Amazon AWS Certified Solutions Architect - Professional SAP-C02 Bundle

Although Enable AWS Config recording and rules for encryption compliance can be valid when Cloud resources drift from approved encryption settings after console changes, it targets a different technical condition. Config tracks resource state and identifies policy deviation over time.

This alternative, Query CloudTrail management events and correlate role session identity, is appropriate when An audit asks which engineer removed a production bucket policy at a precise timestamp. API audit logs tie configuration changes to actors and events.

For the separate situation An infrastructure deployment requires automatically remediating unauthorized public security-group ingress, Use AWS Config compliance findings with an approved Systems Manager Automation remediation could be useful. Config-triggered remediation can restore expected security-group settings under governance.

This alternative, Use Secrets Manager with a controlled custom rotation Lambda and verification, is appropriate when A Lambda integration depends on a certificate secret rotated quarterly by an operations engineer. Rotation workflows can update secrets and coordinate downstream credential changes.

For the separate situation A container task reads credentials from a shared EC2 node profile that also grants admin rights, Give the ECS task a dedicated IAM task role with least-privilege access could be useful. Task roles isolate application AWS API credentials from the container host identity.

Although Audit Secrets Manager API calls in CloudTrail and correlate STS role sessions can be valid when An administrator wants proof of which principals retrieved a production secret during an incident, it targets a different technical condition. CloudTrail records secret-access API activities for actor attribution.

For the separate situation A Lambda integration depends on a certificate secret rotated quarterly by an operations engineer, Use Secrets Manager with a controlled custom rotation Lambda and verification could be useful. Rotation workflows can update secrets and coordinate downstream credential changes.

Give the ECS task a dedicated IAM task role with least-privilege access solves the related scenario A container task reads credentials from a shared EC2 node profile that also grants admin rights; task roles isolate application AWS API credentials from the container host identity.

Although Move the credential to Secrets Manager and retrieve it through an application IAM role can be valid when An application keeps an RDS master password in an unencrypted deployment file, it targets a different technical condition. Central secrets retrieval limits plaintext distribution and allows policy-controlled rotation.

Audit Secrets Manager API calls in CloudTrail and correlate STS role sessions solves the related scenario An administrator wants proof of which principals retrieved a production secret during an incident; cloudTrail records secret-access API activities for actor attribution.

Move the credential to Secrets Manager and retrieve it through an application IAM role would address a different requirement: An application keeps an RDS master password in an unencrypted deployment file. Central secrets retrieval limits plaintext distribution and allows policy-controlled rotation.

This alternative, Disable and rotate exposed long-lived keys and replace access with time-bound roles if needed, is appropriate when An external vendor previously had permanent IAM access keys and its contract expires. Permanent credentials remain usable until explicitly revoked and broaden compromise risk.

Although Move the credential to Secrets Manager and retrieve it through an application IAM role can be valid when An application keeps an RDS master password in an unencrypted deployment file, it targets a different technical condition. Central secrets retrieval limits plaintext distribution and allows policy-controlled rotation.

Use Secrets Manager with a controlled custom rotation Lambda and verification would address a different requirement: A Lambda integration depends on a certificate secret rotated quarterly by an operations engineer. Rotation workflows can update secrets and coordinate downstream credential changes.

This alternative, Audit Secrets Manager API calls in CloudTrail and correlate STS role sessions, is appropriate when An administrator wants proof of which principals retrieved a production secret during an incident. CloudTrail records secret-access API activities for actor attribution.

Use Secrets Manager with a controlled custom rotation Lambda and verification would address a different requirement: A Lambda integration depends on a certificate secret rotated quarterly by an operations engineer. Rotation workflows can update secrets and coordinate downstream credential changes.

This alternative, Give the ECS task a dedicated IAM task role with least-privilege access, is appropriate when A container task reads credentials from a shared EC2 node profile that also grants admin rights. Task roles isolate application AWS API credentials from the container host identity.

For the separate situation An external vendor previously had permanent IAM access keys and its contract expires, Disable and rotate exposed long-lived keys and replace access with time-bound roles if needed could be useful. Permanent credentials remain usable until explicitly revoked and broaden compromise risk.

Check KMS key policy, grants and role permissions before changing the application solves the related scenario A trusted EC2 role can call AWS APIs but fails to decrypt a KMS-encrypted file; kMS evaluates key access separately from ordinary application permissions.

Although Provision time-limited elevation with documented approval and session logging can be valid when A manager needs temporary admin access during a narrowly approved outage response, it targets a different technical condition. Just-in-time privilege limits persistent high-risk account permissions.

Split the shared policy and apply minimal purpose-specific function-role permissions would address a different requirement: A production Lambda execution role gains AdministratorAccess through a shared policy. Dedicated role policies reduce lateral privilege across unrelated functions.

Provision time-limited elevation with documented approval and session logging solves the related scenario A manager needs temporary admin access during a narrowly approved outage response; just-in-time privilege limits persistent high-risk account permissions.

Although Use IAM Access Analyzer findings to remove unintended cross-account trust can be valid when An external account unexpectedly can read a snapshot through resource permissions, it targets a different technical condition. External-access analysis identifies resource policies granting access beyond the intended boundary.

This alternative, Check KMS key policy, grants and role permissions before changing the application, is appropriate when A trusted EC2 role can call AWS APIs but fails to decrypt a KMS-encrypted file. KMS evaluates key access separately from ordinary application permissions.

Although Replace broad permissions with required S3 actions and resource or prefix constraints can be valid when Several roles use the wildcard s3:* on all buckets despite needing one prefix, it targets a different technical condition. Narrow IAM authorization limits unintended storage actions and data scope.

This alternative, Split the shared policy and apply minimal purpose-specific function-role permissions, is appropriate when A production Lambda execution role gains AdministratorAccess through a shared policy. Dedicated role policies reduce lateral privilege across unrelated functions.

For the separate situation A trusted EC2 role can call AWS APIs but fails to decrypt a KMS-encrypted file, Check KMS key policy, grants and role permissions before changing the application could be useful. KMS evaluates key access separately from ordinary application permissions.

Split the shared policy and apply minimal purpose-specific function-role permissions would address a different requirement: A production Lambda execution role gains AdministratorAccess through a shared policy. Dedicated role policies reduce lateral privilege across unrelated functions.

This alternative, Provision time-limited elevation with documented approval and session logging, is appropriate when A manager needs temporary admin access during a narrowly approved outage response. Just-in-time privilege limits persistent high-risk account permissions.

Replace broad permissions with required S3 actions and resource or prefix constraints solves the related scenario Several roles use the wildcard s3:* on all buckets despite needing one prefix; narrow IAM authorization limits unintended storage actions and data scope.

This alternative, Check KMS key policy, grants and role permissions before changing the application, is appropriate when A trusted EC2 role can call AWS APIs but fails to decrypt a KMS-encrypted file. KMS evaluates key access separately from ordinary application permissions.

Replace broad permissions with required S3 actions and resource or prefix constraints solves the related scenario Several roles use the wildcard s3:* on all buckets despite needing one prefix; narrow IAM authorization limits unintended storage actions and data scope.

Although Use IAM Access Analyzer findings to remove unintended cross-account trust can be valid when An external account unexpectedly can read a snapshot through resource permissions, it targets a different technical condition. External-access analysis identifies resource policies granting access beyond the intended boundary.