namespace.

Setting the deployment policy to 'Rolling' is the correct approach for a rolling deployment strategy in AWS Elastic Beanstalk. This method updates instances in batches, ensuring that a portion of the application's capacity remains available to serve traffic throughout the deployment process. Elastic Beanstalk performs health checks on each batch before proceeding, minimizing downtime and allowing for a gradual, controlled update of the application version across the environment.

A Canary deployment preference with CloudWatch alarms is the correct approach for shifting 10 percent of traffic to a new Lambda version. This strategy allows CodeDeploy to gradually shift a specified percentage of traffic (e.g., 10%) to the new function version, while the remaining traffic continues to serve the old version. Integrating CloudWatch alarms provides automated monitoring during this shift, triggering an automatic rollback to the stable version if predefined error thresholds or latency metrics are breached, ensuring a safe and controlled rollout.

Enabling Amazon RDS Performance Insights is the most effective initial step for diagnosing slow database performance. It provides a visual dashboard of database load, breaking down wait events, active sessions, and top SQL queries over time. This granular visibility allows developers to pinpoint specific bottlenecks, such as I/O waits, CPU contention, or inefficient query execution plans, before implementing any corrective actions.

Since MFA Delete is configured for the S3 bucket, any operation that results in the permanent deletion of an object version, such as deleting a specific version ID, necessitates the inclusion of a valid MFA token in the request. If the DELETE request targeting a specific version ID lacks this required MFA authentication, Amazon S3 will strictly enforce the MFA Delete policy. Consequently, the request will be rejected, and an AccessDenied error will be returned to the caller.

When an S3 bucket utilizes Server-Side Encryption with AWS KMS (SSE-KMS) for object encryption, any entity attempting to read those encrypted objects requires two distinct sets of permissions. First, it needs `s3:GetObject` permission on the S3 bucket and object. Second, and critically, the Lambda function's execution role must also have `kms:Decrypt` permission on the specific AWS KMS key used to encrypt the objects. This `kms:Decrypt` permission is granted via the KMS key policy, not the S3 bucket policy, and without it, the Lambda cannot decrypt the object data even if it successfully retrieves the encrypted bytes from S3.

The error message "User: arn:aws:iam::123456789012:user/DevUser is not authorized to perform: kms:Decrypt" explicitly indicates that the IAM principal attempting the operation lacks the necessary kms:Decrypt permission. This typically means either the IAM policy attached to 'DevUser' does not grant kms:Decrypt on the specific KMS key, or the KMS key policy itself does not permit 'DevUser' to perform this action. For a KMS operation to succeed, both the IAM identity's policy and the KMS key's resource policy must explicitly allow the requested action.

Reviewing the slow query log is the first diagnostic step because it captures queries that exceed a specified duration, along with their execution time and connection metadata. Once identified, use EXPLAIN to analyze the execution plan, exposing table scans, missing indexes, or poor join ordering. This evidence-based approach tells you exactly which query to optimize and whether to add indexes or rewrite the query.

The most direct and secure solution is to modify the S3 bucket policy to remove any statements that grant public access, typically identified by "Principal: "*". Concurrently, implement specific IAM policies attached to users, groups, or roles to grant precise, least-privilege access to authorized principals. This approach directly addresses the misconfiguration, ensures granular control, and aligns with AWS security best practices for managing access to S3 resources.

An explicit Deny statement takes precedence over any Allow, so even if the user's other policies grant ec2:TerminateInstances, this line will effectively block the action. The wildcard resource scopes the denial to all EC2 instances in the account, meaning no running instance can be terminated by that user. This directly implements the developer's requirement to prevent termination.

Amazon ElastiCache for Redis is an excellent choice for storing web application session state due to its in-memory, high-performance nature. It provides extremely low-latency read and write operations, essential for a responsive user experience. As a fully managed service, it simplifies deployment and scaling, offering robust support for various data structures that efficiently manage session attributes and expiration.

If the RDS instance has the DeletionProtection attribute set to true, CloudFormation's attempt to delete or replace that instance during the stack update silently fails, leaving the instance running and still attached to the security group's ENI, which in turn prevents the security group from being deleted since AWS will not remove a security group that is still in use by an active resource.

Storing credentials as a SecureString parameter in Systems Manager Parameter Store and referencing it via the task definition's secrets block injects the value at container start, satisfying the requirement to pass database credentials securely without hardcoding them in the image or environment variables.

Amazon Elastic File System (EFS) is a fully managed, scalable, and highly available network file system designed for use with AWS cloud services and on-premises resources. EFS provides a POSIX-compliant file system interface, allowing multiple EC2 instances, containers, or serverless functions to concurrently access and share the same data. This makes it an ideal solution for containerized applications that require persistent, shared storage across a fleet of instances.

Monitoring ElastiCache CPU utilization in CloudWatch helps identify if the cluster is under-provisioned or experiencing heavy processing load, indicating a need for scaling. Concurrently, tracking the cache hit ratio is vital; a low hit ratio suggests that the application is frequently missing cached data, leading to increased latency as requests fall back to the origin database. These metrics collectively provide actionable insights into cache efficiency and potential performance bottlenecks.

For an EC2 instance to access an S3 bucket, both the IAM role attached to the instance and the S3 bucket policy must explicitly grant the necessary permissions. If the S3 bucket policy includes a Principal element or a Condition that references a specific IAM role ARN, a mismatch between that ARN and the actual ARN of the role assumed by the EC2 instance will result in an AccessDenied error. This strict ARN matching ensures that only authorized identities can perform actions, even if the IAM role policy itself grants permissions.

Elastic Beanstalk maintains a history of all deployed application versions. When a new deployment introduces issues, the console or CLI allows direct selection and deployment of any previously uploaded and deployed application version. This process triggers an in-place update of the existing environment's instances, replacing the problematic code with the last known good version, thereby providing a quick and efficient rollback mechanism without requiring environment recreation.

When a Lambda function has a reserved concurrency of 10, it means that at any given moment, a maximum of 10 instances of that function can be executing simultaneously. If there's a sudden influx of messages from the SQS queue, Lambda will invoke up to 10 functions to process them. Any additional messages beyond what these 10 concurrent invocations can handle will remain in the SQS queue, awaiting an available function instance to process them.

AWS Systems Manager Parameter Store SecureString parameters store database credentials as encrypted values using AWS KMS, and they can be retrieved through the AWS API, CLI, or SDK by services like EC2, ECS, and Lambda. However, while Parameter Store can integrate with KMS and supports versioning, it does not natively automate credential rotation, so it is best when you need encrypted secrets without the additional lifecycle features of Secrets Manager.

Configuring an Auto Scaling simple scaling policy based on Average CPU Utilization with thresholds of > 70% for scale-out and < 30% for scale-in is the correct and most common approach for horizontally scaling web applications in Elastic Beanstalk. High CPU utilization directly indicates that the existing instances are struggling to process requests, necessitating more compute capacity. Conversely, low CPU utilization suggests instances are underutilized, allowing for cost-efficient scale-in.

This condition key, `s3:x-amz-server-side-encryption-aws-kms-key-id`, is precisely designed for S3 bucket policies to enforce the use of a *specific* AWS KMS customer master key (CMK) when objects are uploaded with server-side encryption using KMS (SSE-KMS). By including this condition, an S3 bucket policy can mandate that all incoming objects encrypted with SSE-KMS must utilize a predefined KMS key ARN, preventing uploads encrypted with unauthorized or default KMS keys. This ensures strict compliance with data residency or security requirements by linking data to a specific cryptographic key.

If the S3 bucket policy restricts access to a specific VPC endpoint, the Lambda function must send requests through that endpoint. This requires the Lambda function to be configured with VPC access, and the VPC must have an S3 gateway endpoint. Without this, the request originates from the public internet and is denied by the bucket policy.

This is a valid and common use case for Amazon S3 event notifications. S3 can be configured to publish messages to an Amazon SQS queue whenever specific object-level events occur, such as s3:ObjectCreated:Put or s3:ObjectCreated:Post. This enables decoupled architectures where other services can asynchronously consume these messages to react to new object uploads, facilitating further processing or logging.

CloudFront's price classes determine which edge locations are utilized for content delivery. Selecting "Price Class All" ensures that CloudFront leverages its entire global network of edge locations, including those in regions with higher infrastructure costs. This maximizes the geographic proximity of cached content to end-users worldwide, thereby minimizing latency for static content delivery regardless of the user's physical location.

Configuring a Lambda alias with a canary deployment allows for gradual shifting of traffic to the new function version, starting with a small percentage. Integrating this with an Amazon CloudWatch error rate alarm enables automatic rollback: if the new version's error rate exceeds a predefined threshold during the canary phase, the alias automatically reverts all traffic to the stable old version. This strategy minimizes the impact of potential issues by detecting them early and automating recovery.

The unified CloudWatch agent is the correct and recommended solution for collecting detailed operating system-level metrics, including memory utilization, from EC2 instances. This agent can be configured to gather various custom metrics, such as used memory percentage, free memory, and swap usage, directly from the instance's operating system. These collected metrics are then reliably published to CloudWatch, enabling comprehensive monitoring, alarming, and dashboarding capabilities.

This is the correct answer. DynamoDB tables operate on a provisioned throughput model, where Write Capacity Units (WCUs) must be sufficient to handle the incoming write traffic. When the rate of write requests, especially during traffic spikes, exceeds the allocated provisioned write capacity, DynamoDB will begin to throttle requests. This throttling mechanism protects the underlying infrastructure and ensures consistent performance for other requests within the provisioned limits, but it results in rejected write operations for the application.

Making requests to the S3 API endpoint over HTTPS wraps every request and response in TLS, encrypting the data as it moves across the network between the application and S3's servers, which is precisely what in-transit encryption means and is enabled by default on all S3 endpoints.

CodeDeploy integrates directly with an Application Load Balancer (ALB) to manage traffic during deployments and validate instance health. During a deployment, CodeDeploy monitors the health of instances in the target group using the ALB's configured health checks. If these health checks fail, either due to an incorrect configuration (e.g., wrong port, path, or expected response) or because the deployed application itself is not starting correctly or responding to the health check requests, CodeDeploy will detect this and halt the deployment, often initiating a rollback. This critical mechanism ensures that only healthy instances receive production traffic, preventing service disruptions.

Lambda proxy integration simplifies API Gateway configuration by passing the entire client request, including headers, query string parameters, path parameters, and body, directly to the Lambda function as a single event object. This allows the Lambda function to parse the request and handle different HTTP methods and paths dynamically, significantly reducing the need for explicit mapping templates within API Gateway and streamlining serverless application development.

AWS Secrets Manager is the optimal choice as it is purpose-built for managing, retrieving, and rotating database credentials, API keys, and other secrets throughout their lifecycle. It offers native integration with services like Amazon RDS and Amazon Redshift for automatic credential rotation, enhancing security by regularly changing credentials without application downtime. Furthermore, it provides fine-grained access control through AWS IAM and comprehensive auditing via AWS CloudTrail, ensuring secure and compliant secret management.

An IAM role attached to the EC2 instance delivers temporary, automatically rotated credentials through the instance metadata service, so no long-term secrets are stored on the instance. This satisfies the no-hardcoded-credentials constraint while granting least-privilege access to Secrets Manager.

Amazon CloudWatch Logs is specifically designed for centralizing logs from various sources, including EC2 instances, AWS Lambda functions, and other AWS services. It provides a dedicated agent for easy installation on EC2 instances to collect application logs, offers configurable retention policies, and allows for real-time monitoring, searching, and analysis of log data. This makes it the most straightforward and cost-effective solution for collecting, storing, and managing application logs with integrated viewing capabilities.

This option correctly leverages AWS CodeDeploy's canary deployment strategy, which gradually shifts a small percentage of traffic (10%) to the new Lambda version initially. This allows for real-world testing with minimal impact before shifting the remaining traffic. Crucially, integrating a CloudWatch alarm for error rates enables automatic rollback, ensuring immediate mitigation if the new version introduces issues, making it a robust and safe deployment approach.

Correct. s3:ObjectCreated:* captures all creation events, allowing the developer to filter updates in the processing function. While it does not exclusively trigger on new objects, it is the most comprehensive event type and is the intended answer given the limitations of S3 event notifications.

Because the aws:MultiFactorAuthPresent key is always populated with a true or false value during Management Console sign-in, a Deny statement using Bool with the condition set to false correctly and directly blocks every console action for any session that did not authenticate with MFA, which is exactly the explicit-deny enforcement the security team requires.

API Gateway expects its integrated Lambda function to return a specific JSON response format, including status code, headers, and body, for successful processing and mapping. When a Lambda function encounters an unhandled exception, times out, or returns malformed output that does not conform to this expected structure, API Gateway cannot properly map this response to an HTTP response for the client. Consequently, API Gateway returns an HTTP 502 Bad Gateway error, indicating that it received an invalid response from the upstream Lambda service.

Using a DynamoDB table to store unique message identifiers (e.g., SQS MessageId or a business transaction ID) allows the consumer to check if a message has already been processed before executing its logic. By performing a conditional write (e.g., PutItem with ConditionExpression attribute_not_exists(id)) to the DynamoDB table, the application ensures that the processing logic for a specific message ID is executed only once, effectively achieving idempotency and eliminating duplicate processing even with SQS's at-least-once delivery.

This policy correctly adheres to the principle of least privilege by granting only the necessary permissions for a Lambda function to process an S3 object and log its execution. 'logs:CreateLogGroup' allows the function to create its dedicated log group, 'logs:CreateLogStream' enables the creation of log streams within that group, and 'logs:PutLogEvents' permits writing runtime logs to CloudWatch. 's3:GetObject' is the precise permission required to retrieve the S3 object's content, ensuring the function can perform its core task securely.

Modifying the Lambda function to use the sequence number of each record is the correct approach for deduplication. Each record in a Kinesis stream has a unique sequence number within its shard, which, when combined with the shard ID, forms a globally unique identifier. By storing the last successfully processed sequence number (and shard ID) in a durable external data store, such as Amazon DynamoDB, the Lambda function can check if a record has already been processed before executing its business logic, effectively achieving idempotency.

For a Lambda function to successfully connect to an Amazon RDS database, the RDS instance's security group must explicitly permit inbound traffic on the database port (e.g., 3306 for MySQL, 5432 for PostgreSQL). A common best practice is to configure the RDS security group to allow inbound connections from the *security group associated with the Lambda function's ENIs*. If this rule is missing or incorrectly configured, the connection will be blocked, making this a highly probable cause of connectivity issues.

When an EC2 instance is deregistered from an Application Load Balancer (ALB) target group, connection draining (also known as deregistration delay) begins. During this period, the ALB stops sending new requests to the instance but attempts to allow existing in-flight requests to complete. If the configured deregistration delay timeout is shorter than the time required for active requests to finish processing, the ALB will forcibly close those connections, leading to 502 Bad Gateway errors for the client, as the backend server did not return a proper response.

The slow query log records every SQL statement that takes longer than the `long_query_time` threshold to execute, capturing the exact query text, execution time, lock time, and rows examined. Enabling it via the RDS parameter group (`slow_query_log=1`) is the most direct way to pinpoint which specific statements are causing the observed slowdown, allowing targeted optimization such as adding indexes or rewriting the query. This makes it the definitive first step for diagnosing slow queries at the statement level rather than relying on inferred metrics.

The Lambda function's execution role requires specific permissions to interact with CloudWatch Logs. The 'logs:CreateLogStream' permission allows the function to create a unique log stream for its execution environment within the designated log group, while 'logs:PutLogEvents' is essential for sending the actual log data to that stream. Without both of these critical permissions, the function cannot successfully publish any output or runtime messages to CloudWatch Logs, leading to the observation of no logs.

aws lambda update-function-code is the correct command because it uploads a new deployment package (ZIP file or container image) to the Lambda service, replacing the code currently associated with the function. This command updates the function's code while preserving its configuration, and it operates on the $LATEST version unless you specify a different qualifying qualifier, making it the proper way to deploy a new code version.

DynamoDB auto scaling dynamically adjusts the provisioned read and write capacity units (RCUs/WCUs) for a table or global secondary index based on actual traffic patterns. By automatically increasing capacity during peak loads and decreasing it during lulls, auto scaling ensures that the table has sufficient throughput to handle incoming requests, effectively preventing throttling errors caused by exceeding provisioned limits.

Elastic Beanstalk's enhanced health reporting is derived primarily from the associated load balancer's target health checks; if the new application version returns HTTP 503 (or fails to respond) on the configured health check path after deployment, the ELB marks targets unhealthy and Beanstalk immediately reflects that as Red, even though application-level logs show nothing because the failure is at the HTTP response layer, not an exception.

This is the correct and standard procedure for adding encryption to an existing unencrypted Amazon RDS instance. First, a snapshot captures the current data of the unencrypted instance. Then, this unencrypted snapshot is copied, and crucially, during the copy process, encryption with an AWS Key Management Service (KMS) key is enabled. Finally, a new encrypted RDS instance is launched from this newly encrypted snapshot, effectively migrating the data to an encrypted environment.

The "MessageDeduplicationId" in an Amazon SQS FIFO queue is the primary mechanism for achieving exactly-once processing semantics by preventing duplicate messages from being added to the queue. When a producer sends a message with a specific deduplication ID, SQS ensures that any subsequent message sent with the same ID within a 5-minute deduplication interval is treated as a duplicate and not delivered to the queue. This directly guarantees that a command is enqueued and thus processed only once, even if the producer attempts to send it multiple times.

Attaching a policy statement granting only kms:Decrypt, scoped to the specific key's ARN, on the Lambda execution role is exactly the least-privilege permission needed — it grants decrypt capability for that one key and nothing more.

API Gateway offers built-in caching capabilities that can be enabled per stage or per method. This feature stores responses from your backend integrations, reducing the number of requests sent to your backend and significantly improving API response times for repeat requests. You can configure a Time To Live (TTL) for cached responses, allowing precise control over how long data remains in the cache before being refreshed, which is crucial for managing data freshness and reducing backend load.

The aws s3 sync command is the most appropriate and efficient solution for resuming an interrupted file transfer to S3. It intelligently compares the source directory with the S3 bucket, identifying only files that are new, have changed content (based on size and modification time), or are missing from the destination. This ensures that only the necessary data is transferred, minimizing bandwidth usage and significantly reducing the time required to complete the operation.

This statement accurately describes a fundamental principle of AWS Identity and Access Management (IAM) policy evaluation. When multiple policies apply to a request, IAM first checks for any explicit Deny statements. If an explicit Deny exists for the requested action or resource, the request is immediately denied, regardless of any explicit Allow statements that might also be present. An explicit Deny always overrides an explicit Allow, making it the most powerful permission modifier in the evaluation logic.

A CodeDeploy rollback re-deploys a previously successful application revision, utilizing that revision's specific AppSpec file. If this AppSpec file contains a 'hooks' section referencing a script, an IAM role, or a lifecycle event that has since been removed or become invalid in the target environment, the rollback deployment will fail when attempting to execute that non-existent or misconfigured hook. This scenario highlights how environmental drift can cause a previously successful revision's deployment instructions to become unexecutable.

The CloudWatch agent, when running on an EC2 instance, requires an associated IAM role with specific permissions to interact with CloudWatch Logs. Without an IAM policy granting actions such as logs:CreateLogGroup, logs:CreateLogStream, and logs:PutLogEvents, the agent will be unauthorized to publish log events to the designated log group and stream. This is a fundamental security requirement, ensuring that AWS services only perform actions for which they have explicit authorization.

Creating the RDS instance outside Elastic Beanstalk decouples its lifecycle from the environment, so terminating the environment leaves the database intact. Environment variables pass connection details to the application, satisfying the no-accidental-deletion requirement without relying on Elastic Beanstalk's coupled database option.

Configuring the ALB listener with a TLS certificate ensures traffic from the client to the ALB is encrypted. By setting the target group protocol to HTTPS, the ALB then re-encrypts this traffic before forwarding it to the backend EC2 instances. The EC2 instances must have their own server certificates installed and configured on their web servers to successfully complete the TLS handshake, thereby providing comprehensive end-to-end encryption for data in transit.

Enabling default encryption for an S3 bucket ensures that all newly written objects are encrypted at rest, either with SSE-S3 (AES-256) or SSE-KMS, so the raw data is stored as ciphertext. This protects against data leaks where an attacker gains access to the underlying storage media or backups, because they cannot interpret the encrypted bytes without the decryption keys. Note that default encryption is not a replacement for access control; it is a confidentiality layer that complements IAM policies and Block Public Access, and it can be enforced at the bucket policy level to reject unencrypted writes.

The task execution role is critical for allowing the Amazon ECS agent to perform necessary actions on your behalf, including pulling container images from private repositories like Amazon ECR. If this role lacks specific permissions such as `ecr:GetDownloadUrlForLayer`, `ecr:BatchGetImage`, and `ecr:BatchCheckLayerAvailability`, the ECS agent will be unauthorized to retrieve the image layers. Consequently, the container runtime will fail to download the image, resulting in a distinct image pull error.

RDS Proxy is specifically designed to manage and pool database connections for applications like AWS Lambda, which often create many short-lived connections. It sits between your Lambda function and the RDS database, maintaining a pool of established connections to the database. This significantly reduces the overhead of establishing new connections, improves scalability, and enhances security by integrating with AWS Secrets Manager for credential management and IAM for authentication.

While requirements.txt is the standard and preferred method for declaring Python application dependencies that pip can install, it is primarily designed for Python packages available via PyPI or specified URLs. This method is insufficient for installing system-level packages, libraries that require specific compilation flags, or dependencies that need custom shell commands to set up. For such non-standard or operating system-level requirements, requirements.txt alone cannot fulfill the installation.

Viewing stack events in the CloudFormation console is the direct diagnostic path. During stack creation, every resource activity is logged as an event with a status (CREATE_IN_PROGRESS, CREATE_FAILED, etc.) and a 'status reason' field. That status reason for the first failed resource contains the precise underlying error returned by the AWS service (for example, an EC2 error or an IAM permission problem), making it the authoritative source for troubleshooting a failed stack.

SSE-KMS encrypts each object using a data key generated and protected by an AWS KMS customer managed or AWS managed key, giving administrators fine-grained IAM control over who can use the key, a full CloudTrail audit trail of key usage, and support for key rotation.

Setting up an Amazon SNS topic is a fundamental step when configuring a manual approval action in AWS CodePipeline. This SNS topic serves as the primary mechanism for automatically notifying designated approvers, typically via email or other subscribed endpoints, that a pipeline execution has reached a manual approval gate and is awaiting their intervention. Without an associated SNS topic, approvers would lack timely, automated alerts regarding pending approvals, potentially causing significant delays in the deployment process.

DynamoDB distributes provisioned capacity evenly across its underlying partitions. If a specific partition key receives a disproportionately high volume of read requests, it can exhaust its allocated share of the table's total read capacity, even if the overall table capacity is not fully utilized. This scenario, known as a 'hot partition,' causes throttling errors for requests targeting that specific partition, despite ample table-level RCUs.

Configuring the ECS task definition to utilize the `awslogs` log driver is the recommended and most efficient method for sending container logs from Fargate tasks to Amazon CloudWatch Logs. This native integration automatically captures `stdout` and `stderr` streams from your containers and delivers them to a specified CloudWatch Logs log group. It simplifies log management, centralizes monitoring, and requires no application code changes or agent deployments within the container.

An 'Access Denied' error during the deploy stage is a classic indication that the AWS CodePipeline service role lacks the necessary IAM permissions to perform the deployment actions on the target AWS resource. For instance, if deploying to an S3 bucket, the role needs `s3:PutObject` and `s3:GetObject` permissions for the artifact. Without these explicit `Allow` statements in its policy, the service principal is unauthorized to interact with the target service, resulting in the reported access denial.

AWS CodeBuild's "Test reports" feature is specifically designed to ingest and display structured test results and code coverage metrics directly within the CodeBuild console. By configuring the `reports` section in the `buildspec.yml` to point to test output files (e.g., JUnit XML, JaCoCo XML), CodeBuild processes these files to generate visual reports, including pass/fail rates, test duration, and code coverage percentages, providing immediate feedback on application quality.

When an AWS KMS key is disabled, it transitions into a `Disabled` state, preventing any cryptographic operations such as encryption or decryption. Enabling the KMS key directly changes its state back to `Enabled`, immediately restoring its full functionality. This allows the application to resume using the key for all authorized cryptographic operations without requiring any changes to application code or data migration, making it the most direct and efficient solution.

This statement correctly pairs s3:GetObject, which retrieves object content, with logs:CreateLogStream and logs:PutLogEvents, the two actions required to create a log stream and write log events, and scopes each action to its precise resource ARN, satisfying both requirements with least privilege.

Configuring the target group to use HTTPS protocol explicitly instructs the Application Load Balancer (ALB) to establish a TLS-encrypted connection when forwarding requests to its registered backend instances. This setting ensures that all data transmitted from the ALB to the instances is encrypted in transit, directly fulfilling the security policy requirement. It offloads the initial client-side TLS termination to the ALB while maintaining a secure communication channel to the backend.

Enabling automatic key rotation for a CMK in AWS KMS ensures that the underlying cryptographic material (backing key) used for encryption is replaced annually. This process is transparent to applications, as the CMK's Amazon Resource Name (ARN) and Key ID remain unchanged, allowing existing encrypted data to still be decrypted by the original backing key. This fully automates the compliance requirement for annual key rotation without operational disruption.

The `secrets` field within the `containerDefinitions` section of an AWS ECS task definition is the correct and intended mechanism for injecting sensitive data or configuration, including values stored in AWS Systems Manager Parameter Store, into a container. By specifying the ARN of a Parameter Store parameter, ECS can securely retrieve the value and expose it as an environment variable or file within the container at runtime. This ensures sensitive data is not hardcoded in the task definition or container image.

Amazon SQS FIFO (First-In, First-Out) queues are specifically engineered to guarantee strict message ordering and exactly-once processing. By configuring the Lambda function to poll a FIFO queue with a batch size of 1, each message is retrieved and processed individually and sequentially. This combination ensures that the processing order by the Lambda function precisely matches the order in which messages were originally sent to the queue, reliably meeting both ordering and exactly-once requirements.