How to Easily Pass the Amazon Web Services SOA-C02 Exam: Expert Advice

To securely manage and rotate the credentials for an Amazon RDS database created by a CloudFormation template, you should use AWS Secrets Manager. The AWS::SecretsManager::Secret resource can be used to create a secret, and the resolve:secretsmanager dynamic reference can be used to retrieve the secret.

Define Secrets Manager Resource in CloudFormation Template:

Add an AWS::SecretsManager::Secret resource to the CloudFormation template to store the database credentials.

Reference the Secret in RDS Resource:

Use the resolve:secretsmanager dynamic reference to retrieve the secret when creating the AWS::RDS::DBInstance resource.

Example CloudFormation Template:

MyDatabaseSecret:

Type: AWS::SecretsManager::Secret

Properties:

Name: MyDatabaseSecret

GenerateSecretString:

SecretStringTemplate: '{"username": "admin"}'

GenerateStringKey: "password"

PasswordLength: 16

ExcludeCharacters: '"@/\\'

MyRDSInstance:

Type: AWS::RDS::DBInstance

Properties:

DBInstanceIdentifier: MyRDSInstance

Engine: mysql

MasterUsername: !Sub '{{resolve:secretsmanager:MyDatabaseSecret:SecretString:username}}'

MasterUserPassword: !Sub '{{resolve:secretsmanager:MyDatabaseSecret:SecretString:password}}'

DBInstanceClass: db.t2.micro

AllocatedStorage: 20

References:

AWS::SecretsManager::Secret

Dynamic References

To ensure that all traffic, including rejected traffic, is logged in VPC Flow Logs, you need to create a new flow log with a filter setting to capture all traffic.

Create a New Flow Log:

Open the VPC console.

Select the VPC for which you want to create the flow log.

Choose "Create flow log."

In the filter setting, select "All" to capture all traffic (accepted and rejected).

Flow Log Configuration:

Ensure that the destination for the flow logs (e.g., CloudWatch Logs or S3) is properly configured.

Specify the appropriate IAM role to allow VPC Flow Logs to publish logs to the destination.

References:

VPC Flow Logs

Creating a Flow Log

To define a custom health check for EC2 instances behind an Application Load Balancer (ALB), follow these steps:

Configure Health Checks on ALB:

In the AWS Management Console, navigate to the EC2 dashboard, then to Load Balancers.

Select your ALB and go to the "Health Checks" tab.

Set the HealthCheckPath to the specific path that your application uses to determine if an instance is healthy. This could be a specific URL or endpoint on your application.

To view a list of security groups that are open to the internet on port 3389, the most appropriate tool is AWS Trusted Advisor.

AWS Trusted Advisor:

AWS Trusted Advisor provides real-time guidance to help you provision your resources following AWS best practices.

It includes a security check that identifies security groups with unrestricted access.

Using Trusted Advisor:

Go to the AWS Trusted Advisor console.

In the "Security" category, look for the check that identifies security groups with unrestricted access.

Review the report to find security groups that allow unrestricted access on port 3389 (RDP).

References:

AWS Trusted Advisor

AWS Trusted Advisor Best Practices