Amazon Web Services Updated SOA-C02 Exam Questions and Answers by aria-rose

Amazon CloudFront is a global content delivery network (CDN) service that delivers your content with low latency and high transfer speeds. By distributing the static content (images and videos) to CloudFront edge locations, users in the United States and Europe can access the content from the nearest edge location, significantly improving the load times.

Create a CloudFront Distribution:

Open the Amazon CloudFront console at Amazon CloudFront Console.

Choose Create Distribution and select Web.

Specify the S3 bucket as the origin where your static content is stored.

Configure Distribution Settings:

Configure the settings, such as cache behaviors and SSL/TLS settings.

Optionally, configure additional features like geo-restriction and logging.

Update DNS Configuration:

Update your DNS records to point to the CloudFront distribution. This can be done via Amazon Route 53 or your DNS provider.

Monitor Performance:

Use CloudFront reports and logs to monitor the performance and adjust configurations if needed.

Amazon CloudFront Overview

Creating a CloudFront Distribution

Systems Manager Quick Setup is the recommended method for enabling Systems Manager capabilities across all accounts in an organization.

From AWS Systems Manager Quick Setup documentation:

You can use Quick Setup in the management account of your organization to automatically configure Systems Manager in all current and future member accounts.

The "Default Host Management Configuration" enables:

Instance registration

SSM Agent setup

IAM role association

This meets the requirement with the least ongoing maintenance.

AWS Config can be used to monitor and enforce compliance of AWS resource configurations, including security group rules.

Steps:

Activate AWS Config Rule:

Open the AWS Config console.

Choose "Rules" and then "Add rule".

Search for and select the restricted-ssh managed rule.

Configure the rule to monitor all security groups for compliance.

Set Up Automatic Remediation:

In the AWS Config console, associate the restricted-ssh rule with the AWS-DisablePublicAccessForSecurityGroup Systems Manager Automation runbook.

This runbook will automatically remove any inbound SSH rule that allows traffic from 0.0.0.0/0.

Set Up Notifications:

Open the Amazon EventBridge console.

Create a new rule to monitor AWS Config compliance changes.

Configure the rule to send notifications to an Amazon SNS topic whenever the restricted-ssh rule is noncompliant.

Subscribe the SysOps team to the SNS topic to receive notifications.

To improve the performance of the website with long loading times, leveraging Amazon CloudFront for caching static content and implementing EC2 Auto Scaling are effective strategies.

Add Amazon CloudFront Caching:

Navigate to the CloudFront console and create a new distribution.

For the origin, specify the S3 bucket where the static content is stored.

Configure caching settings to ensure that static content is cached at edge locations for faster delivery to end users.

Update the DNS settings in Amazon Route 53 to point to the CloudFront distribution for static content.

Implement EC2 Auto Scaling:

Go to the EC2 console and create a new launch configuration or launch template for the web servers.

Set up an Auto Scaling group using the launch configuration/template.

Configure the Auto Scaling group to use health checks, and specify the desired, minimum, and maximum number of instances.

Define scaling policies to add or remove instances based on CPU utilization or other metrics.

Distribute instances across multiple Availability Zones for high availability.

Amazon CloudFront Developer Guide

Amazon EC2 Auto Scaling