Tüm alıştırma soruları

1542 soru

Tüm türler1,542 Çoktan seçmeli782 Çoklu seçim746 Sıralama14

A company's containerized microservice is being migrated to run on AWS Fargate. During task initialization, the Amazon ECS container agent must retrieve database credentials from AWS Secrets Manager and inject them as environment variables inside the container. The containerized application itself does not make any direct AWS SDK calls. A developer creates a task definition and specifies the Secrets Manager secret ARN in the `secrets` parameter of the container definition. However, when attempting to run the task, it fails to start, showing a `ResourceInitializationError` due to access denied errors while retrieving the secret.

Which configuration change is required to resolve this issue?

Attach an IAM policy with the `secretsmanager:GetSecretValue` permission to the Task Execution Role (`executionRoleArn`), and ensure the role's trust policy allows the `ecs-tasks.amazonaws.com` service principal to assume the role.

Attach an IAM policy with the `secretsmanager:GetSecretValue` permission to the Task Role (`taskRoleArn`), and ensure the role's trust policy allows the `ecs-tasks.amazonaws.com` service principal to assume the role.

Attach an IAM policy with the `secretsmanager:GetSecretValue` permission to the Task Execution Role (`executionRoleArn`), and ensure the role's trust policy allows the `ecs.amazonaws.com` service principal to assume the role.

Remove the `secrets` parameter from the container definition, hardcode the database credentials in the application's SDK client configuration, and retrieve the secret directly from Secrets Manager at runtime.

Cevabı ve açıklamayı göster

Cevap: Attach an IAM policy with the `secretsmanager:GetSecretValue` permission to the Task Execution Role (`executionRoleArn`), and ensure the role's trust policy allows the `ecs-tasks.amazonaws.com` service principal to assume the role.

Cevap

The correct option correctly identifies that the ECS container agent retrieves the secret before container startup, meaning the permission must be on the Task Execution Role (`executionRoleArn`). It also correctly points out that the trust policy must allow the `ecs-tasks.amazonaws.com` service principal.

Adım Adım Çözüm

Identify which role is responsible for secret retrieval during container startup.

The Amazon ECS container agent retrieves the secret and injects it as an environment variable before the application starts, which means this action is performed under the context of the Task Execution Role (`executionRoleArn`).

Permissions for operations performed by the ECS agent (such as pulling images or reading secrets for environment variables) belong to the Task Execution Role, while permissions for the application code itself belong to the Task Role.

Determine the required IAM permission and trust policy for the role.

The Task Execution Role must have `secretsmanager:GetSecretValue` permissions, and its trust policy must allow `ecs-tasks.amazonaws.com` to assume the role.

Without the correct trust policy, ECS cannot assume the role to fetch the secret, resulting in a task start failure.

Anahtar Kavram

ECS Task Role vs Task Execution Role for secret management

Soru 1042Soru →

A developer is deploying a backend compliance service using an AWS Lambda function. The function is configured to connect to an Amazon Aurora PostgreSQL database in a private subnet, and it also calls a third-party compliance verification HTTPS endpoint on the internet.

The Lambda function is configured with:
- Execution timeout: $30\text{ seconds}$
- Memory: $512\text{ MB}$
- VPC configuration: Attached to Subnet A and Subnet B
- Security Group: Outbound allows all traffic (`0.0.0.0/0`); Inbound is restricted.

Subnet A's route table has a route for `0.0.0.0/0` pointing to a NAT Gateway located in a public subnet. However, Subnet B's route table has a route for `0.0.0.0/0` pointing directly to an Internet Gateway.

During testing under high concurrency, the developer observes two issues in Amazon CloudWatch Logs:
1. The Lambda function intermittently fails with a timeout error after $30\text{ seconds}$ during peak traffic. The database client connection pool is initialized outside the Lambda handler function.
2. The function fails to connect to the third-party compliance verification endpoint, throwing a network connection timeout, but only during execution threads that run in Subnet B.

Which two actions should the developer take to resolve these execution and configuration issues?

Geçerli olan tümünü seçin

Associate Subnet B with a route table that routes outbound traffic (`0.0.0.0/0`) to the NAT Gateway instead of the Internet Gateway.

Deploy an Amazon RDS Proxy between the Lambda function and the Aurora PostgreSQL database, and update the function to connect to the proxy endpoint.

Enable public IP address assignment in the Lambda function's VPC configuration settings.

Move the database client connection pool initialization inside the Lambda handler function so that a new database connection is created and closed on every invocation.

Configure an inbound security group rule for the Lambda function that allows traffic from the NAT Gateway on port

443

Cevabı ve açıklamayı göster

Cevap: Associate Subnet B with a route table that routes outbound traffic (`0.0.0.0/0`) to the NAT Gateway instead of the Internet Gateway.; Deploy an Amazon RDS Proxy between the Lambda function and the Aurora PostgreSQL database, and update the function to connect to the proxy endpoint.

Cevap

Associate Subnet B with a route table that routes outbound traffic to the NAT Gateway instead of the Internet Gateway, and deploy an Amazon RDS Proxy between the Lambda function and the Aurora PostgreSQL database.

To resolve the internet connectivity issue in Subnet B, the subnet must route internet-bound traffic through the NAT Gateway. Lambda functions running in a VPC do not get public IPs and cannot communicate with the internet directly via an Internet Gateway. To resolve the database connection exhaustion under concurrent load, an Amazon RDS Proxy should be deployed. The proxy handles database connection pooling and efficiently shares connections across Lambda execution environments, preventing connection limits from being breached and avoiding function execution timeouts.

Adım Adım Çözüm

Analyze the network connection timeout to the external HTTPS endpoint occurring only in Subnet B.

Subnet B routes outbound traffic directly to an Internet Gateway. However, Lambda functions in a VPC do not receive public IP addresses, meaning they cannot route traffic directly through an Internet Gateway.

This explains why executions in Subnet B fail to reach the internet, while Subnet A executions succeed via the NAT Gateway.

Determine the required VPC networking correction for Subnet B.

Change the routing of Subnet B so that its route table directs outbound traffic (`0.0.0.0/0`) to the NAT Gateway rather than the Internet Gateway.

This routes Subnet B's internet traffic through the NAT Gateway, which performs NAT translation using its public IP address.

Analyze the database connection and execution timeouts under high concurrency.

When Lambda scales out concurrently, each container creates its own connection pool. These multiple pools quickly exceed the maximum connection limit of the Aurora PostgreSQL database, causing subsequent Lambda executions to block indefinitely and time out.

This explains why initializing the pool outside the handler does not prevent database-side connection exhaustion at scale.

Determine the proper connection management solution.

Deploy an Amazon RDS Proxy between the Lambda function and the database.

RDS Proxy pools database connections and shares them across multiple Lambda execution environments, preventing connection exhaustion and reducing execution timeout issues.

Anahtar Kavram

VPC networking routing rules for AWS Lambda and database connection management at scale.

Soru 1043Soru →

A development team is integrating an on-premises security scanning tool as a custom action in AWS CodePipeline. A custom worker application runs on-premises and processes the security scanning tasks.

Arrange the steps in the correct chronological order that the custom action worker must execute to process and complete a job in CodePipeline.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

The custom worker must first poll for available jobs, acknowledge the retrieved job, process the job by downloading artifacts and running the scan, and finally report the success status back to CodePipeline.

The correct sequence starts with polling for jobs, followed by acknowledging the job to prevent duplicate executions, then downloading the artifacts and running the scan, and finally reporting the success status back to CodePipeline.

Adım Adım Çözüm

Poll for jobs

The worker receives a job token and details from CodePipeline.

Since the worker is on-premises and CodePipeline cannot initiate connection, the worker must poll CodePipeline for new jobs.

Acknowledge the job

The job status is set to in-progress in CodePipeline.

This prevents other worker instances from picking up the same job and verifies that the worker is actively handling it.

Process job workloads

Input artifacts are processed, and the security scan runs.

The worker retrieves input artifacts from S3 using the credentials in the job details, then performs the security scan.

Put job success result

CodePipeline transitions the stage action to succeeded.

CodePipeline requires an explicit API call to mark the action as complete before it can trigger the next stage.

Anahtar Kavram

AWS CodePipeline Custom Actions and the Worker Lifecycle

Tahmini Süre:1m 30s

Soru 1044Soru →

A software engineering team is using AWS CloudFormation to deploy a three-tier web application. The application requires a database password that must be rotated automatically every 30 days. Which approach should the developer use to securely reference the database password in the CloudFormation template?

Retrieve the password using a dynamic reference to an AWS Systems Manager Parameter Store SecureString parameter.

Define the database password in a template Parameter with the NoEcho property set to true, and manually update the EC2 instance database configurations out-of-band when the password rotates.

Retrieve the password using a dynamic reference to AWS Secrets Manager directly within the resource properties in the template.

Define the database password as a standard parameter, and if a stack update fails during rotation, manually delete the database instance to force the stack to continue rollback.

Cevabı ve açıklamayı göster

Cevap: Retrieve the password using a dynamic reference to AWS Secrets Manager directly within the resource properties in the template.

Cevap

Retrieve the password using a dynamic reference to AWS Secrets Manager directly within the resource properties in the template.

Using a dynamic reference to AWS Secrets Manager is the recommended best practice for referencing sensitive data that changes dynamically, such as database credentials that rotate every 30 days. AWS Secrets Manager natively integrates with AWS Lambda to rotate credentials automatically and integrates with CloudFormation templates via dynamic references, preventing plaintext passwords from appearing in the template or stack configuration.

Adım Adım Çözüm

Identify the requirement for automatic rotation of the database password.

AWS Secrets Manager is identified as the service that natively supports automatic rotation (using AWS Lambda) and integration with CloudFormation.

Systems Manager Parameter Store does not support native rotation schedules for secrets.

Determine the secure method to fetch the secret in CloudFormation.

Dynamic references using the 'resolve:secretsmanager' pattern are chosen.

This avoids hardcoding or passing parameters that could be exposed in console logs or template history.

Ensure the template avoids manual drift.

Using dynamic references allows CloudFormation to resolve the latest secret value dynamically during deployment operations without requiring manual resource modifications.

Out-of-band updates violate infrastructure-as-code principles.

Anahtar Kavram

Using AWS Secrets Manager dynamic references in AWS CloudFormation to secure and automatically rotate database credentials without introducing stack drift.

Soru 1045Soru →

A developer has deployed a microservice as an Amazon ECS task. The application writes JSON-formatted logs to an Amazon CloudWatch Logs group named `/aws/ecs/payment-service`. A sample log event is shown below:

{
"level": "error",
"responseCode": 504,
"latency": 1500,
"context": {
"api": "charge"
}
}

The developer needs to:
1. Create a CloudWatch metric filter to increment a custom metric named `PaymentTimeoutCount` whenever `responseCode` is $504$ and `latency` is greater than $1000$ . Currently, the developer's metric filter pattern `[level = "error", responseCode = 504, latency > 1000]` is matching zero events.
2. Stream these matching log events in real time to an Amazon Kinesis Data Firehose delivery stream for archiving in Amazon S3. The developer has created a CloudWatch subscription filter pointing to Kinesis Data Firehose, but logs are not arriving in the S3 bucket, and CloudWatch Logs reports delivery errors.

Which two actions must the developer perform to resolve these issues? (Select two.)

Geçerli olan tümünü seçin

Update the metric filter pattern to use JSON object syntax: `{

.responseCode = 504 &&

.latency > 1000 }`.

Change the metric filter pattern to use a SQL-like query structure: `SELECT * WHERE responseCode = 504 AND latency > 1000`.

Update the IAM role associated with the subscription filter to trust the `logs.amazonaws.com` service principal to perform the `sts:AssumeRole` action.

Modify the Kinesis Data Firehose delivery stream's IAM role to grant the `logs:PutSubscriptionFilter` permission to the CloudWatch Logs service.

Update the ECS task execution role to permit the `firehose:PutRecord` action on the destination delivery stream.

Cevabı ve açıklamayı göster

Cevap: Update the metric filter pattern to use JSON object syntax: `{ $.responseCode = 504 &&$ .latency > 1000 }`.; Update the IAM role associated with the subscription filter to trust the `logs.amazonaws.com` service principal to perform the `sts:AssumeRole` action.

Cevap

To resolve the issues, the developer must update the metric filter pattern to use the JSON object syntax `{

.responseCode = 504 &&

.latency > 1000 }` and update the subscription filter's IAM role trust policy to trust the `logs.amazonaws.com` service principal to perform the `sts:AssumeRole` action.

For JSON-structured logs in CloudWatch Logs, metric filter patterns must follow the JSON object syntax enclosed in curly braces with the `

.` path prefix for fields. The correct pattern is `{

.responseCode = 504 && $.latency > 1000 }`. Additionally, to write logs to Kinesis Data Firehose via a subscription filter, CloudWatch Logs must assume an IAM role. The role's trust policy must allow `logs.amazonaws.com` to assume the role, and the policy must permit `firehose:PutRecord` operations on the target delivery stream.

Adım Adım Çözüm

Diagnose the metric filter matching failure.

The metric filter is currently using space-delimited syntax (`[...]`), which expects space-separated values. Since the logs are JSON-formatted, CloudWatch Logs does not match the fields properly, resulting in zero matched events.

Structured JSON log groups require JSON path query notation to query inner fields.

Correct the metric filter pattern.

Convert the pattern to `{

.responseCode = 504 &&

.latency > 1000 }`.

This JSON syntax properly addresses the target fields and logical operators in CloudWatch Logs metric filters.

Diagnose the subscription filter delivery issue.

Determine that CloudWatch Logs requires permission to write to Kinesis Data Firehose via an IAM role. The delivery error indicates CloudWatch Logs cannot assume the configured role.

Subscription filters execute asynchronously at the CloudWatch service level, necessitating a trust relationship with the `logs.amazonaws.com` service principal.

Update the IAM role trust policy.

Add `logs.amazonaws.com` under the `Principal` block with the `sts:AssumeRole` action.

This authorizes CloudWatch Logs to temporarily assume the role and execute `firehose:PutRecord` batch calls to the delivery stream.

Anahtar Kavram

CloudWatch Logs Metric Filters JSON syntax and Subscription Filter IAM permissions

Tahmini Süre:3m 0s

Soru 1046Soru →

A developer is configuring a deployment for a containerized application to Amazon ECS using AWS CodeDeploy. The developer is writing the AppSpec file in YAML format to manage the lifecycle of the deployment. Which two of the following configurations are valid and supported in the AppSpec file for this Amazon ECS deployment?

Geçerli olan tümünü seçin

The resources section specifying the target ECS service name, task definition, container name, and container port.

The files section mapping source files from the application bundle to destination directory paths on the host container instances.

The hooks section executing AWS Lambda validation functions during events like BeforeAllowTraffic or AfterAllowTraffic.

The hooks section executing shell scripts during the ApplicationStart and ApplicationStop lifecycle events.

The parameters section referencing configuration keys stored in AWS Systems Manager Parameter Store.

Cevabı ve açıklamayı göster

Cevap: The resources section specifying the target ECS service name, task definition, container name, and container port.; The hooks section executing AWS Lambda validation functions during events like BeforeAllowTraffic or AfterAllowTraffic.

Cevap

The correct configurations are the resources section specifying target service and task definition details, and the hooks section executing AWS Lambda functions during ECS lifecycle events.

For an Amazon ECS deployment, AWS CodeDeploy uses the AppSpec file to determine which ECS task definition to deploy and how to validate traffic routing. The resources section is required to specify details such as the target service, task definition, container name, and container port. The hooks section allows developers to trigger validation Lambda functions at specific points in the blue/green deployment workflow (like BeforeAllowTraffic and AfterAllowTraffic) to ensure the new version is healthy before complete traffic cutover.

Adım Adım Çözüm

Analyze the target compute platform for the CodeDeploy deployment.

The target platform is Amazon ECS.

The structure and valid parameters of the AppSpec file vary depending on whether the deployment is for EC2/on-premises, AWS Lambda, or Amazon ECS.

Determine valid top-level sections for an ECS AppSpec file.

An ECS AppSpec file supports 'version', 'resources', and 'hooks'. It does not support 'files' or 'permissions'.

The resources section defines the ECS task definition and service, while hooks are used to coordinate the blue/green deployment traffic routing.

Identify valid lifecycle hooks and execution targets for ECS deployments.

ECS hooks only support AWS Lambda functions as targets. Valid hooks include BeforeInstall, AfterInstall, AfterAllowTestTraffic, BeforeAllowTraffic, and AfterAllowTraffic.

EC2-specific hooks (like ApplicationStart and ApplicationStop) and script execution are unsupported in ECS deployments.

Anahtar Kavram

AWS CodeDeploy AppSpec structure for Amazon ECS compute platform

Tahmini Süre:1m 0s

Soru 1047Soru →

An application running on AWS Fargate needs to encrypt sensitive PDF contract files (each approximately $5\text{ MB}$ in size) before storing them in an Amazon Elastic File System (Amazon EFS) volume. The application must use envelope encryption with a customer managed key in AWS KMS.

Which two actions should a developer implement to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Call the GenerateDataKey API operation of AWS KMS using the customer managed key to obtain a plaintext data key and an encrypted data key.

Encrypt the PDF files locally with the plaintext data key, store the encrypted data key alongside the encrypted PDF files on Amazon EFS, and immediately delete the plaintext data key from memory.

Call the Encrypt API operation of AWS KMS with the customer managed key, passing the entire PDF file payload directly to return the encrypted ciphertext.

Call the GenerateDataKeyWithoutPlaintext API operation of AWS KMS to retrieve only the encrypted data key, and decrypt it locally using an SSL certificate.

Store the PDF files as secure parameters in AWS Systems Manager Parameter Store using a SecureString parameter type encrypted with the customer managed key.

Cevabı ve açıklamayı göster

Cevap: Call the GenerateDataKey API operation of AWS KMS using the customer managed key to obtain a plaintext data key and an encrypted data key.; Encrypt the PDF files locally with the plaintext data key, store the encrypted data key alongside the encrypted PDF files on Amazon EFS, and immediately delete the plaintext data key from memory.

Cevap

Call the GenerateDataKey API operation of AWS KMS using the customer managed key to obtain a plaintext data key and an encrypted data key, and encrypt the PDF files locally with the plaintext data key, store the encrypted data key alongside the encrypted PDF files on Amazon EFS, and immediately delete the plaintext data key from memory.

To encrypt payloads larger than

4\text{ KB}

, envelope encryption is required. The developer calls the `GenerateDataKey` API operation, which returns a plaintext data key and an encrypted data key. The application encrypts the PDF locally using the plaintext key, stores the encrypted data key alongside the ciphertext on Amazon EFS, and discards the plaintext data key from memory.

Adım Adım Çözüm

Generate a unique data key using AWS KMS.

The application receives a plaintext version and an encrypted version of the data key.

Because the files are larger than the

4\text{ KB}

limit of KMS direct encryption, envelope encryption must be used.

Perform local client-side encryption.

The PDF file is encrypted into ciphertext using the plaintext data key.

To secure the data locally before writing it to the shared file system.

Store the encrypted data key and cleanup memory.

The encrypted PDF file and the encrypted data key are written to Amazon EFS, and the plaintext data key is purged from memory.

The encrypted key is required for future decryption, and removing the plaintext key from memory protects against unauthorized memory dumps.

Anahtar Kavram

AWS KMS envelope encryption workflow for objects larger than

4\text{ KB}

Tahmini Süre:1m 30s

Soru 1048Soru →

A developer is deploying a Node.js application to Amazon ECS using the AWS Fargate launch type. The application calls downstream AWS services using the AWS SDK. The developer needs to configure distributed tracing with AWS X-Ray for this containerized application. Which two actions must the developer take to instrument the application and enable trace data collection? (Select TWO.)

Geçerli olan tümünü seçin

Instrument the application code by wrapping the AWS SDK client with the AWS X-Ray SDK.

Add the AWS X-Ray daemon container as a sidecar container in the Amazon ECS task definition.

Initialize the AWS SDK clients by hardcoding AWS access keys and secret keys inside the Node.js application configuration files.

Configure custom API Gateway mapping templates to extract the X-Ray trace headers and pass them as environment variables to the container.

Modify the Amazon SQS queue visibility timeout to be lower than the X-Ray segment propagation timeout to prevent loss of tracing segments.

Cevabı ve açıklamayı göster

Cevap: Instrument the application code by wrapping the AWS SDK client with the AWS X-Ray SDK.; Add the AWS X-Ray daemon container as a sidecar container in the Amazon ECS task definition.

Cevap

Instrumenting the application code by wrapping the AWS SDK client with the AWS X-Ray SDK, and adding the AWS X-Ray daemon container as a sidecar container in the Amazon ECS task definition are both required.

To enable distributed tracing for a Node.js application running on ECS Fargate, two main configurations are necessary: first, instrumenting the application code by wrapping the AWS SDK client to generate segment data, and second, configuring the X-Ray daemon as a sidecar container in the task definition to receive and forward these traces.

Adım Adım Çözüm

Wrap the AWS SDK client with the AWS X-Ray SDK inside the Node.js application code.

The application code is instrumented to capture downstream AWS calls as trace segments.

Without code instrumentation, the AWS SDK will not generate trace data for outbound service calls.

Define an AWS X-Ray daemon container in the task definition to run as a sidecar alongside the application container.

A local X-Ray daemon is running and listening on UDP port 2000 within the same ECS task.

The X-Ray SDK sends trace data to the local daemon, which buffers and uploads the traces to the AWS X-Ray service.

Anahtar Kavram

Instrumenting distributed tracing for containerized applications on ECS requires both application-level code instrumentation using the AWS X-Ray SDK and deploying the X-Ray daemon as a sidecar container.

Soru 1049Soru →

A developer is troubleshooting a containerized Node.js application deployed on Amazon ECS with AWS Fargate. The application calls an external third-party API for address validation and writes records to an Amazon DynamoDB table. The developer configured the AWS X-Ray daemon as a sidecar container in the ECS task definition. While DynamoDB tracing is working correctly, the external API calls do not appear on the X-Ray service map, and trace context is lost for downstream transactions.

Which two actions should the developer take to resolve these issues and ensure complete distributed tracing? (Select TWO.)

Geçerli olan tümünü seçin

Use the AWS X-Ray SDK Express middleware to capture incoming HTTP requests and establish the parent segment context.

Use the AWS X-Ray SDK to wrap the Node.js HTTP/HTTPS module using captureHTTPsGlobal to instrument downstream HTTP calls.

Add the AWSXRayDaemonWriteAccess policy to the ECS Task Execution Role to permit trace data transmission.

Initialize the AWS SDK client inside the application by hardcoding temporary IAM access keys obtained from the container metadata service.

Configure the SQS visibility timeout of any downstream queue to be longer than the API Gateway integration timeout to prevent trace segments from splitting.

Cevabı ve açıklamayı göster

Cevap: Use the AWS X-Ray SDK Express middleware to capture incoming HTTP requests and establish the parent segment context.; Use the AWS X-Ray SDK to wrap the Node.js HTTP/HTTPS module using captureHTTPsGlobal to instrument downstream HTTP calls.

Cevap

To enable complete distributed tracing, the developer must use the AWS X-Ray SDK Express middleware to capture incoming HTTP requests and establish the parent segment context, and use the AWS X-Ray SDK to wrap the Node.js HTTP/HTTPS module using captureHTTPsGlobal to instrument downstream HTTP calls.

Establishing incoming request context via Express middleware and wrapping outgoing HTTP client libraries with the AWS X-Ray SDK ensure that trace IDs are generated, propagated, and associated correctly. This enables the complete trace path to appear on the X-Ray service map.

Adım Adım Çözüm

Add the AWS X-Ray SDK Express middleware to the Node.js application.

Incoming HTTP requests are intercepted, a parent segment is initialized, and the tracing context is set.

Without parent segment context initialized for incoming requests, any downstream subsegments created during external calls will fail to associate correctly.

Wrap the HTTP/HTTPS core modules using the AWS X-Ray SDK's captureHTTPsGlobal method.

Outgoing HTTP requests to the third-party API are instrumented, creating subsegments and appending the tracing header.

Unwrapped HTTP client calls are not intercepted by the SDK, preventing trace details from being sent to X-Ray and losing trace correlation.

Anahtar Kavram

Instrumenting distributed tracing for containerized applications involves initializing incoming request middleware to manage trace context and wrapping downstream HTTP clients to propagate the tracing header.

Soru 1050Soru →

A developer is configuring an AWS Lambda function in Account A ( $111122223333$ ) to write data to an Amazon DynamoDB table in Account B ( $444455556666$ ). The function executes using the IAM execution role `AccountALambdaRole`. The developer creates an IAM role named `CrossAccountAccessRole` in Account B with a policy that allows write operations on the DynamoDB table. The trust policy for `CrossAccountAccessRole` is currently configured as follows:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "lambda.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}

When the Lambda function in Account A attempts to assume the role `CrossAccountAccessRole` using the AWS SDK to write to the DynamoDB table, it fails with an `AccessDenied` error. Which two of the following modifications are required to resolve this error and allow the Lambda function to write to the DynamoDB table?

Geçerli olan tümünü seçin

Update the trust policy of CrossAccountAccessRole in Account B to specify the Principal as "AWS": "arn:aws:iam::111122223333:role/AccountALambdaRole" instead of the lambda.amazonaws.com service principal.

Attach an IAM permission policy to AccountALambdaRole in Account A that grants the sts:AssumeRole action on the resource arn:aws:iam::444455556666:role/CrossAccountAccessRole.

Add a statement to the identity-based permission policy of AccountALambdaRole in Account A that includes a Principal element set to lambda.amazonaws.com with the sts:AssumeRole action.

Modify the trust policy of the Lambda execution role AccountALambdaRole in Account A to trust the role arn:aws:iam::444455556666:role/CrossAccountAccessRole.

Configure the Lambda function code to use hardcoded AWS access keys of an IAM user from Account B in the AWS SDK client constructor to write to the DynamoDB table directly.

Cevabı ve açıklamayı göster

Cevap: Update the trust policy of CrossAccountAccessRole in Account B to specify the Principal as "AWS": "arn:aws:iam::111122223333:role/AccountALambdaRole" instead of the lambda.amazonaws.com service principal.; Attach an IAM permission policy to AccountALambdaRole in Account A that grants the sts:AssumeRole action on the resource arn:aws:iam::444455556666:role/CrossAccountAccessRole.

Cevap

To allow the Lambda function in Account A to write to the DynamoDB table in Account B, the developer must update the trust policy of the target role in Account B to trust the Lambda execution role's ARN, and attach an identity-based policy to the Lambda execution role in Account A that allows the sts:AssumeRole action on the target role's ARN.

For cross-account access using IAM roles, a two-way authorization flow must be established. First, the trust policy of the target role in Account B must be updated to specify the caller's ARN (Account A's Lambda role) as the trusted Principal. Second, the calling identity (Account A's Lambda role) must be granted the sts:AssumeRole permission on the target role's ARN in its identity-based policy. This establishes both the trust from the target and the permission from the source.

Adım Adım Çözüm

Modify the trust policy in the target account (Account B).

The trust policy of CrossAccountAccessRole in Account B is updated to trust the ARN of AccountALambdaRole from Account A.

This establishes trust between Account B's role and the specific IAM principal in Account A, permitting the execution role to assume it.

Modify the permissions policy in the source account (Account A).

An identity-based policy is attached to AccountALambdaRole allowing the sts:AssumeRole action on the target role's ARN in Account B.

This grants the caller in Account A the necessary outbound permission to perform the role assumption operation.

Update the Lambda function code to use temporary credentials.

The AWS SDK calls AssumeRole, retrieves temporary credentials, and instantiates the DynamoDB client using them.

The function must run with the temporary credentials generated by the assumed role to access the DynamoDB table in Account B.

Anahtar Kavram

Cross-account IAM role assumption requires both a trust policy on the target role specifying the calling principal and a permission policy on the calling principal allowing sts:AssumeRole on the target role resource.

Soru 1051Soru →

A developer is deploying a backend worker microservice as an AWS Lambda function. The function is designed to poll an Amazon SQS queue, process incoming JSON messages, and write results to an Amazon DynamoDB table. The developer creates an IAM role named BackendWorkerRole and attaches the managed policies AWSLambdaSQSQueueExecutionRole and AmazonDynamoDBFullAccess to it. However, when trying to associate BackendWorkerRole as the execution role in the Lambda function's configuration using the AWS CLI, the command fails with the following error:

An error occurred (InvalidParameterValueException) when calling the CreateFunction operation: The role defined for the function cannot be assumed by Lambda.

Which of the following configuration adjustments is required to resolve this error?

Add an inline permission policy to the role that explicitly grants the sts:AssumeRole action on the AWS Lambda service principal.

Modify the trust policy of the role to specify 'lambda.amazonaws.com' as the trusted service principal allowed to assume the role.

Update the Lambda function's initialization code to explicitly call the AWS STS AssumeRole API using hardcoded temporary access keys.

Increase the Lambda function's execution timeout limit to 15 minutes to ensure that the STS session credentials do not expire during function creation.

Cevabı ve açıklamayı göster

Cevap: Modify the trust policy of the role to specify 'lambda.amazonaws.com' as the trusted service principal allowed to assume the role.

Cevap

Modify the trust policy of the role to specify 'lambda.amazonaws.com' as the trusted service principal allowed to assume the role.

The correct answer is correct because AWS Lambda requires a trust policy (trust relationship) defined on the execution role. This policy must explicitly trust the 'lambda.amazonaws.com' service principal and allow it to perform the 'sts:AssumeRole' action. Without this trust configuration, AWS Lambda cannot assume the execution role to retrieve the credentials needed to access downstream resources.

Adım Adım Çözüm

Analyze the error message returned by the AWS CLI execution.

The error indicates that Lambda is blocked from assuming the defined execution role.

The AWS Lambda service principal must have trust relationship permissions to assume the role on the user's behalf.

Review the trust policy of the BackendWorkerRole IAM role.

Identify that the trust policy is missing the service principal lambda.amazonaws.com or restricts it incorrectly.

Trust policies govern which entities can assume the role, whereas permission policies govern what the role can access.

Update the IAM role's trust relationship document to allow lambda.amazonaws.com.

The Lambda service can now successfully assume the role using AWS STS, and the function configuration succeeds.

This updates the trust configuration necessary for AWS Lambda to execute in your account environment.

Anahtar Kavram

IAM Execution Role Trust Policies for AWS Lambda

Soru 1052Soru →

A developer is designing a deployment strategy for a high-traffic web application hosted on Amazon EC2 instances. The company requires a canary deployment strategy where $10\%$ of the production traffic is routed to the new version of the application for validation. The rollout must allow for an immediate rollback to the stable version in the event of an application error, without waiting for client DNS caches to expire.

Which approach should the developer implement to meet these requirements?

Configure Amazon Route 53 with a Weighted routing policy pointing to separate load balancers for the stable and new versions, assigning weights of

90

and

10

respectively.

Configure Amazon Route 53 with a Multivalue Answer routing policy to return the IP addresses of both the stable and new instances, letting client-side routing distribute the traffic.

Configure an Application Load Balancer (ALB) with a single listener and two target groups (one for the stable version and one for the new version). Set the listener routing rule to distribute traffic with a weight of

90\%

to the stable target group and

10\%

to the new target group.

Configure an Application Load Balancer (ALB) with path-based routing rules to direct

10\%

of the incoming request paths to the target group of the new version.

Cevabı ve açıklamayı göster

Cevap: Configure an Application Load Balancer (ALB) with a single listener and two target groups (one for the stable version and one for the new version). Set the listener routing rule to distribute traffic with a weight of $90\%$ to the stable target group and $10\%$ to the new target group.

Cevap

90\%

to the stable target group and

10\%

to the new target group.

Configuring an Application Load Balancer (ALB) with weighted target groups shifts traffic at the application layer (HTTP/HTTPS). The client resolves a single DNS name for the load balancer, which then determines how to route requests. When a rollback is required, changing the listener rule weight immediately routes all traffic to the stable target group. This occurs instantly at the ALB level, bypassing client-side DNS caching and TTL limitations.

Adım Adım Çözüm

Analyze the requirement for a canary deployment that routes

10\%

of traffic to the new version.

The solution must support weighted routing where

90\%

goes to the stable version and

10\%

to the new version.

This establishes the target traffic split for validation.

Analyze the constraint regarding immediate rollback without waiting for client DNS caches to expire.

DNS-level routing options (such as Route 53 Weighted routing) are disqualified due to DNS cache TTL latencies.

If an error occurs, client browsers that have cached the DNS record pointing to the canary version will continue to send traffic to it, violating the immediate rollback constraint.

Select the application-layer routing mechanism that bypasses DNS cache latency.

An Application Load Balancer (ALB) with weighted target groups distributes traffic at the HTTP layer.

Because the client connects to the same ALB DNS name, updating the listener rule to route

100\%

of traffic back to the stable target group instantly redirects all subsequent requests without any DNS propagation delay.

Anahtar Kavram

Application Load Balancer weighted target groups shift traffic at the HTTP layer, bypassing DNS caching limitations during canary deployments.

Soru 1053Soru →

A developer is deploying an application on a standalone Amazon EC2 instance. The application needs to read messages from an Amazon SQS queue and write records to an Amazon DynamoDB table. To follow security best practices, the developer decides to use an IAM role. Which TWO configurations or steps are required to securely grant the EC2 instance the necessary permissions? (Select TWO.)

Geçerli olan tümünü seçin

Create an IAM role with a trust policy that allows the ec2.amazonaws.com service principal to assume the role.

Associate the IAM role with an EC2 instance profile and attach the instance profile to the EC2 instance.

Store an IAM user's long-term Access Key ID and Secret Access Key in the application's configuration file on the instance.

Configure the trust policy of the IAM role to allow the dynamodb.amazonaws.com service principal to assume the role.

Assign the application's permission policy directly to the ECS Task Execution Role of the instance.

Cevabı ve açıklamayı göster

Cevap: Create an IAM role with a trust policy that allows the ec2.amazonaws.com service principal to assume the role.; Associate the IAM role with an EC2 instance profile and attach the instance profile to the EC2 instance.

Cevap

To securely grant the EC2 instance permissions, the developer must create an IAM role with a trust policy allowing the EC2 service principal to assume it, and attach this role to the EC2 instance using an EC2 instance profile.

The correct configurations are to create an IAM role with a trust policy that allows the EC2 service principal (ec2.amazonaws.com) to assume the role, and to associate this role with an EC2 instance profile which is then attached to the EC2 instance. This configuration allows the application running on the EC2 instance to securely retrieve temporary security credentials from the instance metadata without hardcoding secrets.

Adım Adım Çözüm

Determine the service principal that needs to assume the role.

Since the application runs on an EC2 instance, the trust policy must specify 'ec2.amazonaws.com' as the principal.

The trust policy controls which AWS service or entity is allowed to assume the IAM role and retrieve temporary credentials.

Determine how the role is associated with the EC2 instance.

The IAM role must be associated with an EC2 instance profile, and that instance profile must be attached to the EC2 instance.

EC2 instances require an instance profile to act as a bridge to attach an IAM role to the instance.

Anahtar Kavram

Assigning IAM permissions to EC2 instances using Instance Profiles and Trust Policies

Soru 1054Soru →

A developer is writing a backend service that needs to encrypt a sensitive JSON configuration payload of $3\text{ KB}$ before writing it to an Amazon DynamoDB table. The encryption must be performed client-side using AWS KMS, minimizing latency and the number of AWS API calls.

Which approach meets these requirements most efficiently?

Call the KMS GenerateDataKey API to retrieve a data key, encrypt the JSON payload locally using the plaintext key, and store the encrypted data key along with the ciphertext in the DynamoDB table.

Call the KMS Encrypt API directly using a customer managed key, and store the resulting ciphertext in the DynamoDB table.

Call the KMS GenerateDataKeyWithoutPlaintext API to obtain an encrypted data key, call the Decrypt API to retrieve the plaintext key, encrypt the JSON payload locally, and store it in the DynamoDB table.

Store the JSON configuration payload in AWS Secrets Manager as a secret, configure automatic rotation, and retrieve the secret using a DynamoDB stream trigger on every write operation.

Cevabı ve açıklamayı göster

Cevap: Call the KMS Encrypt API directly using a customer managed key, and store the resulting ciphertext in the DynamoDB table.

Cevap

Call the KMS Encrypt API directly using a customer managed key, and store the resulting ciphertext in the DynamoDB table.

The correct option is to call the KMS Encrypt API directly because the payload size (

3\text{ KB}

) is less than the

4\text{ KB}

limit for direct KMS encryption. This approach minimizes latency by requiring only one API call and removes the complexity of managing envelope encryption keys locally.

Adım Adım Çözüm

Determine the size of the payload to be encrypted.

The JSON payload is

3\text{ KB}

(

3072

bytes).

AWS KMS limits direct encryption via the Encrypt API to a maximum of

4\text{ KB}

(

4096

bytes).

Select the appropriate KMS API strategy.

Since

3\text{ KB} < 4\text{ KB}

, the payload can be encrypted directly using the Encrypt API rather than employing envelope encryption.

Direct encryption requires only a single API call and removes the operational overhead of managing data keys client-side.

Execute the encryption and store the output.

Send the plaintext payload to the KMS Encrypt API, receive the ciphertext, and store it in DynamoDB.

This achieves client-side encryption with minimum latency and complexity.

Anahtar Kavram

AWS KMS direct encryption capability and its

4\text{ KB}

payload limit.

Soru 1055Soru →

A developer is troubleshooting a Python-based AWS Lambda function that processes real-time telemetry packets from an Amazon Kinesis Data Stream. The function is configured with a memory limit of $128\text{ MB}$ and a timeout of $3\text{ seconds}$ . It is attached to a private subnet within a VPC to query an Amazon RDS database. During testing, the developer observes the following issues:
- The Lambda function logs `Task timed out after 3.00 seconds` when processing batches with larger telemetry packets.
- The Lambda function fails with a socket timeout error when trying to send analytical summaries to an external third-party API.

Which two actions should the developer take to resolve these issues? (Select two.)

Geçerli olan tümünü seçin

Configure a NAT Gateway in a public subnet of the VPC, and add a route in the private subnet's route table pointing

0.0.0.0/0

traffic to the NAT Gateway.

Increase the Lambda function's timeout configuration to allow more processing time and allocate more memory to scale CPU performance proportionally.

Associate the Lambda function with a public subnet and enable the public IP assignment configuration on the function's elastic network interface (ENI).

Add a route in the private subnet's route table that maps all internet-bound traffic (

0.0.0.0/0

) directly to an Internet Gateway.

Modify the Lambda function's initialization code to force the destruction of the execution context at the end of every handler invocation.

Cevabı ve açıklamayı göster

Cevap: Configure a NAT Gateway in a public subnet of the VPC, and add a route in the private subnet's route table pointing $0.0.0.0/0$ traffic to the NAT Gateway.; Increase the Lambda function's timeout configuration to allow more processing time and allocate more memory to scale CPU performance proportionally.

Cevap

To resolve these issues, the developer must configure a NAT Gateway in a public subnet and update the private subnet's route table to route internet-bound traffic to it, and also increase the Lambda function's timeout and memory configuration.

To resolve the external API connection issue, the Lambda function must have outbound internet access. Since the function is in a private subnet, a NAT Gateway must be created in a public subnet, and the private subnet's route table must route all outbound traffic (

0.0.0.0/0

) to this NAT Gateway. To resolve the timeout issues, the function's execution time must be extended by increasing the timeout configuration, and allocating more memory will scale the CPU performance proportionally, allowing it to process large telemetry packets faster.

Adım Adım Çözüm

Diagnose the database and external API connectivity failure.

The Lambda function is associated with a private subnet to securely query the Amazon RDS database, which blocks direct access to the public internet.

A Lambda function configured to run in a VPC does not have access to the public internet by default, resulting in socket timeouts when attempting to reach the external third-party API.

Configure outbound internet connectivity.

Create a NAT Gateway in a public subnet of the VPC and add a route in the private subnet's route table pointing

0.0.0.0/0

traffic to the NAT Gateway.

The NAT Gateway translates private IP traffic from the private subnet to a public IP and routes it to the Internet Gateway, enabling the Lambda function to reach the external API.

Resolve the execution timeout issue.

Increase the Lambda function's timeout setting and allocate more memory.

Larger telemetry packets require more processing time and compute power. Increasing the memory limit scales the CPU proportionally, and extending the timeout window prevents premature execution failures.

Anahtar Kavram

Configuring VPC Lambda network routing for internet access and tuning memory and timeout settings to resolve processing bottlenecks.

Tahmini Süre:2m 0s

Soru 1056Soru →

An IoT telemetry ingestion application processes sensor data using an AWS Lambda function written in Node.js and writes the parsed payloads to an Amazon RDS database. During testing under heavy load, the Lambda function execution terminates prematurely after $3$ seconds, and the database metrics show a spike in active client connections that reaches the database's limit. The database connection client initialization code is currently located inside the Lambda handler function.

Which TWO actions should be taken to resolve these configuration and execution issues?

Geçerli olan tümünü seçin

Increase the Lambda function's timeout configuration to a value that accommodates the database write latency.

Move the database connection initialization code outside of the Lambda handler function to reuse the database client across multiple invocations.

Deploy the Lambda function in a public subnet of a VPC to allow direct internet access to the database.

Enable active tracing with AWS X-Ray to automatically close database connections at the end of each invocation.

Reduce the Lambda function's memory configuration to force faster garbage collection of unused database connections.

Cevabı ve açıklamayı göster

Cevap: Increase the Lambda function's timeout configuration to a value that accommodates the database write latency.; Move the database connection initialization code outside of the Lambda handler function to reuse the database client across multiple invocations.

Cevap

Increase the Lambda function's timeout configuration and move the database connection initialization code outside of the Lambda handler function.

Increasing the function timeout allows it to execute beyond the 3-second default threshold, which accommodates database write latency. Moving the database client initialization outside of the handler leverages the Lambda execution context reuse, allowing subsequent requests to share the connection pool and avoiding database connection exhaustion.

Adım Adım Çözüm

Analyze the log metrics to identify that the execution terminates early because of the default 3-second timeout limit.

Confirming that the timeout limit needs to be increased.

The function requires more time to complete database connections and writes.

Analyze the database connection limit error to identify that new connections are created for every single invocation.

Confirming that the database client is initialized inside the handler.

Initializing the client inside the handler forces a new connection on every invocation, causing connection pool exhaustion.

Modify the code to move the initialization of the database client outside the handler and update the Lambda timeout configuration in the AWS console or IaC template.

Connection reuse is enabled across warm starts, and execution times are allowed to exceed 3 seconds.

This resolves both the timeout and connection exhaustion issues by optimizing execution context reuse and configuration parameters.

Anahtar Kavram

AWS Lambda configuration tuning and execution context optimization

Soru 1057Soru →

An engineering team is implementing canary deployments for an AWS Lambda function using AWS CodeDeploy. They define the following `appspec.yaml` file to run validation tests on the new function version before traffic is shifted:

yaml
version: 0.0
Resources:
- myLambdaFunction:
Type: AWS::Lambda::Function
Properties:
Name: "myLambdaFunction"
Alias: "live"
CurrentVersion: "1"
TargetVersion: "2"
Hooks:
- BeforeAllowTraffic: "RunSanityCheck"

The CodeDeploy service role has the AWS-managed policy `AWSCodeDeployRoleForLambda` attached. During execution, the deployment immediately fails at the `BeforeAllowTraffic` lifecycle hook event.

Which of the following is the correct explanation for this deployment failure?

The CodeDeploy service role lacks permissions to invoke the validation function because the AWS-managed policy restricts `lambda:InvokeFunction` to functions prefixed with `CodeDeployHook_`.

The validation function must be specified under the `BeforeInstall` hook in the `appspec.yaml` file, as the `BeforeAllowTraffic` hook is only supported on Amazon EC2 deployments.

The validation function's IAM execution role trust policy does not permit the CodeDeploy service principal (`codedeploy.amazonaws.com`) to assume the role.

The validation function is attempting to retrieve database credentials from AWS Systems Manager Parameter Store, but the AppSpec file must define these secrets in the resources section for CodeDeploy to inject them.

Cevabı ve açıklamayı göster

Cevap: The CodeDeploy service role lacks permissions to invoke the validation function because the AWS-managed policy restricts `lambda:InvokeFunction` to functions prefixed with `CodeDeployHook_`.

Cevap

The CodeDeploy service role lacks permissions to invoke the validation function because the AWS-managed policy restricts `lambda:InvokeFunction` to functions prefixed with `CodeDeployHook_`.

The standard AWS-managed policy `AWSCodeDeployRoleForLambda` restricts the `lambda:InvokeFunction` permission to functions whose names start with the prefix `CodeDeployHook_`. Because the validation function is named `RunSanityCheck`, the CodeDeploy service role is not authorized to invoke it, leading to a failure during the `BeforeAllowTraffic` hook execution and triggering an automatic rollback.

Adım Adım Çözüm

Analyze the AppSpec file for the compute platform target and hooks.

The target is AWS Lambda, and the validation hook `RunSanityCheck` is registered under `BeforeAllowTraffic`.

This confirms the hook placement and names conform to the AWS Lambda AppSpec specification.

Examine the IAM permissions of the CodeDeploy service role with `AWSCodeDeployRoleForLambda` attached.

The policy permits `lambda:InvokeFunction` but restricts the resource ARN to `arn:aws:lambda:*:*:function:CodeDeployHook_*`.

This is a security best practice built into the AWS-managed policy to prevent CodeDeploy from executing arbitrary Lambda functions.

Compare the validation function name with the policy constraint.

The function name `RunSanityCheck` does not start with `CodeDeployHook_`, triggering an AccessDenied exception during invocation.

Identifying the naming mismatch resolves why the deployment fails at the lifecycle hook execution step.

Anahtar Kavram

AWS CodeDeploy Lambda Hook Validation Permissions

Tahmini Süre:2m 0s

Soru 1058Soru →

A developer has configured an AWS Lambda function inside a private subnet of a VPC to connect to an internal database. The function also needs to call an external API on the public internet, but all connection attempts to the external API time out. Which configuration change will resolve this issue while maintaining access to the private database?

Route the outbound traffic from the private subnet containing the Lambda function through a NAT Gateway.

Move the Lambda function to a public subnet within the VPC to allow direct internet access.

Configure the Lambda function to assign a public IP address to its Elastic Network Interface (ENI).

Increase the Lambda function's execution timeout limit to allow the connection to succeed.

Cevabı ve açıklamayı göster

Cevap: Route the outbound traffic from the private subnet containing the Lambda function through a NAT Gateway.

Cevap

Route the outbound traffic from the private subnet containing the Lambda function through a NAT Gateway.

For a Lambda function inside a VPC to access the internet, it must be placed in a private subnet. The outbound traffic from this private subnet must be routed to a NAT Gateway located in a public subnet, which then routes the traffic to the internet through an Internet Gateway.

Adım Adım Çözüm

Identify the networking requirements of the Lambda function.

The Lambda function needs to communicate with an internal database inside the VPC and an external API on the public internet.

Placing a Lambda function inside a VPC restricts its default direct internet access.

Determine the proper routing configuration for internet access from a VPC.

Lambda functions in a VPC require a NAT Gateway (or NAT instance) to translate private subnet traffic to the public internet.

Lambda functions do not get public IP addresses assigned to their network interfaces, meaning they cannot use an Internet Gateway directly.

Configure the subnet route tables.

Add a route to the private subnet's route table pointing 0.0.0.0/0 traffic to the NAT Gateway in the public subnet.

This establishes a valid outbound path to the internet for resources inside the private subnet.

Anahtar Kavram

VPC Lambda Internet Connectivity

Soru 1059Soru →

A developer is deploying a microservices application to Amazon ECS using the AWS Fargate launch type. The Docker image for the application is hosted in a private Docker Hub repository. The credentials for the private repository are securely stored in AWS Secrets Manager. The developer needs to configure the ECS task definition and IAM permissions so that the Amazon ECS container agent can pull the image during task startup.

Which two actions should the developer take to meet these requirements?

Geçerli olan tümünü seçin

In the container definition of the ECS task definition, configure the repositoryCredentials parameter and set the credentialsParameter property to the ARN of the AWS Secrets Manager secret containing the registry credentials.

Attach an IAM policy to the ECS task execution role that grants the secretsmanager:GetSecretValue permission for the secret, and configure the role's trust policy to trust the ecs-tasks.amazonaws.com service principal.

Attach an IAM policy to the ECS task role that grants the secretsmanager:GetSecretValue permission, and configure the container definition to reference the secret in the container's environment variables.

In the container definition of the ECS task definition, configure the repositoryCredentials parameter and set the credentialsParameter property to the name of an AWS Systems Manager Parameter Store parameter containing the registry credentials.

Attach an IAM policy to the ECS task execution role that grants the secretsmanager:GetSecretValue permission, and configure the role's trust policy to trust the ec2.amazonaws.com service principal.

Cevabı ve açıklamayı göster

Cevap: In the container definition of the ECS task definition, configure the repositoryCredentials parameter and set the credentialsParameter property to the ARN of the AWS Secrets Manager secret containing the registry credentials.; Attach an IAM policy to the ECS task execution role that grants the secretsmanager:GetSecretValue permission for the secret, and configure the role's trust policy to trust the ecs-tasks.amazonaws.com service principal.

Cevap

The developer must configure the repositoryCredentials parameter in the container definition to reference the Secrets Manager secret ARN, and attach a policy to the Task Execution Role allowing secretsmanager:GetSecretValue with a trust policy for ecs-tasks.amazonaws.com.

To pull container images from private external registries like Docker Hub on ECS Fargate, the container agent requires credentials. The correct procedure is to reference the AWS Secrets Manager secret ARN inside the repositoryCredentials block of the task definition. Because this action is performed by the Amazon ECS container agent before the container runs, the permissions (secretsmanager:GetSecretValue) must be granted to the ECS Task Execution Role, and this role must trust the ecs-tasks.amazonaws.com service principal to allow ECS to assume it.

Adım Adım Çözüm

Determine which role is responsible for task initialization and image pulling.

The Task Execution Role is identified as the role assumed by the ECS agent to pull images and write logs, whereas the Task Role is for application runtime permissions.

This prevents assigning secret retrieval permissions to the wrong role (Task Role).

Identify the proper parameter for private registry authentication in the ECS task definition.

The repositoryCredentials parameter inside the container definition is selected, which requires the ARN of an AWS Secrets Manager secret.

This establishes that SSM Parameter Store is invalid for private registry credentials in ECS.

Configure the trust relationship and permissions for the Task Execution Role.

The Task Execution Role is granted secretsmanager:GetSecretValue permission, and its trust policy is configured to trust the ecs-tasks.amazonaws.com service principal.

This allows the ECS service to assume the execution role and retrieve the registry credentials during startup on Fargate.

Anahtar Kavram

Configuring private registry authentication on ECS Fargate requires the repositoryCredentials property in the task definition referencing a Secrets Manager secret, and granting the secretsmanager:GetSecretValue permission to the ECS Task Execution Role.

Tahmini Süre:2m 30s

Soru 1060Soru →

An organization has a serverless API hosted on Amazon API Gateway that routes requests to an AWS Lambda function. The function queries an Amazon DynamoDB table to retrieve static configuration metadata that changes only once a day. Due to a sudden surge in traffic, the application is experiencing high latency and increased DynamoDB costs. The developer wants to implement a caching strategy to reduce latency and database reads with the least operational overhead and no code changes. Which of the following is the most suitable solution?

Enable caching on the Amazon API Gateway stage for the GET method.

Increase the provisioned Read Capacity Units (RCUs) on the DynamoDB table and use strongly consistent reads for all configuration queries.

Modify the AWS Lambda function code to perform a DynamoDB Scan operation to fetch the configuration metadata on every invocation.

Migrate the configuration metadata to AWS Secrets Manager and configure the Lambda function to fetch the secret on each execution.

Cevabı ve açıklamayı göster

Cevap: Enable caching on the Amazon API Gateway stage for the GET method.

Cevap

Enable caching on the Amazon API Gateway stage for the GET method.

Enabling caching on the API Gateway stage allows the API Gateway to return cached responses directly to the client for the specified Time-to-Live (TTL). This bypasses the Lambda function invocation and subsequent DynamoDB queries entirely, reducing both latency and costs without requiring any modification to the application code.

Adım Adım Çözüm

Analyze the requirements for caching static configuration data that changes once a day.

Determine that caching at the entry point (API Gateway) is the most efficient way to prevent traffic from hitting Lambda and DynamoDB.

Reduces read queries, minimizes downstream load, and lowers latency.

Evaluate the constraints: least operational overhead and no code changes.

API Gateway stage caching requires zero application code modifications.

Allows implementation directly through AWS configuration.

Anahtar Kavram

API Gateway Caching

ÖncekiSayfa 53 / 78Sonraki

Tüm alıştırma soruları

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram