Amazon Web Services Updated SOA-C02 Exam Questions and Answers by nell

The provided IAM policy grants the following permissions:

Describe AWS Load Balancers:

The policy allows actions with the prefix elasticloadbalancing:. This includes actions like DescribeLoadBalancers and other Describe* actions related to Elastic Load Balancing.

 Lambda Function to Rotate IAM Access Keys:

A Lambda function can be used to automate the rotation of IAM access keys based on their age.

Steps:

Write a Lambda function that checks the age of IAM access keys.

The function should rotate keys that are at least 30 days old.

Deploy the Lambda function.

 Amazon EventBridge Rule:

EventBridge can trigger the Lambda function periodically and when a new key is created.

Steps:

Create an EventBridge rule that triggers the Lambda function on a schedule (e.g., daily) and on IAM key creation events.

Rotating Access Keys for IAM Users, Amazon EventBridge

To manage scaling of EC2 instances in response to variable SQS message loads effectively:

Monitor SQS Queue Size: Utilize Amazon CloudWatch to monitor the number of visible messages in the SQS queue. This metric gives an indication of the workload that needs to be processed by the worker instances.

Metric Math Expression: Create a CloudWatch metric math expression that calculates the approximate number of messages visible per instance. This provides a more precise scaling metric, ensuring that each instance in the Auto Scaling group has a manageable load.

Target Tracking Scaling Policy: Implement a target tracking scaling policy based on this metric math expression. Configure the Auto Scaling group to automatically adjust its size to maintain a target value for the average number of SQS messages per instance. This approach ensures that the EC2 instances scale up during high traffic periods and scale down when the message load decreases.

This solution optimizes resource utilization and cost while maintaining performance by ensuring that the worker processes are neither overwhelmed nor idle.

To ensure that Amazon Elasticsearch Service (Amazon ES) can be accessed only from the branch offices while preserving existing data, an IP-based domain access policy is the best approach. This allows you to restrict access to specific IP ranges.

Configure an IP-Based Domain Access Policy:

Navigate to the Amazon ES console.

Select the domain and go to the "Access policies" tab.

Update the Access Policy:

Edit the access policy to include an allow statement for the private IP CIDR blocks of each branch office.

Example policy:

"Version": "2012-10-17",

"Statement": [

{

"Effect": "Allow",

"Principal": "*",

"Action": "es:*",

"Condition": {

"IpAddress": {

"aws:SourceIp": [

"branch-office-cidr-1",

"branch-office-cidr-2"

]

}

}

}

]

}

Verify the Configuration:

Ensure that the policy correctly restricts access to the specified IP ranges.

Test access from the branch offices to confirm connectivity.

Amazon Elasticsearch Service Access Control

Configuring Access Policies