SCS-C01 AWS Certified Security - Specialty Questions and Answers

Filter the event history on the exposed access key in the CloudTrail console Examine the data from the past 11 days.

Use the IAM CLI lo generate an IAM credential report Extract all the data from the past 11 days.

Use Amazon Athena to query the CloudTrail logs from Amazon S3 Retrieve the rows for the exposed access key tor the past 11 days.

Use the Access Advisor tab in the IAM console to view all of the access key activity for the past 11 days.

Associate the EC2 instances with a security group that blocks traffic from blacklisted IP addresses.

Use an ELB Application Load Balancer and Auto Scaling group to scale to absorb application layer traffic.

Use Amazon Inspector on the EC2 instances to examine incoming traffic and discard malicious traffic.

Use CloudFront and IAM WAF to prevent malicious traffic from reaching the application

Enable GuardDuty to block malicious traffic from reaching the application

It will allow all access to the bucket mybucket

It will allow the user mark from IAM account number 111111111 all access to the bucket but deny everyone else all access to the bucket

It will deny all access to the bucket mybucket

None of these

IAM Cognito

IAM SAML

IAM IAM

IAM Config

Use a VPC endpoint to the DynamoDB table

Use a VPN connection from the VPC

Use a VPC gateway from the VPC

Use a VPC Peering connection to the DynamoDB table

Enable versioning on the S3 bucket

Enable data at rest for the objects in the bucket

Enable MFA Delete in the bucket policy

Enable data in transit for the objects in the bucket

Use the containers to automate security deployments.

Limit resource consumption (CPU, memory), networking connections, ports, and unnecessary container libraries.

Segregate containers by host, function, and data classification.

Use Docker Notary framework to sign task definitions.

Enable container breakout at the host kernel.

In the statement block that contains the Sid "Allow use of the key", under the "Condition" block, change StringEquals to StringLike.

In the policy document, remove the statement Dlock that contains the Sid "Enable IAM User Permissions". Add key management policies to the KMS policy.

In the statement block that contains the Sid "Allow use of the Key", under the "Condition" block, change the Kms:ViaService value to ec2.us-east-1 .amazonIAM com.

In the policy document, add a new statement block that grants the kms:Disable' permission to the security engineer's IAM role.

IAM policies

Buckets ACL's

IAM users

Bucket policies

Move the SCP to the root OU of organization to remove the restriction to access Amazon $3.

Add an IAM policy for the developer, which grants $3 access.

Create a new OU without applying the SCP restricting $3 access. Move the developer account to this new OU.

Add an allow list for the developer account for the $3 service.

Create an Amazon CloudFront distribution and configure the ALB as the origin

Block the malicious IPs with a network access list (NACL).

Create an IAM Web Application Firewall (WAF). and attach it to the ALB

Map the application domain name to use Route 53

Create a new Customer Key using KMS and attach it to the existing volume

You cannot decrypt the data that was encrypted under the CMK, and the data is not recoverable.

Request IAM Support to recover the key

Use IAM Config to recover the key

Allow Inbound on port 3306 for Source Web Server Security Group WebSecGrp.

Allow Inbound on port 3306 from source 20.0.0.0/16

Allow Outbound on port 3306 for Destination Web Server Security Group WebSecGrp.

Allow Outbound on port 80 for Destination NAT Instance IP

From the IAM Management Console, navigate to the Security Credentials page and retrieve the access and secret key for your account.

Create an IAM user within the enterprise account assign a user policy to the IAM user that allows only the actions required by the SaaS application. Create a new access and secret key for the user and provide these credentials to the SaaS provider.

Create an IAM role for cross-account access allows the SaaS provider's account to assume the role and assign it a policy that allows only the actions required by the SaaS application.

Create an IAM role for EC2 instances, assign it a policy that allows only the actions required tor the Saas application to work, provide the role ARN to the SaaS provider to use when launching their application instances.

Generate pre-signed URLs for each user as they request access to protected S3 content

Create an IAM user for each subscribed user and assign the GetObject permission to each IAM user

Create an S3 bucket policy that limits access to your private content to only your subscribed users'credentials

Crpafp a Cloud Front Clriein Identity user for vnur suhsrrihprl users and assign the GptOhiprt oprmissinn to this user

The CMK that is used in the attempt does not exist.

The CMK that is used in the attempt needs to be rotated.

The CMK that is used in the attempt is using the CMK's key ID instead of the CMK ARN.

The CMK that is used in the attempt is not enabled.

The CMK that is used in the attempt is using an alias.

Create a new role and add each user to the IAM role

Use the IAM groups and add users, based upon their role, to different groups and apply the policy to group

Create a policy and apply it to multiple users using a JSON script

Create an S3 bucket policy with unlimited access which includes each user's IAM account ID

Create a role that has the required permissions for the auditor.

Create an SNS notification that sends the CloudTrail log files to the auditor's email when CIoudTrail delivers the logs to S3, but do not allow the auditor access to the IAM environment.

The company should contact IAM as part of the shared responsibility model, and IAM will grant required access to th^ third-party auditor.

Enable CloudTrail logging and create an IAM user who has read-only permissions to the required IAM resources, including the bucket containing the CloudTrail logs.

There is no API operation to retrieve an S3 object in its encrypted form.

Encryption of S3 objects is performed within the secure boundary of the KMS service.

S3 uses KMS to generate a unique data key for each individual object.

Using a single master key to encrypt all data includes having a single place to perform audits and usage validation.

The KMS encryption envelope digitally signs the master key during encryption to prevent cryptographic wear-out

IAM KMS

IAM Customer Keys

IAM managed keys

IAM Cloud HSM

Add users to groups that represent the teams. Create a policy for each team that allows the team to access its respective S3 buckets only. Attach the policy to the corresponding group.

Create an IAM role for each team. Create a policy for each team that allows the team to access its respective S3 buckets only. Attach the policy to the corresponding role.

Create IAM roles that are labeled with an access tag value of a team. Create one policy that allows dynamic access to S3 buckets with the same tag. Attach the policy to the IAM roles. Tag the S3 buckets accordingly.

Implement a role-based access control (RBAC) authorization model. Create the corresponding policies, and attach them to the IAM users.

Create a new Amazon S3 bucket Use EBS lifecycle policies to move EBS snapshots to the new S3 bucket. Move snapshots to Amazon S3 Glacier using lifecycle policies, and apply Glacier Vault Lock policies to prevent deletion

Use IAM Systems Manager to distribute a configuration that performs local backups of all attached disks to Amazon S3.

Create a new IAM account with limited privileges. Allow the new account to access the IAM KMS key used to encrypt the EBS snapshots, and copy the encrypted snapshots to the new account on a recuning basis

Use IAM Backup to copy EBS snapshots to Amazon S3.

Option A

Option B

Option C

Option D

Use Bucket policies

Use the Secure Token service

Use IAM user policies

Use IAM Access Keys

Configure a web ACL rule for IAM WAF to block requests with a string match condition for the user agent of the loT device. Associate the v/eb ACL with the ALB.

Configure an Amazon CloudFront distribution to use the ALB as an origin. Configure a web ACL rule for IAM WAF to block requests with a string match condition for the user agent of the loT device. Associate the web ACL with the ALB Change the public DNS entry of the website to point to the CloudFront distribution.

Configure an Amazon CloudFront distribution to use a new ALB as an origin. Configure a web ACL rule for IAM WAF to block requests with a string match condition for the user agent of the loT device. Change the ALB security group to alow access from CloudFront IP address ranges only Change the public DNS entry of the website to point to the CloudFront distribution.

Activate IAM Shield Advanced to enable DDoS protection. Apply an IAM WAF ACL to the ALB. and configure a listener rule on the ALB to block loT devices based on the user agent.

Add an inbound rule to the security group associated with the logging server that allows requests from the web server

Add an outbound rule to the security group associated with the web server that allows requests to the logging server.

Add a route to the route table associated with the subnet that hosts the logging server that targets the peering connection

Add a route to the route table associated with the subnet that hosts the web server that targets the peering connection

Establish an IAM Direct Connect connection with IAM and set up a Direct Connect gateway. In the Direct Connect gateway configuration, enable IPsec and BGP, and then leverage native IAM network encryption between Availability Zones and Regions,

Establish an IAM Direct Connect connection with IAM and set up a Direct Connect gateway. Using the Direct Connect gateway, create a private virtual interface and advertise the customer gateway private IP addresses. Create a VPN connection using the customer gateway and the virtual private gateway

Establish a VPN connection with the IAM virtual private cloud over the internet

Establish an IAM Direct Connect connection with IAM and establish a public virtual interface. For prefixes that need to be advertised, enter the customer gateway public IP addresses. Create a VPN connection over Direct Connect using the customer gateway and the virtual private gateway.

Set up an Amazon CloudWatch Event rule to forward ail GuardDuty findings to the security account Use an IAM Lambda function as a target to raise findings

Set up an Amazon CloudWatch Events rule to forward all GuardDuty findings to the security account Use an IAM Lambda function as a target to raise findings in IAM Security Hub

Check that GuardDuty in the security account is able to assume a role in the compromised account using the GuardDuty fast findings permission Schedule an Amazon CloudWatch Events rule and an IAM Lambda function to periodically check for GuardDuty findings

Use the IAM GuardDuty get-members IAM CLI command m the security account to see if the account is listed Send an invitation from GuardDuty m the security account to GuardDuty in the compromised account Accept the invitation to forward all future GuardDuty findings

Obtain the list of instances by directly querying Amazon EC2 using: IAM ec2 describe-instances --fi1ters "Name=key-name,Values=KEYNAMEHERE".

Obtain the fingerprint for the key pair from the IAM Management Console, then search for the fingerprint in the Amazon Inspector logs.

Obtain the output from the EC2 instance metadata using: curl http: //169.254.169.254/latest/meta-data/public- keys/0/.

Obtain the fingerprint for the key pair from the IAM Management Console, then search for the fingerprint in Amazon CloudWatch Logs using: IAM logs filter-log-events.

Change the value of IAM MultiFactorAuthPresent to true.

Instruct users to run the IAM sts get-session-token CLI command and pass the multi-factor authentication —serial-number and —token-code parameters. Use these resulting values to make API/CLI calls

Implement federated API/CLI access using SAML 2.0, then configure the identity provider to enforce multi-factor authentication.

Create a role and enforce multi-factor authentication in the role trust policy Instruct users to run the sts assume-role CLI command and pass --serial-number and —token-code parameters Store the resulting values in environment variables. Add sts:AssumeRole to NotAction in the policy.

The S3 ACL for the S3 bucket fails to explicitly grant access to the Application Developer

The IAM KMS key for the S3 bucket fails to list the Application Developer as an administrator

The S3 bucket policy fails to explicitly grant access to the Application Developer

The S3 bucket policy explicitly denies access to the Application Developer

Store the credentials securely in a file in an Amazon S3 bucket with restricted access to the application team IAM role Ask the application team to read the credentials from the S3 object instead

Create an IAM Secrets Manager secret and specify the key/value pairs to be stored in this secret

Modify the application to pull credentials from the IAM Secrets Manager secret instead of the environment variables.

Add the following statement to the container instance IAM role policy

Add the following statement to the execution role policy.

Log in to the IAM Fargate instance, create a script to read the secret value from IAM Secret Manager, and inject the environment variables. Ask the application team to redeploy the application.

Set up an Amazon CloudWatch Events rule that triggers an Amazon SNS notification.

Set up an Amazon CloudWatch Events rule that triggers an Amazon SNS notification logs from S3 and generate notifications using Amazon SNS.

Set up a rule in IAM config to trigger root user events. Trigger an IAM Lambda function and generate notifications using Amazon SNS.

Use Amazon Inspector to monitor the usage of the root user and generate notifications using Amazon SNS

Check that the role the Security Engineer uses grants permission to decrypt objects using the KMS CMK.

Check that the role the Security Engineer uses grants permission to decrypt objects using the KMS CMK and gives access to the S3 bucket and objects

Check that the role the EC2 instance profile uses grants permission lo decrypt objects using the KMS CMK and gives access to the S3 bucket and objects

Check that the role the EC2 instance profile uses grants permission to decrypt objects using the KMS CMK

Use client-side encryption with an IAM KMS customer-managed key implemented with the IAM Encryption SDK

Use IAM CloudHSM to store the keys and perform cryptographic operations Save the encrypted text in Amazon S3

Use an IAM KMS customer-managed key that is backed by a custom key store using IAM CloudHSM

Use an IAM KMS customer-managed key with the bring your own key (BYOK) feature to import a key stored in IAM CloudHSM

Configuring IAM Organizations to monitor root user API calls on the paying account

Creating an Amazon CloudWatch Events rule that will trigger when any API call from the root user is reported

Configuring Amazon Inspector to scan the IAM account for any root user activity

Configuring IAM Trusted Advisor to send an email to the Security team when the root user logs in to the console

Using Amazon SNS to notify the target group

IAM CloudFormation

Amazon GuardDuty

Amazon Inspector

Amazon Macie

IAM Step Functions

Put all the proxy EC2 instances in a cluster placement group.

Disable source and destination checks on the proxy EC2 instances.

Open all inbound ports on the proxy EC2 instance security group.

Change the VPC's DHCP domain-name-servers options set to the IP addresses of proxy EC2 instances.

Use IAM X-Ray to inspect the traffic going 10 the EC2 instances

Move the state content to Amazon S3 and font this with an Amazon CloudFront distribution

Change the security group configuration to block the source of the attack traffic

Use IAM WAF security rules to inspect the inbound traffic

Use Amazon inspector assessment templates to inspect the inbound traffic

Use Amazon Route 53 to distribute traffic

Move the SCP to the root OU of Organizations to remove the restriction to access Amazon S3.

Add an IAM policy for the Developer, which grants S3 access.

Create a new OU without applying the SCP restricting S3 access. Move the Developer account to this new OU.

Add an allow list for the Developer account for the S3 service.

Update the password length policy In the on-premises Active Directory configuration.

Update the password length policy In the IAM configuration.

Enforce an IAM policy In Amazon Cognito and IAM IAM with a minimum password length condition.

Update the password length policy in the Amazon Cognito configuration.

Create an SCP with IAM Organizations that enforces a minimum password length for IAM IAM and Amazon Cognito.

Create an Amazon S3 lifecycle policy that archives IAM CloudTrail trail logs to Amazon S3 Glacier after 90 days. Configure Amazon Inspector to provide a notification when a policy change is made to resources.

Configure IAM Artifact to archive IAM CloudTrail logs Configure IAM Trusted Advisor to provide a notification when a policy change is made to resources.

Configure Amazon CloudWatch to export log groups to Amazon S3. Configure IAM CloudTrail to provide a notification when a policy change is made to resources.

Create an IAM CloudTrail trail that stores audit logs in Amazon S3. Configure an IAM Config rule to provide a notification when a policy change is made to resources.

Place each file into a different S3 bucket. Set the default encryption of each bucket to use a different IAM KMS customer managed key.

Put all the files in the same S3 bucket. Using S3 events as a trigger, write an IAM Lambda function to encrypt each file as it is added using different IAM KMS data keys.

Use the S3 encryption client to encrypt each file individually using S3-generated data keys

Place all the files in the same S3 bucket. Use server-side encryption with IAM KMS-managed keys (SSE-KMS) to encrypt the data

IAM managed Customer Master Key (CMK)

Customer managed CMK with IAM generated key material

Customer managed CMK with imported key material

IAM managed data key

Extract the subject (sub), audience (aud), and cognito:username from the ID token payload Manually check the subject and audience for the user name In the user pool

Search for the public key with a key ID that matches the key ID In the header of the token. Then use a JSON Web Token (JWT) library to validate the signature of the token and extract values, such as the expiry date

Verify that the token is not expired. Then use the token_use claim function In Amazon Cognito to validate the key IDs

Copy the JSON Web Token (JWT) as a JSON document Obtain the public JSON Web Key (JWK) and convert It to a pem file. Then use the file to validate the original JWT.

Associate the instances to the same security groups.

Add 0.0.0.0/0 to the egress rules of the instance security groups.

Add the instance IDs to the ingress rules of the instance security groups.

Add the public IP addresses to the ingress rules of the instance security groups.

Create an IAM Config rule defining the patch as a required configuration for EC2 instances.

Use the IAM Systems Manager Run Command to patch affected instances.

Use an IAM Systems Manager Patch Manager predefined baseline to patch affected instances.

Use IAM Systems Manager Session Manager to log in to each affected instance and apply the patch.

Configure the S3 bucket ACLs to allow IAM Config to record changes to the buckets.

Configure policies attached to S3 buckets to allow IAM Config to record changes to the buckets.

Attach the AmazonS3ReadOnryAccess managed policy to the IAM user.

Verify the security engineer's IAM user has an attached policy that allows all IAM Config actions.

Assign the IAMConfigRole managed policy to the IAM Config role

Log in to each account four times a day and filter the IAM CloudTrail log data, then copy and paste the logs in to the Amazon S3 bucket in the destination account.

Set up Amazon CloudWatch to stream data to an Amazon S3 bucket in each source account. Set up bucket replication for each source account into a centralized bucket owned by the Security Engineer.

Set up an IAM Config aggregator to collect IAM configuration data from multiple sources.

Set up Amazon CloudWatch cross-account log data sharing with subscriptions in each account. Send the logs to Amazon Kinesis Data Firehose in the Security Engineer's account.

The execution role for the Lambda function did not grant permissions to write log data to CloudWatch Logs.

The Lambda function was executed by using Amazon API Gateway, so the logs are not stored in CloudWatch Logs.

The execution role for the Lambda function did not grant permissions to write to the Amazon S3 bucket where CloudWatch Logs stores the logs.

The version of the Lambda function that was executed was not current.

Remove the sensitive data from the object name, and store the sensitive data using S3 user-defined metadata.

Add an S3 bucket policy that denies the action s3:GetObject

Use a random and unique S3 object key, and create an S3 metadata index in Amazon DynamoDB using client-side encrypted attributes.

Store all sensitive objects in Binary Large Objects (BLOBS) in an encrypted Amazon RDS instance.

The policy allows access for the IAM account 111122223333 to manage key access though IAM policies.

The policy allows all IAM users in account 111122223333 to have full access to the KMS key.

The policy allows the root user in account 111122223333 to have full access to the KMS key.

The policy allows the KMS service-linked role in account 111122223333 to have full access to the KMS key.

The policy allows all IAM roles in account 111122223333 to have full access to the KMS key.

Enable CORS for the bucket

Enable versioning for the bucket

Enable MFA for the bucket

Enable CRR for the bucket

Create a rule in IAM WAF rules with conditions that block requests based on the presence of ExampleGame/1.22 in the User-Agent header

Create a geographic restriction on the CloudFront distribution to prevent access to the application from most geographic regions

Create a rate-based rule in IAM WAF to limit the total number of requests that the web application services.

Create an IP-based blacklist in IAM WAF to block the IP addresses that are originating from requests that contain ExampleGame/1.22 in the User-Agent header.

IAM User name and password

Key pairs

IAM Access keys

IAM SDK keys

Enable MFA for these user accounts

Enable versioning for these user accounts

Enable accidental deletion for these user accounts

Disable root access for the users

Create a new S3 bucket in a separate IAM account for centralized storage of CloudTrail logs, and enable “Log File Validation” on all trails.

Use an existing S3 bucket in one of the accounts, apply a bucket policy to the new centralized S3 bucket that permits the CloudTrail service to use the "s3: PutObject" action and the "s3 GetBucketACL" action, and specify the appropriate resource ARNs for the CloudTrail trails.

Apply a bucket policy to the new centralized S3 bucket that permits the CloudTrail service to use the "s3 PutObject" action and the "s3 GelBucketACL" action, and specify the appropriate resource ARNs for the CloudTrail trails.

Use unique log file prefixes for trails in each IAM account.

Configure CloudTrail in the centralized account to log all accounts to the new centralized S3 bucket.

Enable encryption of the log files by using IAM Key Management Service

Change the key policy permissions associated with the KMS CMK for each application when it must access the data in Amazon S3.

Have each application assume an IAM role that provides permissions to use the IAM Certificate Manager CMK.

Have each application use a grant on the KMS CMK to add or remove specific access controls on the KMS CMK.

Have each application use an IAM policy in a user context to have specific access permissions on the KMS CMK.

Move all the files to an Amazon S3 bucket. Have the web server serve the files from the S3 bucket.

Launch a second Amazon EC2 instance in a new subnet. Launch an Application Load Balancer in front of both instances.

Launch an Application Load Balancer in front of the EC2 instance. Create an Amazon CloudFront distribution in front of the Application Load Balancer.

Move all the files to an Amazon S3 bucket. Create a CloudFront distribution in front of the bucket and terminate the web server.

Create a custom authorization service using IAM Lambda.

Configure a SAML identity provider in Amazon Cognito to map attributes to the Amazon Cognito user pool attributes.

Configure the SAML identity provider to add the Amazon Cognito user pool as a relying party.

Configure an Amazon Cognito identity pool to integrate with social login providers.

Update DynamoDB to store the user email addresses and passwords.

Update API Gateway to use a COGNITO_USER_POOLS authorizer.

Call the abort-vault-lock operation, fix the typo, and call the initiate-vault-lock again.

Copy the vault data to Amazon S3, delete the vault, and create a new vault with the data.

Update the policy, keeping the vault lock in place.

Update the policy and call initiate-vault-lock again to apply the new policy.

Turn on Cloud trail and carry out the penetration test

Turn on VPC Flow Logs and carry out the penetration test

Submit a request to IAM Support

Use a custom IAM Marketplace solution for conducting the penetration test

Change the volume encryption on the EBS volume to use a different encryption mechanism. Then, release the EBS volumes back to IAM.

Release the volumes back to IAM. IAM immediately wipes the disk after it is deprovisioned.

Delete the encryption key used to encrypt the EBS volume. Then, release the EBS volumes back to IAM.

Delete the data by using the operating system delete commands. Run Quick Format on the drive and then release the EBS volumes back to IAM.

Enable automatic key rotation annually for the CMK.

Use IAM Command Line Interface to create an IAM Lambda function to rotate the existing CMK annually.

Import new key material to the existing CMK and manually rotate the CMK.

Create a new CMK, import new key material to it, and point the key alias to the new CMK.

Offload SSL termination onto an SSL listener on a Classic Load Balancer, and use a TCP connection between the load balancer and the EC2 instances.

Route all traffic through a TCP listener on a Classic Load Balancer, and terminate the TLS connection on the EC2 instances.

Create an HTTPS listener using an Application Load Balancer, and route all of the communication through that load balancer.

Offload SSL termination onto an SSL listener using an Application Load Balancer, and re-spawn and SSL connection between the load balancer and the EC2 instances.

Create a new IAM user that has administrator permissions in the IAM account. Delete the password for the IAM account root user.

Create a new IAM user that has administrator permissions in the IAM account. Modify the permissions for the existing IAM users.

Replace the access key for the IAM account root user. Delete the password for the IAM account root user.

Create a new IAM user that has administrator permissions in the IAM account. Enable multi-factor authentication for the IAM account root user.

Copy the application’s IAM KMS CMK from the source region to the target region so that it can be used to decrypt the resource after it is copied to the target region.

Configure IAM KMS to automatically synchronize the CMK between regions so that it can be used to decrypt the resource in the target region.

Use IAM services that replicate data across regions, and re-wrap the data encryption key created in the source region by using the CMK in the target region so that the target region’s CMK can decrypt the database encryption key.

Configure the target region’s IAM service to communicate with the source region’s IAM KMS so that it can decrypt the resource in the target region.

Create an Amazon CloudWatch metric filter that looks for API call error codes and then implement an alarm based on that metric’s rate.

Configure IAM CloudTrail to stream event data to Amazon Kinesis. Configure an IAM Lambda function on the stream to alarm when the threshold has been exceeded.

Run an Amazon Athena SQL query against CloudTrail log files. Use Amazon QuickSight to create an operational dashboard.

Use the Amazon Personal Health Dashboard to monitor the account’s use of IAM services, and raise an alert if service error rates increase.

Confirm that the EC2 instance's security group authorizes S3 access.

Verify that the KMS key policy allows decrypt access for the KMS key for this IAM principle.

Check the S3 bucket policy for statements that deny access to objects.

Confirm that the EC2 instance is using the correct key pair.

Confirm that the IAM role associated with the EC2 instance has the proper privileges.

Confirm that the instance and the S3 bucket are in the same Region.

Remove the instance from the load balancer and terminate it.

Remove the instance from the load balancer, and shut down access to the instance by tightening the security group.

Reboot the instance and check for any Amazon CloudWatch alarms.

Stop the instance and make a snapshot of the root EBS volume.

Create a powershell script using the IAM CLI. Query for all resources with the tag of production.

Create a bash shell script with the IAM CLI. Query for all resources in all regions. Store the results in an S3 bucket.

Use Cloud Trail to get the list of all resources

Use IAM Config to get the list of all resources

Configure IAM WAF rules to implement the required rules.

Use the operating system built-in, host-based firewall to implement the required rules.

Use a NAT gateway to control ingress and egress according to the requirements.

Launch an EC2-based firewall product from the IAM Marketplace, and implement the required rules in that product.

Use IAM Certificate Manager to generate certificates from a public certificate authority and deploy them to all the containers.

Create a self-signed certificate in one container and use IAM Secrets Manager to distribute the certificate to the other containers to establish trust.

Use IAM Certificate Manager Private Certificate Authority (ACM PCA) to create a subordinate certificate authority, then create the private keys in the containers and sign them using the ACM PCA API.

Use IAM Certificate Manager Private Certificate Authority (ACM PCA) to create a subordinate certificate authority, then use IAM Certificate Manager to generate the private certificates and deploy them to all the containers.

Pass databases credentials to EC2 by using CloudFormation stack parameters with the property set to true. Ensure that the instance is configured to log to Amazon CloudWatch Logs.

Store database passwords in IAM Systems Manager Parameter Store by using SecureString parameters. Set the IAM role for the EC2 instance profile to allow access to the parameters.

Create an IAM Lambda that ingests the database password and persists it to Amazon S3 with server-side encryption. Have the EC2 instances retrieve the S3 object on startup, and log all script invocations to syslog.

Write a script that is passed in as UserData so that it is executed upon launch of the EC2 instance. Ensure that the instance is configured to log to Amazon CloudWatch Logs.

Create an S3 bucket in a dedicated log account and grant the other accounts write only access. Deliver all log files from every account to this S3 bucket.

Write a Lambda function that queries the Trusted Advisor Cloud Trail checks. Run the function every 10 minutes.

Enable CloudTrail log file integrity validation

Use Systems Manager Configuration Compliance to continually monitor the access policies of S3 buckets containing Cloud Trail logs.

Create a Security Group that blocks all traffic except calls from the CloudTrail service. Associate the security group with) all the Cloud Trail destination S3 buckets.

Ensure that file permissions for monitored files that allow the CloudWatch Logs agent to read the file have not been modified.

Verify that the OS Log rotation rules are compatible with the configuration requirements for agent streaming.

Configure an Amazon Kinesis producer to first put the logs into Amazon Kinesis Streams.

Create a CloudWatch Logs metric to isolate a value that changes at least once during the period before logging stops.

Use IAM CloudFormation to dynamically create and maintain the configuration file for the CloudWatch Logs agent.