Amazon Kendra is an intelligent search service powered by machine learning. Its primary function is to enable users to search for information across various content repositories. Kendra can connect to data sources, including Amazon S3, to index documents and their content. It then provides a natural language search capability, allowing users to find specific text within those documents. This directly fulfills the company's requirement to search for text in documents stored in Amazon S3.

B. Amazon Rekognition is an image and video analysis service. While it can detect text in images, it is not a document search service.

C. Amazon Polly is a text-to-speech service that converts written text into lifelike speech; it does not perform search operations.

D. Amazon Lex is a service for building conversational interfaces, such as chatbots, and is not designed for searching document repositories.

1. Amazon Kendra Developer Guide: In the "What is Amazon Kendra?" section

the documentation states

"Amazon Kendra is an intelligent search service powered by machine learning (ML)... so your employees and customers can easily find the content they are looking for... scattered across multiple locations and content repositories". It explicitly lists Amazon S3 as a supported data source. (Source: AWS Documentation

Amazon Kendra Developer Guide

"What is Amazon Kendra?"

Section: "How it works").

2. Amazon Rekognition Developer Guide: The "What Is Amazon Rekognition?" section describes the service as one that "makes it easy to add image and video analysis to your applications." This confirms its purpose is analysis

not document search. (Source: AWS Documentation

Amazon Rekognition Developer Guide

"What Is Amazon Rekognition?"

First paragraph).

3. Amazon Polly Developer Guide: The "What Is Amazon Polly?" section states

"Amazon Polly is a service that turns text into lifelike speech." This clarifies its function is text-to-speech conversion. (Source: AWS Documentation

Amazon Polly Developer Guide

"What Is Amazon Polly?"

First paragraph).

4. Amazon Lex V2 Developer Guide: The "What is Amazon Lex?" section explains

"Amazon Lex is an AWS service for building conversational interfaces for applications using voice and text." This defines its role in creating chatbots. (Source: AWS Documentation

Amazon Lex V2 Developer Guide

"What is Amazon Lex?"

First paragraph).

AWS Secrets Manager is a dedicated service designed specifically for the secure storage and lifecycle management of secrets, including passwords, API keys, and database credentials. It provides encryption at rest using AWS Key Management Service (KMS), fine-grained access control through AWS IAM policies, and, most importantly, the ability to automatically rotate secrets on a schedule. This combination of features makes it the most secure and appropriate service for this purpose among the options provided.

A. Storing passwords in an Amazon S3 bucket is not ideal. While S3 supports encryption, it is a general-purpose object storage service and lacks native secret rotation and management capabilities.

B. AWS CloudFormation parameters are used to pass inputs to templates. They are not designed for secure, long-term storage or lifecycle management of secrets like passwords.

C. AWS Storage Gateway is a hybrid cloud storage service that connects on-premises environments to AWS storage. It is irrelevant for managing application secrets like passwords.

1. AWS Secrets Manager User Guide: "AWS Secrets Manager helps you protect secrets needed to access your applications

services

and IT resources. The service enables you to easily rotate

manage

and retrieve database credentials

API keys

and other secrets throughout their lifecycle."

Source: AWS Secrets Manager User Guide

"What is AWS Secrets Manager?"

Introduction.

2. AWS Security Best Practices Whitepaper: This whitepaper emphasizes using dedicated services for managing secrets. "Instead of storing secrets in configuration files or code

we recommend you use a secrets management service like AWS Secrets Manager or AWS Systems Manager Parameter Store."

Source: AWS Security Best Practices Whitepaper (August 2023)

Page 38

"SEC 06: How do you reduce the risk of managing secrets and credentials?".

3. AWS CloudFormation User Guide: This document explains that parameters are for template inputs

and while the NoEcho property can mask values

it does not provide the security of a dedicated secrets manager. "If you set the NoEcho attribute to true

CloudFormation returns the parameter value as a list of asterisks () for any call that describes the stack's events or configuration."

Source: AWS CloudFormation User Guide

"Parameters"

NoEcho section.

AWS Trusted Advisor is an online tool that provides real-time guidance to help you provision your resources following AWS best practices. One of its core functions is to inspect the AWS environment and make recommendations for saving money, improving system performance, and closing security gaps. The Security category of Trusted Advisor includes a specific check for "Security Groups - Unrestricted Access," which identifies security group rules that allow unrestricted inbound traffic (from 0.0.0.0/0) to potentially vulnerable ports, including SSH (port 22). This directly addresses the user's requirement.

A. Amazon Cognito: This service provides identity management for web and mobile applications, handling user sign-up, sign-in, and access control. It does not analyze infrastructure security configurations like security groups.

B. AWS Shield: This is a managed Distributed Denial of Service (DDoS) protection service. It safeguards applications running on AWS from malicious traffic but does not audit security group rules.

C. Amazon Macie: This is a data security service that uses machine learning to discover, classify, and protect sensitive data stored in Amazon S3. It does not inspect network security settings.

1. AWS Trusted Advisor Documentation: "The Security category includes checks that help you secure your AWS services... For example

we check for security groups with unrestricted access..."

Source: AWS Trusted Advisor Documentation

"AWS Trusted Advisor check reference"

Security category. (Specifically

the "Security Groups - Unrestricted Access" check description).

2. AWS Trusted Advisor Documentation: "Checks security groups for rules that allow unrestricted access to specific ports. Unrestricted access (0.0.0.0/0) increases opportunities for malicious activity (hacking

denial-of-service attacks

loss of data). The ports with the highest risk are flagged."

Source: AWS Trusted Advisor Documentation

"Security Groups - Unrestricted Access" check details.

3. Amazon Cognito Documentation: "Amazon Cognito handles user authentication and authorization for your web and mobile apps."

Source: AWS Documentation

"What Is Amazon Cognito?".

4. AWS Shield Documentation: "AWS Shield is a managed distributed denial of service (DDoS) protection service that safeguards applications running on AWS."

Source: AWS Documentation

"What is AWS Shield?".

5. Amazon Macie Documentation: "Amazon Macie is a data security service that discovers sensitive data by using machine learning and pattern matching..."

Source: AWS Documentation

"What is Amazon Macie?".

Amazon QuickSight is a scalable, serverless, machine learning-powered business intelligence (BI) service built for the cloud. Its primary function is to create and publish interactive dashboards and visualizations. AWS Cost and Usage Reports (CUR) are delivered to an Amazon S3 bucket, and QuickSight can directly connect to data in S3 to ingest, analyze, and visualize the cost and usage data, making it the appropriate service for the company's requirement.

B. Amazon Pinpoint: This is a marketing and customer engagement service used for sending communications like emails and SMS messages, not for data visualization.

C. Amazon Neptune: This is a fully managed graph database service designed for applications that work with highly connected datasets, not for general report visualization.

D. Amazon Kinesis: This service is for collecting, processing, and analyzing real-time streaming data, not for visualizing static report files like the AWS CUR.

1. AWS Documentation: Amazon QuickSight User Guide. "What Is Amazon QuickSight?" states

"Amazon QuickSight is a cloud-scale business intelligence (BI) service that you can use to deliver easy-to-understand insights... QuickSight lets you create and publish interactive BI dashboards that include ML-powered insights."

Source: AWS Documentation

Amazon QuickSight User Guide

"What Is Amazon QuickSight?".

2. AWS Documentation: Cost and Usage Reports User Guide. "Creating cost and usage dashboards with Amazon QuickSight" provides a step-by-step tutorial on this exact use case. It states

"You can use Amazon QuickSight to visualize the information in your AWS Cost and Usage Report."

Source: AWS Documentation

AWS Cost and Usage Reports User Guide

Section: "Creating cost and usage dashboards with Amazon QuickSight".

3. AWS Documentation: Amazon Kinesis. "What is Amazon Kinesis?" describes it as a service to "collect

process

and analyze real-time

streaming data so you can get timely insights and react quickly to new information." This confirms it is for real-time streams

not static reports.

Source: AWS Documentation

Amazon Kinesis Developer Guide

"What is Amazon Kinesis?".

4. AWS Documentation: Amazon Neptune. "What Is Amazon Neptune?" defines it as "a fast

reliable

fully managed graph database service that makes it easy to build and run applications that work with highly connected datasets."

Source: AWS Documentation

Amazon Neptune User Guide

"What Is Amazon Neptune?".

Developing and building applications for Apple's iOS platform requires the macOS operating system and the Xcode development environment. Amazon EC2 Mac instances are the only service among the options that provide on-demand macOS environments in the AWS Cloud. These instances run on genuine Apple Mac hardware (like the M1 Mac mini) and are designed specifically for developers to build, test, package, and sign applications for Apple platforms, including iOS, iPadOS, and macOS. This directly addresses the company's need to move its iOS development and build activities to AWS.

A. AWS CodeCommit is a managed source control service for hosting private Git repositories. It stores code but does not provide the computational environment needed to build it.

C. AWS Amplify is a development framework and set of tools for building web and mobile backends. While it can be used with an iOS app, it does not provide the required macOS build environment.

D. AWS App Runner is a fully managed service for deploying containerized web applications and APIs. It is not designed for building native mobile applications like those for iOS.

1. Amazon EC2 Mac instances Documentation: "Amazon EC2 Mac instances allow you to run on-demand macOS workloads in the cloud... With EC2 Mac instances

you can... build

test

package

and sign Xcode applications for the Apple platform including macOS

iOS

iPadOS

tvOS

watchOS

and Safari."

Source: AWS Documentation

"Amazon EC2 Mac instances

" Product Details section.

2. AWS CodeCommit User Guide: "AWS CodeCommit is a version control service hosted by Amazon Web Services that you can use to privately store and manage assets (such as documents

source code

and binary files) in the cloud."

Source: AWS Documentation

AWS CodeCommit User Guide

"What is AWS CodeCommit?

" Introduction.

3. AWS App Runner Developer Guide: "AWS App Runner is an AWS service that provides a fast

simple

and cost-effective way to deploy from source code or a container image directly to a scalable and secure web application."

Source: AWS Documentation

AWS App Runner Developer Guide

"What is AWS App Runner?

" Introduction.

4. AWS Amplify Documentation: "AWS Amplify is a complete solution that lets frontend web and mobile developers easily build

ship

and host full-stack applications on AWS..."

Source: AWS Documentation

AWS Amplify Docs

"What is AWS Amplify?

" Overview.

The AWS Cloud Adoption Framework (AWS CAF) provides guidance on organizational change to support cloud adoption. The question focuses on becoming more responsive to customers, which directly relates to business agility. The AWS CAF's Business Perspective emphasizes using agile methods to rapidly iterate and evolve products and services in response to customer needs. Additionally, the People Perspective advocates for organizational alignment by structuring teams around products and value streams. This structure empowers teams to own the customer experience and respond quickly to feedback, thus fulfilling the company's requirements for organizational transformation.

B. Creating new value propositions is a strategic business outcome that results from agility, not a direct task to achieve it.

D. This is a technical implementation that falls under the Platform Perspective; it supports responsiveness but is not the primary organizational change itself.

E. This is a foundational technical migration activity (Platform Perspective), not the specific organizational transformation required to improve customer responsiveness.

1. AWS. (2021). An Overview of the AWS Cloud Adoption Framework

Version 2. AWS Whitepaper.

Page 10

People perspective

Organizational alignment: "To accelerate your cloud journey

we recommend organizing your teams around products and value streams." This supports option A.

Page 9

Business perspective

Business agility: "Business agility is your organization’s ability to rapidly adapt to and drive market changes for your customers’ benefit... We recommend using agile methods to rapidly iterate and evolve products and services." This supports option C.

2. AWS. (n.d.). AWS Cloud Adoption Framework. AWS Documentation.

Business Perspective section: This section describes how the cloud can enhance business agility

stating

"This perspective helps stakeholders understand how to update the staff skills and organizational processes that are necessary to optimize their business value." This aligns with the organizational changes in options A and C.

AWS Budgets allows you to set custom cost and usage budgets for your AWS services. A key feature of AWS Budgets is its ability to send alerts when your actual or forecasted costs and usage exceed the thresholds you define. This directly addresses the company's requirement to track costs and receive notifications when spending is forecasted to reach a specific level. You can configure these alerts to be delivered via Amazon Simple Notification Service (SNS), email, or AWS Chatbot, ensuring timely notification to manage spending proactively.

B. AWS Cost Explorer is a tool for visualizing and analyzing historical and forecasted cost and usage data, but it does not natively create and send threshold-based alerts.

C. Savings Plans are a flexible pricing model that provides lower prices on compute usage in exchange for a commitment. It is a cost-optimization tool, not a cost-tracking and alerting service.

D. AWS Billing Conductor is a service for customizing billing data for chargeback and showback purposes, typically used by AWS Solution Providers or enterprises with multiple business units.

1. AWS Budgets User Guide: "Managing your costs with AWS Budgets." It states

"You can also set up alerts to notify you when your actual or forecasted cost and usage exceeds

or is forecasted to exceed

your budget." (Source: AWS Documentation

AWS Budgets User Guide

"What is AWS Budgets?")

2. AWS Cost Management Documentation: "AWS Cost Explorer." This document describes Cost Explorer as a tool to "visualize

understand

and manage your AWS costs and usage over time

" focusing on analysis and visualization rather than alerting. (Source: AWS Documentation

AWS Cost Management User Guide

"What is AWS Cost Explorer?")

3. AWS Savings Plans User Guide: "What are Savings Plans?" This guide defines Savings Plans as "a flexible pricing model that provides savings of up to 72% on your AWS compute usage." (Source: AWS Documentation

Savings Plans User Guide

"Overview")

4. AWS Billing Conductor User Guide: "What is AWS Billing Conductor?" The guide explains

"AWS Billing Conductor is a customization service that supports the showback and chargeback workflows of AWS Solution Providers and Enterprise customers." (Source: AWS Documentation

AWS Billing Conductor User Guide

"Overview")

Amazon Aurora is a cloud-native relational database service that combines the performance and availability of high-end commercial databases with the simplicity and cost-effectiveness of open-source databases. It is designed to be a drop-in replacement for existing databases and offers full compatibility with two popular open-source database engines: MySQL and PostgreSQL. This allows users to migrate their existing MySQL and PostgreSQL applications and workloads to Aurora with minimal to no code changes, while benefiting from its enhanced performance, scalability, and reliability.

A. Oracle: Amazon Aurora is not compatible with Oracle. For Oracle workloads, AWS offers Amazon RDS for Oracle.

B. Microsoft SQL Server: Amazon Aurora is not compatible with Microsoft SQL Server. AWS provides Amazon RDS for SQL Server for this engine.

E. MongoDB: MongoDB is a NoSQL database. Amazon DocumentDB (with MongoDB compatibility) is the relevant AWS service, not Aurora.

1. AWS Documentation - Amazon Aurora FAQs: Under the "General" section

the question "Q: What relational database engines does Amazon Aurora support?" is answered with: "Amazon Aurora is compatible with MySQL and PostgreSQL."

Source: AWS. (n.d.). Amazon Aurora FAQs. Retrieved from https://aws.amazon.com/rds/aurora/faqs/

2. AWS Documentation - What is Amazon Aurora?: The introductory section states

"Amazon Aurora is a global-scale relational database service built for the cloud

with full MySQL and PostgreSQL compatibility."

Source: AWS. (n.d.). What is Amazon Aurora?. AWS Documentation. Retrieved from https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/CHAPAuroraOverview.html

3. AWS Documentation - Amazon Aurora Features: The overview of features explicitly mentions its compatibility: "Amazon Aurora is a relational database management system (RDBMS) that is compatible with MySQL and PostgreSQL."

Source: AWS. (n.d.). Amazon Aurora Features. Retrieved from https://aws.amazon.com/rds/aurora/features/

AWS CloudTrail is the service designed for governance, compliance, and operational and risk auditing of an AWS account. It provides a detailed event history of actions taken within the account, including API calls made through the AWS Management Console, AWS SDKs, and command-line tools. CloudTrail logs capture crucial information such as the identity of the user or service that made the request, the time of the request, the source IP address, and the specific action performed, such as terminating an EC2 instance. This makes it the definitive tool for identifying who performed a specific action.

A. Amazon CloudWatch is a monitoring and observability service for AWS resources and applications. It collects metrics and logs for performance analysis, not for auditing user API activity.

B. AWS Trusted Advisor is an online tool that provides real-time guidance to help you provision your resources following AWS best practices across cost, performance, security, and fault tolerance.

D. Amazon Inspector is an automated vulnerability management service that continuously scans AWS workloads for software vulnerabilities and unintended network exposure. It does not track user actions.

1. AWS CloudTrail User Guide: "What Is AWS CloudTrail?" section states

"CloudTrail is an AWS service that helps you enable governance

compliance

and operational and risk auditing of your AWS account. Actions taken by a user

role

or an AWS service are recorded as events in CloudTrail."

2. AWS CloudTrail User Guide: In the "Viewing events with CloudTrail Event history" section

it details how to find information about events

including "who made the request." This directly addresses the question's requirement.

3. AWS Documentation - Amazon CloudWatch: The "What is Amazon CloudWatch?" page describes it as a service that "collects monitoring and operational data in the form of logs

metrics

and events

" focusing on performance and health

not user auditing.

4. AWS Documentation - AWS Trusted Advisor: The "How AWS Trusted Advisor works" section explains its function is to "inspect your AWS environment and then makes recommendations when opportunities exist to save money

improve system availability and performance

or help close security gaps."

AWS CodeDeploy is a fully managed deployment service that automates software deployments to a variety of compute services, including Amazon EC2, AWS Fargate, AWS Lambda, and on-premises servers. It simplifies the process of rapidly releasing new features by automating the code deployment process, which helps to avoid downtime during application deployment and handles the complexity of updating applications. CodeDeploy is a core component of a continuous integration and continuous delivery (CI/CD) pipeline on AWS, directly fulfilling the requirement to release application changes in an automated way.

A. Amazon AppFlow is a fully managed integration service that automates secure data flows between SaaS applications and AWS services, not for deploying application code.

C. AWS PrivateLink provides private, secure connectivity between VPCs, AWS services, and on-premises networks. It is a networking service, not a deployment automation tool.

D. Amazon EKS Distro is a Kubernetes distribution used to build and run Kubernetes clusters. It is the platform, not the service that automates application releases onto it.

1. AWS CodeDeploy User Guide: "AWS CodeDeploy is a deployment service that automates application deployments to Amazon EC2 instances

on-premises instances

serverless Lambda functions

or Amazon ECS services." (Source: AWS CodeDeploy User Guide

"What Is CodeDeploy?"

Introduction section).

2. Amazon AppFlow User Guide: "Amazon AppFlow is a fully managed integration service that you can use to securely transfer data between Software-as-a-Service (SaaS) applications... and AWS services." (Source: Amazon AppFlow User Guide

"What is Amazon AppFlow?"

Introduction section).

3. AWS PrivateLink Documentation: "With AWS PrivateLink

you can simplify your network architecture by connecting your services across different accounts and VPCs... It provides private connectivity between VPCs

AWS services

and your on-premises networks." (Source: AWS PrivateLink Documentation

"What is AWS PrivateLink?"

Introduction section).

4. Amazon EKS Distro Documentation: "Amazon EKS Distro is a Kubernetes distribution based on and used by Amazon Elastic Kubernetes Service (EKS) to create reliable and secure Kubernetes clusters." (Source: Amazon EKS Distro Documentation

Home page

Introduction paragraph).