Amazon SOA-C02 Practice Test - Questions Answers, Page 37

Enabling Instance Scale-In Protection:

Instance scale-in protection prevents Auto Scaling from terminating specific instances.

Steps:

Go to the AWS Management Console.

Navigate to EC2 and select 'Auto Scaling Groups.'

Select your Auto Scaling group.

Go to the 'Instance management' tab.

Select the instances you want to protect and click 'Actions.'

Choose 'Enable scale-in protection.'

This ensures that instances are not terminated during troubleshooting.

Using CloudFormation Stack Sets:

CloudFormation stack sets allow you to deploy CloudFormation stacks across multiple AWS accounts and regions.

Steps:

Go to the AWS Management Console.

Navigate to CloudFormation and select 'StackSets.'

Click on 'Create StackSet.'

Provide the template URL or upload a template file.

Configure the stack set options and specify the accounts and regions.

Deploy the stack set to the specified accounts and regions.

Snapshot Deletion Policy:

The Snapshot Deletion Policy ensures that a snapshot is created when an RDS instance is deleted as part of a CloudFormation stack deletion.

Steps:

Update your CloudFormation template to include the DeletionPolicy attribute for the RDS instance resource.

Example template snippet:

Resources:

MyDBInstance:

Type: AWS::RDS::DBInstance

Properties:

# DB instance properties

DeletionPolicy: Snapshot

This configuration retains a snapshot of the RDS instance data when the stack is deleted.

Reference: AWS CloudFormation DeletionPolicy

Applying SCPs to an Organizational Unit:

Service Control Policies (SCPs) allow you to manage permissions for multiple AWS accounts within an organization.

Steps:

Go to the AWS Management Console.

Navigate to AWS Organizations.

Create an Organizational Unit (OU) if not already created.

Move the target accounts into the OU.

Create an SCP that denies the use of the specific EC2 instance family.

Attach the SCP to the OU.

This approach ensures that the policy is applied consistently across all accounts in the OU.

Enable deletion protection for the DynamoDB tables:

Deletion protection is a feature that prevents accidental deletion of DynamoDB tables. When enabled, it requires an additional step to disable this protection before the table can be deleted.

Steps:

Go to the AWS Management Console.

Navigate to DynamoDB.

Select the table you want to protect.

Choose the 'Overview' tab.

Under 'Deletion protection,' click 'Enable deletion protection.'

Enable point-in-time recovery (PITR) for the DynamoDB tables:

PITR provides continuous backups of your DynamoDB tables. You can restore the table to any point in time within the last 35 days.

Steps:

Go to the AWS Management Console.

Navigate to DynamoDB.

Select the table you want to enable PITR for.

Choose the 'Backups' tab.

Click on 'Enable Point-in-Time Recovery.'

If a table is accidentally deleted, you can restore it using PITR.

Go to the DynamoDB console.

Select 'Backups' from the navigation pane.

Find the table backup and choose 'Restore.'

AWS Global Accelerator:

AWS Global Accelerator is a service that improves the availability and performance of your applications with a global user base. It provides static IP addresses that act as a fixed entry point to your application endpoints (such as ALBs).

Steps:

Go to the AWS Management Console.

Navigate to Global Accelerator.

Click on 'Create accelerator.'

Configure the accelerator by providing a name and adding listeners.

Add your Application Load Balancer as an endpoint.

Allocate two static IP addresses.

This setup ensures that your application is accessible via two static IP addresses, fulfilling the requirement.

Adding a Route to the Route Tables:

When new subnets are created, they need appropriate routing to ensure communication with on-premises networks.

Steps:

Go to the AWS Management Console.

Navigate to VPC.

Select the route table associated with the new subnets.

Choose 'Edit routes.'

Add a new route with the destination CIDR block of the on-premises network.

For the target, select the virtual private gateway (VGW).

This ensures that traffic destined for the on-premises network is routed correctly through the VPN connection.

Configuring Security Groups:

Security groups act as virtual firewalls for your instances to control inbound and outbound traffic.

Steps:

Go to the AWS Management Console.

Navigate to EC2.

Select 'Security Groups' from the left-hand menu.

Find and select the security group associated with your EC2 instances.

Choose the 'Inbound rules' tab and click 'Edit inbound rules.'

Add a rule to allow traffic from the security group associated with the NLB.

Type: Custom TCP (or the specific port your application uses)

Source: Select 'Custom' and enter the ID of the NLB's security group.

This setup ensures that the EC2 instances accept traffic only from the NLB, enhancing security with minimal operational overhead.

DependsOn Attribute in CloudFormation:

The DependsOn attribute in AWS CloudFormation ensures that one resource is created only after another resource has been successfully created. In this case, it ensures that the EC2 instance is fully launched before the custom resource (the Lambda function) is executed.

Steps:

Update the CloudFormation template to include the DependsOn attribute for the custom resource.

Ensure that the custom resource references the EC2 instance.

Resources:

MyEC2Instance:

Type: AWS::EC2::Instance

Properties:

# EC2 properties

MyCustomResource:

Type: Custom::MyCustomResource

DependsOn: MyEC2Instance

Properties:

ServiceToken: !GetAtt MyLambdaFunction.Arn

# Other properties