All practice questions

1542 questions

All types1,542 Multiple choice782 Multiple select746 Ordering14

A developer has deployed a Java application on an Amazon EC2 instance. The application is designed to retrieve database credentials from AWS Secrets Manager using the AWS SDK. The credentials are encrypted using a customer managed AWS KMS key. The EC2 instance is associated with an IAM instance profile that has the following IAM policy attached:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"secretsmanager:GetSecretValue"
],
"Resource": "arn:aws:secretsmanager:us-east-1:123456789012:secret:ProductionDatabaseSecret-xyz789"
}
]
}

When the application attempts to retrieve the secret value, it receives an `AccessDeniedException` error. Which two actions should the developer take to resolve this authorization failure? (Select TWO.)

Select all that apply

Add the `kms:Decrypt` permission to the IAM policy attached to the EC2 instance's IAM role for the customer managed KMS key.

Update the key policy of the customer managed KMS key to grant the EC2 instance's IAM role permission to perform the `kms:Decrypt` action.

Update the trust policy of the EC2 instance's IAM role to allow the AWS Secrets Manager service principal (`secretsmanager.amazonaws.com`) to assume the role.

Modify the application code to initialize the Secrets Manager client by hardcoding the AWS access key ID and secret access key of an IAM user that has administrative privileges.

Configure an Amazon Cognito Identity Pool to exchange the EC2 instance profile's temporary credentials for a new Cognito User Pool session that has KMS decrypt permissions.

Show answer & explanation

Answer: Add the `kms:Decrypt` permission to the IAM policy attached to the EC2 instance's IAM role for the customer managed KMS key.; Update the key policy of the customer managed KMS key to grant the EC2 instance's IAM role permission to perform the `kms:Decrypt` action.

Answer

To resolve the authorization failure, the developer must grant decrypt permissions on the KMS key to the EC2 instance's IAM role, and update the KMS key's key policy to trust the EC2 instance's IAM role to perform the decryption.

When a secret in AWS Secrets Manager is encrypted with a customer managed KMS key, any entity attempting to retrieve that secret must have permissions for both `secretsmanager:GetSecretValue` and `kms:Decrypt`. Because the encryption key is customer managed, authorization requires a union of permissions from both the caller's identity policy (the EC2 instance's IAM role policy) and the resource-based policy of the KMS key (the KMS key policy). The correct options ensure that the EC2 role is granted decrypt permissions in both policy locations.

Step-by-Step Solution

Identify the encryption key used by the Secrets Manager secret.

Confirm that the secret is encrypted with a customer managed KMS key rather than the default `aws/secretsmanager` key.

Default keys automatically allow the account's roles to perform decrypt operations, but customer managed KMS keys require explicit policy definitions on both the IAM role and the KMS key policy.

Update the IAM policy of the EC2 instance's role.

Add the `kms:Decrypt` action targeting the ARN of the customer managed KMS key.

This grants the EC2 instance application permission to execute the decryption operation through the AWS SDK when calling Secrets Manager.

Update the KMS key policy.

Modify the key policy to allow the ARN of the EC2 instance's role to perform `kms:Decrypt`.

KMS key policies act as resource-based boundaries; without permission in the key policy, IAM policies alone cannot grant access to a customer managed KMS key.

Key Concept

Resolving Access Denied errors in Secrets Manager when customer managed KMS keys are used by ensuring permissions exist on both the client IAM policy and the resource-based KMS key policy.

Question 1342Question →

A developer is planning the deployment of a new version of a critical web application hosted on AWS Elastic Beanstalk. The application runs on a fleet of Amazon EC2 instances managed by an Auto Scaling group behind an Application Load Balancer. The deployment must satisfy the following constraints:

* The update must be rolled out with zero downtime.
* The application must maintain $100\%$ of its instance capacity to handle the current traffic load at all times during the deployment.
* In the event of a deployment failure, the application must support an immediate rollback to the previous version without requiring a full redeployment of the original code.

Which two deployment strategies meet these requirements? (Select two.)

Select all that apply

Blue/Green deployment

Immutable deployment

Rolling with additional batch deployment

Rolling deployment

All at once deployment

Show answer & explanation

Answer: Blue/Green deployment; Immutable deployment

Answer

Blue/Green deployment and Immutable deployment

Blue/Green deployment and Immutable deployment satisfy all requirements. Blue/Green deployment provisions a separate environment with the new version and performs a DNS CNAME swap, keeping both environments at

100\%

capacity and allowing an instant swap back in case of failure. Immutable deployment creates a temporary Auto Scaling group with the new version alongside the existing one, maintaining

100\%

capacity, and immediately rolls back by terminating the new Auto Scaling group if the deployment fails.

Step-by-Step Solution

Analyze the capacity requirement.

Since the application must maintain

100\%

of its instance capacity during the deployment, strategies that take existing instances out of service (like Rolling and All at once) are disqualified.

To ensure there is no performance degradation under high load.

Analyze the rollback requirement.

The rollback must be immediate and not require a full redeployment. This disqualifies Rolling with additional batch deployment, where rollback requires redeploying the old version onto updated instances.

To minimize the duration of service issues if the new version is buggy.

Evaluate the remaining options.

Blue/Green deployment (via CNAME swap) and Immutable deployment both run a full set of new instances alongside the old ones (maintaining

100\%

capacity) and support immediate rollback (by swapping CNAMEs back or terminating the temporary Auto Scaling group, respectively).

Both strategies satisfy all the constraints in the scenario.

Key Concept

AWS Elastic Beanstalk deployment strategies trade-offs including capacity, downtime, and rollback mechanisms.

Question 1343Question →

A developer is designing a single-page web application where users sign in with their email address and password. After authentication, the application must be able to call a secure backend REST API hosted on Amazon API Gateway and download user-specific profile images directly from a private Amazon S3 bucket. Which two actions should the developer take to meet these requirements with the least operational overhead?

Select all that apply

Configure an Amazon Cognito User Pool to manage user authentication, and use the built-in Cognito User Pool Authorizer in API Gateway to validate the identity token (ID token) presented by the client application.

Configure an Amazon Cognito Identity Pool linked to the User Pool, and map an IAM role to authenticated users that provides read access to the specific Amazon S3 prefix.

Embed IAM user access keys directly inside the client application code, and call the AWS STS AssumeRole API to retrieve credentials for S3 access.

Create a custom Lambda Authorizer in API Gateway that makes a direct query to the Cognito User Pool backend database to verify user credentials on every request.

Configure the S3 Bucket Policy to inspect the HTTP Authorization header and directly validate the JSON Web Tokens (JWTs) generated by the Cognito User Pool.

Show answer & explanation

Answer: Configure an Amazon Cognito User Pool to manage user authentication, and use the built-in Cognito User Pool Authorizer in API Gateway to validate the identity token (ID token) presented by the client application.; Configure an Amazon Cognito Identity Pool linked to the User Pool, and map an IAM role to authenticated users that provides read access to the specific Amazon S3 prefix.

Answer

Configure an Amazon Cognito User Pool for user authentication alongside a built-in Cognito User Pool Authorizer in API Gateway, and configure an Amazon Cognito Identity Pool to delegate temporary AWS IAM credentials for S3 access.

The correct architecture uses a Cognito User Pool for managing user directories and generating JSON Web Tokens (JWTs) for API Gateway authorization via the built-in Cognito User Pool Authorizer. In addition, an Amazon Cognito Identity Pool maps the authenticated Cognito User Pool identities to temporary AWS IAM credentials, allowing the application to securely download private files directly from Amazon S3.

Step-by-Step Solution

Set up authentication directory

Amazon Cognito User Pool is configured to register and authenticate users via email and password.

This establishes the identity store and handles user sign-in flows.

Secure the API Gateway REST API

API Gateway is configured with a Cognito User Pool Authorizer linked to the User Pool.

This offloads token verification directly to API Gateway without requiring custom Lambda code.

Secure direct S3 access

An Amazon Cognito Identity Pool is created with the User Pool set as the authentication provider, and an authenticated IAM Role is associated with the required S3 read permissions.

This enables the client-side app to exchange the User Pool token for temporary AWS IAM credentials to interact directly with S3.

Key Concept

Distinction between Amazon Cognito User Pools (authentication and API Gateway authorization) and Identity Pools (exchange tokens for temporary AWS IAM credentials for direct AWS service access).

Estimated Time:2m 0s

Question 1344Question →

A developer is monitoring a serverless application where the Lambda functions write structured JSON log events to Amazon CloudWatch Logs. A sample log event is shown below:

{
"request_id": "req-98765",
"status": "Failure",
"http_status": 504
}

The developer attempts to create a CloudWatch Metric Filter to count the occurrences of gateway timeouts where the request has a status of "Failure" and an http_status of 504. The developer configures the following filter pattern:

`{ $.status == "Failure" &&$ .http_status == 504 }`

After applying this filter, the metric is not populated even though log events matching these criteria are present in the log group. Which of the following explains why the metric filter is failing to match the log events?

The metric filter pattern uses double equal signs for comparison, which is invalid syntax; the pattern must use a single equal sign for equality comparison.

The filter pattern must use space-delimited syntax enclosed in square brackets because CloudWatch Logs does not natively parse JSON log structures.

The double ampersand operator is not supported in CloudWatch metric filters; logical operations must be split into separate, single-condition metric filters.

The Lambda function's IAM execution role lacks permissions to publish to the metric filter, preventing the filter from being evaluated as logs are written.

Show answer & explanation

Answer: The metric filter pattern uses double equal signs for comparison, which is invalid syntax; the pattern must use a single equal sign for equality comparison.

Answer

The metric filter pattern uses double equal signs for comparison, which is invalid syntax; the pattern must use a single equal sign for equality comparison.

The correct option is correct because Amazon CloudWatch Logs JSON metric filters utilize a single equal sign (=) for matching field values. The use of a double equal sign (==) is unsupported and results in the filter failing to match the JSON log events, leaving the metric unpopulated.

Step-by-Step Solution

Analyze the log format and the proposed CloudWatch Metric Filter pattern.

The log format is structured JSON, and the filter pattern uses JSON path syntax: `{

.status == "Failure" &&

.http_status == 504 }`.

This helps determine the correct filtering rules (curly braces for JSON structures).

Evaluate the syntax of the comparison operators within the filter pattern.

The developer specified `==` to verify equality for both `status` and `http_status` fields.

The syntax rules of CloudWatch Metric Filters dictate which symbols are allowed for logical and comparison operators.

Compare the query operator with CloudWatch specifications.

CloudWatch Logs metric filter syntax uses a single `=` for equality comparisons. The double equal sign `==` is not recognized, resulting in zero matches.

Correcting the syntax to `{

.status = "Failure" &&

.http_status = 504 }` allows CloudWatch to correctly parse and match the JSON log fields.

Key Concept

CloudWatch Logs Metric Filter JSON Syntax and Operators

Estimated Time:1m 30s

Question 1345Question →

An enterprise web application running on Amazon EC2 instances needs to authenticate with an Amazon RDS for PostgreSQL database. The database password must be rotated every 30 days to comply with security requirements. The developer wants to implement a secure solution that automates the rotation process with the least operational overhead. Which approach should the developer take to meet these requirements?

Store the database password in AWS Secrets Manager. Enable automatic rotation, choose the target RDS database, and configure a rotation interval of 30 days. Retrieve the secret dynamically in the application using the AWS SDK.

Store the database password as a SecureString parameter in AWS Systems Manager Parameter Store. Enable built-in automatic rotation in the Parameter Store settings for RDS and configure a rotation interval of 30 days.

Store the database credentials in a secure configuration file packaged with the application. Initialize the AWS SDK client inside the application by hardcoding temporary IAM user access keys that have permission to read the configuration file.

Store the database password as a standard String parameter in AWS Systems Manager Parameter Store. Use a local cron job on the EC2 instances to retrieve the parameter using hardcoded AWS access keys and rotate the password in the database.

Show answer & explanation

Answer: Store the database password in AWS Secrets Manager. Enable automatic rotation, choose the target RDS database, and configure a rotation interval of 30 days. Retrieve the secret dynamically in the application using the AWS SDK.

Answer

AWS Secrets Manager natively supports automatic rotation of database credentials, including built-in templates for Amazon RDS databases. By enabling rotation and selecting the target RDS database, Secrets Manager automatically updates the database password and the secret value at the specified interval using a managed Lambda function. The application can query Secrets Manager via the AWS SDK at runtime using IAM roles, ensuring it always uses the current credentials without requiring code changes or redeployments.

Step-by-Step Solution

Identify the security requirements: password rotation every 30 days, minimal operational overhead, and secure runtime access by the application.

Recognize that database credential rotation is natively supported by AWS Secrets Manager for Amazon RDS databases, whereas Parameter Store lacks native database rotation integration.

Choosing the service with native rotation integration minimizes custom script maintenance and operational overhead.

Evaluate the credential retrieval method from the application running on EC2.

Ensure the application retrieves the database password dynamically at runtime using the AWS SDK, authenticated via temporary credentials from an IAM instance profile.

Dynamic retrieval ensures the application uses the latest password post-rotation, and IAM instance profiles avoid the security risk of hardcoding AWS access keys.

Key Concept

AWS Secrets Manager native RDS rotation vs Systems Manager Parameter Store configuration

Estimated Time:1m 30s

Question 1346Question →

A developer is configuring AWS CodeDeploy to deploy a web application to a fleet of Amazon EC2 instances. The deployment must copy application files to the target instances and run a shell script (scripts/initialize.sh) that installs application dependencies. During execution, this script must download a configuration file from a secured Amazon S3 bucket.

Which two options must the developer configure to meet these requirements? (Select TWO.)

Select all that apply

Define the script path and execution settings under the AfterInstall lifecycle hook in the hooks section of the appspec.yml file.

Attach an IAM instance profile to the Amazon EC2 instances with a policy that allows the s3:GetObject action on the target S3 bucket.

Define the script path and execution settings under the BeforeAllowTraffic lifecycle hook in the hooks section of the appspec.yml file.

Attach an IAM policy to the CodeDeploy service role that allows the s3:GetObject action on the target S3 bucket.

Store the configuration file in AWS Secrets Manager and grant the CodeDeploy service role permission to rotate the secret during the ValidateService hook.

Show answer & explanation

Answer: Define the script path and execution settings under the AfterInstall lifecycle hook in the hooks section of the appspec.yml file.; Attach an IAM instance profile to the Amazon EC2 instances with a policy that allows the s3:GetObject action on the target S3 bucket.

Answer

Define the script path and execution settings under the AfterInstall lifecycle hook in the appspec.yml file, and attach an IAM instance profile to the Amazon EC2 instances with a policy that allows the s3:GetObject action on the target S3 bucket.

The correct options are to define the script execution under the AfterInstall hook in the appspec.yml file and to attach an S3 read permission policy to the EC2 instance profile. The AfterInstall hook is a standard EC2 deployment lifecycle hook suitable for post-installation tasks like installing dependencies. Because the CodeDeploy agent runs directly on the EC2 instances, any commands executed by the agent (such as scripts in the hooks section) run under the security context of the EC2 instance. Therefore, the instance profile attached to the EC2 instances must have permissions to access the S3 bucket.

Step-by-Step Solution

Determine the correct lifecycle hook for the EC2 deployment script.

The AfterInstall hook is selected as the appropriate hook to run dependency installation scripts after the application bundle has been copied.

EC2 deployments use specific lifecycle hooks like BeforeInstall, Install, AfterInstall, and ApplicationStart. The script must run after files are copied.

Determine the proper IAM credentials configuration for script execution.

The EC2 instance profile must be granted the s3:GetObject permission.

Scripts executed by the CodeDeploy agent run on the EC2 instance itself and use the instance's IAM role (instance profile) to authenticate to S3, not the CodeDeploy service role.

Key Concept

Understanding AWS CodeDeploy EC2 lifecycle hooks and how IAM permissions are resolved for scripts executed by the CodeDeploy agent on EC2 instances.

Question 1347Question →

A developer is configuring an AWS Serverless Application Model (SAM) template for a microservice. The microservice includes an `AWS::Serverless::Function` that requires access to a database password. The password must be rotated automatically every 30 days to comply with corporate security standards.

Which approach should the developer use to securely provide the database password to the function through the SAM template?

Reference the password in the function's environment variables using an AWS Systems Manager Parameter Store SecureString dynamic reference.

Store the password in a local configuration file and omit the `Transform: AWS::Serverless-2016-10-31` declaration at the root of the template to prevent SAM from parsing it.

Reference the password in the function's environment variables using an AWS Secrets Manager dynamic reference.

Configure the function's execution role with an IAM trust policy that allows the database service principal to inject the password during execution.

Show answer & explanation

Answer: Reference the password in the function's environment variables using an AWS Secrets Manager dynamic reference.

Answer

Reference the password in the function's environment variables using an AWS Secrets Manager dynamic reference.

The correct approach is to reference the password using an AWS Secrets Manager dynamic reference. AWS Secrets Manager is designed to store sensitive data such as database credentials and supports automated rotation out of the box. By using a dynamic reference in the environment variables of the function, the SAM deployment safely retrieves the value during stack operations.

Step-by-Step Solution

Identify the rotation requirement for the credential.

Since the password must be rotated every 30 days, AWS Secrets Manager is the correct destination because it offers native, automated secret rotation, whereas Systems Manager Parameter Store does not.

Choosing the correct credential store satisfies the rotation compliance rule.

Identify how to retrieve the credential in the template.

Utilize a dynamic reference `{{resolve:secretsmanager:secret-id}}` inside the environment variable declaration of the AWS::Serverless::Function resource.

This allows the template to fetch the current value of the secret at runtime or deployment without hardcoding it.

Verify template compilation requirements.

Retain the root-level `Transform: AWS::Serverless-2016-10-31` header so that the AWS SAM template is transformed into standard CloudFormation resources successfully.

Omitting the Transform header causes CloudFormation to reject serverless resources like AWS::Serverless::Function.

Key Concept

AWS SAM integration with AWS Secrets Manager dynamic references for automated credential management.

Estimated Time:1m 30s

Question 1348Question →

A developer is releasing an update to a production REST API managed by Amazon API Gateway. The update includes changes to both the API Gateway resource structure and the backend integrations. To minimize risk, the developer wants to route $15\%$ of the API traffic to the new version while the remaining $85\%$ is handled by the stable production version. The strategy must support immediate rollback to the stable version without modifying client configurations or deploying new API stages. Which approach should the developer use to meet these requirements?

Configure a canary release on the existing API Gateway deployment stage and set the canary traffic percentage to

15\%

Deploy the update to a new API Gateway stage and configure an Amazon Route 53 weighted routing policy pointing to both stages.

Set up AWS CodeDeploy to perform a Canary15Percent10Minutes deployment targeting the API Gateway stage.

Deploy the update to a new stage and use an Application Load Balancer weighted target group to distribute traffic between the two stage URLs.

Show answer & explanation

Answer: Configure a canary release on the existing API Gateway deployment stage and set the canary traffic percentage to $15\%$ .

Answer

Configure a canary release on the existing API Gateway deployment stage and set the canary traffic percentage to

15\%

Configuring a canary release on the existing API Gateway stage is the only option that keeps the endpoint URL unchanged for clients, avoids creating new stages, and allows immediate rollback by deleting the canary release.

Step-by-Step Solution

Analyze the deployment constraints:

15\%

traffic routing,

85\%

remaining on stable, immediate rollback capability, no client configuration changes, and no creation of new API stages.

Identify that the deployment must take place within the existing API Gateway stage and support built-in traffic shifting.

Creating new stages or changing DNS/client endpoints is prohibited by the scenario requirements.

Evaluate the capabilities of Amazon API Gateway deployment stages.

Determine that API Gateway supports configuring a Canary release directly on a stage, allowing a designated percentage of traffic (e.g.,

15\%

) to be sent to a new deployment.

This configuration keeps the stage endpoint URL identical for clients and allows immediate promotion or deletion of the canary to rollback.

Compare the correct API Gateway canary configuration with other alternatives.

Confirm that Route 53, CodeDeploy, and Application Load Balancer solutions either require new stages or are not supported natively for shifting API Gateway stage configuration traffic.

Eliminating options that violate the no-new-stage constraint ensures the selection of the correct option.

Key Concept

API Gateway Canary Deployments

Question 1349Question →

A developer is setting up an AWS CodeBuild project to automate a build pipeline. The project is configured to use a custom service role named CodeBuildServiceRole to access AWS resources. However, when starting a build run, the build fails immediately during the provisioning phase with the following error:

Failed to assume role: CodeBuild is not authorized to perform: sts:AssumeRole on the role CodeBuildServiceRole

The developer examines the trust policy for CodeBuildServiceRole, which contains the following JSON document:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "ec2.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}

Which modification should the developer make to the trust policy to resolve this error?

Attach an IAM permissions policy to the role that grants the sts:AssumeRole action to codebuild.amazonaws.com.

Change the Service principal in the trust policy statement from ec2.amazonaws.com to codebuild.amazonaws.com.

Configure the buildspec.yml file to define temporary AWS access keys and secret keys under the environment variables section.

Modify the Principal element of the trust policy to use "AWS": "codebuild.amazonaws.com" instead of the Service block.

Show answer & explanation

Answer: Change the Service principal in the trust policy statement from ec2.amazonaws.com to codebuild.amazonaws.com.

Answer

Change the Service principal in the trust policy statement from ec2.amazonaws.com to codebuild.amazonaws.com.

The correct action is to update the trust policy's Principal to allow the CodeBuild service (codebuild.amazonaws.com) to assume the role. The error occurs because the trust policy currently only trusts the EC2 service (ec2.amazonaws.com) to assume it.

Step-by-Step Solution

Analyze the error message indicating that CodeBuild is not authorized to assume the role.

Identify that the issue lies in the role's trust relationship rather than the permissions policy.

The error message explicitly points to sts:AssumeRole authorization failure for the CodeBuild service principal.

Examine the role's trust policy document.

Observe that the Principal block currently specifies "Service": "ec2.amazonaws.com".

The role currently trusts only the EC2 service to assume it, preventing other services like CodeBuild from performing the sts:AssumeRole operation.

Modify the Service principal to target the correct service.

Change the Principal to "Service": "codebuild.amazonaws.com".

This establishes a trust relationship that explicitly authorizes the AWS CodeBuild service to assume the role during build execution.

Key Concept

An IAM role requires a trust policy (trust relationship) that designates which principal (e.g., an AWS service like CodeBuild) is allowed to assume the role via the sts:AssumeRole action.

Question 1350Question →

A developer is configuring a blue/green deployment for an Amazon ECS service using AWS CodeDeploy. The deployment must execute an AWS Lambda function to run validation tests on the replacement task set before production traffic is shifted. The validation tests require retrieving a database password that must be rotated automatically every 30 days. Additionally, the developer must configure the IAM trust policy for the CodeDeploy service role to allow the service to perform the deployment.

Which configuration should the developer implement?

Configure the validation Lambda function under the `ValidateService` lifecycle hook in the `appspec.yaml` file. Store the database password in AWS Secrets Manager, and configure the CodeDeploy service role's trust policy to allow `codedeploy.amazonaws.com` to assume the role.

Configure the validation Lambda function under the `AfterInstall` lifecycle hook in the `appspec.yaml` file. Store the database password in AWS Secrets Manager, and configure the CodeDeploy service role's trust policy to allow `ecs-tasks.amazonaws.com` to assume the role.

Configure the validation Lambda function under the `AfterInstall` lifecycle hook in the `appspec.yaml` file. Store the database password in AWS Systems Manager Parameter Store, and configure the CodeDeploy service role's trust policy to allow `codedeploy.amazonaws.com` to assume the role.

Show answer & explanation

Answer: Configure the validation Lambda function under the `AfterInstall` lifecycle hook in the `appspec.yaml` file. Store the database password in AWS Secrets Manager, and configure the CodeDeploy service role's trust policy to allow `codedeploy.amazonaws.com` to assume the role.

Answer

Configure the validation Lambda function under the `AfterInstall` lifecycle hook in the `appspec.yaml` file, store the database password in AWS Secrets Manager, and configure the CodeDeploy service role's trust policy to allow `codedeploy.amazonaws.com` to assume the role.

The correct configuration uses the `AfterInstall` lifecycle hook in the `appspec.yaml` file, which is valid for ECS blue/green deployments to run validation tests on the replacement task set before traffic routing. It stores the database password in AWS Secrets Manager because Secrets Manager natively supports automatic rotation of secrets. Lastly, the CodeDeploy service role trust policy must allow `codedeploy.amazonaws.com` to assume the role so CodeDeploy can perform the deployment tasks.

Step-by-Step Solution

Determine the appropriate lifecycle hook for running validation tests on Amazon ECS in AWS CodeDeploy.

The `AfterInstall` hook is selected.

In ECS blue/green deployments, CodeDeploy supports specific hooks such as `AfterInstall` and `AfterAllowTestTraffic` to run validation Lambda functions. Hooks like `ValidateService` are EC2-specific and not supported on ECS.

Evaluate the requirement for rotating a database password automatically.

AWS Secrets Manager is chosen.

AWS Secrets Manager natively supports automatic rotation of secrets (e.g., every 30 days) using built-in or custom Lambda functions. AWS Systems Manager Parameter Store does not support native automatic rotation.

Determine the service principal for the CodeDeploy service role trust policy.

Configure `codedeploy.amazonaws.com` as the trusted entity.

The service performing the deployment (AWS CodeDeploy) needs permission to assume the role. The principal `ecs-tasks.amazonaws.com` is used for ECS tasks to gain permissions to AWS resources, not for the CodeDeploy deployment service itself.

Key Concept

Understanding the differences between Amazon ECS and EC2 CodeDeploy lifecycle hooks, choosing appropriate AWS storage options for rotated secrets, and configuring proper IAM service trust policies.

Question 1351Question →

A developer is building an AWS Lambda function that integrates with an external customer relationship management (CRM) platform. The integration requires a client secret that must be stored securely and rotated automatically every 30 days. Which solution meets these requirements with the least operational overhead?

Hardcode the client secret in the Lambda function's source code, and use a customer managed key in AWS Key Management Service (AWS KMS) to encrypt the function deployment package.

Store the client secret in AWS Secrets Manager. Configure automatic rotation for the secret by defining a rotation schedule of 30 days and using an AWS Lambda function to perform the rotation.

Store the client secret in AWS Systems Manager Parameter Store as a SecureString parameter. Set up an Amazon EventBridge scheduled rule to trigger a custom AWS Lambda function that updates the parameter value every 30 days.

Store the client secret in AWS Systems Manager Parameter Store as a String parameter, and reference the parameter value directly in the Lambda function's environment variables.

Show answer & explanation

Answer: Store the client secret in AWS Secrets Manager. Configure automatic rotation for the secret by defining a rotation schedule of 30 days and using an AWS Lambda function to perform the rotation.

Answer

Store the client secret in AWS Secrets Manager, and configure automatic rotation for the secret using a 30-day schedule and an AWS Lambda function to execute the rotation.

AWS Secrets Manager is the optimal service for storing sensitive API keys and secrets that require automatic rotation. It features built-in support for rotating secrets on a defined schedule using a Lambda function. This native integration reduces administrative overhead compared to building custom rotation tools.

Step-by-Step Solution

Evaluate the security and rotation requirements for the sensitive CRM client secret.

Identify that the secret must be encrypted and must support automated rotation every 30 days with minimal operational overhead.

This establishes the criteria for selecting between AWS Secrets Manager and Systems Manager Parameter Store.

Compare AWS Secrets Manager and AWS Systems Manager Parameter Store features.

Determine that while Parameter Store supports SecureString parameters, it does not offer built-in rotation functionality. Secrets Manager natively supports automatic rotation via Lambda on a schedule.

This eliminates Parameter Store options due to the lack of built-in rotation capabilities.

Select the correct option based on security best practices.

Store the secret in Secrets Manager and configure automatic rotation.

This fulfills all requirements with the least operational effort.

Key Concept

AWS Secrets Manager vs Systems Manager Parameter Store rotation capabilities

Question 1352Question →

An application running on AWS Fargate writes structured JSON logs to an Amazon CloudWatch Logs log group. A developer needs to track the frequency of database connection errors. A sample log event is shown below:

{
"timestamp": "2026-07-14T12:00:00Z",
"event_type": "database_connect",
"status": "error",
"latency_ms": 2500
}

Which actions must the developer take to configure the metric filter correctly? (Select TWO.)

Select all that apply

Define the metric filter pattern as `{ (

.event_type = "database_connect") && (

.status = "error") }`

Set the metric value of the metric transformation to `1`

Define the metric filter pattern as `[timestamp, event_type="database_connect", status="error", latency_ms]`

Set the metric value of the metric transformation to `$.latency_ms`

Define the metric filter pattern using the query syntax `fields @timestamp, event_type | filter event_type = "database_connect" and status = "error"`

Show answer & explanation

Answer: Define the metric filter pattern as `{ ( $.event_type = "database_connect") && ($ .status = "error") }`; Set the metric value of the metric transformation to `1`

Answer

Define the metric filter pattern as `{ (

.event_type = "database_connect") && (

.status = "error") }` and set the metric value of the metric transformation to 1.

To create a metric filter for structured JSON logs, the pattern must follow CloudWatch's JSON syntax which utilizes curly braces `{}` and dot notation (`$.property`) to reference nested keys. The logical operator `&&` is used to join the two conditions. Additionally, since the goal is to count the frequency of occurrences of these errors, the metric value must be set to `1` so that the custom metric increments by 1 for every match.

Step-by-Step Solution

Determine the log event format to apply the correct filter pattern syntax.

Since the logs are structured in JSON, the filter pattern must use the JSON metric filter syntax (curly braces `{}` and `$.property` notation) instead of space-delimited or SQL-like syntax.

Applying the wrong filter syntax will result in zero matches and a failure to trigger metrics/alarms.

Construct the conditional expression for the filter pattern.

The correct pattern is `{ (

.event_type = "database_connect") && (

.status = "error") }` to target specific properties and require both conditions to be met.

This isolates the exact database connection failures needed for the metric.

Configure the metric transformation properties to count the events.

Set the metric value to `1` in the transformation configuration.

Using a value of 1 increments the metric count by 1 for each occurrence of the error. Using a variable field like latency would record response times rather than counting error frequency.

Key Concept

Creating CloudWatch metric filters for JSON logs to track frequency of events

Question 1353Question →

A developer is creating a serverless application using AWS SAM. The application contains an Amazon SQS queue and an AWS::Serverless::Function that needs to process messages from the queue. The function must have the minimum necessary permissions to poll messages from the SQS queue and delete them after processing. Which two configurations in the AWS SAM template are required to set up this event source and its permissions?

Select all that apply

Configure an event source under the function's Events property with the Type set to SQS and the Queue property referencing the SQS queue ARN.

Include the SQSPollerPolicy policy template under the function's Policies property, specifying the SQS queue name.

Configure an IAM trust policy on the SQS queue that allows the lambda.amazonaws.com service principal to assume the queue's execution role.

Remove the Transform: AWS::Serverless-2016-10-31 declaration from the template since standard AWS CloudFormation natively interprets the AWS::Serverless::Function resource type.

Set the Lambda function's Timeout to be greater than the SQS queue's visibility timeout to ensure the function has enough time to process and delete the messages.

Show answer & explanation

Answer: Configure an event source under the function's Events property with the Type set to SQS and the Queue property referencing the SQS queue ARN.; Include the SQSPollerPolicy policy template under the function's Policies property, specifying the SQS queue name.

Answer

The correct configurations are: (1) Configure an event source under the function's Events property with the Type set to SQS and the Queue property referencing the SQS queue ARN; (2) Include the SQSPollerPolicy policy template under the function's Policies property, specifying the SQS queue's name.

To integrate an SQS queue with an AWS SAM Lambda function, you need two primary configurations: defining the event source and granting the necessary permissions. Specifying the SQS event source under the Events property ensures the AWS Lambda service invokes the function upon message arrival. Referencing the SQSPollerPolicy template under the Policies property is the standard, secure way to assign the Lambda execution role the exact permissions required to pull and process the queue messages.

Step-by-Step Solution

Define the event trigger mapping.

Create an event mapping of type SQS pointing to the queue's ARN under the function's Events property.

This establishes the relationship that enables AWS Lambda to poll the SQS queue automatically.

Configure the security execution permissions using SAM policy templates.

Add SQSPollerPolicy under the function's Policies property.

This automatically creates the minimum required IAM permissions for the Lambda function to invoke SQS operations (ReceiveMessage, DeleteMessage, GetQueueAttributes) on the specified queue.

Key Concept

AWS SAM Event Sources and Policy Templates

Question 1354Question →

A developer is configuring an in-place deployment using AWS CodeDeploy for an application running on a fleet of $8$ Amazon EC2 instances behind an Application Load Balancer. The application must maintain at least $75\%$ of its serving capacity throughout the deployment process. Which TWO of the following CodeDeploy deployment configurations can the developer use to meet this requirement? (Select TWO.)

Select all that apply

Use the predefined CodeDeployDefault.OneAtATime deployment configuration.

Create a custom deployment configuration with the minimum healthy hosts set to a percentage of

75\%

Use the predefined CodeDeployDefault.HalfAtATime deployment configuration.

Use the predefined CodeDeployDefault.AllAtOnce deployment configuration.

Create a custom deployment configuration with the minimum healthy hosts set to a percentage of

25\%

Show answer & explanation

Answer: Use the predefined CodeDeployDefault.OneAtATime deployment configuration.; Create a custom deployment configuration with the minimum healthy hosts set to a percentage of $75\%$ .

Answer

To maintain at least

75\%

capacity of the

8

-instance fleet during deployment, the developer can either use the predefined OneAtATime configuration or create a custom configuration with the minimum healthy hosts set to

75\%

To maintain at least

75\%

capacity of an

8

-instance fleet, CodeDeploy must keep at least

6

instances healthy at all times (

8 \times 0.75 = 6

). The predefined configuration that deploys to one instance at a time ensures that

7

out of

8

instances (

87.5\%

) remain healthy during the deployment, which satisfies the

75\%

threshold. Alternatively, creating a custom deployment configuration with the minimum healthy hosts explicitly set to a percentage of

75\%

directly guarantees that at least

6

instances remain online and healthy.

Step-by-Step Solution

Calculate the minimum number of healthy instances required during deployment.

8

instances

\times 0.75 = 6

healthy instances.

The scenario requires maintaining at least

75\%

capacity of the fleet.

Evaluate the predefined CodeDeploy deployment configurations against the calculated minimum capacity.

The predefined OneAtATime configuration leaves

7

instances healthy (

87.5\%

), which is greater than or equal to

75\%

. The HalfAtATime configuration leaves

4

instances healthy (

50\%

), and AllAtOnce leaves

0

healthy (

0\%

). Both are less than

75\%

and are therefore incorrect.

To identify which predefined configuration satisfies the capacity constraint.

Evaluate custom deployment configurations to enforce the threshold.

A custom deployment configuration with minimum healthy hosts set to

75\%

directly guarantees

6

healthy instances remain online, whereas a minimum healthy host configuration set to

25\%

allows capacity to drop to

2

instances, failing the requirement.

To select the correct custom configuration option.

Key Concept

CodeDeploy Deployment Configurations

Question 1355Question →

A developer is troubleshooting a mobile web application hosted on https://cargo.freight-flow.io that interacts with a backend REST API. The API is hosted on Amazon API Gateway and routes requests to an AWS Lambda function using a Lambda Proxy Integration. When the application sends a POST request to create a shipment, the browser console displays a CORS preflight blocked error, and the client receives a 502 Bad Gateway error. The developer inspects the Amazon CloudWatch logs for the Lambda function and confirms that the function executed successfully and returned the following raw dictionary:

{
"message": "Shipment created successfully",
"shipmentId": "12345"
}

Which two actions should the developer take to resolve these errors?

Select all that apply

Configure CORS on the API Gateway resource to create an OPTIONS method that returns the required Access-Control-Allow-Origin and Access-Control-Allow-Methods headers for the preflight request.

Modify the Lambda function response to return a formatted JSON object containing statusCode, headers with Access-Control-Allow-Origin, and a stringified body.

Update the CORS configuration on the Amazon S3 bucket hosting the web application to allow requests from the API Gateway endpoint.

Modify the integration type to Lambda Custom Integration and configure a body mapping template to wrap the raw response.

Increase the execution timeout of the Lambda function and enable active tracing with AWS X-Ray to debug the response serialization.

Show answer & explanation

Answer: Configure CORS on the API Gateway resource to create an OPTIONS method that returns the required Access-Control-Allow-Origin and Access-Control-Allow-Methods headers for the preflight request.; Modify the Lambda function response to return a formatted JSON object containing statusCode, headers with Access-Control-Allow-Origin, and a stringified body.

Answer

Configure CORS on the API Gateway resource to create an OPTIONS method for the preflight request, and modify the Lambda function response to return a formatted JSON object containing statusCode, headers with Access-Control-Allow-Origin, and a stringified body.

To resolve the CORS preflight blocked and 502 Bad Gateway errors, the developer must address two things. First, the OPTIONS preflight request must be handled by enabling CORS on the API Gateway resource, which configures a Mock integration to return the correct headers. Second, because the API uses a Lambda Proxy Integration, the backend Lambda function must return a properly structured JSON object that includes the statusCode, headers (including Access-Control-Allow-Origin), and a stringified JSON body. The current raw dictionary response format is not recognized by the proxy integration, resulting in a 502 Bad Gateway error.

Step-by-Step Solution

Enable CORS on the target API Gateway resource in the AWS Console or via Infrastructure as Code.

An OPTIONS method is created on the resource with a Mock Integration that returns the Access-Control-Allow-Origin, Access-Control-Allow-Methods, and Access-Control-Allow-Headers headers for browser preflight checks.

This satisfies the browser's initial CORS preflight request.

Modify the backend Lambda function code to wrap the response payload in a standardized integration response schema.

The function now returns a JSON structure containing 'statusCode', 'headers' (with 'Access-Control-Allow-Origin' value matching the origin), and 'body' (as a stringified JSON representation of the payload).

This satisfies the response contract required by API Gateway Lambda Proxy integrations and prevents the 502 Bad Gateway error on the actual request.

Deploy the API Gateway stage to apply the resource and method modifications.

The changes become active, allowing the client application to successfully complete both the preflight and the actual POST requests.

API Gateway updates do not take effect until the API is deployed to a stage.

Key Concept

CORS and Lambda Proxy Integration response contracts in Amazon API Gateway.

Estimated Time:1m 30s

Question 1356Question →

A developer is designing a mobile photo-sharing application that allows users to authenticate using social identity providers. The application must store photos in user-specific folders within an Amazon S3 bucket. Additionally, the application needs to call a secure backend REST API hosted on Amazon API Gateway. Which TWO steps should the developer perform to implement this authentication and authorization flow with the least operational complexity?

Select all that apply

Create an Amazon Cognito User Pool to handle user authentication, federation with social identity providers, and token generation.

Create an Amazon Cognito Identity Pool, integrate it with the User Pool, and map an IAM role to obtain temporary AWS credentials for S3 access.

Configure the Amazon Cognito User Pool to directly issue temporary AWS security credentials to the mobile client for S3 bucket access.

Implement a custom API Gateway Lambda Authorizer that parses the user pool token, assumes an IAM role, and returns temporary security credentials to the client.

Configure the Amazon Cognito Identity Pool to store user attributes, manage password strength policies, and handle multi-factor authentication (MFA).

Show answer & explanation

Answer: Create an Amazon Cognito User Pool to handle user authentication, federation with social identity providers, and token generation.; Create an Amazon Cognito Identity Pool, integrate it with the User Pool, and map an IAM role to obtain temporary AWS credentials for S3 access.

Answer

To implement this flow, the developer should create an Amazon Cognito User Pool to handle user authentication and social provider federation, and create an Amazon Cognito Identity Pool linked to the User Pool to authorize users by providing temporary AWS IAM credentials for S3 access.

For the social identity authentication, the application needs an Amazon Cognito User Pool to serve as the user directory and handle federation. To authorize the client to upload files to Amazon S3, the application must exchange the User Pool tokens for temporary AWS security credentials, which is the primary function of an Amazon Cognito Identity Pool.

Step-by-Step Solution

Set up authentication

Configure an Amazon Cognito User Pool, set up social identity providers, and establish client application settings to receive JWTs upon successful sign-in.

This establishes the identity directory and federated login capabilities for the mobile application.

Set up authorization for AWS resources

Configure an Amazon Cognito Identity Pool, register the User Pool as an identity provider, and associate an IAM role with permissions to the specific S3 folder.

This allows the authenticated user's JWTs to be exchanged for temporary, scoped AWS credentials, granting the client application access to Amazon S3.

Key Concept

Separation of concerns between Cognito User Pools (authentication and user directory) and Cognito Identity Pools (authorization and temporary AWS credentials generation).

Estimated Time:2m 0s

Question 1357Question →

A client-side Vue.js application hosted on `https://portal.health-insights.com` receives a `403 Forbidden` error with the message 'User is not authorized to access this resource' when attempting to fetch a user's health report. The application interacts with an Amazon API Gateway REST API secured by a custom Lambda Authorizer. The authorizer has caching enabled with a TTL of 300 seconds and is configured with `method.request.header.Authorization` as the identity source. The authorizer function dynamically builds an IAM policy that sets the `Resource` element to the incoming request's `event.methodArn` (for example, `arn:aws:execute-api:us-east-1:123456789012:apiId/prod/GET/user/profile`). A user successfully logs in and views their profile (`GET /user/profile`), but immediately receives the `403 Forbidden` error when navigating to view their reports page (`GET /user/reports`). How should the developer resolve this issue?

Modify the Lambda Authorizer to return an IAM policy with a wildcard resource path (such as `arn:aws:execute-api:us-east-1:123456789012:apiId/prod/*/*`) instead of the specific `event.methodArn` value.

Replace the Lambda Authorizer with a Cognito User Pool Authorizer and configure API Gateway to dynamically generate IAM policies for each distinct HTTP method.

Enable CORS on the API Gateway and add the `Access-Control-Allow-Origin` header to the S3 bucket hosting the client-side application.

Change the API Gateway integration type from Lambda Proxy to Lambda Custom integration and format the authorizer's output as a JSON payload containing the statusCode and body keys.

Show answer & explanation

Answer: Modify the Lambda Authorizer to return an IAM policy with a wildcard resource path (such as `arn:aws:execute-api:us-east-1:123456789012:apiId/prod/*/*`) instead of the specific `event.methodArn` value.

Answer

When caching is enabled on an API Gateway Lambda Authorizer, API Gateway uses the cached IAM policy for subsequent requests with the same token. If the policy specifies the exact `event.methodArn` (e.g., `/GET/user/profile`), any subsequent request to a different path (e.g., `/GET/user/reports`) using the same token will fail because the cached policy does not grant permission to that path. Replacing the specific path with a wildcard resource path allows the cached policy to authorize other paths during the cache TTL period.

Step-by-Step Solution

Analyze the cause of the `403 Forbidden` response.

The custom Lambda Authorizer has caching enabled for 300 seconds, keyed by the Authorization header.

This means that after the first call to `GET /user/profile`, API Gateway caches the returned policy for subsequent calls with the same token.

Examine the policy's Resource element.

The authorizer generates a policy scoped strictly to the current request's `event.methodArn` (which is `GET /user/profile`).

Since the cached policy only grants access to `GET /user/profile`, the subsequent request to `GET /user/reports` is evaluated against this cached policy and denied.

Update the policy generation logic.

Modify the authorizer to use wildcards in the Resource ARN (e.g., `/prod/*/*` or `/*`) so the cached policy allows access to multiple paths under the API.

This ensures the cached policy is broad enough to permit or deny other authorized routes for the same user within the cache TTL.

Key Concept

API Gateway Lambda Authorizer Caching and Policy Scope

Question 1358Question →

A cloud engineer is deploying a serverless microservice using an AWS Serverless Application Model (SAM) template. During the deployment process, the AWS CloudFormation engine returns an error stating that the resource type `AWS::Serverless::Function` is not supported or is invalid.

The template contains the following configuration:

yaml
AWSTemplateFormatVersion: '2010-09-09'

Resources:
GetProductFunction:
Type: AWS::Serverless::Function
Properties:
Handler: index.handler
Runtime: nodejs18.x
CodeUri: ./src
Events:
GetProductApi:
Type: Api
Properties:
Path: /products/{id}
Method: get

Which of the following configuration adjustments will resolve this deployment error?

Modify the event source properties to use a custom Integration type instead of the default proxy integration.

Configure an explicit IAM Role with a trust policy that allows the API Gateway service principal to assume the execution role.

Add the `Transform: AWS::Serverless-2016-10-31` declaration at the root level of the template.

Specify a larger timeout value under the Globals section of the template to prevent deployment timeouts.

Show answer & explanation

Answer: Add the `Transform: AWS::Serverless-2016-10-31` declaration at the root level of the template.

Answer

Add the `Transform: AWS::Serverless-2016-10-31` declaration at the root level of the template.

Adding the `Transform` declaration at the root level of the template allows AWS CloudFormation to process the SAM template. The template is converted into standard CloudFormation resources, resolving the error where `AWS::Serverless::Function` is unrecognized.

Step-by-Step Solution

Analyze the error message returned by CloudFormation.

The parser fails because it does not recognize the custom resource type `AWS::Serverless::Function`.

CloudFormation by default only supports standard AWS resource types unless a transform macro is declared.

Identify the missing requirement for AWS SAM templates.

The template is missing the mandatory `Transform` header.

The Transform header specifies the macro that AWS CloudFormation uses to translate the SAM template into a compliant CloudFormation template.

Insert the Transform statement at the root level.

The template now contains `Transform: AWS::Serverless-2016-10-31`.

This allows CloudFormation to resolve SAM shorthand syntax like `AWS::Serverless::Function` into standard AWS Lambda and IAM resources.

Key Concept

AWS Serverless Application Model (SAM) template transformation

Estimated Time:1m 15s

Question 1359Question →

A developer is configuring a blue/green deployment for an Amazon ECS application using AWS CodeDeploy. The deployment must execute validation tests on the green task set after it starts but before production traffic is directed to it. In addition, the developer must ensure that AWS CodeDeploy has the correct permissions to perform the deployment. Which two configurations must the developer implement to satisfy these requirements? (Select TWO.)

Select all that apply

In the AppSpec file, specify an AWS Lambda function under the AfterAllowTestTraffic lifecycle hook to perform validation tests on the green task set.

Configure the AWS IAM service role for CodeDeploy with a trust policy that allows the service principal codedeploy.amazonaws.com to assume the role.

Define a shell script path under the AfterInstall hook in the AppSpec file to execute the validation tests directly on the container instances.

Configure the CodeDeploy service role with a trust policy that permits the ec2.amazonaws.com service principal to assume the role.

Store the database credentials for the validation tests in AWS Systems Manager Parameter Store and enable the native automated rotation feature for the parameter.

Show answer & explanation

Answer: In the AppSpec file, specify an AWS Lambda function under the AfterAllowTestTraffic lifecycle hook to perform validation tests on the green task set.; Configure the AWS IAM service role for CodeDeploy with a trust policy that allows the service principal codedeploy.amazonaws.com to assume the role.

Answer

To configure validation testing and permissions for an ECS blue/green deployment, the developer must specify an AWS Lambda function under the AfterAllowTestTraffic hook in the AppSpec file, and configure the CodeDeploy service role trust policy to allow codedeploy.amazonaws.com to assume the role.

For validation testing on Amazon ECS, the AppSpec file must define an AWS Lambda function under the AfterAllowTestTraffic hook, allowing testing on the green task set before production traffic is routed. Furthermore, CodeDeploy needs a service role with a trust policy that designates the codedeploy.amazonaws.com service principal as an allowed entity to assume the role.

Step-by-Step Solution

Determine the correct CodeDeploy AppSpec hook for validation testing before shifting production traffic in ECS.

Identify the AfterAllowTestTraffic lifecycle hook.

This hook executes after traffic is directed to the test port on the green task set, allowing validation tests to run prior to the production traffic shift.

Select the correct executor type for ECS AppSpec lifecycle hooks.

Use an AWS Lambda function for the lifecycle hook.

Unlike EC2 deployments, CodeDeploy hook executions for ECS and Lambda deployments only support invoking an AWS Lambda function, not executing custom shell scripts.

Configure the IAM trust policy for the CodeDeploy service role.

Add codedeploy.amazonaws.com as the principal in the AssumeRole policy statement.

This allows CodeDeploy to assume the service role and make API calls to update the ECS service and shift traffic on behalf of the developer.

Key Concept

AWS CodeDeploy AppSpec lifecycle hooks for ECS and the trust policy required for the CodeDeploy service role.

Question 1360Question →

A developer is implementing secure client-side uploads for a mobile application. The application must allow authenticated users to upload files to their own prefix in an Amazon S3 bucket named $\text{app-user-data}$ using temporary credentials provided by Amazon Cognito Identity Pools. The target prefix is $\text{cognito/}\$\{cognito-identity.amazonaws.com:sub\}/$ , where $\$\$\{cognito-identity.amazonaws.com:sub\}$ represents the user's Cognito Identity ID.

Which of the following configurations must the developer implement to meet these requirements? (Select TWO.)

Select all that apply

In the IAM permissions policy attached to the authenticated role, define the S3 resource path as

\text{arn:aws:s3:::app-user-data/cognito/}\$\{cognito-identity.amazonaws.com:sub\}/*

and allow the

\text{s3:PutObject}

action.

Configure the trust policy of the authenticated IAM role to allow the

\text{cognito-identity.amazonaws.com}

service principal to call the

\text{sts:AssumeRoleWithWebIdentity}

action.

Hardcode the AWS credentials of an IAM User with full S3 write permissions inside the mobile application code to initialize the S3 client wrapper.

Add a trust relationship directly to the Amazon S3 bucket policy allowing the

\text{cognito-identity.amazonaws.com}

service principal to assume the bucket's permissions.

Configure the trust policy of the authenticated IAM role to allow the

\text{cognito-idp.amazonaws.com}

service principal to call the

\text{sts:AssumeRole}

action.

Show answer & explanation

Answer: In the IAM permissions policy attached to the authenticated role, define the S3 resource path as $\text{arn:aws:s3:::app-user-data/cognito/}\$\{cognito-identity.amazonaws.com:sub\}/*$ and allow the $\text{s3:PutObject}$ action.; Configure the trust policy of the authenticated IAM role to allow the $\text{cognito-identity.amazonaws.com}$ service principal to call the $\text{sts:AssumeRoleWithWebIdentity}$ action.

Answer

Configure the trust policy of the authenticated IAM role to allow the federated principal

\text{cognito-identity.amazonaws.com}

to call the

\text{sts:AssumeRoleWithWebIdentity}

action. Additionally, in the IAM permissions policy attached to this role, allow the

\text{s3:PutObject}

action on the resource path

\text{arn:aws:s3:::app-user-data/cognito/}\$\{cognito-identity.amazonaws.com:sub\}/*

To allow client-side users authenticated with Cognito Identity Pools to access AWS resources, the authenticated IAM role must establish a trust relationship with the identity pool provider principal

\text{cognito-identity.amazonaws.com}

and allow the

\text{sts:AssumeRoleWithWebIdentity}

API action. To secure user uploads to S3, the attached permissions policy must grant

\text{s3:PutObject}

access to the user-specific prefix, utilizing the dynamic policy variable

\$\$\{cognito-identity.amazonaws.com:sub\}

to enforce user isolation.

Step-by-Step Solution

Configure the trust policy of the IAM role to permit web identity federation.

The identity pool service principal

\text{cognito-identity.amazonaws.com}

is allowed to assume the role using

\text{sts:AssumeRoleWithWebIdentity}

This establishes trust between Amazon Cognito Identity Pools and the IAM role, enabling the exchange of Cognito tokens for temporary AWS security credentials.

Define dynamic resource-level S3 permissions using Cognito policy variables.

The IAM policy allows

\text{s3:PutObject}

specifically on resource

\text{arn:aws:s3:::app-user-data/cognito/}\$\{cognito-identity.amazonaws.com:sub\}/*

The dynamic variable

\$\$\{cognito-identity.amazonaws.com:sub\}

resolves to the current user's unique identity ID at runtime, isolating S3 uploads per user.

Key Concept

Configuring IAM Trust Policies and Identity Pool Variables for Dynamic Resource Isolation

PreviousPage 68 / 78Next

All practice questions

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept