Amazon Web Services SCS-C02 Exam With Confidence Using Practice Dumps

The solution to receiving automated email notifications when AWS access keys are detected on code repository sites is to use Amazon EventBridge with Amazon GuardDuty findings. Specifically, creating an EventBridge rule that targets Amazon GuardDuty findings, particularly theUnauthorizedAccess:IAMUser/InstanceCredentialExfiltrationfinding type, allows for the detection of potential unauthorized use or exposure of AWS credentials. When such a finding is detected, EventBridge can then trigger an action to send a notification via Amazon Simple Notification Service (Amazon SNS). By configuring an SNS topic to send emails, stakeholders can be promptly informed of such security incidents. This approach leverages AWS's native security and monitoring services to provide timely alerts with minimal operational overhead, ensuring that the company can respond quickly to potential security breaches involving exposed AWS credentials.

To ensure that application content is accessible only through CloudFront and not directly, the security engineer should do the following:

Add an origin custom header. This is a header that CloudFront adds to the requests that it sends to the origin, but viewers cannot see or modify.

Set the viewer protocol policy to redirect HTTP to HTTPS. This ensures that the viewers always use HTTPS when they access the website through CloudFront.

Set the origin protocol policy to HTTPS only. This ensures that CloudFront always uses HTTPS when it connects to the origin.

Update the application to validate the CloudFront custom header. This means that the application checks if the request has the custom header and only responds if it does. Otherwise, it denies or ignores the request. This prevents users from bypassing CloudFront and accessing the content directly on the origin.

Use AWS Systems Manager Session Manager:

AWS Systems Manager Session Manager provides a secure way to access Amazon EC2 instances without requiring SSH keys, opening inbound ports, or maintaining bastion hosts.

This complies with the company's requirement of not managing SSH keys or maintaining bastion hosts.

Configure Session Manager Logging to CloudWatch:

In the Systems Manager Console, configure Session Manager to upload session logs to Amazon CloudWatch Logs.

This ensures all session activity logs are recorded and stored securely.

Encrypt Logs in CloudWatch:

Use an AWS Key Management Service (AWS KMS) key to encrypt the logs in CloudWatch Logs. Ensure that the CloudWatch log group is configured to use an encrypted KMS key.

This meets the requirement to encrypt logs.

Monitor Logs for Compliance and Security:

Monitor the CloudWatch Logs to ensure proper access and record all activity for compliance purposes.

AWS Systems Manager Session Manager Documentation

Encrypting CloudWatch Logs with KMS

AWS Best Practices for Accessing EC2 Instances