Amazon Web Services DOP-C02 Exam With Confidence Using Practice Dumps

Create an Amazon EventBridge (Amazon CloudWatch Events) rule that matches an AWS Config evaluation result of NON_COMPLIANT for the restricted-ssh rule. Configure an input transformer for the EventBridge (CloudWatch Events) rule. Configure the EventBridge (CloudWatch Events) rule to publish a notification to the SNS topic. This approach uses Amazon EventBridge (previously known as Amazon CloudWatch Events) to filter AWS Config evaluation results based on the restricted-ssh rule and its compliance status (NON_COMPLIANT). An input transformer can be used to customize the information contained in the notification, such as the name and ID of the noncompliant security group. The EventBridge (CloudWatch Events) rule can then be configured to publish a notification to the SNS topic, which will notify the appropriate personnel in real-time.

When a Lambda function processes an SQS batch and a subset of messages fail, the default behavior re-queues the entire batch, causing already-successfully-processed messages to be delivered and processed again. The ReportBatchItemFailures feature in the Lambda event source mapping allows the function to return a partial failure response, indicating only the specific message IDs that failed. Lambda then deletes the successfully processed messages from the queue and re-queues only the failed items, preventing duplicate processing of successful messages. This approach maintains high concurrency because it does not restrict parallelism. Setting batch size to 1 (Option B) avoids batching entirely but eliminates the concurrency and throughput benefits. Reserved concurrency of 1 (Option D) severely restricts scalability. A 1-second batch window (Option A) affects how long Lambda waits to form a batch but does not prevent duplicate processing.

================

Step 1: Understanding Lambda Permissions and AWS Config

The custom AWS Config rule evaluates resources and invokes an AWS Lambda function when a compliance check is triggered. For AWS Config to invoke the Lambda function, it requires permission to do so.

Issue: The Lambda function fails to execute because AWS Config doesn ' t have permission to invoke it.

Action: Modify the resource-based policy of the Lambda function to grant AWS Config permission to invoke the Lambda function.

Why: Without this permission, AWS Config cannot trigger the Lambda function, which is why the evaluation fails.