For improving upload performance globally for an Amazon S3 bucket, enabling S3 Transfer

Acceleration is the best solution. This service optimizes file transfers to S3 using Amazon

CloudFront's globally distributed edge locations. After enabling this feature, uploads to the S3 bucket

are first routed to an AWS edge location and then transferred to S3 over an optimized network path.

Option C is correct, and the developers should use the provided accelerate endpoint in their API

calls. For more details, consult the AWS documentation on S3 Transfer Acceleration Amazon S3

Transfer Acceleration.

Objective:

Enforce corporate policy to prevent the creation of EC2 instances in unauthorized AWS Regions.

Using Service Control Policies (SCPs):

SCPs are an AWS Organizations feature that allow centralized control over permissions for all

accounts in the organization.

By attaching an SCP to the root level of the organization, you can enforce the restriction across all

accounts.

Solution Implementation:

Step 1: Open the AWS Organizations console.

Step 2: Create a new SCP with the following policy:

{

"Version": "2012-10-17",

"Statement":

[

{

"Effect": "Deny",

"Action": "ec2:RunInstances",

"Resource": "*",

"Condition": {

"StringNotEquals": {

"aws:RequestedRegion":

[

"us-east-1",

"us-west-2"

]

}

}

}

]

}

Replace "us-east-1" and "us-west-2" with the allowed Regions.

Step 3: Attach the SCP to the root level of the organization.

AWS Reference:

Service Control Policies (SCPs):SCP Best Practices

Restricting EC2 Regions with SCP:SCP Examples

Why Other Options Are Incorrect:

Option A: CloudTrail and EventBridge with Lambda are operationally less efficient and reactive rather

than preventative.

Option B: IAM policies applied at the account level require manual configuration for each account,

which is less efficient.

Option C: Permissions boundaries are more suited for controlling specific IAM user or role actions,

not account-wide restrictions.

Amazon FSx provides a fully managed file system that is optimized for Windows-based workloads

and can be used to create file shares that can be accessed both on premises and in the AWS Cloud.

The file shares that are created in Amazon FSx are highly available and can be accessed with low

latency. Additionally, Amazon FSx supports Windows-based authentication, making it easy to

integrate with existing Windows user accounts.

Reference:

[1] https://aws.amazon.com/fsx/

[2] https://aws.amazon.com/storage/file-storage/

[3] https://docs.aws.amazon.com/fsx/latest/WindowsGuide/what-is.html

[4] https://aws.amazon.com/premiumsupport/knowledge-center/fsx-file-gateway-access/

To analyze CloudWatch logs across multiple AWS Lambda functions for historical errors, the most

operationally efficient way is to use AWS Glue and Amazon Athena.

AWS Glue and Amazon Athena:

AWS Glue can crawl the data in S3, creating a catalog that makes it queryable.

Amazon Athena allows you to run SQL queries on the data cataloged by AWS Glue.

Steps to Implement:

Set up an AWS Glue crawler to index the logs stored in S3.

Configure the crawler to create a table in the AWS Glue Data Catalog.

Use Amazon Athena to query the table for errors using SQL. Since errors have a common string

prefix, you can use SQL queries to filter and find these errors.

AWS Glue

Amazon Athena

The requirement is to monitor and notify whenever a non-production EC2 instance is started during

the night. Amazon EventBridge offers a robust solution by triggering workflows in response to

events.

Setting up Amazon EventBridge: Create an EventBridge rule that listens for the "EC2 Instance State-

change Notification" event. Configure the rule to trigger only when instances transition to the

"running" state.

Lambda Function: Attach a Lambda function as the target of the EventBridge rule. This function will

execute when an EC2 instance starts. Inside the Lambda function, implement logic to check the

current time and confirm it is during the night hours. Additionally, the function will check the

instance's tags to verify if it's labeled as "non-production".

Notification via Amazon SNS: If the conditions are met (non-production and nighttime), the Lambda

function publishes a message to an Amazon SNS topic specifically set up for this alert. The IT

manager is subscribed to this topic, enabling them to receive an email notification almost

instantaneously when the event occurs.

This solution is operationally efficient as it leverages serverless components that are inherently

scalable and cost-effective, providing real-time monitoring and notifications without the need for

continuous polling or complex infrastructure.

NAT Gateway Setup:

A NAT gateway allows instances in a private subnet to connect to the internet or other AWS services,

but prevents the internet from initiating a connection with those instances.

Steps:

Go to the AWS Management Console.

Navigate to VPC and select "NAT Gateways."

Create a NAT gateway in the public subnet of each Availability Zone.

Allocate an Elastic IP address to each NAT gateway.

Update the route tables for the private subnets to route internet-bound traffic to the NAT gateways.

Creating a NAT Gateway

To upgrade the instance type of a Memcached cluster in Amazon ElastiCache due to increased usage

and the need for more memory:

ModifyCacheCluster API: Utilize the ModifyCacheCluster API call. This API allows you to change

various settings of an existing cache cluster, including the instance type, which is referred to as

cacheNodeType.

Instance Upgrade: Specify a new, larger cacheNodeType that provides more memory. This upgrade

will involve a brief interruption as nodes are replaced with the larger type, but it is necessary to

accommodate the increased load and memory requirements.

Cluster Availability: Ensure that the Memcached cluster is configured for minimal downtime during

this change. The upgrade process is handled by ElastiCache, and the new nodes will join the cluster

with more memory capacity.

This approach enables you to effectively scale up the resources available to your Memcached cluster,

enhancing its performance and capacity to handle larger workloads.

In AWS CloudFormation, the PrivateDnsName property of an EC2 instance cannot be directly set

within the template. This property is automatically assigned by AWS when the instance is launched

within a VPC and is associated with the private IP address of the instance. The attempt to explicitly

set PrivateDnsName in a CloudFormation template will result in an error, causing the stack creation

to fail. Therefore, option C is correct. For reference, the AWS documentation on EC2 instances in

CloudFormation does not list PrivateDnsName as a configurable property AWS CloudFormation User

Guide.

The reason is that it uses the Amazon CloudWatch billing alarm which is a built-in service specifically

designed to monitor and alert on cost usage of your AWS account, which makes it a more suitable

solution for this use case. The alarm can be configured to detect when costs reach 75% of the

threshold and when it is triggered, it can publish a message to an Amazon Simple Notification Service

(Amazon SNS) topic. The email distribution list can be subscribed to the topic, so that they will

receive the alerts when costs reach 75% of the threshold.

AWS Budgets allows you to track and manage your costs, but it doesn't specifically focus on data

transfer costs between regions, and it might not provide as much granularity as CloudWatch Alarms.

Enabling the organizational view in AWS Health will allow the SysOps administrator to consolidate

the alerts from each account’s Personal Health Dashboard. It will also provide the administrator with

a single view of all the accounts in the organization, allowing them to easily monitor the health of all

the accounts in the organization.

Reference:

[1] https://aws.amazon.com/premiumsupport/knowledge-center/organizational-view-healthdashboard/