Master AWS Certifications with Confidence

S3 Standard

S3 Glacier Flexible Retrieval

S3 One Zone-Infrequent Access (S3 One Zone-IA)

S3 Standard-Infrequent Access (S3 Standard-IA)

Launch phase

Scale phase

Assess phase

Mobilize phase

Migrate and modernize phase

Create a new S3 bucket. Enable Cross-Region Replication (CRR) using server-side encryption with AWS KMS multi-Region keys (SSE-KMS). Use Amazon Athena for querying.

Create a new S3 bucket. Enable CRR with SSE-KMS. Use Amazon RDS for querying.

Use the existing S3 bucket. Enable CRR with server-side encryption using Amazon S3 managed keys (SSE-S3). Use Amazon Athena for querying.

Use the existing S3 bucket. Enable CRR with SSE-S3. Use Amazon RDS for querying.

Attach an IAM role that grants S3 permissions to the EKS pod.

Attach an IAM user with S3 access policies to the EKS pod.

Allow outbound connectivity to S3 through the private subnets\u2019 route tables.

Create a Gateway-type VPC endpoint for S3.

Store AWS access keys in environment variables within the application.

Integrate the third-party identity provider with API Gateway. Configure an API Gateway Lambda authorizer to validate OAuth 2.0 tokens from the identity provider. Enforce the Lambda authorizer on all API endpoints. Update the mobile backend to obtain tokens from the identity provider and include them in the Authorization header for API Gateway requests.

Integrate the third-party identity provider with Amazon Cognito. Configure Cognito as a JWT authorizer for API Gateway to validate tokens. Enforce the Cognito authorizer on all API endpoints. Update the mobile backend to use Cognito-hosted UI for token retrieval and include tokens in API requests.

Integrate the third-party identity provider with AWS IAM. Configure IAM roles with permissions to invoke the API Gateway REST API. Update the mobile backend to assume the IAM role using AWS Security Token Service (STS) and sign requests with SigV4 signatures.

Integrate the third-party identity provider with AWS IAM Identity Center. Configure API Gateway to use IAM Identity Center for automatic token validation. Update the mobile backend to retrieve temporary credentials from IAM Identity Center and include them in API requests.

Implement a Deny list approach in the SCPs.

Analyze AWS IAM Access Advisor data to identify active services.

Utilize AWS CloudTrail logs to determine service usage patterns.

Detach the default FullAWSAccess policy from the root.

Organize accounts into organizational units (OUs) based on function.

Create a new SCP that uses an Allow list strategy.

Modify the execution role of each Lambda function to include a policy that restricts access to the respective S3 bucket.

Update each S3 bucket's policy to allow event notifications only to the intended Lambda function.

Move the development and production environments into separate AWS accounts. Update each Lambda function's execution role to restrict access to the S3 bucket in the same account.

Move the development and production environments into separate AWS accounts. Attach a resource policy to each Lambda function allowing invocation only from S3 buckets within the same account.

Provision an Amazon Aurora database, then configure session handling at the application layer to store session data in the Aurora database.

Deploy an Amazon EFS file system across all Amazon EC2 instances, then modify the application to store session data on the shared file system.

Set up an Amazon ElastiCache (Redis) cluster, then update the application to use the in-memory cache for session data storage.

Create an Amazon DynamoDB table with provisioned throughput, then adjust the application to store session data in the DynamoDB table.