Amazon Web Services DOP-C02 - AWS Certified DevOps Engineer - Professional

https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps.html?icmpid=docs_orgs_console

SCPs (Service Control Policies) are the best way to restrict permissions at the organizational level, which in this case would be used to restrict modifications to the IAM role used by the auditing application, while still allowing trusted administrators to make changes to it. Options C and D are not as effective because IAM permission boundaries are applied to IAM entities (users, groups, and roles), not the account itself, and must be applied to all IAM entities in the account.

A zonal shift in Amazon Application Recovery Controller is the correct mechanism for quickly moving traffic away from an impaired Availability Zone while keeping the application active in healthy zones. AWS states that zonal shift causes the load balancer to stop sending new traffic to the affected Availability Zone. For ALB targets, the shifted-away targets receive an AdministrativeOverride state, and the ALB stops routing new traffic to them while existing connections close normally. Disabling cross-zone load balancing at the target group level supports the static-stability goal because traffic and capacity remain zonally scoped. Option B is manual and slower. Option C leaves cross-zone inheritance in place, which weakens zonal isolation. Option D changes subnet configuration and is operationally riskier than ARC zonal shift.

================

To restrict access to S3 buckets so that only IAM principals from within the AWS Organization can access them, an SCP (Service Control Policy) with conditions using the aws:PrincipalAccount or preferably aws:PrincipalOrgID can be applied at the OU level.

SCPs restrict the maximum permissions for IAM entities in member accounts and can be used to enforce access control policies across accounts.

The aws:PrincipalAccount condition restricts access to principals from specific accounts, while aws:PrincipalOrgID restricts based on the organization ID.

IAM permissions boundaries (Option B) cannot be applied organization-wide and do not enforce restrictions across accounts.

AWS RAM (Option C) is for sharing resources but does not restrict S3 bucket access based on organizational principals.

There is no such thing as an RCP in AWS Organizations (Option D is invalid).

https://docs.aws.amazon.com/glue/latest/dg/components-overview.html

ï‚· Configure AWS Systems Manager on Each Instance:

AWS Systems Manager provides a unified interface for managing AWS resources. Install the Systems Manager agent on each EC2 instance to enable inventory management and other features.

ï‚· Use AWS Systems Manager Inventory:

Systems Manager Inventory collects metadata about your instances and the software installed on them. This data includes information about applications, network configurations, and more.

Enable Systems Manager Inventory on all EC2 instances to gather detailed information about installed applications.

ï‚· Use Systems Manager Resource Data Sync to Synchronize and Store Findings in an Amazon S3 Bucket:

Resource Data Sync aggregates inventory data from multiple accounts and regions into a single S3 bucket, making it easier to query and analyze the data.

Configure Resource Data Sync to automatically transfer inventory data to an S3 bucket for centralized storage.

ï‚· Create an AWS Lambda Function that Runs When New Objects are Added to the S3 Bucket:

Use an S3 event to trigger a Lambda function whenever new inventory data is added to the S3 bucket.

The Lambda function can parse the inventory data and check for the presence of prohibited applications.

ï‚· Configure the Lambda Function to Identify Prohibited Applications:

The Lambda function should be programmed to scan the inventory data for any known prohibited applications and generate alerts or take appropriate actions if such applications are found.

Example Lambda function in Python

import json

import boto3

def lambda_handler(event, context):

s3 = boto3.client( ' s3 ' )

bucket = event[ ' Records ' ][0] [ ' s3 ' ][ ' bucket ' ][ ' name ' ]

key = event[ ' Records ' ][0] [ ' s3 ' ][ ' object ' ][ ' key ' ]

response = s3.get_object(Bucket=bucket, Key=key)

inventory_data = json.loads(response[ ' Body ' ].read().decode( ' utf-8 ' ))

prohibited_apps = [ ' app1 ' , ' app2 ' ]

for instance in inventory_data[ ' Instances ' ]:

for app in instance[ ' Applications ' ]:

if app[ ' Name ' ] in prohibited_apps:

# Send notification or take action

print(f " Prohibited application found: {app[ ' Name ' ]} on instance {instance[ ' InstanceId ' ]} " )

return { ' statusCode ' : 200, ' body ' : json.dumps( ' Check completed ' )}

By leveraging AWS Systems Manager Inventory, Resource Data Sync, and Lambda, this solution provides an efficient and automated way to audit EC2 instances for prohibited applications.

AWS Health provides real-time events and information related to your AWS infrastructure. It can be integrated with Amazon EventBridge to act upon the health events automatically. If the maintenance notification from AWS Health indicates that an EC2 instance requires a restart, you can set up an EventBridge rule to respond to such events. In this case, the target of this rule would be a Lambda function that would trigger a Systems Manager automation to restart the EC2 instance during a maintenance window. Remember, AWS Health is the source of the events (not EC2 or Systems Manager), and AWS Lambda can be used to execute complex remediation tasks, such as scheduling maintenance tasks via Systems Manager.

The following are the steps involved in configuring the EventBridge rule to meet these requirements:

Configure an event source of AWS Health, a service of EC2, and an event type that indicates instance maintenance.

Target a newly created AWS Lambda function that registers an automation task to restart the EC2 instance during a maintenance window.

The AWS Lambda function will be triggered by the event from AWS Health. The function will then register an automation task to restart the EC2 instance during the next maintenance window.

ALB supports weighted target groups for traffic splitting between versions without DNS-level changes. By attaching multiple target groups (old & beta) to the same ALB listener rule with weights (90/10), partial traffic testing can occur seamlessly. This is the recommended least-change method per Application Load Balancer advanced request routing documentation.

Using the principalTag in the Permission Set inline policy a logged in user belonging to a specific AD group in the IDP can be permitted access to perform operations on certain resources if their group matches the group used in the PrincipleTag. Basically you are narrowing the scope of privileges assigned via Permission policies conditionally based on whether the logged in user belongs to a specific AD Group in IDP. The mapping of the AD group to the request attributes can be done using SSO attributes where we can pass other attributes like the SAML token as well.

https://docs.aws.amazon.com/singlesignon/latest/userguide/abac.html

Update the status of the affected CodeArtifact package version to deleted:

Deleting the vulnerable package version prevents it from being available for download by any users or systems, ensuring that the compromised version is not consumed.

Update the CodeArtifact package origin control settings to allow direct publishing and to block upstream operations:

By allowing direct publishing, the security team can publish the patched version of the package directly to the CodeArtifact repository.

Blocking upstream operations prevents the repository from automatically fetching and serving the vulnerable package version from upstream public repositories.

By deleting the vulnerable version and configuring the origin control settings to allow direct publishing and block upstream operations, the company ensures that only the patched version is available and the vulnerable version cannot be downloaded.