Platform engineering, system design and infrastructure shape.
10 items · all topics
A compliance review finds that an existing Amazon EBS volume attached to a production EC2 instance is unencrypted. The data on the volume must be encrypted at rest with an AWS KMS key. Which sequence of steps achieves this?
You cannot turn encryption on for an existing EBS volume in place. The supported path is to snapshot it, copy the snapshot with encryption enabled, create a new volume from the encrypted copy, and swap it onto the instance.
A company uses AWS Organizations with all features enabled. For compliance reasons, workloads may only run in two approved AWS Regions. Account administrators in member accounts currently hold the AdministratorAccess policy. The company must prevent resources from being created in any other Region. What should a solutions architect do?
A service control policy is the only control that an account administrator cannot remove, because it caps what identities in a member account may do no matter what their IAM policies say. IAM policies and permissions boundaries can both be edited by the very administrators you are trying to constrain.
A public web application runs on Amazon EC2 instances behind an Application Load Balancer and is fronted by Amazon CloudFront. The application has been targeted by SQL injection attempts and by volumetric network floods. A solutions architect must reduce exposure to both. Which TWO actions should the architect take?
These are two different attacks and they need two different controls. AWS WAF inspects HTTP requests and stops injection attempts, while AWS Shield Advanced adds managed protection and cost protection against large network floods. Security groups and network ACLs operate below the layer where SQL injection is visible.
An ecommerce application sends order events to a processing service. During sales events the processing service is overwhelmed and drops orders. Orders for a given customer must be processed in the sequence they were submitted, and no order may be processed twice. Which solution meets these requirements?
Two requirements in the stem, ordering and no duplicates, point at exactly one service. An SQS FIFO queue guarantees first-in-first-out delivery within a message group and provides exactly-once processing through deduplication. A standard queue gives neither.
A colleague asks what a Terraform provider actually is, given that Terraform can manage AWS, GitHub and PagerDuty without knowing anything about them. What is the accurate answer?
A provider is a plugin that Terraform downloads and runs. It defines the resource and data source types for one platform and makes the API calls that create, read, update and destroy them.
A company runs a business-critical application in one AWS Region. The disaster recovery plan requires a recovery time objective of 10 minutes and a recovery point objective of 1 minute in a second Region. The company wants to avoid paying for a full duplicate of the production fleet. Which disaster recovery strategy should a solutions architect choose?
RTO and RPO in minutes rule out backup and restore and pilot light, because both require standing infrastructure up before traffic can move. Warm standby keeps a scaled-down copy always running, which is what buys minutes instead of hours without paying for a second full fleet.
A media company stores original video files in an Amazon S3 bucket in us-east-1. Regulators require that a copy of every new file exists in a second AWS Region within 15 minutes of upload, and that no file can be permanently deleted by mistake. Which TWO actions should a solutions architect take?
Cross-Region Replication copies new objects to a bucket in another Region automatically, and versioning is its prerequisite as well as the control that makes deletion recoverable. The pair answers both halves of the requirement with one dependency between them.
A content management application runs on Amazon EC2 Linux instances spread across three Availability Zones. All instances must read and write the same set of files using standard file system semantics, and the storage must grow automatically as content is added. Which storage solution should a solutions architect recommend?
Multiple Linux instances, multiple Availability Zones, shared file system semantics and automatic growth describe Amazon EFS exactly. EBS attaches to a single Availability Zone, and S3 is object storage without file system semantics.
A company is migrating a Windows application to AWS. The application requires shared storage accessed over the SMB protocol, with Windows NTFS permissions and integration with the company's Active Directory. Which AWS service meets these requirements?
SMB, NTFS permissions and Active Directory together name exactly one AWS service. Amazon FSx for Windows File Server is the managed Windows file system, and the other FSx variants and EFS all serve different protocols.
A multiplayer game server runs on Amazon EC2 instances behind Network Load Balancers in three AWS Regions. Players connect over UDP. The company needs to route each player to the lowest-latency healthy Region, to fail over within seconds if a Region becomes unhealthy, and to publish a fixed set of IP addresses that players' firewalls can allow. Which solution meets these requirements?
UDP, static IP addresses and fast regional failover all point at AWS Global Accelerator rather than CloudFront. Global Accelerator gives you anycast static IPs, carries traffic over the AWS backbone, and reroutes without waiting for DNS to expire anywhere.