How to Easily Pass the Amazon Web Services SOA-C02 Exam: Expert Advice

To automate the process of disabling unused IAM user accounts that have not been active for 90 days, using an AWS Config managed rule with an AWS Systems Manager automation runbook is the most operationally efficient method.

Set Up AWS Config Managed Rule:

Open the AWS Config console.

Create a rule using the managed rule iam-user-no-policies-check.

Configure the rule to trigger when IAM users have not been active for 90 days.

AWS Systems Manager Automation Runbook:

Create a Systems Manager automation document (runbook) to disable the access keys for inactive IAM users.

Use the aws:executeAutomation action to disable access keys and passwords.

Schedule the Automation:

Use Amazon EventBridge (formerly CloudWatch Events) to schedule the automation to run periodically.

References:

AWS Config Managed Rules

AWS Systems Manager Automation

Scheduling AWS Systems Manager Automation

AWS WAF (Web Application Firewall) helps protect your web applications from common web exploits and bots. A rate-based rule allows you to control the rate of requests to your application.

Create a Global-Scoped AWS WAF Web ACL:

Navigate to the AWS WAF console.

Create a new Web ACL and choose "Global" for the scope.

Set the default action to "Allow".

Configure a Rate-Based Rule:

Within the Web ACL, add a new rule and select "Rate-based rule".

Define the rate limit (e.g., 2000 requests per 5 minutes).

Set the action to "Block".

Associate Web ACL with CloudFront Distribution:

After creating the Web ACL and rule, go to your CloudFront distribution settings.

In the "General" tab, associate the Web ACL with your CloudFront distribution.

Review and Confirm:

Review the configuration and ensure the Web ACL is correctly associated with the CloudFront distribution.

References:

AWS WAF Rate-Based Rules

Associating AWS WAF with CloudFront

https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock-overview.html In governance mode, users can 't overwrite or delete an object version or alter its lock settings unless they have special permissions. With governance mode, you protect objects against being deleted by most users, but you can still grant some users permission to alter the retention settings or delete the object if necessary. You can also use governance mode to test retention-period settings before creating a compliance-mode retention period. In compliance mode, a protected object version can't be overwritten or deleted by any user, including the root user in your AWS account. When an object is locked in compliance mode, its retention mode can't be changed, and its retention period can't be shortened. Compliance mode helps ensure that an object version can't be overwritten or deleted for the duration of the retention period.

AWS Config can be used to monitor and enforce compliance of AWS resource configurations, including security group rules.

Steps:

Activate AWS Config Rule:

Open the AWS Config console.

Choose "Rules" and then "Add rule".

Search for and select the restricted-ssh managed rule.

Configure the rule to monitor all security groups for compliance.

Set Up Automatic Remediation:

In the AWS Config console, associate the restricted-ssh rule with the AWS-DisablePublicAccessForSecurityGroup Systems Manager Automation runbook.

This runbook will automatically remove any inbound SSH rule that allows traffic from 0.0.0.0/0.

Set Up Notifications:

Open the Amazon EventBridge console.

Create a new rule to monitor AWS Config compliance changes.

Configure the rule to send notifications to an Amazon SNS topic whenever the restricted-ssh rule is noncompliant.

Subscribe the SysOps team to the SNS topic to receive notifications.

Step-by-Step Explanation:

Understand the Problem:

Each Lambda function generates 1 GB of log data daily in its own CloudWatch Logs log group.

The security team needs a count of application errors, grouped by type, across all log groups.

Analyze the Requirements:

Aggregate and analyze log data across multiple log groups.

Count and group errors by type.

Evaluate the Options:

Option A: Perform a CloudWatch Logs Insights query.

CloudWatch Logs Insights allows querying and analyzing log data.

The stats command and count function can aggregate and count errors across log groups.

Option B: Perform a CloudWatch Logs search with groupby and count.

CloudWatch Logs search does not support these functions; Logs Insights is needed for advanced queries.

Option C: Perform an Amazon Athena query.

Athena can query data in S3 but is not directly applicable to CloudWatch Logs.

Option D: Perform an Amazon RDS query.

RDS queries are for database data, not applicable to log data in CloudWatch.

Select the Best Solution:

Option A: CloudWatch Logs Insights is designed for querying and analyzing log data, making it the appropriate choice for counting and grouping errors.

References:

Amazon CloudWatch Logs Insights

CloudWatch Logs Insights provides powerful querying capabilities to aggregate and analyze log data, including counting and grouping errors.

Here are the steps to configure an Amazon S3 bucket to serve a static error page in the event of a failure at the primary site:

Log in to the AWS Management Console and navigate to the S3 service in the us-east-2 Region.

Find the existing S3 bucket named lab-751906329398-26023898.com and click on it.

In the "Properties" tab, click on "Static website hosting" and select "Use this bucket to host a website".

In "Index Document" field, enter the name of the object that you want to use as the index document, in this case, "index.html"

In the "Permissions" tab, click on "Block Public Access", and make sure that "Block all public access" is turned OFF.

Click on "Bucket Policy" and add the following policy to allow public read access:

{

"Version": "2012-10-17",

"Statement": [

{

"Sid": "PublicReadGetObject",

"Effect": "Allow",

"Principal": "*",

"Action": "s3:GetObject",

"Resource": "arn:aws:s3:::lab-751906329398-26023898.com/*"

}

]

}

Now navigate to the Amazon Route 53 service, and find the existing hosted zone named lab-751906329398-26023898.com.

Click on the "A record" and update the routing policy to "Primary - Failover" and add the existing ALB as the primary record.

Click on "Create Record" button and create a new secondary failover alias record for the domain lab-751906329398-26023898.com that routes traffic to the existing S3 bucket.

Now, when the primary site (ALB) goes down, traffic will be automatically routed to the S3 bucket serving the static error page.

Note:

You can use CloudWatch to monitor the health of your ALB.

You can use Amazon S3 to host a static website.

You can use Amazon Route 53 for routing traffic to different resources based on health checks.

You can refer to the AWS documentation for more information on how to configure and use these services:

https://aws.amazon.com/s3/

https://aws.amazon.com/route53/

https://aws.amazon.com/cloudwatch/

Graphical user interface, text, application Description automatically generated

Graphical user interface, application, Teams Description automatically generated

Here are the steps to update an existing AWS CloudFormation stack:

Log in to the AWS Management Console and navigate to the CloudFormation service in the us-east-2 Region.

Find the existing stack named 1700182 and click on it.

Click on the "Update" button.

Choose "Replace current template" and upload the updated CloudFormation template from the Amazon S3 bucket named "cloudformation-bucket"

In the "Parameter" section, update the EC2 instance type to us-east-t2.nano and add the IP address range 192.168.100.0/30 for SSH access.

Replace the instance profile IAM role with IamRoleB.

In the "Capabilities" section, check the checkbox for "IAM Resources"

Choose the role CFServiceR01e and click on "Update Stack"

Wait for the stack to be updated.

Once the update is complete, navigate to the stack and click on the "Stack options" button, and select "Prevent updates to prevent accidental deletion"

To get the value of the Prodlnstanceld , navigate to the "Outputs" tab in the CloudFormation stack and find the key "Prodlnstanceld". The value corresponding to it is the value that you need to enter in the text box below.

Note:

You can use AWS CloudFormation to update an existing stack.

You can use the AWS CloudFormation service role to deploy updates.

You can refer to the AWS CloudFormation documentation for more information on how to update and manage stacks: https://aws.amazon.com/cloudformation/

Here are the steps to configure Amazon EventBridge to meet the above requirements:

Log in to the AWS Management Console by using the AWS Management Console shortcut from the VM desktop. Make sure that you are logged in to the desired AWS account.

Go to the EventBridge service in the us-east-2 Region.

In the EventBridge service, navigate to the "Event buses" page.

Click on the "Create event bus" button.

Give a name to your event bus, and select "default" as the event source type.

Navigate to "Rules" page and create a new rule named "RunFunction"

In the "Event pattern" section, select "Schedule" as the event source and set the schedule to run every 15 minutes.

In the "Actions" section, select "Send to Lambda" and choose the existing AWS Lambda function named "LogEventFunction"

Create another rule named "SpotWarning"

In the "Event pattern" section, select "EC2" as the event source, and filter the events on "EC2 Spot Instance interruption"

In the "Actions" section, select "Send to SNS topic" and create a new standard Amazon SNS topic named "TopicEvents"

In the "Input Transformer" section, set the Input Path to {“instance” : “$.detail.instance-id”} and Input template to “The EC2 Spot Instance has been interrupted on account.

Now all Amazon EC2 events in the default event bus will be replayable for past 90 days.

Note:

You can use the AWS Management Console, AWS CLI, or SDKs to create and manage EventBridge resources.

You can use CloudTrail event history to replay events from the past 90 days.

You can refer to the AWS EventBridge documentation for more information on how to configure and use the service: https://aws.amazon.com/eventbridge/

To host a web application in an S3 bucket while adhering to the policy that prohibits public S3 buckets:

Amazon CloudFront: Set up a CloudFront distribution and designate the S3 bucket as its origin. This allows the web application to be served via CloudFront, which can handle web traffic at scale and provide additional features such as HTTPS delivery.

Origin Access Identity (OAI): Create an OAI for the CloudFront distribution and configure the S3 bucket policy to grant the s3:GetObject permission to the OAI. This allows only CloudFront to access the content in the S3 bucket, keeping the bucket private from direct public access.

Security and Performance: This configuration ensures that the web application is only accessible through CloudFront, enhancing security and performance. It also complies with the company's policy against public S3 buckets by controlling access strictly through CloudFront.

This method leverages CloudFront's capabilities to securely serve web applications from S3, maintaining privacy and compliance with organizational policies.

https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-networking-awsvpc.html

To monitor traffic flows between ECS tasks, you need to use VPC Flow Logs and specify the awsvpc network mode in the task definition.

VPC Flow Logs:

VPC Flow Logs capture information about the IP traffic going to and from network interfaces in your VPC.

Enable VPC Flow Logs on the elastic network interfaces (ENIs) used by the ECS tasks.

awsvpc Network Mode:

The awsvpc network mode gives each task its own ENI, allowing for more granular network monitoring and security controls.

This mode is required to capture detailed traffic flow information for each ECS task.

References:

VPC Flow Logs

Amazon ECS Task Networking