Tüm alıştırma soruları

976 soru

Tüm türler976 Çoktan seçmeli502 Çoklu seçim450 Sıralama24

A SysOps administrator wants to configure cost alerts for a development sandbox account. The administrator needs to receive an email notification as soon as the monthly spend for the account is projected to exceed $500, before the actual charges are incurred.

Which AWS service or feature should the administrator use to meet this requirement?

An AWS Budgets cost budget with an alert threshold based on forecasted cost

An AWS Cost Anomaly Detection monitor with a threshold of $500

An Amazon CloudWatch billing alarm configured with detailed monitoring enabled

Cost allocation tags activated in the Billing console with billing alerts enabled

Cevabı ve açıklamayı göster

Cevap: An AWS Budgets cost budget with an alert threshold based on forecasted cost

Cevap

An AWS Budgets cost budget with an alert threshold based on forecasted cost

An AWS Budgets cost budget is the correct solution because it allows administrators to create alerts that trigger based on forecasted costs. This satisfies the requirement of notifying the administrator when the projected monthly spend is predicted to exceed the threshold ($500) before those costs are actually incurred.

Adım Adım Çözüm

Identify the requirement to trigger an alert based on forecasted monthly spend before the threshold is actually exceeded.

Determined that the solution must support forecasting capabilities.

Traditional billing alarms only trigger on actual accumulated costs, which does not satisfy the requirement to alert before the charges are incurred.

Evaluate AWS native services that support forecast-based alerting.

AWS Budgets is identified as the service designed to track costs against a threshold and generate alerts based on actual or forecasted amounts.

AWS Budgets allows setting up alerts when forecasted monthly spend is projected to exceed the budget limit ($500).

Anahtar Kavram

AWS Budgets configuration for forecasted cost alerts

Soru 842Soru →

A company's SysOps administrator has configured an Amazon EventBridge rule to detect when the Amazon RDS Idle DB Instances check from AWS Trusted Advisor enters a warning status. The rule is configured to target an AWS Systems Manager (SSM) Automation document that stops the idle DB instance. During testing, the administrator notices that the EventBridge rule is never triggered, even though several development RDS instances have had zero database connections for over two weeks. In the AWS Trusted Advisor console, the Cost Optimization category displays a lock icon and prompts the administrator to upgrade the support plan. Which of the following explains why the automated remediation is failing and describes the correct action to resolve the issue?

The EventBridge rule is failing to trigger because Trusted Advisor cost checks require detailed monitoring to be enabled on all target RDS DB instances. The administrator must enable detailed monitoring on the RDS instances to allow Trusted Advisor to collect metric data at one-minute intervals.

The EventBridge rule cannot directly target SSM Automation for Trusted Advisor cost checks without an active AWS Config rule. The administrator must deploy an AWS Config rule to evaluate the RDS instance idle status and configure the remediation action through AWS Config.

The AWS account is currently on the Developer Support plan, which limits Trusted Advisor to core security and service limit checks. The company must upgrade the AWS Support plan to Business or Enterprise to enable the Cost Optimization checks and allow the EventBridge notifications to function.

The Trusted Advisor check is failing to report status changes because cost allocation tags are not activated in the Billing console. The administrator must activate the environment tags in the Billing console to allow Trusted Advisor to analyze the cost metrics of the RDS instances.

Cevabı ve açıklamayı göster

Cevap: The AWS account is currently on the Developer Support plan, which limits Trusted Advisor to core security and service limit checks. The company must upgrade the AWS Support plan to Business or Enterprise to enable the Cost Optimization checks and allow the EventBridge notifications to function.

Cevap

The correct answer explains that AWS Trusted Advisor requires a Business, Enterprise On-Ramp, or Enterprise Support plan to access Cost Optimization checks. Without this level of support, the checks remain locked and do not refresh, meaning no status notifications are published to Amazon EventBridge, and the automated remediation flow cannot trigger.

Adım Adım Çözüm

Identify the status of the Trusted Advisor checks in the console.

The Cost Optimization checks show a lock icon, indicating that the full set of checks is not available under the current AWS Support plan.

AWS accounts on Basic or Developer Support plans only have access to core security and service limit checks in Trusted Advisor.

Evaluate the requirement for Amazon EventBridge integration with Trusted Advisor.

EventBridge receives events only when Trusted Advisor checks are processed and refreshed, which requires access to the full checks.

Since the cost optimization checks are locked, Trusted Advisor does not evaluate the RDS DB instances, resulting in no status events being sent to EventBridge.

Select the correct support plan level to unlock the required checks.

Upgrade the AWS Support plan to Business, Enterprise On-Ramp, or Enterprise.

These support tiers unlock the full set of Trusted Advisor checks, including Cost Optimization, and enable automated check refreshes and EventBridge notifications.

Anahtar Kavram

AWS Trusted Advisor Support Plan Requirements and EventBridge Integration

Soru 843Soru →

A SysOps Administrator is troubleshooting a routing issue in a hybrid network environment. Traffic from resources in a private VPC subnet destined for an on-premises data center network ( $172.16.0.0/16$ ) is routing through a backup Site-to-Site VPN connection instead of a primary $10\text{ Gbps}$ AWS Direct Connect connection. Both the Direct Connect connection (via a Transit Gateway attachment) and the VPN connection terminate on a single AWS Transit Gateway.

The administrator verifies the following configuration details:
- Both connections are actively establishing BGP sessions and advertising the identical $172.16.0.0/16$ prefix.
- The Transit Gateway route table associated with the VPC attachment shows active route propagation from both the Direct Connect gateway attachment and the VPN attachment.
- The Transit Gateway route table contains a static route for $172.16.0.0/16$ with the VPN attachment as the target.

Which action should the administrator take to ensure that traffic is routed over the Direct Connect connection as the primary path?

Delete the static route for

172.16.0.0/16

pointing to the VPN attachment from the Transit Gateway route table.

Modify the Route 53 private hosted zone routing policy for the on-premises domain to use failover routing with the Direct Connect path as primary.

Add a static route for

172.16.0.0/16

in the VPC subnet route tables pointing to the Internet Gateway (IGW) to bypass the Transit Gateway.

Create a VPC Gateway Endpoint for the on-premises network and associate it with the private subnet route tables.

Cevabı ve açıklamayı göster

Cevap: Delete the static route for $172.16.0.0/16$ pointing to the VPN attachment from the Transit Gateway route table.

Cevap

Delete the static route for

172.16.0.0/16

pointing to the VPN attachment from the Transit Gateway route table.

Deleting the static route targeting the VPN attachment is the correct action. AWS Transit Gateway routes traffic by prioritizing longest prefix match first, followed by static routes, and then dynamically propagated routes. Since both the Direct Connect and VPN connections advertise the identical

172.16.0.0/16

range, the static route pointing to the VPN attachment wins and forces all traffic through the VPN. Removing the static route allows Transit Gateway to evaluate the dynamically propagated routes. For propagated routes, the Transit Gateway automatically prioritizes Direct Connect gateway attachments over Site-to-Site VPN attachments.

Adım Adım Çözüm

Analyze Transit Gateway route evaluation order.

Identify that AWS Transit Gateway evaluates routing in the following order: (1) Longest Prefix Match (LPM), (2) Static routes, (3) Propagated routes.

Understanding the hierarchy of route evaluation is necessary to find why the VPN path is preferred.

Determine why the VPN is currently preferred.

Since both connections advertise the identical prefix

172.16.0.0/16

, LPM is a tie. The next criteria is static vs. propagated. The existing static route targeting the VPN attachment overrides all dynamically propagated routes, including the one from Direct Connect.

This explains the root cause of the incorrect routing path.

Select the remediation action.

Delete the static route targeting the VPN attachment. This falls back to propagated route evaluation, where the Transit Gateway will compare the propagated routes and select the Direct Connect gateway attachment because it has a higher default preference than the VPN attachment.

This restores correct traffic prioritization over the primary Direct Connect connection.

Anahtar Kavram

AWS Transit Gateway Route Evaluation and Precedence

Soru 844Soru →

A company runs a high-volume media processing platform that stores source files in an Amazon S3 bucket with versioning enabled. A SysOps administrator must configure an S3 Lifecycle policy to optimize storage costs based on the following requirements:
- Current versions (average size $150\text{ MB}$ ): Accessed frequently for the first $30\text{ days}$ . After $30\text{ days}$ , they are accessed occasionally and must remain immediately accessible. After $45\text{ days}$ , they are rarely accessed but must be retrievable within $5\text{ minutes}$ when requested.
- Noncurrent versions: Retained for $180\text{ days}$ after becoming noncurrent. They are rarely accessed, but must be available with millisecond retrieval times if requested.

Which S3 Lifecycle configuration meets these requirements in the most cost-effective manner while avoiding S3 validation errors and early transition or deletion fees?

Configure a rule for current versions to transition to S3 Standard-Infrequent Access (Standard-IA) after

30\text{ days}

and to S3 Glacier Flexible Retrieval after

60\text{ days}

. Configure a rule for noncurrent versions to transition to S3 Glacier Instant Retrieval after

1\text{ day}

and expire after

180\text{ days}

Configure a rule for current versions to transition to S3 Standard-Infrequent Access (Standard-IA) after

15\text{ days}

and to S3 Glacier Flexible Retrieval after

45\text{ days}

. Configure a rule for noncurrent versions to transition to S3 Glacier Deep Archive after

1\text{ day}

and expire after $180\text{ days}.

Configure a rule for current versions to transition to S3 Standard-Infrequent Access (Standard-IA) after

30\text{ days}

and to S3 Glacier Flexible Retrieval after

45\text{ days}

. Configure a rule for noncurrent versions to transition to S3 Glacier Instant Retrieval after

1\text{ day}

and expire after $180\text{ days}.

Configure a rule for current versions to transition to S3 Standard-Infrequent Access (Standard-IA) after

30\text{ days}

and to S3 Glacier Instant Retrieval after

60\text{ days}

. Configure a rule for noncurrent versions to transition to S3 Standard-Infrequent Access (Standard-IA) after

1\text{ day}

and to S3 Glacier Flexible Retrieval after

15\text{ days}

, then expire after $180\text{ days}.

Cevabı ve açıklamayı göster

Cevap: Configure a rule for current versions to transition to S3 Standard-Infrequent Access (Standard-IA) after $30\text{ days}$ and to S3 Glacier Flexible Retrieval after $60\text{ days}$ . Configure a rule for noncurrent versions to transition to S3 Glacier Instant Retrieval after $1\text{ day}$ and expire after $180\text{ days}$ .

Cevap

Configure a rule for current versions to transition to S3 Standard-Infrequent Access (Standard-IA) after 30 days and to S3 Glacier Flexible Retrieval after 60 days. Configure a rule for noncurrent versions to transition to S3 Glacier Instant Retrieval after 1 day and expire after 180 days.

The correct configuration transitions current versions to S3 Standard-IA at day 30, satisfying the 30-day minimum age requirement. It then transitions them to S3 Glacier Flexible Retrieval at day 60, ensuring they spend at least 30 days in S3 Standard-IA to avoid early transition fees. Noncurrent versions are transitioned to S3 Glacier Instant Retrieval after 1 day, which provides the required millisecond retrieval capability, and they are expired after 180 days (exceeding the 90-day minimum storage duration for S3 Glacier Instant Retrieval).

Adım Adım Çözüm

Analyze current version lifecycle constraints for S3 Standard-IA.

Transitions from S3 Standard to S3 Standard-IA or S3 One Zone-IA require objects to be stored in the source class for at least 30 days. Therefore, transition to S3 Standard-IA can only happen at day 30 or later.

To satisfy S3 Lifecycle validation limits on transition age.

Evaluate S3 Standard-IA minimum storage duration rules.

S3 Standard-IA has a 30-day minimum storage duration. Moving objects to S3 Glacier Flexible Retrieval at day 45 (after only 15 days in Standard-IA) would trigger early transition fees. Postponing the Glacier transition to day 60 ensures they spend 30 days in S3 Standard-IA, avoiding fees.

To prevent unexpected early transition charges.

Identify the correct storage class for noncurrent versions based on retrieval requirements.

Noncurrent versions must be available with millisecond retrieval times. Only S3 Glacier Instant Retrieval provides millisecond access among the Glacier classes. S3 Glacier Flexible Retrieval (minutes/hours) and S3 Glacier Deep Archive (hours) do not meet this requirement.

To satisfy the millisecond retrieval time SLA.

Verify Glacier Instant Retrieval minimum storage duration rules.

S3 Glacier Instant Retrieval has a minimum storage duration of 90 days. Expiring the noncurrent versions at day 180 is safe and will not incur early deletion fees.

To ensure no early deletion fees are charged on the noncurrent versions.

Anahtar Kavram

Amazon S3 Storage Class Lifecycle Rules and Minimum Storage Durations

Soru 845Soru →

An administrator registers a fleet of Amazon EC2 instances running a web application on port 8080 to an Application Load Balancer (ALB) target group. The ALB's target group health checks are configured to use the default HTTP settings on port 80. As a result, the ALB marks all instances as unhealthy. Which action should the administrator take to resolve this health check failure?

Modify the target group settings to override the health check port to 8080.

Update the health check path to a static file path like /health while keeping port 80.

Change the Route 53 routing policy to active-passive failover to bypass the unhealthy targets.

Associate an Internet Gateway with the private subnet's route table to allow the ALB to reach the instances.

Cevabı ve açıklamayı göster

Cevap: Modify the target group settings to override the health check port to 8080.

Cevap

Modify the target group settings to override the health check port to 8080.

The correct action is to modify the target group settings to override the health check port to 8080. This aligns the destination port of the health check packets with the port on which the web application on the EC2 instances is configured to listen.

Adım Adım Çözüm

Identify the port where the backend application is listening.

The application is listening on port 8080.

Health checks must be sent to the correct port to receive a response.

Compare the application port with the target group's health check configuration.

There is a port mismatch (health check port is 80, application port is 8080).

This port mismatch explains why the target group health checks are failing.

Modify the health check port in the target group settings to match the application port.

The health checks are sent to port 8080, and the targets become healthy.

This aligns the load balancer's requests with the backend application port.

Anahtar Kavram

Configuring Elastic Load Balancing target group health checks to align with backend application listening ports.

Soru 846Soru →

A fleet of application servers resides in a private subnet within Spoke VPC A. The servers regularly write large analytics payloads to an Amazon DynamoDB table in the same AWS Region. The network topology utilizes a hub-and-spoke model where Spoke VPC A is connected to a central Hub VPC via an AWS Transit Gateway, and all internet-bound traffic is routed through a centralized NAT Gateway in the Hub VPC. The SysOps administrator identifies that this DynamoDB write traffic is incurring both Transit Gateway and NAT Gateway data processing charges, significantly inflating the monthly bill. Which configuration will eliminate the data processing charges for this traffic in the most cost-effective manner?

Create a Gateway VPC endpoint for DynamoDB in Spoke VPC A, and select the private subnet's route table during creation to automatically add the route.

Deploy an Interface VPC endpoint (AWS PrivateLink) for DynamoDB in Spoke VPC A, and update the private subnet's route table to route DynamoDB traffic to the endpoint network interface.

Create a Gateway VPC endpoint for DynamoDB in Spoke VPC A, but do not associate it with any route tables, and instead add a manual route pointing to the endpoint's Elastic Network Interface (ENI).

Deploy a local NAT Gateway in a public subnet within Spoke VPC A, and update the private subnet's route table to direct DynamoDB traffic through the local NAT Gateway.

Cevabı ve açıklamayı göster

Cevap: Create a Gateway VPC endpoint for DynamoDB in Spoke VPC A, and select the private subnet's route table during creation to automatically add the route.

Cevap

Create a Gateway VPC endpoint for DynamoDB in Spoke VPC A, and select the private subnet's route table during creation to automatically add the route.

The correct option is to create a Gateway VPC endpoint and associate it with the private subnet's route table. Gateway endpoints are free and route DynamoDB traffic privately, avoiding the processing charges of both the Transit Gateway and the NAT Gateway.

Adım Adım Çözüm

Analyze the current traffic path and identify charges.

DynamoDB traffic from Spoke VPC A routes through the Transit Gateway to the Hub VPC NAT Gateway. This incurs a Transit Gateway processing fee of

0.02

per GB and a NAT Gateway processing fee of

0.045

per GB.

Understanding the baseline flow exposes the origin of the high costs.

Evaluate private routing options for DynamoDB.

DynamoDB supports Gateway VPC endpoints, which are free and do not incur data processing or hourly charges, unlike Interface VPC endpoints (PrivateLink) which charge

0.01

per GB.

Choosing the correct endpoint type minimizes data transfer costs.

Determine the implementation requirements for Gateway VPC endpoints.

Gateway endpoints update route tables with a prefix list destination pointing to the gateway. They do not use Elastic Network Interfaces (ENIs).

Ensuring the configuration is valid so that traffic is successfully routed over the private connection.

Anahtar Kavram

Gateway VPC endpoints provide free, direct private connectivity to DynamoDB and S3, bypassing NAT Gateways and Transit Gateways to eliminate processing fees.

Soru 847Soru →

A SysOps Administrator is configuring private connectivity between a consumer VPC and a proprietary billing application hosted in a provider VPC using AWS PrivateLink. The provider VPC has configured a VPC Endpoint Service backed by an internal Network Load Balancer. The administrator has created an Interface VPC Endpoint in a private subnet of the consumer VPC, but EC2 instances in that subnet cannot reach the billing application.

Which of the following actions should the administrator take to successfully establish connectivity? (Select TWO).

Geçerli olan tümünü seçin

Accept the endpoint connection request in the Endpoint Service console of the provider account.

Configure the security group associated with the Interface VPC Endpoint to allow inbound traffic on the billing application's port from the EC2 instances.

Add a route in the consumer subnet's route table that targets the Interface VPC Endpoint ID for the destination IP range of the provider VPC.

Deploy a NAT Gateway in the consumer VPC and add a route in the private subnet's route table to direct the application traffic to the NAT Gateway.

Attach an Internet Gateway to the consumer VPC and add a route pointing to the Internet Gateway in the private subnet route table.

Cevabı ve açıklamayı göster

Cevap: Accept the endpoint connection request in the Endpoint Service console of the provider account.; Configure the security group associated with the Interface VPC Endpoint to allow inbound traffic on the billing application's port from the EC2 instances.

Cevap

To establish connectivity, the administrator must accept the connection request in the provider's VPC Endpoint Service configuration and configure the security group associated with the Interface VPC Endpoint in the consumer VPC to allow inbound traffic on the billing application's port from the EC2 instances.

AWS PrivateLink Interface Endpoints create Elastic Network Interfaces (ENIs) with private IP addresses in the consumer subnets. Traffic sent to the service is resolved via DNS to these ENIs. Therefore, the security group attached to the Interface Endpoint must permit inbound traffic from the client instances on the destination port. Additionally, PrivateLink connection requests must be accepted by the provider account to authorize the endpoint connection.

Adım Adım Çözüm

Accept the consumer's connection request in the provider VPC Endpoint Service settings.

The endpoint connection transitions from a pending state to an active state, allowing traffic flow between VPCs.

By default, AWS PrivateLink requires explicit approval from the service provider to authorize consumer access.

Verify and update the security group attached to the Interface VPC Endpoint in the consumer VPC.

The endpoint's Elastic Network Interfaces (ENIs) permit incoming traffic from the EC2 instances.

Interface VPC Endpoints behave like resources within the subnet; traffic must be allowed inbound on the endpoint's security group from the clients' IPs/security groups.

Anahtar Kavram

Establishing private connectivity using AWS PrivateLink and troubleshooting Interface VPC Endpoints, including connection acceptance and security group configuration.

Soru 848Soru →

A SysOps administrator is reviewing the AWS Trusted Advisor dashboard and notices a warning under the Cost Optimization category showing several unassociated Elastic IP addresses that are incurring hourly charges. The administrator needs to eliminate these charges immediately.

Which action should the SysOps administrator take to resolve this issue?

Release the unassociated Elastic IP addresses using the Amazon EC2 console or the AWS CLI.

Enable detailed monitoring on the Elastic IP addresses to track network activity and automatically stop billing charges.

Create a static budget alert in AWS Budgets to automatically release any Elastic IP address that remains unassociated for more than 24 hours.

Configure a CloudWatch Logs metric filter to monitor the connection logs of the Elastic IP addresses and set a retention period of 30 days to save costs.

Cevabı ve açıklamayı göster

Cevap: Release the unassociated Elastic IP addresses using the Amazon EC2 console or the AWS CLI.

Cevap

Release the unassociated Elastic IP addresses using the Amazon EC2 console or the AWS CLI.

Releasing the unassociated Elastic IP addresses returns them to the AWS public IP pool and immediately stops the hourly charges associated with allocating but not using them. In AWS, you are not charged for Elastic IP addresses as long as they are associated with a running EC2 instance or an active Elastic Network Interface (ENI). However, if they are unassociated, AWS charges an hourly fee to prevent IP address hoarding.

Adım Adım Çözüm

Identify the unassociated Elastic IP addresses using the AWS Trusted Advisor Cost Optimization dashboard or by querying the Amazon EC2 service directly.

A list of Elastic IP addresses that are allocated to the AWS account but are not currently associated with any running EC2 instances or network interfaces is obtained.

Before clean up, SysOps administrators must verify which specific IPs are unassociated to avoid affecting active workloads.

Release the identified unassociated Elastic IP addresses.

The Elastic IP addresses are returned to the AWS pool, and hourly charges for holding unassociated addresses are stopped immediately.

AWS charges for Elastic IP addresses that are allocated to an account but not associated with a running instance to ensure efficient use of IPv4 addresses.

Anahtar Kavram

Releasing unassociated Elastic IP addresses to stop hourly allocation charges.

Tahmini Süre:1m 0s

Soru 849Soru →

A company uses AWS Organizations to manage a dedicated sandbox account for trainee training. To control costs, a SysOps administrator must configure a system that automatically applies a restrictive Service Control Policy (SCP) to block new resource creation if the monthly spend on the sandbox account exceeds $1,000. Which of the following solutions will meet these requirements with the least administrative effort?

Configure a monthly cost budget of $1,000 in AWS Budgets. Add a budget action targeting the sandbox account to attach the restrictive SCP when the threshold is exceeded, utilizing an IAM role that allows the budgets.amazonaws.com service principal to assume it.

Configure an AWS Cost Anomaly Detection monitor with a threshold of $1,000. Add an anomaly subscription to automatically apply the restrictive SCP to the sandbox account using native anomaly action policies.

Configure a monthly cost budget of $1,000 in AWS Budgets with an SCP attachment action. Assign an IAM role to the action, and grant the administrator the iam:AssumeRole permission on the role instead of the required iam:PassRole permission.

Create an Amazon CloudWatch billing alarm for $1,000. Configure the alarm to directly trigger an AWS Systems Manager Automation document using a CloudWatch alarm action to attach the SCP to the sandbox account.

Cevabı ve açıklamayı göster

Cevap: Configure a monthly cost budget of $1,000 in AWS Budgets. Add a budget action targeting the sandbox account to attach the restrictive SCP when the threshold is exceeded, utilizing an IAM role that allows the budgets.amazonaws.com service principal to assume it.

Cevap

AWS Budgets natively supports Budgets Actions, which allows you to define automated actions to execute when a budget threshold is exceeded. These actions include applying Service Control Policies (SCPs) to AWS Organizations accounts. To enable this, an IAM role with appropriate policies must be created that trusts the 'budgets.amazonaws.com' service principal. This enables automatic and low-effort cost control compliance.

Adım Adım Çözüm

Determine the cost-control tool that supports automated SCP attachments.

AWS Budgets native budget actions support attaching Service Control Policies (SCPs) to AWS Organizations member accounts when a threshold is crossed.

This avoids custom integration or lambda coding, minimizing administrative overhead.

Configure the required IAM permissions for AWS Budgets.

Create an IAM role in the Organization's management account that allows the service principal budgets.amazonaws.com to assume it, and grant the administrator creating the budget the iam:PassRole permission.

The Budgets service requires permission to assume the execution role to apply the SCP on behalf of the administrator.

Configure the budget and the corresponding action trigger.

Set a monthly budget of $1,000 with a budget action to apply the restrictive SCP at 100% threshold execution.

This guarantees that once the actual cost hits $1,000, the SCP is automatically applied to halt further resource creation.

Anahtar Kavram

AWS Budgets Actions with AWS Organizations Integration

Soru 850Soru →

A SysOps administrator is configuring a monthly AWS budget for a data processing account to prevent cost overruns. The administrator wants to configure a budget action to automatically stop a specific Amazon RDS DB instance if the actual monthly spend exceeds $5,000$ . Which of the following configurations are required to implement this budget action? (Select TWO.)

Geçerli olan tümünü seçin

Create an IAM role with a trust policy that allows the AWS Budgets service principal (budgets.amazonaws.com) to assume the role, and attach an identity-based policy allowing rds:StopDBInstance permissions.

Grant the iam:PassRole permission for the execution role to the SysOps administrator who creates the budget action.

Create an AWS Cost Anomaly Detection monitor with a threshold of

5,000

and configure a subscription to trigger an AWS Lambda function to stop the RDS instance.

Configure an Amazon CloudWatch billing alarm for EstimatedCharges that directly stops the Amazon RDS instance when the threshold is reached.

Define a Service Control Policy (SCP) at the AWS Organizations root that denies rds:StartDBInstance when the budget limit is breached.

Cevabı ve açıklamayı göster

Cevap: Create an IAM role with a trust policy that allows the AWS Budgets service principal (budgets.amazonaws.com) to assume the role, and attach an identity-based policy allowing rds:StopDBInstance permissions.; Grant the iam:PassRole permission for the execution role to the SysOps administrator who creates the budget action.

Cevap

Creating an IAM role with a trust policy that allows the AWS Budgets service principal to assume the role with the necessary RDS permissions, and granting the SysOps administrator the permission to pass that role.

To configure an AWS Budgets action that stops an RDS instance, you must create an IAM execution role that the AWS Budgets service principal (budgets.amazonaws.com) can assume. This role requires the rds:StopDBInstance permission. Additionally, the administrator who configures the budget action must have the iam:PassRole permission to pass this execution role to the AWS Budgets service.

Adım Adım Çözüm

Configure the IAM execution role for AWS Budgets.

An IAM role is created with a trust relationship allowing budgets.amazonaws.com to assume it, and it has rds:StopDBInstance permissions.

AWS Budgets requires delegated permissions to stop the database instance on the user's behalf.

Assign the PassRole permission to the administrator.

The administrator's IAM policy is updated to include the iam:PassRole action targeting the Budgets execution role.

This permission is necessary to authorize the administrator to pass the role to the AWS Budgets service principal.

Anahtar Kavram

AWS Budgets Actions configuration, specifically the IAM role trust policy and PassRole requirements for automated instance stop actions.

Tahmini Süre:2m 0s

Soru 851Soru →

An enterprise database backup system uploads transaction logs to an Amazon S3 Standard bucket. The logs must be managed under the following requirements:

- Logs must be available for immediate, frequent access for the first $30$ days.
- Between day $30$ and day $60$ , logs are accessed occasionally but must retain millisecond retrieval times.
- After $60$ days, logs are rarely accessed, and retrieval times of up to $5$ hours are acceptable for compliance audits.
- The logs must be kept for a total of $365$ days and then permanently deleted.

A SysOps administrator is configuring an S3 Lifecycle policy to automate these transitions while minimizing costs and preventing validation or early transition errors. Which TWO configuration actions should the administrator specify in the lifecycle rule?

Geçerli olan tümünü seçin

A transition action to move objects from the S3 Standard storage class to the S3 Standard-Infrequent Access (Standard-IA) storage class after

30

days.

A transition action to move objects from the S3 Standard-Infrequent Access (Standard-IA) storage class to the S3 Glacier Flexible Retrieval storage class after

60

days.

A transition action to move objects from the S3 Standard-Infrequent Access (Standard-IA) storage class to the S3 Glacier Deep Archive storage class after

45

days.

A transition action to move objects from the S3 Glacier Flexible Retrieval storage class to the S3 Standard-Infrequent Access (Standard-IA) storage class after

90

days.

A transition action to move objects from the S3 Standard storage class to the S3 Glacier Flexible Retrieval storage class after

30

days.

Cevabı ve açıklamayı göster

Cevap: A transition action to move objects from the S3 Standard storage class to the S3 Standard-Infrequent Access (Standard-IA) storage class after $30$ days.; A transition action to move objects from the S3 Standard-Infrequent Access (Standard-IA) storage class to the S3 Glacier Flexible Retrieval storage class after $60$ days.

Cevap

A transition action to move objects from the S3 Standard storage class to the S3 Standard-Infrequent Access (Standard-IA) storage class after

30

days, and a transition action to move objects from the S3 Standard-Infrequent Access (Standard-IA) storage class to the S3 Glacier Flexible Retrieval storage class after

60

days.

The correct options specify transitioning objects from S3 Standard to S3 Standard-IA after

30

days, followed by transitioning from S3 Standard-IA to S3 Glacier Flexible Retrieval after

60

days. This aligns with the access requirements (millisecond retrieval between days

30

and

60

, and up to

5

-hour retrieval after day

60

) and satisfies the S3 Lifecycle API validation constraint requiring a minimum of

30

days of storage in S3 Standard-IA before transitioning to S3 Glacier classes (

60 - 30 = 30

days).

Adım Adım Çözüm

Map the storage class requirements to the timeline.

Days

0

30

require immediate access (S3 Standard). Days

30

60

require occasional access with millisecond retrieval times (S3 Standard-IA). Days

60

365

require rare access with up to

5

-hour retrieval times (S3 Glacier Flexible Retrieval). Day

365

requires permanent deletion.

This establishes the target storage classes based on access frequency, retrieval performance, and retention rules.

Evaluate S3 Lifecycle transition sequence validation constraints.

The transition from S3 Standard to S3 Standard-IA occurs at day

30

. The next transition from S3 Standard-IA to S3 Glacier Flexible Retrieval must be configured such that objects spend at least

30

days in S3 Standard-IA. Therefore, the transition to S3 Glacier Flexible Retrieval must occur at day

60

or later (

30 + 30 = 60

S3 Lifecycle policies will fail API validation if a transition from Standard-IA to a Glacier class is scheduled for fewer than

30

days after the transition to Standard-IA.

Validate transition direction rules.

Ensure all transitions flow from warmer to colder classes (Standard to Standard-IA, and Standard-IA to Glacier).

S3 Lifecycle rules do not support moving objects back to warmer classes (e.g., Glacier to Standard-IA).

Anahtar Kavram

Amazon S3 Lifecycle transition rules and minimum storage class duration validation constraints.

Soru 852Soru →

A SysOps Administrator is deploying Amazon EC2 instances in a private subnet with no internet connectivity. The instances need to send messages to Amazon SQS. The administrator creates an Interface VPC Endpoint for SQS in the VPC. However, the EC2 instances are unable to resolve the standard SQS endpoint URL (sqs.us-east-1.amazonaws.com) to the private IP addresses of the VPC endpoint. What must the administrator do to resolve this DNS resolution issue?

Enable Private DNS names for the Interface VPC Endpoint.

Add a route to the private subnet route table targeting the Amazon SQS Interface VPC Endpoint.

Update the security group of the Interface VPC Endpoint to allow inbound DNS queries on UDP port 53 from the EC2 instances.

Create an Internet Gateway and attach it to the VPC to allow DNS resolution requests to reach public AWS DNS servers.

Cevabı ve açıklamayı göster

Cevap: Enable Private DNS names for the Interface VPC Endpoint.

Cevap

Enable Private DNS names for the Interface VPC Endpoint.

Enabling the Private DNS option for the VPC endpoint ensures that the VPC's internal DNS resolver maps the standard public service DNS name to the private IP addresses of the endpoint's network interfaces.

Adım Adım Çözüm

Identify that the instances are in a private subnet with no internet access and need to communicate with Amazon SQS privately.

Confirming that an Interface VPC Endpoint is the correct choice, but DNS resolution is failing to map the public endpoint URL to private IPs.

Establishing the requirement for local DNS resolution of the public SQS URL within the VPC.

Enable the Private DNS option on the Interface VPC Endpoint configuration.

AWS creates a private hosted zone managed by Route 53 that maps the public SQS DNS name to the private IPs of the endpoint's Elastic Network Interfaces (ENIs).

This allows applications to use the default SQS endpoint URL without code changes, while routing all traffic over the private network.

Anahtar Kavram

VPC Endpoints and PrivateLink Integration

Soru 853Soru →

A SysOps Administrator is managing a CloudFormation stack that deploys a database application, using a dedicated AWS Identity and Access Management (IAM) service role for stack operations. The administrator attempts to update the stack to replace an Amazon RDS DB instance with a new configuration. The update fails during the deployment of a dependent resource, triggering a rollback. However, the rollback fails, and the stack status changes to UPDATE_ROLLBACK_FAILED. AWS CloudTrail logs reveal that the service role was unable to perform the deletion of the old RDS DB instance due to an AccessDenied error. What should the administrator do to resolve the rollback failure and return the stack to a stable state?

Delete the old RDS DB instance manually using the Amazon RDS console, and then run the rollback-stack command targeting the stack.

Update the IAM policy attached to the CloudFormation service role to grant the rds:DeleteDBInstance permission, and then run the continue-update-rollback command.

Attach an IAM policy with iam:PassRole permissions to the administrator's IAM identity, and then run the update-stack command with the --role-arn parameter pointing to the service role.

Run the update-stack command with the --rollback-configuration parameter set to disable rollback for the RDS DB instance resource.

Cevabı ve açıklamayı göster

Cevap: Update the IAM policy attached to the CloudFormation service role to grant the rds:DeleteDBInstance permission, and then run the continue-update-rollback command.

Cevap

Update the IAM policy attached to the CloudFormation service role to grant the rds:DeleteDBInstance permission, and then run the continue-update-rollback command.

The correct action is to update the IAM policy of the service role with the missing rds:DeleteDBInstance permission and run the continue-update-rollback command. This allows AWS CloudFormation to resume the rollback process using the updated permissions of the service role and return the stack to a stable state.

Adım Adım Çözüm

Analyze the rollback failure reason.

Identify from CloudTrail and CloudFormation stack events that the rollback failed due to an AccessDenied error when the service role attempted to delete the old RDS DB instance.

Diagnosing the root cause of the rollback failure is necessary to determine the appropriate remediation action.

Update the service role permissions.

Add the rds:DeleteDBInstance action to the IAM policy attached to the CloudFormation service role.

The service role must have sufficient permissions to delete the resources being replaced or cleaned up during a rollback operation.

Resume the update rollback.

Execute the continue-update-rollback command (or select Continue update rollback in the console).

This command prompts CloudFormation to retry the rollback process, which will now succeed due to the updated service role permissions.

Anahtar Kavram

AWS CloudFormation Update Rollback Failure Resolution

Soru 854Soru →

A SysOps Administrator is deploying an Amazon RDS Multi-AZ DB cluster to support a business-critical application that requires high availability and read scaling. The database engine selected is PostgreSQL. Which of the following statements correctly describe the characteristics and failover behavior of this Amazon RDS Multi-AZ DB cluster? (Select TWO.)

Geçerli olan tümünü seçin

The deployment consists of one primary DB instance and two readable standby DB instances across three separate Availability Zones.

During a failover event, Amazon RDS automatically promotes one of the readable standby instances to primary and updates the cluster's DNS endpoint to point to the new primary instance.

Read traffic is load-balanced across the standby instances by configuring an Amazon Route 53 active-active failover routing policy pointing directly to the individual DB instance endpoints.

The standby instances in the deployment are passive, non-readable targets, meaning a separate standalone Read Replica must be configured to offload read queries.

Cevabı ve açıklamayı göster

Cevap: The deployment consists of one primary DB instance and two readable standby DB instances across three separate Availability Zones.; During a failover event, Amazon RDS automatically promotes one of the readable standby instances to primary and updates the cluster's DNS endpoint to point to the new primary instance.

Cevap

The correct statements are that the deployment consists of one primary DB instance and two readable standby DB instances across three separate Availability Zones, and that Amazon RDS automatically promotes one of the readable standby instances to primary and updates the cluster's DNS endpoint to point to the new primary instance. An Amazon RDS Multi-AZ DB cluster is specifically designed to provide both high availability and read scalability out of the box by using two readable standby instances across three Availability Zones. Amazon RDS manages the failover automatically by promoting a standby and modifying the DNS mapping of the cluster endpoint.

Adım Adım Çözüm

Analyze the architecture of an Amazon RDS Multi-AZ DB cluster.

Identify that a Multi-AZ DB cluster comprises one primary and two readable standby DB instances located across three different Availability Zones.

This sets it apart from standard Multi-AZ DB instances which have only one non-readable standby instance.

Examine the automated failover mechanism for RDS Multi-AZ DB clusters.

Confirm that failover is fully managed by Amazon RDS, which automatically promotes a standby and updates the cluster DNS endpoint.

This provides seamless failover without requiring Route 53 routing policy configurations or manual promotions.

Evaluate how read scaling is handled in this architecture.

Determine that standby instances are readable, eliminating the need to configure separate read replicas for basic read scaling, and that traffic is handled via the built-in reader endpoint.

This distinguishes it from standard Multi-AZ instances where standby instances cannot accept read connections.

Anahtar Kavram

Amazon RDS Multi-AZ DB cluster architecture provides both high availability via automated DNS-based failover to readable standby instances and read scaling via a built-in reader endpoint.

Soru 855Soru →

A SysOps Administrator is configuring an AWS Service Catalog product that deploys an Amazon RDS DB instance. The deployment must encrypt the database storage volume using a customer managed AWS KMS key. The product is associated with a portfolio that has a launch constraint configured to use a specific IAM service role. During testing, when an end user attempts to provision the product, the deployment fails with a 'CloudFormation stack rollback occurred' error. How should the administrator resolve this failure?

Attach an IAM policy to the end user's IAM role granting full access to the customer managed KMS key, because the end user's permissions determine key access during product provisioning.

Add the ARN of the Service Catalog launch constraint role to the key policy of the customer managed KMS key, permitting the role to use the key for cryptographic operations.

Modify the trust policy of the KMS key to trust the end user's IAM role, and add sts:AssumeRole permissions for the launch constraint role to the end user's IAM policy.

Inspect the CloudFormation events for ROLLBACK_IN_PROGRESS and wait for the stack to automatically retry the resource creation, as Service Catalog triggers a rebuild of failed nested stacks upon rollback completion.

Cevabı ve açıklamayı göster

Cevap: Add the ARN of the Service Catalog launch constraint role to the key policy of the customer managed KMS key, permitting the role to use the key for cryptographic operations.

Cevap

Add the ARN of the Service Catalog launch constraint role to the key policy of the customer managed KMS key, permitting the role to use the key for cryptographic operations.

When an AWS Service Catalog portfolio is configured with a launch constraint, AWS Service Catalog uses the associated service role's permissions to deploy the product's resources instead of the end user's credentials. Because the RDS database volume is encrypted using a customer managed KMS key, the service role must be granted usage permissions on that key. For customer managed KMS keys, permissions must be explicitly defined in the KMS key policy.

Adım Adım Çözüm

Identify the IAM identity responsible for provisioning the resources.

Since a launch constraint is configured on the AWS Service Catalog portfolio, the service role associated with the launch constraint (not the end user) is the identity that performs the actions.

Launch constraints dictate that Service Catalog assumes the specified service role to provision the resources.

Determine the permissions requirement for the encrypted RDS storage volume.

The resource must be encrypted with a customer managed KMS key, which requires the provisioning role to have kms:DescribeKey, kms:CreateGrant, kms:Decrypt, and kms:GenerateDataKey permissions.

RDS requires these cryptographic permissions on the KMS key to associate it with the database volume.

Configure the key policy of the customer managed KMS key to permit the launch constraint role.

Add the launch constraint role's ARN to the KMS key policy statement allowing key usage.

For customer managed KMS keys, key access must be explicitly permitted by the key policy itself; IAM policies alone are insufficient if the key policy does not delegate authorization to IAM.

Anahtar Kavram

AWS Service Catalog Launch Constraints and KMS Key Policy Delegation

Tahmini Süre:2m 0s

Soru 856Soru →

An operations team uses AWS Service Catalog to distribute standardized resources. In a consumer AWS account, a SysOps administrator has configured a launch constraint on an imported portfolio using a local IAM role named SC-Launch-Role. A developer in the consumer account attempts to provision a new product version from this portfolio. The product's CloudFormation template is designed to launch an Amazon EC2 instance and create a new IAM role for that instance. During the provisioning process, the deployment fails, and the CloudFormation stack rolls back with an Access Denied error during the creation of the IAM role. Which configuration change is required to successfully provision the product?

Add the iam:CreateRole and iam:PassRole permissions to the IAM policy attached to SC-Launch-Role in the consumer account.

Attach an IAM policy to the developer's IAM user or role that grants the iam:PassRole permission for the SC-Launch-Role.

Modify the trust policy of SC-Launch-Role in the consumer account to allow the developer's IAM role to assume it, and remove the launch constraint from the portfolio.

Log in to the hub account's AWS CloudFormation console and search for the failed stack events to locate and resolve the template parameter errors.

Cevabı ve açıklamayı göster

Cevap: Add the iam:CreateRole and iam:PassRole permissions to the IAM policy attached to SC-Launch-Role in the consumer account.

Cevap

Add the iam:CreateRole and iam:PassRole permissions to the IAM policy attached to SC-Launch-Role in the consumer account.

The correct answer is to add the iam:CreateRole and iam:PassRole permissions to the launch constraint role (SC-Launch-Role) in the consumer account. When a launch constraint is applied to an AWS Service Catalog portfolio, the service assumes that role to execute the CloudFormation template. Because the template attempts to create a new IAM role and attach it to an EC2 instance, the launch role itself must have the permissions to create that IAM role and pass it to the EC2 service.

Adım Adım Çözüm

Identify the IAM entity performing the resource creation.

Since a launch constraint is configured, AWS Service Catalog assumes the specified role (SC-Launch-Role) in the consumer account to deploy the CloudFormation stack.

This determines which principal's permissions are evaluated when the stack creation fails with Access Denied.

Analyze the failed resource action and its required permissions.

The template attempts to create an IAM role and assign it to an EC2 instance. This requires the performing principal to have iam:CreateRole to create the role, and iam:PassRole to assign (pass) the role to the EC2 service.

Ensures the launch role has sufficient privileges to provision all resources declared in the template.

Update the IAM policy of the launch constraint role in the consumer account.

Add iam:CreateRole and iam:PassRole to the policy of SC-Launch-Role.

Resolves the Access Denied error during the CloudFormation execution.

Anahtar Kavram

AWS Service Catalog Launch Constraints and Role Permissions

Soru 857Soru →

A company uses AWS Service Catalog to manage and distribute standardized AWS CloudFormation templates. A SysOps administrator has uploaded a new version (v2.0) of a database product. The administrator wants to prevent users from provisioning new resources using the older version (v1.0), but must allow users who currently have v1.0 provisioned products to upgrade to v2.0. Which action should the administrator take to meet these requirements with the least operational effort?

Delete the v1.0 product version from the product configuration.

Set the status of the v1.0 product version to Inactive in the AWS Service Catalog console.

Create a new Service Catalog product for v2.0 and delete the original product containing v1.0.

Remove the IAM launch constraint role association from the v1.0 version.

Cevabı ve açıklamayı göster

Cevap: Set the status of the v1.0 product version to Inactive in the AWS Service Catalog console.

Cevap

Set the status of the v1.0 product version to Inactive in the AWS Service Catalog console.

Setting a product version's status to Inactive in AWS Service Catalog ensures that the version is no longer visible or selectable for launching new provisioned products. However, the system retains the version history, allowing users with existing provisioned products still running that version to upgrade seamlessly to any active version, such as v2.0.

Adım Adım Çözüm

Analyze the lifecycle requirements for the product version deprecation.

Identify that the solution must block new launches of the old version while retaining it as a valid source version for upgrades.

Completely removing or replacing the product breaks the upgrade relationship for active provisioned resources.

Evaluate the native version status options in AWS Service Catalog.

Determine that setting a product version to 'Inactive' restricts new provisioning but allows active update actions to go through to newer active versions.

This is a built-in Service Catalog feature designed exactly for deprecation workflows without interrupting running workloads.

Anahtar Kavram

AWS Service Catalog Product Version Lifecycle Management

Soru 858Soru →

An administrator is establishing Same-Region Replication (SRR) for an Amazon S3 bucket within a single AWS account. Both the source and destination buckets have versioning active. The administrator has created a replication IAM role with a trust policy for `s3.amazonaws.com` and a permissions policy that allows `s3:ReplicateObject` on the destination. However, when the administrator executes `aws s3api put-bucket-replication` from their local machine, they receive an 'AccessDenied' error.

Which of the following is the most likely cause of this failure?

The replication IAM role trust policy must specify the administrator's IAM user in the Principal element and grant the `sts:AssumeRole` permission.

The IAM user executing the CLI command does not have the `iam:PassRole` permission to pass the replication role to the Amazon S3 service.

The destination bucket has versioning enabled, but S3 replication requires versioning to be enabled only on the source bucket and suspended on the destination bucket.

The KMS key policy for the destination bucket's encryption key does not permit the administrator's IAM user to access it, overriding the IAM policy.

Cevabı ve açıklamayı göster

Cevap: The IAM user executing the CLI command does not have the `iam:PassRole` permission to pass the replication role to the Amazon S3 service.

Cevap

The IAM user executing the CLI command does not have the `iam:PassRole` permission to pass the replication role to the Amazon S3 service.

The correct answer is correct because setting up S3 replication requires the user to pass an IAM service role to Amazon S3. AWS enforces security by requiring that the identity configuring replication must have the `iam:PassRole` permission for the specific IAM role. Without this permission, the AWS CLI command will return an Access Denied error.

Adım Adım Çözüm

Determine the permissions required to associate an IAM role with an AWS service.

Associating an IAM service role with a resource like an S3 replication configuration requires the caller to have the `iam:PassRole` permission for that role.

This prevents unauthorized users from passing administrative or privileged roles to services.

Verify if the CLI command is failing due to role configuration or command authorization.

Since versioning is enabled and the role's trust policy is configured, the API execution itself is blocked, indicating a user authorization issue rather than a service validation issue.

An AccessDenied error on the API endpoint when setting configurations with a role parameter typically points to a missing `iam:PassRole` permission on the user.

Anahtar Kavram

IAM PassRole permission requirement for service role delegation

Tahmini Süre:1m 30s

Soru 859Soru →

A SysOps Administrator is configuring an AWS Systems Manager State Manager association to execute a custom Automation document that runs on a fleet of Amazon EC2 instances. The target instances have the Systems Manager (SSM) Agent installed and active, and they are targeted using the tag `Environment: Production`. The instances also have the necessary IAM instance profile attached. During the creation of the State Manager association, the administrator specifies a custom IAM service role to allow Systems Manager to execute the Automation workflow. However, the creation of the association fails immediately with an AccessDenied error.

Which of the following is the most likely root cause of this failure?

The Gateway VPC Endpoint for S3 is not associated with the route tables of the subnets where the target EC2 instances reside.

The target EC2 instances have a patch group tag misalignment, preventing the State Manager association from registering them as managed nodes.

The administrator's IAM user policy does not grant the `iam:PassRole` permission for the custom IAM service role.

The customer managed KMS key policy lacks permission to allow the administrator to encrypt the State Manager association metadata.

Cevabı ve açıklamayı göster

Cevap: The administrator's IAM user policy does not grant the `iam:PassRole` permission for the custom IAM service role.

Cevap

The administrator's IAM user policy does not grant the `iam:PassRole` permission for the custom IAM service role.

The correct answer is that the administrator's IAM user policy does not grant the `iam:PassRole` permission for the custom IAM service role. When setting up a State Manager association or Automation workflow that uses a service role to perform actions, the IAM user creating the association must have permission to pass that role to the Systems Manager service.

Adım Adım Çözüm

Analyze the timing of the failure.

The failure occurs immediately during the creation of the State Manager association, not during runtime execution on the target EC2 instances.

Identifying the error timing helps isolate issues related to IAM role configuration/creation permissions from runtime resource access issues.

Evaluate the permissions required by the administrator to create the association using a service role.

Creating an association that executes a workflow via a service role requires the user to have the `iam:PassRole` permission for that service role.

IAM requires the `iam:PassRole` permission to prevent unauthorized users from passing highly privileged roles to AWS services.

Differentiate between the correct answer and the distractors.

The other options involve runtime execution issues (such as S3 VPC endpoint routing, KMS key policies, or patch group misalignment) that do not block association creation API calls.

This confirms that only the IAM PassRole omission explains the immediate creation failure with an AccessDenied error.

Anahtar Kavram

IAM PassRole Permission for Systems Manager Automation and State Manager

Soru 860Soru →

A SysOps Administrator needs to automate the deployment of an application database password to a fleet of Amazon EC2 instances. The password must be stored securely and decrypted only during the execution of a Systems Manager Run Command script. The administrator wants to adhere to the principle of least privilege, ensuring the IAM policy limits access to only the specific resources involved. The SSM Agent is already installed and running on the target EC2 instances, but they do not yet have any IAM roles or instance profiles attached.

What is the correct sequence of steps to configure this secure parameter access and execute the script on the instances?

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

First, create a customer managed key (CMK) in AWS KMS. Second, create a SecureString parameter in Systems Manager Parameter Store using the KMS CMK. Third, create an IAM policy with ssm:GetParameters and kms:Decrypt permissions restricted to the specific parameter and KMS CMK ARNs and attach it to an IAM role. Fourth, attach the IAM role as an instance profile to the target EC2 instances. Finally, execute the Run Command using an SSM document that retrieves and decrypts the parameter.

The correct sequence starts with creating the KMS key because it is required to encrypt the Parameter Store parameter. Next, the SecureString parameter is created. With both resource ARNs available, a least-privilege IAM policy can be defined and attached to an IAM role. The role is then attached to the EC2 instances as an instance profile to register them as managed nodes with the necessary decryption permissions. Finally, Run Command is executed to run the retrieval script.

Adım Adım Çözüm

Create the customer managed key (CMK) in AWS Key Management Service (AWS KMS).

A unique KMS CMK and its ARN are created, which will be used for encryption and decryption operations.

You must have the KMS key available before you can configure a SecureString parameter to use it for encryption.

Create a SecureString parameter in Systems Manager Parameter Store.

The database password is saved securely under a specific parameter path, encrypted using the KMS CMK.

The parameter must exist to establish its ARN, which is required to write a least-privilege IAM policy.

Create a custom IAM policy and attach it to an IAM role.

An IAM role is configured with explicit ssm:GetParameters and kms:Decrypt permissions targeting only the parameter and KMS key ARNs.

Restricting permissions to specific resource ARNs ensures the principle of least privilege is maintained.

Attach the IAM role as an instance profile to the EC2 instances.

The EC2 instances register as online managed nodes in Systems Manager and gain the identity needed to perform decryption.

The instances must be managed nodes and have the instance profile attached to communicate with Systems Manager and retrieve parameters.

Execute the Systems Manager Run Command.

The script runs on the instances, successfully fetches the parameter, decrypts it using the role's KMS permissions, and uses it for the database deployment.

Executing the command is the final step once all preconditions, permissions, and security configurations are in place.

Anahtar Kavram

To execute Run Command tasks that securely retrieve and decrypt parameters under the principle of least privilege, the underlying KMS key and Parameter Store parameter must be created first to obtain their specific ARNs. These ARNs are then locked down in an IAM policy attached to the EC2 instance role before the role is attached to the instances and the Run Command is executed.

ÖncekiSayfa 43 / 49Sonraki

Tüm alıştırma soruları

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram