Select Two (Multi-Select) Questions

Apply service control policies (SCPs) to deny the creation of IAM roles with overly broad permissions, such as 'Action: *' and 'Resource: *'.

SCPs enforce preventive controls at the organization level.

Enable IAM Access Analyzer to review and identify IAM roles that grant permissions to external principals or have unused permissions.

Access Analyzer helps identify overly permissive roles.

The management account must have an IAM role (StackSetsAdminRole) with permissions to create stack instances in member accounts.

This is the admin role that assumes the execution role in member accounts.

The execution role in member accounts must have permissions to create the resources defined in the CloudFormation template (e.g., VPC, subnets).

The execution role needs permissions to actually create the resources.

The management account must have permission to assume the execution role in member accounts (via IAM trust policy).

The admin role must be trusted by the execution role.

TLS for all data in transit

TLS encrypts data in transit.

AWS Key Management Service (KMS) for encryption at rest

KMS manages encryption keys for at-rest encryption.

Create an AWS Config rule that checks for S3 bucket default encryption and auto-remediates using SSM Automation.

Config rules can enforce and remediate non-compliant resources.

Create a service control policy (SCP) that denies s3:PutObject unless the x-amz-server-side-encryption header is present.

SCPs can deny actions that do not meet conditions.

Switch the DynamoDB table to on-demand capacity mode.

On-demand mode eliminates throttling by scaling automatically.

Enable DynamoDB auto scaling for the table to adjust read/write capacity automatically.

Auto scaling adjusts capacity to handle load, reducing throttling.

Migrate the database to Amazon RDS for PostgreSQL

RDS reduces operational overhead compared to managing PostgreSQL on EC2.

Deploy the Java backend on Amazon ECS with AWS Fargate

Fargate eliminates server management for containers.

Create an SCP that denies the ec2:RunInstances action for specific instance types.

SCPs can deny actions based on condition keys like ec2:InstanceType.

Use AWS Config rules to detect non-compliant instance types and automatically terminate them using AWS Systems Manager Automation.

AWS Config can detect and auto-remediate.

Use an SCP to prevent disabling of AWS Config in any account.

SCPs can deny actions that disable Config.

Configure the central S3 bucket policy to allow cross-account log delivery from all accounts in the organization.

The bucket policy must grant write access to AWS Config service principal from all accounts.

Enable AWS Config in the management account and use Control Tower's account factory to propagate the configuration to all accounts.

Control Tower's account factory can automatically enable Config.

Configure an Auto Scaling group with a launch template that includes a user data script to bootstrap the web server

Auto Scaling group provides automatic scaling and high availability.

Attach the Auto Scaling group to an Application Load Balancer

ALB distributes HTTP traffic and works with Auto Scaling.

Use Amazon Route 53 health checks to monitor the primary application and configure DNS failover to the secondary Region.

Route 53 health checks and failover route traffic to the secondary Region when the primary fails.

Create an Amazon Machine Image (AMI) of the EC2 instances and copy it to the secondary Region. Use an Auto Scaling group to launch instances from the AMI.

Copying AMIs to another Region allows recovery of EC2 instances.

Create a cross-Region read replica of the RDS MySQL database in the secondary Region.

Cross-Region read replicas provide asynchronous replication with low RPO.

Configure the Kinesis Data Stream with 10 shards.

10 shards provide sufficient throughput and each shard maintains record order.

Configure the Lambda function to process records from each shard sequentially by setting the batch size to 1.

Processing one record at a time ensures exactly-once processing and order.

Use IAM roles for service accounts (IRSA) to grant pods access to Secrets Manager

IRSA provides fine-grained permissions for pods.

Store secrets in AWS Secrets Manager and enable automatic rotation

Secrets Manager supports automatic rotation.

Use the AWS Secrets and Configuration Provider (ASCP) for the Secrets Store CSI Driver to inject secrets into pods

ASCP injects secrets securely into pods.

AWS Certificate Manager (ACM)

ACM provides certificates for mTLS.

AWS App Mesh

App Mesh enables mTLS and traffic control.

AWS Cloud Map

Cloud Map provides service discovery.

Create a scheduled scaling policy that increases the desired capacity before the batch job starts.

Scheduled scaling ensures capacity is available when needed.

Use a launch template with multiple instance types to increase the chances of obtaining Spot capacity.

Diversifying instance types improves Spot availability.

Use Spot Instances in the Auto Scaling group for the batch job.

Spot Instances are cost-effective for fault-tolerant batch workloads.

Add an Amazon RDS Read Replica in the same AWS Region.

Read Replicas can handle read queries, reducing load on the primary.

Implement an Amazon ElastiCache for Redis cluster to cache frequent queries.

Caching reduces database read load.

{"Effect": "Allow", "Action": ["s3:GetObject"], "Resource": "arn:aws:s3:::my-bucket/*"}

Grants read access to objects in the bucket.

{"Effect": "Allow", "Action": ["logs:CreateLogStream", "logs:PutLogEvents"], "Resource": "arn:aws:logs:us-east-1:123456789012:log-group:my-log-group:*"}

Grants write access to CloudWatch Logs.

{"Effect": "Allow", "Action": ["s3:PutObject"], "Resource": "arn:aws:s3:::my-bucket/*"}

Grants write access to the bucket (if needed by the application).

Add more reader instances to the cluster to distribute the read traffic.

More readers improve read scalability.

Increase the instance size of the reader instances to larger instance types.

Larger instances can handle more read load and reduce lag.

Enable Aurora Auto Scaling for the reader instances.

Auto Scaling dynamically adjusts reader count based on load.

Use AWS Application Migration Service (MGN) to migrate the application server to Amazon EC2

MGN automates migration with minimal code changes.

Use Amazon EFS to replace the proprietary file-based storage

EFS provides a managed, highly available file system.

Migrate the proprietary storage to Amazon RDS for PostgreSQL

RDS reduces operational overhead and improves availability.

Replatform the application to use AWS Elastic Beanstalk and Amazon RDS for PostgreSQL.

Reduces operational overhead and licensing costs.

Replatform the database to Amazon RDS for PostgreSQL and refactor the application to use it.

Reduces licensing costs and improves scalability.

Implement Amazon CloudFront to cache static content and reduce load on the web tier.

Reduces requests to the origin servers.

Create an Amazon RDS read replica for the MySQL database and route read queries to it.

Offloads read traffic from the primary database.

Configure an Auto Scaling group for the application tier to scale based on CPU utilization.

Automatically adds instances during high CPU.