Amazon Web Services SOA-C02 Online Access

To provision AWS accounts for each team with a defined baseline and governance guardrails in a scalable and efficient way, using AWS Control Tower is the best solution.

AWS Control Tower:

AWS Control Tower provides a straightforward way to set up and govern a secure, multi-account AWS environment based on best practices.

It uses Account Factory, a feature that automates the creation of new AWS accounts with predefined configurations.

Creating Accounts with Control Tower:

Navigate to the AWS Control Tower console.

Use Account Factory to create a new account.

Customize the account template to include the necessary configurations, such as organizational units (OUs), guardrails, and baselines.

Advantages:

Ensures consistent security and compliance across all accounts.

Automates account creation and configuration, saving time and reducing errors.

AWS Control Tower

Setting Up Account Factory

Ref.

Amazon S3 Batch Operations is a feature that lets you perform large-scale batch operations on S3 objects. It is the most operationally efficient way to replace a tag on all objects in an S3 bucket.

Create an S3 Batch Operations Job:

Open the Amazon S3 console at Amazon S3 Console.

Navigate to Batch Operations and create a new job.

Specify the Operation:

Choose the operation to replace all object tags.

Provide a manifest that lists the objects in the bucket. You can generate this manifest using an S3 inventory report.

Execute the Job:

Review the job configuration and submit it.

Monitor the job execution to ensure all tags are replaced as specified.

Using S3 Batch Operations automates the process and minimizes manual effort.

Amazon S3 Batch Operations

Tagging Amazon S3 Objects

To troubleshoot connectivity issues for an EC2 instance that's not accessible via RDP after moving to a private subnet, VPC flow logs are the most direct and useful tool. VPC flow logs capture information about the IP traffic going to and from network interfaces in your VPC, enabling you to identify whether the traffic to the EC2 instance is being allowed or rejected. Setting up flow logs for the EC2 instance’s network interface will help pinpoint any blocks or drops in traffic that could be causing the timeout error. Option C is the correct action as it directly investigates the traffic flow, which is crucial for resolving connectivity issues. AWS documentation on VPC flow logs provides further details VPC Flow Logs.

To determine the service costs incurred by each developer, follow these steps:

Activate the createdBy Tag:

Tagging resources with a createdBy tag helps identify which user created the resource. This tag should be applied consistently across all resources created by the developers.