Amazon AWS Certified Solutions Architect - Associate SAA-C03 Bundle

The option Configure a supported Secrets Manager rotation workflow for the database secret addresses a separate condition: an application needs scheduled automatic secret rotation with RDS integration. Secret rotation manages credential lifecycle without application code edits. The actual requirement is a deployment requires nonsecret environment settings without the cost of secret rotation. Recommended corrective action: Store configuration using Systems Manager Parameter Store with appropriate parameter type. Parameter Store suits configuration values and controlled retrieval.

Allow the precise secretsmanager:GetSecretValue action on the secret ARN to its execution role would help if a Lambda function needs to fetch the secret but receives AccessDenied. Lambda's execution identity authorizes secret retrieval. That is not the symptom described here: a deployment requires nonsecret environment settings without the cost of secret rotation. The matching response is Store configuration using Systems Manager Parameter Store with appropriate parameter type, because parameter Store suits configuration values and controlled retrieval.

For the alternative failure application code stores an RDS database password in a Git repository, the control Move the password into AWS Secrets Manager and rotate the compromised credential is relevant: secrets Manager decouples sensitive values from source code. Here the evidence instead is a deployment requires nonsecret environment settings without the cost of secret rotation. The selected technical mechanism is Store configuration using Systems Manager Parameter Store with appropriate parameter type: parameter Store suits configuration values and controlled retrieval.

Create an S3 gateway endpoint in relevant VPC route tables would help if eC2 must access Amazon S3 at scale without NAT processing charges. Gateway endpoints serve S3 through managed prefix routes. That is not the symptom described here: a Lambda function in a private subnet needs private access to Secrets Manager APIs. The matching response is Create an interface endpoint for Secrets Manager and allow its endpoint security-group traffic, because privateLink interface endpoints expose supported service APIs as private VPC IPs.

For the alternative failure a security policy requires additional filtering on endpoint usage regardless of instance IAM, the control Apply the endpoint policy supported for the service and retain IAM authorization is relevant: endpoint policies restrict which principals/actions may traverse an endpoint. Here the evidence instead is a Lambda function in a private subnet needs private access to Secrets Manager APIs. The selected technical mechanism is Create an interface endpoint for Secrets Manager and allow its endpoint security-group traffic: privateLink interface endpoints expose supported service APIs as private VPC IPs.

Enable and validate private DNS for the supported endpoint solves a different operational problem where a private API request cannot resolve the interface endpoint's normal regional hostname. Private DNS resolves a regional service name to endpoint interface addresses. It does not directly address a Lambda function in a private subnet needs private access to Secrets Manager APIs. The case calls for Create an interface endpoint for Secrets Manager and allow its endpoint security-group traffic, since privateLink interface endpoints expose supported service APIs as private VPC IPs.

For the alternative failure a private API request cannot resolve the interface endpoint's normal regional hostname, the control Enable and validate private DNS for the supported endpoint is relevant: private DNS resolves a regional service name to endpoint interface addresses. Here the evidence instead is eC2 must access Amazon S3 at scale without NAT processing charges. The selected technical mechanism is Create an S3 gateway endpoint in relevant VPC route tables: gateway endpoints serve S3 through managed prefix routes.

Create an interface endpoint for Secrets Manager and allow its endpoint security-group traffic solves a different operational problem where a Lambda function in a private subnet needs private access to Secrets Manager APIs. PrivateLink interface endpoints expose supported service APIs as private VPC IPs. It does not directly address eC2 must access Amazon S3 at scale without NAT processing charges. The case calls for Create an S3 gateway endpoint in relevant VPC route tables, since gateway endpoints serve S3 through managed prefix routes.

The competing option Apply the endpoint policy supported for the service and retain IAM authorization would be useful when a security policy requires additional filtering on endpoint usage regardless of instance IAM. Endpoint policies restrict which principals/actions may traverse an endpoint. The present issue is eC2 must access Amazon S3 at scale without NAT processing charges; it is more directly addressed by Create an S3 gateway endpoint in relevant VPC route tables. Gateway endpoints serve S3 through managed prefix routes.

Create an S3 gateway endpoint in relevant VPC route tables solves a different operational problem where eC2 must access Amazon S3 at scale without NAT processing charges. Gateway endpoints serve S3 through managed prefix routes. It does not directly address an AWS service endpoint must only serve calls from an approved VPC. The case calls for Configure a suitable service resource-policy condition on the source VPC endpoint, since resource-policy context keys can constrain endpoint-origin calls.

The competing option Create an interface endpoint for Secrets Manager and allow its endpoint security-group traffic would be useful when a Lambda function in a private subnet needs private access to Secrets Manager APIs. PrivateLink interface endpoints expose supported service APIs as private VPC IPs. The present issue is an AWS service endpoint must only serve calls from an approved VPC; it is more directly addressed by Configure a suitable service resource-policy condition on the source VPC endpoint. Resource-policy context keys can constrain endpoint-origin calls.

The option Enable and validate private DNS for the supported endpoint addresses a separate condition: a private API request cannot resolve the interface endpoint's normal regional hostname. Private DNS resolves a regional service name to endpoint interface addresses. The actual requirement is an AWS service endpoint must only serve calls from an approved VPC. Recommended corrective action: Configure a suitable service resource-policy condition on the source VPC endpoint. Resource-policy context keys can constrain endpoint-origin calls.

The competing option Create an interface endpoint for Secrets Manager and allow its endpoint security-group traffic would be useful when a Lambda function in a private subnet needs private access to Secrets Manager APIs. PrivateLink interface endpoints expose supported service APIs as private VPC IPs. The present issue is a private API request cannot resolve the interface endpoint's normal regional hostname; it is more directly addressed by Enable and validate private DNS for the supported endpoint. Private DNS resolves a regional service name to endpoint interface addresses.

The option Create an S3 gateway endpoint in relevant VPC route tables addresses a separate condition: eC2 must access Amazon S3 at scale without NAT processing charges. Gateway endpoints serve S3 through managed prefix routes. The actual requirement is a private API request cannot resolve the interface endpoint's normal regional hostname. Recommended corrective action: Enable and validate private DNS for the supported endpoint. Private DNS resolves a regional service name to endpoint interface addresses.

For the alternative failure a security policy requires additional filtering on endpoint usage regardless of instance IAM, the control Apply the endpoint policy supported for the service and retain IAM authorization is relevant: endpoint policies restrict which principals/actions may traverse an endpoint. Here the evidence instead is a private API request cannot resolve the interface endpoint's normal regional hostname. The selected technical mechanism is Enable and validate private DNS for the supported endpoint: private DNS resolves a regional service name to endpoint interface addresses.

The option Enable and validate private DNS for the supported endpoint addresses a separate condition: a private API request cannot resolve the interface endpoint's normal regional hostname. Private DNS resolves a regional service name to endpoint interface addresses. The actual requirement is a security policy requires additional filtering on endpoint usage regardless of instance IAM. Recommended corrective action: Apply the endpoint policy supported for the service and retain IAM authorization. Endpoint policies restrict which principals/actions may traverse an endpoint.

For the alternative failure eC2 must access Amazon S3 at scale without NAT processing charges, the control Create an S3 gateway endpoint in relevant VPC route tables is relevant: gateway endpoints serve S3 through managed prefix routes. Here the evidence instead is a security policy requires additional filtering on endpoint usage regardless of instance IAM. The selected technical mechanism is Apply the endpoint policy supported for the service and retain IAM authorization: endpoint policies restrict which principals/actions may traverse an endpoint.

Configure a suitable service resource-policy condition on the source VPC endpoint solves a different operational problem where an AWS service endpoint must only serve calls from an approved VPC. Resource-policy context keys can constrain endpoint-origin calls. It does not directly address a security policy requires additional filtering on endpoint usage regardless of instance IAM. The case calls for Apply the endpoint policy supported for the service and retain IAM authorization, since endpoint policies restrict which principals/actions may traverse an endpoint.

Configure the correct Transit Gateway route-table association and propagation would help if a spoke VPC cannot reach another because the Transit Gateway attachment lacks route propagation. TGW route tables govern interattachment forwarding. That is not the symptom described here: three VPCs need a transitive hub for routed connectivity. The matching response is Connect them using a properly routed AWS Transit Gateway, because transit Gateway provides centralized transitive VPC routing.

For the alternative failure two VPCs need direct, nontransitive private peering, the control Establish VPC peering and reciprocal routes for nonoverlapping CIDRs is relevant: vPC peering offers point-to-point routing without transitivity. Here the evidence instead is three VPCs need a transitive hub for routed connectivity. The selected technical mechanism is Connect them using a properly routed AWS Transit Gateway: transit Gateway provides centralized transitive VPC routing.

Publish the service through a PrivateLink endpoint service and Network Load Balancer solves a different operational problem where a service producer wants consumers to reach one private service without full VPC routing. PrivateLink exposes selected services rather than routing entire VPC CIDRs. It does not directly address three VPCs need a transitive hub for routed connectivity. The case calls for Connect them using a properly routed AWS Transit Gateway, since transit Gateway provides centralized transitive VPC routing.

For the alternative failure a service producer wants consumers to reach one private service without full VPC routing, the control Publish the service through a PrivateLink endpoint service and Network Load Balancer is relevant: privateLink exposes selected services rather than routing entire VPC CIDRs. Here the evidence instead is two VPCs need direct, nontransitive private peering. The selected technical mechanism is Establish VPC peering and reciprocal routes for nonoverlapping CIDRs: vPC peering offers point-to-point routing without transitivity.

Prefer PrivateLink for supported service-specific access or renumber CIDRs solves a different operational problem where two VPCs share the same CIDR and cannot use ordinary peering routes. Overlapping CIDRs prevent straightforward peering route resolution. It does not directly address two VPCs need direct, nontransitive private peering. The case calls for Establish VPC peering and reciprocal routes for nonoverlapping CIDRs, since vPC peering offers point-to-point routing without transitivity.

The option Connect them using a properly routed AWS Transit Gateway addresses a separate condition: three VPCs need a transitive hub for routed connectivity. Transit Gateway provides centralized transitive VPC routing. The actual requirement is two VPCs need direct, nontransitive private peering. Recommended corrective action: Establish VPC peering and reciprocal routes for nonoverlapping CIDRs. VPC peering offers point-to-point routing without transitivity.

The competing option Configure the correct Transit Gateway route-table association and propagation would be useful when a spoke VPC cannot reach another because the Transit Gateway attachment lacks route propagation. TGW route tables govern interattachment forwarding. The present issue is a service producer wants consumers to reach one private service without full VPC routing; it is more directly addressed by Publish the service through a PrivateLink endpoint service and Network Load Balancer. PrivateLink exposes selected services rather than routing entire VPC CIDRs.

The option Establish VPC peering and reciprocal routes for nonoverlapping CIDRs addresses a separate condition: two VPCs need direct, nontransitive private peering. VPC peering offers point-to-point routing without transitivity. The actual requirement is a service producer wants consumers to reach one private service without full VPC routing. Recommended corrective action: Publish the service through a PrivateLink endpoint service and Network Load Balancer. PrivateLink exposes selected services rather than routing entire VPC CIDRs.

Connect them using a properly routed AWS Transit Gateway would help if three VPCs need a transitive hub for routed connectivity. Transit Gateway provides centralized transitive VPC routing. That is not the symptom described here: a service producer wants consumers to reach one private service without full VPC routing. The matching response is Publish the service through a PrivateLink endpoint service and Network Load Balancer, because privateLink exposes selected services rather than routing entire VPC CIDRs.

The competing option Establish VPC peering and reciprocal routes for nonoverlapping CIDRs would be useful when two VPCs need direct, nontransitive private peering. VPC peering offers point-to-point routing without transitivity. The present issue is a spoke VPC cannot reach another because the Transit Gateway attachment lacks route propagation; it is more directly addressed by Configure the correct Transit Gateway route-table association and propagation. TGW route tables govern interattachment forwarding.

The option Connect them using a properly routed AWS Transit Gateway addresses a separate condition: three VPCs need a transitive hub for routed connectivity. Transit Gateway provides centralized transitive VPC routing. The actual requirement is a spoke VPC cannot reach another because the Transit Gateway attachment lacks route propagation. Recommended corrective action: Configure the correct Transit Gateway route-table association and propagation. TGW route tables govern interattachment forwarding.

Publish the service through a PrivateLink endpoint service and Network Load Balancer would help if a service producer wants consumers to reach one private service without full VPC routing. PrivateLink exposes selected services rather than routing entire VPC CIDRs. That is not the symptom described here: a spoke VPC cannot reach another because the Transit Gateway attachment lacks route propagation. The matching response is Configure the correct Transit Gateway route-table association and propagation, because tGW route tables govern interattachment forwarding.

The option Configure the correct Transit Gateway route-table association and propagation addresses a separate condition: a spoke VPC cannot reach another because the Transit Gateway attachment lacks route propagation. TGW route tables govern interattachment forwarding. The actual requirement is two VPCs share the same CIDR and cannot use ordinary peering routes. Recommended corrective action: Prefer PrivateLink for supported service-specific access or renumber CIDRs. Overlapping CIDRs prevent straightforward peering route resolution.

For the alternative failure a service producer wants consumers to reach one private service without full VPC routing, the control Publish the service through a PrivateLink endpoint service and Network Load Balancer is relevant: privateLink exposes selected services rather than routing entire VPC CIDRs. Here the evidence instead is two VPCs share the same CIDR and cannot use ordinary peering routes. The selected technical mechanism is Prefer PrivateLink for supported service-specific access or renumber CIDRs: overlapping CIDRs prevent straightforward peering route resolution.

Establish VPC peering and reciprocal routes for nonoverlapping CIDRs solves a different operational problem where two VPCs need direct, nontransitive private peering. VPC peering offers point-to-point routing without transitivity. It does not directly address two VPCs share the same CIDR and cannot use ordinary peering routes. The case calls for Prefer PrivateLink for supported service-specific access or renumber CIDRs, since overlapping CIDRs prevent straightforward peering route resolution.