Passed Exam Today SOA-C02

Step-by-Step Explanation:

Understand the Problem:

Share an AMI with other AWS accounts while ensuring it is encrypted with AWS KMS keys and accessible only to authorized accounts.

Analyze the Requirements:

Encrypt the AMI with a customer-managed key (CMK).

Share the AMI securely with specific AWS accounts.

Evaluate the Options:

Option A: Create a CMK and modify the key policy but do not create a copy of the AMI.

This does not re-encrypt the AMI with the CMK.

Option B: Create a CMK, modify the key policy, create a copy of the AMI, and specify the CMK.

This ensures the AMI is encrypted with the CMK and shared securely.

Option C: Create a CMK, modify the key policy, create a copy of the AMI, and make it public.

Making the AMI public does not meet the requirement of sharing with specific accounts only.

Option D: Modify the key policy of the AWS managed key and share the AMI.

AWS managed keys cannot have their key policies modified to add permissions for other accounts.

Select the Best Solution:

Option B: Creating a CMK, modifying the key policy, creating a copy of the AMI with the CMK, and specifying the permissions ensures the AMI is securely shared with specific AWS accounts.

Copying an AMI

Creating and Managing Keys

Sharing AMIs

This solution ensures the AMI is encrypted with a customer-managed key and shared securely with the specified AWS accounts.

Retain the Security Group:

When deleting a CloudFormation stack, you can specify resources to be retained instead of deleted.

Steps:

Go to the AWS Management Console.

Navigate to CloudFormation and select the stack.

Choose to delete the stack.

In the deletion options, specify that the security group should be retained.

This will delete the stack but keep the security group, ensuring no impact on other applications.

Deleting a Stack

Using CloudFormation Stack Sets:

CloudFormation stack sets allow you to deploy CloudFormation stacks across multiple AWS accounts and regions.

Steps:

Go to the AWS Management Console.

Navigate to CloudFormation and select "StackSets."

Click on "Create StackSet."

Provide the template URL or upload a template file.

Configure the stack set options and specify the accounts and regions.

Deploy the stack set to the specified accounts and regions.

AWS CloudFormation StackSets

To allow outbound IPv6 traffic from instances in your VPC to the internet, but prevent inbound traffic from the internet, you should use an egress-only internet gateway.

Egress-Only Internet Gateway:

An egress-only internet gateway is a horizontally scaled, redundant, and highly available VPC component that allows outbound communication over IPv6 from instances in your VPC to the internet and prevents the internet from initiating an IPv6 connection with your instances.

Routing Configuration:

Open the Amazon VPC console.

Select the route table associated with your VPC.

Add a route for IPv6 traffic (destination ::/0) to the egress-only internet gateway.

Egress-Only Internet Gateways

Routing for IPv6 Traffic