AWS DevOps Engineer - Professional

AWS Config’s ENCRYPTED_VOLUMES managed rule reports attached EBS volumes as NON_COMPLIANT when they are unencrypted. An organization AWS Config rule centrally deploys the rule across member accounts, including accounts that subsequently join the organization. An SCP that denies actions to stop or delete AWS Config helps ensure the ongoing compliance evaluation cannot be disabled by member accounts.

Amazon DynamoDB global tables automatically replicate table data across AWS Regions, providing the near-real-time multi-Region session-data replication required. Amazon Route 53 weighted routing sends traffic in specified proportions, so records weighted at 99% and 1% continuously exercise the secondary Region. When health checks mark the primary endpoint unhealthy, Route 53 stops returning that endpoint and routes traffic to the healthy secondary deployment. Elastic Beanstalk can host the application in each Region and scale the secondary environment as needed. DynamoDB global tables and Route 53 weighted routing support these capabilities.

Cross-account S3 Cross-Region Replication uses an IAM replication role in the source account, a replication rule configured on the source bucket, and a destination-bucket policy that grants the source-account replication role permission to replicate objects into that bucket. S3 replication rules specify the destination from the source bucket; the destination does not need its own replication rule or replication role.

Amazon S3 must have permission to publish event messages to an Amazon SNS topic. This permission is granted through an IAM resource policy on the destination SNS topic that allows the S3 service principal to perform sns:Publish, typically constrained to the source bucket and account. Lambda and SNS can both receive ObjectCreated:Put notifications, and separate non-overlapping suffix filters can coexist.

Aurora MySQL cross-Region read replicas can be promoted to standalone DB clusters through the Amazon RDS promotion API. An EventBridge-triggered Lambda function can detect the failure and invoke that promotion, while updating the active endpoint in Systems Manager Parameter Store. Reloading that parameter after a database connection failure directs the application to the newly promoted cluster, satisfying both promotion and traffic redirection requirements. AWS documentation: Promoting a read replica to a DB cluster for Aurora MySQL