AWS Certified Security Specialty SCS-C02 (SCS-C02) — Questions 676–750

Amazon CloudWatch Logs is the monitoring and analysis layer that ingests CloudTrail events when a trail is configured to deliver to a log group. It enables real-time and historical inspection of API calls through metric filters, which can trigger CloudWatch Alarms based on specific API activity, and CloudWatch Logs Insights for ad-hoc querying. This makes it the correct service for actively monitoring and alerting on AWS API calls, rather than merely recording them.

Amazon GuardDuty is a managed threat detection service that continuously consumes VPC Flow Logs, DNS query logs, CloudTrail events, and S3 data events. It applies integrated threat intelligence from AWS and third-party sources, along with machine learning and anomaly detection, to generate findings when an EC2 instance communicates with a known malicious IP, Bitcoin miner, or Tor node. Its findings include the affected resource, the malicious IP, the protocol and port, and confidence indicators, enabling a security engineer to quickly investigate and respond.

In AWS IAM Identity Center, access to an AWS account is granted only after an account assignment links the user (or a group containing them) to a permission set in that account. The assignment is what provisions the temporary IAM role credentials, so without it the portal might still list the account but authorization fails because no IAM role exists for that user. This missing assignment is exactly the root cause and must be created in the console or CLI before access is possible.

For instances in a private subnet to reach the internet through a NAT gateway, the subnet's route table must have a default route (0.0.0.0/0) with the NAT gateway as the target. If this route is missing, any outbound internet-bound traffic has no valid next hop and is dropped, causing the connectivity failure. After adding this route, ensure the NAT gateway itself is in a public subnet with an associated Elastic IP and that the public subnet's route table points 0.0.0.0/0 to an internet gateway. This is the most direct and common cause when private instances cannot access the internet.

The aws:SourceVpce condition key is the standard and most direct way to restrict S3 bucket access to a single VPC endpoint. By including this condition in a bucket policy statement, you can match the VPC endpoint ID that appears in the request context, ensuring only requests that come through that endpoint are allowed. For example, you can pair an Allow effect for the endpoint's traffic with Principal '*' and the condition 'StringEquals' on aws:SourceVpce, providing fine-grained control.

AWS Config rules continuously evaluate the bucket against your desired state; a remediation action then invokes the bucket policy automatically. This satisfies the automatic remediation requirement, unlike services that only detect or report public access without applying policy changes.

Amazon GuardDuty is a managed threat detection service that uses machine learning, anomaly detection, and integrated threat intelligence to continuously monitor VPC Flow Logs, DNS logs, and CloudTrail event logs. It identifies suspicious activity such as reconnaissance, credential compromise, or data exfiltration, and automatically generates findings that can trigger CloudWatch Events. GuardDuty is purpose-built to detect and alert on a wide range of security threats without requiring manual analysis or custom logic.

Enabling TLS/SSL on the database connections encrypts the entire session between the application and the database, protecting the data from eavesdropping or tampering while it traverses the network. This is a direct, protocol-level mitigation for the lack of encryption between the application and the database, and it can be enforced at the database server (e.g., requiring SSL/TLS for all client connections) and supported by the client driver. It does not change network routing or access control, but it specifically ensures confidentiality and integrity of the data in transit.

By using the ALB's security group as the source in the instance's inbound rule, the rule matches traffic from any ENI that has that security group attached. As the ALB scales, its new ENIs are automatically covered because they inherit the same security group, so the rule remains current without manual updates. This creates a precise, security-group-to-security-group boundary that ensures only the ALB can initiate traffic to the instances, which is the recommended pattern.

This is the exact definition of iam:PassRole: it permits a user to specify an existing IAM role as a configuration parameter for an AWS service, such as setting the execution role for a Lambda function or the instance profile for an EC2 instance. The user is not assuming the role themselves, but rather delegating the role to the service so that the service can use its permissions after assuming it via its trust policy.

Capturing memory using a forensic tool is a correct forensic acquisition step because RAM contains volatile data such as running processes, open network connections, loaded kernel modules, and decryption keys that are lost when power is removed. In AWS, memory capture must be performed on the live instance, typically using tools like LiME or a memory dump utility, before any shutdown or snapshot. This preserves the most ephemeral evidence first, following the order of volatility.

Amazon Cognito identity pools are purpose-built for granting temporary AWS credentials to mobile app users. When an identity is authenticated (via Cognito User Pools, social providers, or SAML), the identity pool exchanges the user's token for short-lived credentials by assuming an IAM role. These credentials are scoped to that role's permissions and automatically expire, eliminating the need to embed or manage long-term access keys. This is the standard serverless pattern for secure mobile access to AWS APIs.

S3 Object Lock in Compliance mode enforces a write-once-read-many retention period that no principal, including the AWS account root user, can shorten or bypass, so CloudTrail log objects cannot be deleted or altered for the mandated duration.

A Direct Connect public virtual interface links to AWS public services over the dedicated connection, but the traffic on the link itself is unencrypted. By overlaying an IPsec VPN tunnel on that public VIF, you encrypt all traffic while still using the Direct Connect physical link, satisfying both the Direct Connect and encryption-in-transit mandates. This approach is the standard way to add encryption to a Direct Connect connection that also needs access to public AWS endpoints.

AWS Config continuously records configuration items for IAM users and supports the managed rule iam-user-mfa-enabled, which evaluates whether each IAM user has MFA enabled and marks noncompliant users in the Config dashboard. When a user becomes noncompliant, Config can publish evaluation results to Amazon SNS, triggering notifications or automated remediation via Systems Manager Automation. It also provides configuration history and snapshots so you can audit MFA status over time, making it the correct service for continuously verifying that all IAM users have multi-factor authentication.

The action field in VPC Flow Logs records whether the traffic was accepted or rejected by security groups and network ACLs. A value of ACCEPT confirms that the flow was allowed, making this the only field that directly answers the question of whether the traffic was permitted or blocked. Without evaluating this field, no other field can determine the outcome.

AWS CloudTrail records all S3 API requests as event history, and by enabling data events, it captures object-level operations such as GetObject and PutObject. By delivering these events to CloudWatch Logs, you can create metric filters that match S3 error responses such as AccessDenied (403) or AuthorizationError, and then attach a CloudWatch alarm to trigger SNS notifications. Because CloudTrail pushes events to CloudWatch Logs near real time, it enables immediate detection of unauthorized access attempts. This makes it the most suitable option for real-time alerting on actual access denials.

The correct solution combines S3 Object Lock in either governance or compliance mode with Amazon Athena. Object Lock enforces a retention period that prevents any user — including an AWS account root user — from deleting or overwriting log files, and Athena can directly query the partitioned S3 logs using standard SQL through the Glue Data Catalog. This yields a durable, tamper-evident, serverless analytics pipeline for long-term CloudTrail log storage.

This is correct because an IAM policy's Allow effect only takes effect when all conditions are satisfied. The IpAddress condition restricts valid source IPs to 192.0.2.0/24; if a request originates outside that range, the condition fails and the Allow does not apply. Since no other statement explicitly allows the action, the request is implicitly denied by default.

AWS Backup is the correct service because it provides a centralized, fully managed backup layer that can govern Amazon RDS databases across accounts and Regions. You define backup plans with schedules, lifecycle rules, and a retention period, then assign resources by tags or ID. It also supports cross-account backup copying and integration with AWS Organizations, enabling consistent backup compliance and centralized recovery point management for RDS workloads.

AWS Config rules can run managed or custom rules against the configuration of CloudTrail trails, and an aggregator in the management account lets you view compliance results from all member accounts in a single dashboard. When a trail is misconfigured or deleted, the rule evaluates the change and can trigger an Amazon EventBridge event to notify administrators. This is the only option that provides continuous, native, multi-account governance without writing custom monitoring code or relying on external scheduling.

Applying an SCP to the OU is the correct preventive control at the AWS Organizations level. An SCP can explicitly deny actions for all AWS services or specific services (e.g., ec2:*) across every member account under that OU, and it applies to all IAM principals including the root user. SCPs operate at the account boundary as an allowlist or denylist, and effective permissions are the intersection of the SCP and the IAM identity/resource policies, ensuring that a centrally defined deny cannot be bypassed by per-account IAM policies.

Route tables in the VPC control where each destination CIDR is sent. If the private subnet route table contains a route for the on-premises CIDR pointing to the NAT Gateway, traffic destined for on-premises is sent to the NAT Gateway, which is designed only for internet-bound traffic and cannot forward it across the Direct Connect or virtual private gateway. Because the route to the NAT Gateway overrides the propagated Direct Connect route, the instances cannot reach on-premises resources. This is the correct root cause.

Enabling S3 Versioning together with MFA Delete is the correct answer because versioning preserves every overwrite and deletion as a previous version, while MFA Delete adds a second-factor requirement for permanently erasing versions or changing the bucket's versioning state. When an object is deleted, S3 simply creates a delete marker and the prior versions remain recoverable; without the MFA token, even the AWS account root user cannot permanently delete a version, which effectively prevents accidental or malicious deletion.

If the engineer updated the security policy on one listener but the application uses another listener (e.g., a different port), clients connecting to the unchanged listener could still use TLS 1.0. This is a common misconfiguration where changes are applied to the wrong listener or the listener is not updated. The scenario states that some clients can use TLS 1.0, indicating that a listener with a permissive policy is still active.

AWS Network Firewall is the correct choice because it is a managed, stateful firewall that can inspect all traffic crossing subnet boundaries within the VPC, including traffic routed between application tiers or from a transit gateway. It combines stateless rule groups with stateful inspection engines (Suricata-compatible) to detect and block malicious payloads, protocol anomalies, and known threat signatures at wire speed. By forcing traffic through firewall endpoints in each Availability Zone and using route tables, you can enforce intrusion prevention and traffic filtering across the VPC, which aligns directly with the requirement for network-level threat detection and blocking.

When the eventType is AwsServiceEvent, it means the event was generated by an AWS service performing an action on a resource, often on behalf of a customer or as part of automatic operations. The userIdentity is typically null or represents a service role, and the eventSource field identifies the service (e.g., ec2.amazonaws.com, s3.amazonaws.com). This is the correct explanation because AwsServiceEvent is the only eventType that directly maps to an action initiated by an AWS service, not by a user or a console sign-in.

IAM Access Analyzer analyzes resource policies and IAM policies to identify overly permissive access, including wildcard actions and resources. It can generate findings and provide alerts, helping automate the detection of noncompliant policies. This directly addresses the requirement to evaluate policies before attachment.

With SSE-KMS, S3 invokes kms:Decrypt using the requesting user's credentials every time an encrypted object is read. The KMS key policy is the resource-based policy that controls which principals can use the key; if it does not grant the user (or the user's role) kms:Decrypt, the KMS call is denied even when the user's IAM policy allows s3:GetObject. That denial manifests as an AccessDenied error during object retrieval.

AWS Secrets Manager uses a Lambda function as the compute engine for its native rotation feature. When rotation is triggered, Secrets Manager invokes the Lambda function with different stages (createSecret, setSecret, testSecret, finishSecret) to generate and store a new secret value and update the associated service or database. You must provide the Lambda function with an IAM role that has permissions to access the secret and the target resource, and for private resources, it must be attached to a VPC. This is why the correct answer is the Lambda function, not a scheduling or compliance service.

This is the correct condition because the x-amz-server-side-encryption request header, when set to 'aws:kms', explicitly instructs S3 to encrypt the object with an AWS KMS-managed CMK upon upload. A bucket policy or IAM policy condition that checks this key and value will deny requests that specify a different encryption mode, but note that a robust enforcement policy should also explicitly deny requests that omit the header entirely (using a StringNotEquals condition) to prevent unencrypted uploads.

An Origin Access Identity (OAI) is a dedicated CloudFront user identity that CloudFront uses to authenticate to S3 when fetching objects. By granting the OAI read permission (e.g., s3:GetObject) in the bucket policy and removing public access, the bucket becomes private and only requests authenticated as that OAI can succeed. This ensures direct S3 access by anonymous users is denied while CloudFront can still retrieve and distribute the content.

Athena is the correct choice because CloudTrail logs are stored as gzipped JSON objects in an S3 bucket, and Athena can directly query that data with standard SQL through a table defined in the AWS Glue Data Catalog. Partitioning the table by account, region, and date lets Athena perform partition pruning, so only the relevant log files are scanned, which minimizes both cost and query latency. Because the logs for all member accounts are centrally delivered to a single S3 bucket in the management account, Athena provides a serverless, cross-account query capability without needing to move or transform the data.

S3 server access logs must be delivered to a destination bucket in the same AWS Region as the source bucket. The S3 logging infrastructure delivers log objects using regional endpoints, and cross-region log delivery is not supported for server access logging. If you attempt to use a destination bucket in a different Region, the configuration may fail validation in the console or, in some cases, the logs will not be delivered. This Region mismatch is precisely why the security engineer observes no server access logs flowing to the destination bucket.

CloudWatch Logs accepts log streams from many sources, including CloudTrail, VPC Flow Logs and application agents, and supports metric filters, alarms and cross-account subscriptions. That aggregation plus alerting capability satisfies the centralised collection requirement across accounts.

aws:SourceVpce is the correct condition key because it directly evaluates the VPC endpoint ID (for example, vpce-0123abc) from which the S3 request originated. Combining a bucket policy that allows a principal like "*" with the condition "aws:SourceVpce": "vpce-0123abc" ensures the bucket is accessible only via that specific gateway or interface endpoint. Requests from the internet, other endpoints, or on-premises networks do not have the matching SourceVpce value and are denied, giving you precise, endpoint-level access control.

AWS CloudTrail records every API call, including AuthorizeSecurityGroupIngress, RevokeSecurityGroupIngress and ModifySecurityGroupRules, delivering events to CloudWatch Logs or EventBridge for real-time alerting. This satisfies the requirement to capture the specific management events that change security group rules, which CloudWatch metrics alone cannot identify.

The s3:x-amz-server-side-encryption condition key is the correct way to enforce encryption in an S3 bucket policy, as it directly evaluates the x-amz-server-side-encryption header that clients must include in PutObject requests. You can combine it with StringEquals to require a specific value such as aws:kms or AES256, and use a Deny effect to reject any upload lacking the required encryption header. This condition key is evaluated by S3 during the request, making it a precise, application-level control that cannot be bypassed by network or regional context.

AWS CloudTrail is the native API auditing service: it records user activity and API calls across the account as CloudTrail events, capturing the identity, source IP, timestamp, request parameters, and response elements. These events can be delivered to Amazon S3 for long-term retention and queried with Athena, or sent to CloudWatch Logs for alerting. To fully meet an "all API calls" requirement, both management and data events must be enabled across all regions.

AWS Service Catalog acts as a governed provisioning layer for CloudFormation templates, allowing administrators to create portfolios of approved products and attach tag options, stack constraints, and IAM roles to those products. When a user provisions a product, Service Catalog automatically applies the configured tag options to the stack and all resources within it, and can reject deployment if required tags are missing. This makes it the only option here that prevents non-compliant infrastructure from being created while still allowing users to deploy via CloudFormation.

This is correct because the two data sources complement each other: EC2 OS logs (e.g., /var/log/secure on Linux, or Windows Event Logs) record interactive logins, sudo usage, and command execution on the guest OS, while CloudTrail logs the RunInstances API call, identifying the IAM principal, source IP, and timestamp of instance launch. Together they give you both the actor who created the instance and the subsequent commands run within it, enabling a full forensic timeline of the security incident.

AWS Backup is the fully managed, policy-based backup service that centralizes and automates backup scheduling, retention, and cross-region/cross-account copying across AWS services. You define backup plans with rules for frequency and retention, assign resources via tags or resource IDs, and AWS Backup enforces those policies continuously—including creating backups on schedule and enforcing lifecycle transitions to cold storage or expiration. This meets the requirement to centrally manage and enforce backup policies.

AWS STS AssumeRole provides temporary security credentials with a specified duration. The engineer can create an IAM role with read-only permissions and allow the auditor to assume it, granting time-limited access without long-term credentials. This meets the requirement for temporary, read-only access.

Amazon Macie is a fully managed data security and privacy service that uses machine learning and pattern matching to automatically discover, classify, and protect sensitive data in Amazon S3, including PII, PHI, and financial information. It supports DLP by generating custom findings and sending alerts via Amazon EventBridge or AWS Security Hub, and it can integrate with AWS Organizations to scale across multiple accounts. Macie provides both managed data identifiers and custom identifiers so customers can detect proprietary or regulatory data types.

Enabling multi-factor authentication (MFA) on the root user is a critical AWS security best practice because the root user bypasses all IAM policies and has unrestricted access to all services and resources. A stolen or guessed root password alone is insufficient for an attacker if MFA is present; they would also need the MFA device, which is typically a hardware token or virtual authenticator app. AWS explicitly lists root-user MFA as the first step in account hardening, and it also reduces the risk of accidental destructive actions by requiring a second factor.

The policy statement uses "Effect": "Deny" with a condition key "aws:SecureTransport" set to "false". Since "Resource" is "*", it denies every S3 API action—on any bucket or object—when the request is transmitted over HTTP without TLS. This is a standard pattern to enforce HTTPS: any request where the secure transport boolean is false is blocked, while HTTPS requests remain unaffected by this statement.

AWS Config is the correct service because it continuously records configuration changes for resources like AWS::S3::Bucket and evaluates each bucket policy against managed rules (e.g., s3-bucket-public-read-prohibited) or custom rules written in AWS Lambda. On detecting a noncompliant policy, Config can invoke an automatic remediation action, such as running an SSM Automation document or a custom Lambda function to revert or fix the policy. This gives you native detect-and-remediate capabilities rather than just an audit trail or a threat alert.

A transit gateway with carefully designed route tables is the standard way to enforce centralized inspection: attach all VPCs to the transit gateway, then configure a route in each spoke VPC's propagation that sends inter-VPC destination CIDRs to the firewall appliance's elastic network interface in the shared services VPC. The firewall inspects and forwards the traffic back to the transit gateway, which delivers it to the destination VPC. This enables deterministic, high-availability routing through the security appliance.

VPC Flow Logs capture metadata about every IP traffic flow accepted or rejected by a VPC network interface, including source/destination IP, source/destination port, protocol, packets, and bytes transferred. By enabling these logs for the subnets or ENIs and publishing to CloudWatch Logs or S3, you can query for outbound traffic to suspicious IP addresses, unusual ports, or high data transfer volumes. This raw flow-level data is exactly what is needed to supplement a GuardDuty finding and trace which EC2 instance initiated the malicious connection.

The command invokes the KMS Encrypt API by taking the plaintext bytes from secret.txt, sending them with the specified key ID, and writing the returned base64-encoded `CiphertextBlob` to encrypted_secret.txt. This is the direct encryption of the file's contents under the given KMS key, producing ciphertext that can later be decrypted only with the same key (and any required encryption context). Because KMS Encrypt accepts plaintext up to only 4 KB, this approach is appropriate for small secrets like passwords or configuration values, not for large files.

AWS CloudTrail is the correct service because it records all management events, including every RDS API call such as StartDBInstance and StopDBInstance. Each CloudTrail event contains the identity of the caller, the time of the action, the source IP address, and request parameters, enabling a complete audit trail. You can also configure CloudTrail to deliver logs to Amazon S3 and set up EventBridge rules to trigger real-time alerts whenever a specific RDS API action occurs. This makes CloudTrail the definitive source for monitoring and alerting on RDS instance lifecycle changes.

Amazon GuardDuty is the correct answer because it is a managed threat detection service that combines machine learning, anomaly detection, and threat intelligence to monitor suspicious activity across your AWS environment. Specifically, it consumes CloudTrail management events to profile each IAM user's normal behavior—typical IP addresses, geographic locations, login times, and API call frequency—and then flags deviations as findings like 'Unusual IAM User Login' or 'Impossible Travel' activity. When a finding is generated, GuardDuty automatically emits an event to Amazon EventBridge, which you can pipe to SNS, Lambda, or Security Hub to trigger near-real-time alerts and automated responses. This provides exactly the detect-and-alert capability the company needs without requiring them to build custom analytics.

Correct. S3 Batch Operations can re-encrypt existing objects with a new key, and the old key remains active for decryption.

SSE-S3 (Server-Side Encryption with Amazon S3-Managed Keys) is a built-in S3 feature that uses AES-256 to encrypt each object at rest with a unique data key, and the data key itself is encrypted with a regularly rotated master key managed by S3. You enable it by setting the x-amz-server-side-encryption header to AES256 or by applying a bucket default encryption policy, and S3 fully handles the key lifecycle—requiring no customer key management or extra cost.

Amazon Athena can query CloudTrail logs directly in Amazon S3 using standard SQL, without requiring any ingestion or ETL step. When all accounts in the organization deliver CloudTrail logs to a centralized S3 bucket, Athena can run cross-account queries over the entire set of log files. Amazon QuickSight connects to Athena to build interactive dashboards from those results, and the serverless pay-per-query pricing makes this a cost-effective analysis solution.

The correct solution is a CloudWatch Events rule (now Amazon EventBridge) that matches the management events CloudTrail emits for the StopLogging, UpdateTrail, or DeleteTrail API calls, using an event pattern with source 'aws.cloudtrail' and eventName in the list. When such a call occurs, the rule triggers an SNS topic or Lambda function to notify security teams in near real-time. This works because CloudTrail delivers every management event to CloudWatch Events as a default integration, including the very call that disables logging.

The most direct reason the flow logs fail is that the S3 bucket policy is missing an explicit Allow that lets the delivering VPC Flow Logs service write objects into the bucket. For cross-account delivery, the policy needs a statement with Principal as vpc-flow-logs.amazonaws.com (or the aggregated log delivery principal) and Action s3:PutObject on the destination prefix such as arn:aws:s3:::central-bucket/AWSLogs/<member-account-id>/*. Without this resource-based grant, S3 denies the write even if the member account has full IAM permissions.

Security groups are stateful, instance-level firewalls that allow you to reference another security group as a source. By creating a web server security group that allows inbound TCP/443 and TCP/80 from 0.0.0.0/0, and an application server security group with an inbound rule whose source is the web server security group ID, traffic is permitted only from the specific EC2 instances associated with that web security group. This precisely satisfies the requirement without exposing the application tier directly to the internet, and it automatically accounts for new web instances that join the group.

The correct architecture is CloudTrail for recording console login events, CloudWatch Logs as the destination for those CloudTrail events, and a CloudWatch Logs metric filter that looks for IAM console sign-in failures (e.g., MFA denied or incorrect password). The metric filter increments a CloudWatch metric, and a CloudWatch Alarm on that metric triggers an Amazon SNS notification, delivering a near-real-time alert when a defined threshold (like 1 failure) is breached.

The Client VPN endpoint is the central AWS server component that clients connect to; it is configured with a server certificate, authentication methods (such as mutual TLS, SAML, or Active Directory), and connection parameters like client CIDR ranges and DNS settings. It serves as the termination point for TLS-based VPN sessions and is a required component because without it, there is nothing for remote clients to establish a tunnel with. All other components (like target network associations and authorization rules) are configured on this endpoint.

Streaming /var/log/secure to CloudWatch Logs via the CloudWatch Logs agent enables real-time ingestion of OS-level authentication events. A metric filter with pattern 'Failed password' converts each matching log line into a metric value, and a CloudWatch alarm evaluates the metric over a chosen period to alert on anomalous login failures. This is the standard pattern for Linux SSH login monitoring because the agent is natively supported and the filter operates on the actual log content.

AWS CloudTrail records all API activity across your account, including the identity making the call, source IP, timestamp, and the exact action performed. By creating a CloudWatch Events rule that filters for specific CloudTrail events—such as unauthorized PutBucketPolicy attempts, failed console logins, or IAM privilege escalation patterns—you can trigger near-real-time alerts through Amazon SNS, Lambda, or AWS Chatbot. This combination provides a native, low-latency pipeline to both detect and alert on suspicious management-plane activity.

The application is failing because the IAM policy includes a Condition key s3:x-amz-acl with StringEquals bucket-owner-full-control. For S3 to allow a PutObject call, the request must carry an x-amz-acl header matching that exact value; if the header is absent or different, S3 treats the condition as unmet and denies the request. IAM permissions alone don't bypass S3's request-level parameter checks. The application must explicitly set the header in each PutObject request.

Enabling all features in AWS Organizations and creating service control policies (SCPs) is the foundational step for central governance because SCPs apply boundary limits across every principal in member accounts, including the root user, without needing to log in to each account. SCPs can deny high-risk actions such as disabling CloudTrail, deleting IAM roles, or leaving the organization, and they work alongside IAM policies to enforce a global guardrail.

Native RDS encryption at rest is a one-way, create-time configuration: you specify a customer-managed AWS KMS key (or the default aws/rds key) when launching the DB instance, and RDS uses envelope encryption to encrypt the instance's storage, automated backups, snapshots, and read replicas. Because the encryption decision is baked into the underlying storage during provisioning, it cannot be retroactively applied to an already-running instance. This is the simplest and most operationally transparent way to meet an at-rest encryption requirement for Amazon RDS.

Creating an IAM role and attaching it to the EC2 instance profile is the AWS-recommended pattern. The instance profile securely delivers temporary credentials to the instance through the instance metadata service (IMDSv2), and the AWS SDKs automatically retrieve and refresh these credentials. Permissions are scoped to the role's policy, no secrets are stored on disk or in source code, and credentials rotate automatically, minimizing the blast radius of any single credential leak.

Modifying the existing rule's source CIDR from 0.0.0.0/0 to 203.0.113.0/24 is the minimal, precise change: the rule continues to allow TCP/22 only from the company's IP range. Security group rules are stateful and evaluated as a union, so editing the existing rule ensures no separate overly permissive rule remains. This directly satisfies the requirement to allow SSH only from the company IP while preserving connectivity for authorized administrators.

Amazon GuardDuty is a continuous threat detection service that consumes CloudTrail management and data events, VPC flow logs, and DNS logs, then applies anomaly detection and threat intelligence to identify suspicious API activity and credential compromise. It uses machine learning to baseline normal behavior and can trigger findings for events like unusual login patterns, account compromises, or API calls made from known malicious IPs. This directly satisfies the requirement to detect and respond to potential behavioral threats, making it the correct choice.

The IAM policy includes a condition that requires requests to originate from the VPC endpoint (e.g., aws:SourceVpce). If the EC2 instance routes traffic over an internet gateway to DynamoDB's public endpoint, the source is the internet gateway, not the VPC endpoint, so the condition fails. This mismatch directly explains the access denied error. To resolve it, the instance should route DynamoDB-bound traffic through the VPC endpoint, or the condition must be changed to align with the actual traffic path.

The aws:SecureTransport condition key evaluates whether the request arrived over TLS, returning false for plain HTTP. Adding it with a Boolean false value denies unencrypted access, satisfying the stem's requirement that only encrypted connections reach the cross-account bucket.

AWS Config natively tracks configuration items for S3 buckets and applies managed rules such as s3-bucket-public-read-prohibited and s3-bucket-public-write-prohibited to flag noncompliant public access settings. When a change makes a bucket noncompliant, Config can invoke an AWS Lambda function through an SNS topic or a custom rule, allowing the Lambda to send an alert or automatically remediate the issue. This pairing provides the state-based monitoring and action-taking pipeline the requirement asks for.

GuardDuty is the source service that produces the security findings in question. Security Hub is purely an aggregator: it ingests findings from GuardDuty only when GuardDuty is actually enabled and actively detecting threats in the account. If GuardDuty is not enabled in the production account, it generates no findings, so Security Hub has nothing to aggregate, regardless of how correctly Security Hub and cross-account roles are configured. Enabling Security Hub does not automatically enable GuardDuty, so this is the root cause.

A service control policy (SCP) applied at the root organizational unit centrally enforces the 90-day access key age limit across all accounts. SCPs can use a condition like 'aws:AccessKeyAge' to deny actions (e.g., 'iam:CreateAccessKey') when the age exceeds 90 days. This is the most efficient because it's a single policy that applies to all accounts without per-account configuration or manual auditing.