Amazon SOA-C02 Practice Test - Questions Answers, Page 39

Lambda Function to Rotate IAM Access Keys:

A Lambda function can be used to automate the rotation of IAM access keys based on their age.

Steps:

Write a Lambda function that checks the age of IAM access keys.

The function should rotate keys that are at least 30 days old.

Deploy the Lambda function.

Amazon EventBridge Rule:

EventBridge can trigger the Lambda function periodically and when a new key is created.

Steps:

Create an EventBridge rule that triggers the Lambda function on a schedule (e.g., daily) and on IAM key creation events.

Using an AMI with CloudWatch Agent:

The CloudWatch agent can collect memory utilization metrics and send them to CloudWatch.

Steps:

Create or use an existing AMI that includes the CloudWatch agent installed and configured.

Ensure the CloudWatch agent is configured to collect memory metrics.

Use this AMI for instances in the Auto Scaling group.

Storage Auto Scaling:

Aurora storage auto scaling automatically increases the storage capacity of the database cluster when free storage space is running low.

Steps:

Go to the AWS Management Console.

Navigate to RDS and select your Aurora DB cluster.

Modify the DB cluster configuration to enable storage auto scaling.

Apply the changes.

Group EC2 Instances Using Resource Groups:

Resource groups help organize and manage AWS resources based on tags and other criteria.

Steps:

Go to the AWS Management Console.

Navigate to AWS Resource Groups.

Create resource groups for similar EC2 instances based on tags or other criteria.

Create a Schedule in Patch Manager:

AWS Systems Manager Patch Manager automates the process of patching managed instances.

Steps:

Go to the AWS Management Console.

Navigate to Systems Manager and select Patch Manager.

Create a patch baseline if not already created.

Create a schedule for patching and specify the resource group as the target.

Create Maintenance Windows for Resource Groups:

Maintenance windows define a period of time for performing administrative tasks on instances.

Steps:

Go to the AWS Management Console.

Navigate to Systems Manager and select Maintenance Windows.

Create a maintenance window for each resource group.

Specify tasks and targets (resource groups) for each maintenance window.

Retain the Security Group:

When deleting a CloudFormation stack, you can specify resources to be retained instead of deleted.

Steps:

Go to the AWS Management Console.

Navigate to CloudFormation and select the stack.

Choose to delete the stack.

In the deletion options, specify that the security group should be retained.

This will delete the stack but keep the security group, ensuring no impact on other applications.

Create an SNS Topic and Subscription:

Amazon SNS allows you to send notifications to multiple endpoints.

Steps:

Go to the AWS Management Console.

Navigate to SNS and create a new topic.

Create a subscription for the topic using the email protocol.

Enter the architecture team's email address as the subscriber.

Create an EventBridge Rule:

Amazon EventBridge can monitor events and trigger actions.

Steps:

Go to the AWS Management Console.

Navigate to EventBridge.

Create a new rule that reacts to EC2 instance launch events.

Specify the SNS topic as the rule's target.

Update AWS Account Name:

The AWS account name can only be changed by the root user of the account.

Steps:

Sign in to the AWS Management Console using the root user credentials.

Navigate to the 'My Account' page.

Update the account name field and save the changes.

Enable Access Logging for the ALB:

Access logging provides detailed information about requests sent to your load balancer.

Steps:

Go to the AWS Management Console.

Navigate to EC2 and select 'Load Balancers.'

Select your Application Load Balancer.

Under the 'Attributes' tab, enable 'Access logs.'

Specify an S3 bucket where the logs will be saved.

Use Amazon Athena to Query the ALB Logs:

Athena allows you to run SQL queries on data stored in S3.

Steps:

Go to the AWS Management Console.

Navigate to Athena.

Create a table for the ALB logs using the appropriate schema.

Run queries to calculate the total bytes sent and received, grouped by the target field.

Example query:

SELECT target, SUM(received_bytes) as total_received, SUM(sent_bytes) as total_sent

FROM alb_logs

GROUP BY target, port

AWS Config Managed Rule for S3 Logging:

The s3-bucket-logging-enabled AWS Config rule checks whether S3 buckets have logging enabled.

Steps:

Go to the AWS Management Console.

Navigate to AWS Config.

Create a rule using s3-bucket-logging-enabled.

Add a remediation action using an AWS Lambda function or Systems Manager Automation runbook.

Using AWS Lambda for Remediation:

Create a Lambda function that enables logging on S3 buckets.

Steps:

Write a Lambda function in Python or Node.js to enable logging.

Configure the function to trigger on non-compliant buckets.

Using AWS Systems Manager Automation:

The AWS-ConfigureS3BucketLogging runbook automates enabling logging.

Steps:

Go to the AWS Management Console.

Navigate to Systems Manager.

Create an Automation document or use the existing AWS-ConfigureS3BucketLogging runbook.

Configure the remediation action to use this runbook.