Amazon Web Services Updated SOA-C02 Exam Questions and Answers by ciaran

To encrypt an existing Amazon RDS DB instance that is not encrypted, you cannot directly enable encryption. Instead, you need to follow these steps:

Take a Snapshot:

Open the Amazon RDS console at Amazon RDS Console.

Select the DB instance and take a snapshot.

Copy and Encrypt the Snapshot:

After the snapshot is created, select the snapshot and choose Copy Snapshot.

In the copy snapshot dialog, enable encryption and choose a KMS key.

Restore the Encrypted Snapshot:

Once the encrypted snapshot is created, select it and choose Restore Snapshot.

Provide the necessary details to create a new DB instance from the encrypted snapshot.

This process ensures that the new DB instance is encrypted at rest.

Encrypting Amazon RDS Resources

Copying an Amazon RDS Snapshot

gp3 volumes provide higher performance and flexibility than gp2. With gp3, you can provision IOPS and throughput independently of storage size.

From the Amazon EBS documentation:

gp3 volumes deliver baseline performance of 3,000 IOPS, and you can provision up to 16,000 IOPS and 1,000 MB/s, regardless of volume size.

The issues experienced by users with legacy browsers typically stem from the SSL/TLS ciphers that are supported or enforced by the ALB. Modern security policies may exclude older ciphers that are necessary for compatibility with older browsers. Here’s how to resolve it:

Access the ALB Settings: Go to the AWS Management Console, navigate to the ALB settings, and locate the SSL negotiation configurations.

Modify Security Policy: Update the SSL/TLS security policy on the ALB to include ciphers that are compatible with legacy browsers. AWS provides predefined security policies, and some of these policies are designed to support older ciphers while still maintaining a level of security that complies with general best practices.

Apply Changes: Once the security policy is updated, the ALB will start using this new configuration, which should resolve compatibility issues with legacy browsers without needing to replace the SSL certificate or alter the infrastructure.

This solution maintains the operational efficiency of the setup and avoids the need for additional resources like a second ALB or new certificates.

Aurora databases can be exported to S3 using the StartExportTask API, and the exported files can then be replicated cross-account and cross-region via S3 replication rules.

From RDS Export to S3 documentation:

You can export data to Amazon S3 from a snapshot using the StartExportTask API.

To automate, use Amazon EventBridge Scheduler and set up replication rules on the destination bucket.

This offers low operational overhead and full automation.