Amazon Web Services Updated SOA-C02 Exam Questions and Answers by jannat

One possible cause for the failure of the CloudFormation template to create an EC2 instance in the us-west-2 Region is that the Amazon Machine Image (AMI) ID referenced in the template could not be found in the us-west-2 Region. This could be due to the fact that the AMI is not available in that region, or the credentials used to access the AMI were not configured properly. The other options (resource tags defined in the CloudFormation template are specific to the us-east-I Region, the cfn-init script did not run during resource provisioning in the us-west-2 Region, and the IAM user was not created in the specified Region) are not valid causes for this failure.

The requirement is to monitor and notify whenever a non-production EC2 instance is started during the night. Amazon EventBridge offers a robust solution by triggering workflows in response to events.

Setting up Amazon EventBridge: Create an EventBridge rule that listens for the "EC2 Instance State-change Notification" event. Configure the rule to trigger only when instances transition to the "running" state.

Lambda Function: Attach a Lambda function as the target of the EventBridge rule. This function will execute when an EC2 instance starts. Inside the Lambda function, implement logic to check the current time and confirm it is during the night hours. Additionally, the function will check the instance's tags to verify if it's labeled as "non-production".

Notification via Amazon SNS: If the conditions are met (non-production and nighttime), the Lambda function publishes a message to an Amazon SNS topic specifically set up for this alert. The IT manager is subscribed to this topic, enabling them to receive an email notification almost instantaneously when the event occurs.

This solution is operationally efficient as it leverages serverless components that are inherently scalable and cost-effective, providing real-time monitoring and notifications without the need for continuous polling or complex infrastructure.

The most operationally efficient solution to ensure that administrator passwords for Amazon RDS DB instances are changed at least annually is to use AWS Secrets Manager with automatic rotation.

AWS Secrets Manager:

AWS Secrets Manager helps you protect access to your applications, services, and IT resources without the upfront cost and complexity of managing your own hardware security infrastructure.

Secrets Manager enables you to rotate, manage, and retrieve database credentials, API keys, and other secrets throughout their lifecycle.

Configure Automatic Rotation:

Store the database credentials in AWS Secrets Manager.

Configure the secret to rotate automatically every 365 days.

AWS Secrets Manager provides built-in integration for rotating credentials for supported databases, including Amazon RDS.

Steps to Configure:

Open the Secrets Manager console.

Create a new secret and provide the necessary database credentials.

Enable automatic rotation and set the rotation interval to 365 days.

Secrets Manager will handle the rotation process, updating the credentials in the database and ensuring they are securely stored.

AWS Secrets Manager

Rotating Your AWS Secrets Manager Secrets

Monitoring EC2 Instances with CloudWatch:

Amazon CloudWatch provides monitoring and alarms for AWS resources.

Alarms can be created for metrics like CPUUtilization, and notifications can be sent to Amazon SNS topics.

Steps to Set Up the Solution:

Create an SNS Topic:

Open the Amazon SNS Console.

Create a topic (e.g., "CPU_Alerts").

Add subscriptions for the development team's email addresses.

Create a CloudWatch Alarm:

Open the CloudWatch Console.

Navigate to the Alarms section and select Create Alarm.

Choose the EC2 CPUUtilization metric and set the alarm conditions:

Metric: Average CPU Utilization

Threshold: 80%

Period: 5 minutes

Link the alarm to the SNS topic for notifications.

Test the Alarm:

Simulate high CPU utilization to verify that alerts are sent to the subscribed email addresses.

Why Other Options Are Incorrect:

A and B: Using Amazon SES directly for alerts is not a standard practice for operational efficiency or integration with CloudWatch.

C: Using "sum" instead of "average" for CPU utilization is not appropriate for real-time monitoring, as it aggregates data over a large interval.