AWS Certified DevOps Engineer Professional Practice DOP-C02

7

Codedeploy Application:

CodeDeploy deployment group:

To use AWS Firewall Manager

Your account must be a member of AWS Organizations.
– Your AWS account must be a member of an organization in the AWS Organizations service, and the organization must have all features enabled.

Your account must be the AWS Firewall Manager administrator.
– To configure Firewall Manager policies, your account must be set as the AWS Firewall Manager administrator account, in the Settings pane.

You must have AWS Config enabled for your accounts and Regions.
– You must enable AWS Config for each of your AWS Organizations member accounts and for each AWS Region that contains resources that you want to protect using AWS Firewall Manager.

To manage AWS Network Firewall or Route 53 resolver DNS Firewall, the AWS Organizations management account must enable AWS Resource Access Manager (AWS RAM).
– The AWS Organizations management account must enable AWS RAM for all member accounts in your organization.

8

Connect to an external identity provider

If you’re using a self-managed directory in Active Directory or an AWS Managed Microsoft AD, see Connect to a Microsoft AD directory.
For other external identity providers (IdPs), you can use AWS IAM Identity Center (successor to AWS Single Sign-On) to authenticate identities from the IdPs through the Security Assertion Markup Language (SAML) 2.0 standard.
This enables your users to sign in to the AWS access portal with their corporate credentials. They can then navigate to their assigned accounts, roles, and applications hosted in external IdPs.

Provisioning when users come from an external IdP:
When using an external IdP, you must provision all users and groups into IAM Identity Center before you can make any assignments to AWS accounts or applications.
In this case, you can: You can configure Automatic provisioning, or you can configure Manual provisioning of your users and groups.

SCIM profile and SAML 2.0 implementation:
– SCIM profile and SAML 2.0 implementation
IAM Identity Center supports identity federation with SAML (Security Assertion Markup Language) 2.0. This allows IAM Identity Center to authenticate identities from external identity providers (IdPs).
SAML 2.0 passes information about a user between a SAML authority (called an identity provider or IdP), and a SAML consumer (called a service provider or SP). The IAM Identity Center service uses this information to provide federated single sign-on.
Single sign-on allows users to access AWS accounts and configured applications based on their existing identity provider credential.

– SCIM profile
IAM Identity Center provides support for the System for Cross-domain Identity Management (SCIM) v2.0 standard. SCIM keeps your IAM Identity Center identities in sync with identities from your IdP.
This includes any provisioning, updates, and deprovisioning of users between your IdP and IAM Identity Center.

Automatic provisioning:

IAM Identity Center supports automatic provisioning (synchronization) of user and group information from your identity provider (IdP) into IAM Identity Center using the System for Cross-domain Identity Management (SCIM) v2.0 protocol.
When you configure SCIM synchronization, you create a mapping of your identity provider (IdP) user attributes to the named attributes in IAM Identity Center.
This causes the expected attributes to match between IAM Identity Center and your IdP.
You configure this connection in your IdP using your SCIM endpoint for IAM Identity Center and a bearer token that you create in IAM Identity Center.

Permission sets:

IAM Identity Center assigns access to a user or group in one or more AWS accounts with permission sets. When you assign a permission set, IAM Identity Center creates corresponding IAM Identity Center-controlled IAM roles in each account, and attaches the policies specified in the permission set to those roles. IAM Identity Center manages the role, and allows the authorized users you’ve defined to assume the role, by using the IAM Identity Center User Portal or AWS CLI. As you modify the permission set, IAM Identity Center ensures that the corresponding IAM policies and roles are updated accordingly.

Working With AWS IAM Identity Center and AWS Control Tower:
https://docs.aws.amazon.com/controltower/latest/userguide/sso.html

Permission sets

https://docs.aws.amazon.com/singlesignon/latest/userguide/permissionsetsconcept.html

11

AFT (Account Factory for Terraform) offers feature options based on best practices. You can opt-in to these features, by means of feature flags, during AFT deployment.

AWS CloudTrail data events:
When enabled, the AWS CloudTrail data events option configures these capabilities.
– Creates an Organization Trail in the AWS Control Tower management account, for CloudTrail
– Turns on logging for Amazon S3 and Lambda data events
– Encrypts and exports all the CloudTrail data events to an aws-aft-logs-* S3 bucket in the AWS Control Tower Log Archive account, with AWS KMS encryption
– Turns on the Log file validation setting
To enable this option, set ‘aft_feature_cloudtrail_data_events flag to True in your AFT deployment input configuration.

AWS Enterprise Support plan:
When this option is enabled, the AFT pipeline turns on the AWS Enterprise Support plan for accounts provisioned by AFT.
AWS accounts by default come with the AWS Basic Support plan enabled. AFT provides automated enrollment into the enterprise support level, for accounts that AFT provisions. The provisioning process opens a support ticket for the account, requesting it to be added to the AWS Enterprise Support plan.
To enable the Enterprise Support option, set ‘aft_feature_enterprise_support=false’ flag to True in your AFT deployment input configuration.

Delete the AWS default VPC:
When you enable this option, AFT deletes all AWS default VPCs in the management account and in all AWS Regions, even if haven’t deployed AWS Control Tower resources in those AWS Regions.
AFT doesn’t delete AWS default VPCs automatically for any AWS Control Tower accounts that AFT provisions or for existing AWS accounts that you enroll in AWS Control Tower through AFT.
New AWS accounts are created with a VPC set up in each AWS Region, by default. Your enterprise may have standard practices for creating VPCs, which require you to delete the AWS default VPC and avoid enabling it, especially for the AFT management account.
To enable this option, set ‘aft_feature_delete_default_vpcs_enabled’ flag to True in your AFT deployment input configuration.

https://docs.aws.amazon.com/controltower/latest/userguide/aft-feature-options.html

19

The request type is sent in the RequestType field in the vendor request object sent by AWS CloudFormation when the template developer creates, updates, or deletes a stack that contains a custom resource.

Each request type has a particular set of fields that are sent with the request, including an Amazon S3 URL for the response by the custom resource provider. The provider must respond to the S3 bucket with either a SUCCESS or FAILED result within one hour. After one hour, the request times out. Each result also has a particular set of fields expected by AWS CloudFormation.

Custom resource provider requests with RequestType set to Delete are sent when the template developer deletes a stack that contains a custom resource. To successfully delete a stack with a custom resource, the custom resource provider must respond successfully to a delete request.

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/crpg-ref-requesttypes.html

22

S3 Cross-Region Replication (CRR) is used to copy objects across Amazon S3 buckets in different AWS Regions asynchronously.

-Meet compliance requirements
-Minimize latency
-Increase operational efficiency
However, to replicate objects takes 15 minutes which is not ideal for deployment action.

Use AWS CodePipeline to Perform Multi-Region Deployments:

1.Set up S3 Bucket in each region
2.Set up CodeDeploy action in each region
3.Deploy an application to multiple regions using each AWS CodeDeploy action in the pipeline.

https://aws.amazon.com/blogs/devops/using-aws-codepipeline-to-perform-multi-region-deployments/

23

SCPs offer central access controls for all IAM entities in your accounts.

You can use them to enforce the permissions you want everyone in your business to follow. Using SCPs, you can give your employee more freedom to manage their own permissions because you know they can only operate within the boundaries you define.

If your central security team uses a administrative IAM role to audit and make changes to AWS settings, use a SCP.
With the SCP, you can restrict all IAM entities in the account from modifying AdminRole or its associated permissions.

https://aws.amazon.com/ko/blogs/security/how-to-use-service-control-policies-to-set-permission-guardrails-across-accounts-in-your-aws-organization/

A permissions boundary is an advanced feature that allows you to limit the maximum permissions that a principal can have.

As the IAM administrator, you can define one or more permissions boundaries using managed policies and allow your employee to create a principal with this boundary. The employee can then attach a permissions policy to this principal. However, the effective permissions of the principal are the intersection of the permissions boundary and permissions policy. As a result, the new principal cannot exceed the boundary that you defined.

https://aws.amazon.com/ko/blogs/security/delegate-permission-management-to-developers-using-iam-permissions-boundaries/

26

A: Incorrect
AWS GuardDuty focuses on threat detection and monitoring for malicious activities (CloudTrail logs, VPC flow logs, and DNS logs) within your AWS environment.
it is primarily on threat detection and response, not configuration monitoring.

B: Incorrect
CloudFormation StackSets is feasible to mornitoer changes of S3 policy if it is created in a delegated administrator account.
But individual member accounts can stop logging or delete the trails with the CloudTrail console.
It needs additional action to implement automatic drift remediation for AWS CloudFormation if a user delete the Amazon EventBridge rule – https://aws.amazon.com/ko/blogs/mt/implement-automatic-drift-remediation-for-aws-cloudformation-using-amazon-cloudwatch-and-aws-lambda/ .

C: Correct
A conformance pack is a collection of AWS Config rules and remediation actions that can be easily deployed as a single entity in an account and a Region or across an organization in AWS Organizations.

D: Incorrect
Amazon Inspector is a vulnerability management service automatically discovers and scans running Amazon EC2 instances, container images in Amazon Elastic Container Registry, and AWS Lambda functions for known software vulnerabilities and unintended network exposure.
It is not configuration monitoring.
A delegated administrator is Regional for Amazon Inspector unlikely AWS Organizations.

30

You don’t need to install the Amazon CloudWatch Logs agent on ECS instance if you do not use External instances .

You can configure the containers in your tasks to send log information to CloudWatch Logs. If you’re using the Fargate launch type for your tasks, you can view the logs from your containers. If you’re using the EC2 launch type, you can view different logs from your containers in one convenient location, and it prevents your container logs from taking up disk space on your container instances.

https://docs.aws.amazon.com/AmazonECS/latest/developerguide/using_awslogs.html

32

Managing replication rules using the Amazon S3 console

Replication is the automatic, asynchronous copying of objects across buckets in the same or different AWS Regions. It replicates newly created objects and object updates from a source bucket to a specified destination bucket.

Creating an IAM role:

By default, all Amazon S3 resources—buckets, objects, and related subresources—are private, and only the resource owner can access the resource. Amazon S3 needs permissions to read and replicate objects from the source bucket. You grant these permissions by creating an IAM role and specifying the role in your replication configuration.

Create replication rule in a source bucket:

You use the Amazon S3 console to add replication rules to the source bucket. Replication rules define the source bucket objects to replicate and the destination bucket or buckets where the replicated objects are stored

Granting permissions when the source and destination buckets are owned by different AWS accounts:

When the source and destination buckets aren’t owned by the same accounts, the owner of the destination bucket must also add a bucket policy to grant the owner of the source bucket permissions to perform replication actions.

Changing replica ownership:

When different AWS accounts own the source and destination buckets, you can tell Amazon S3 to change the ownership of the replica to the AWS account that owns the destination bucket.

Enable receiving replicated objects from a source bucket in a target bucket:

You can quickly generate the policies needed to enable receiving replicated objects from a source bucket through the AWS Management Console.

https://docs.aws.amazon.com/AmazonS3/latest/userguide/disable-replication.html
https://docs.aws.amazon.com/AmazonS3/latest/userguide/setting-repl-config-perm-overview.html

36

A management account can’t be able to directly access resources created by other accounts within the organisation by default. Each account in an AWS Organisation is a separate entity, and resources created within those accounts are isolated for security reasons.
To access resources created by other accounts in your organisation from the management account, you can do the following:

1. In each member account, create an IAM role that has access to the AmazonEC2ReadOnlyAccess managed policy.
2. In each member account, create a trust relationship that allows users in the management account to assume the IAM roles of the member accounts.
3. In the management account, create an I AM role that allows the sts:AssumeRole action against the member account IAM role’s ARN.

https://repost.aws/questions/QUyAGaxLlpRES1pplrInOo9g/accessing-other-user-resources-with-management-account

37

NAT gateways in each Availability Zone are implemented with redundancy. Create a NAT gateway in each Availability Zone to ensure zone-independent architecture.

https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-comparison.html
40

Customizations for AWS Control Tower

Customizations for AWS Control Tower combines AWS Control Tower and other highly-available, trusted AWS services to help customers more quickly set up a secure, multi-account AWS environment using AWS best practices.

You can easily add customizations to your AWS Control Tower landing zone using an AWS CloudFormation template and service control policies (SCPs).

You can deploy the custom template and policies to individual accounts and organizational units (OUs) within your organization. It also integrates with AWS Control Tower lifecycle events to ensure that resource deployments stay in sync with your landing zone. For example, when a new account is created using the AWS Control Tower account factory, Customizations for AWS Control Tower ensures that all resources attached to the account’s OUs will be automatically deployed.

https://aws.amazon.com/solutions/implementations/customizations-for-aws-control-tower/

48

Nested Stacks

As your infrastructure grows, common patterns can emerge in which you declare the same components in multiple templates. You can separate out these common components and create dedicated templates for them.

StackSets

Using an administrator account, it enable you to create, update, or delete stacks across multiple accounts and AWS Regions with a single operation if your organisation has cross-region and multi-accounts deployment requirements.

Have to know:

Fn::ImportValue intrinsic functions can not be used in the Parameters section.

Use !GetAtt if you reference resources with TemplateURL

https://aws.amazon.com/blogs/networking-and-content-delivery/moving-towards-devops-ci-cd-approach-to-configure-and-manage-aws-networking-resources/

51

Codepipeline invoke actions:

56

CodeDeploy

1. Create an application
2. Create an deployment group
– In Environment configuration, choose Amazon EC2 instances.
– In Agent configuration with AWS Systems Manager, choose how you install AWS CodeDeploy Agent with AWS Systems Manager required prerequisites on the EC2.
– In Deploymnet settings, choose CodeDeployDefault.AllAtOnce as example.

CloudFormation

1. Create change sets for the application stacks.
2. Vew the proposed changes before executing them.

CodePipeline

1. Invoke the CodeBuild job
2. Pause for a manual approval step.
3. Vew the proposed changes in CloudForamtion before approving deployment.
4. Approve deployment
5. Run the CloudFormation change sets action
6. Deploy the application on EC2

58

AWS Config

By using AWS Config you can audit the configuration of your AWS resources and ensure that they comply with configuration best practices. You can use AWS CloudFormation StackSets to enable AWS Config in multiple accounts and Regions.

AWS Config feature allows customers to register a delegated admin account that will be used to deploy and manage these Config resources across AWS Organizations.

https://aws.amazon.com/blogs/mt/aws-config-best-practices/

AWS CloudTrail

If you have created an organization in AWS Organizations, you can create a trail that logs all events for all AWS accounts in that organization. This is sometimes called an organization trail.
The management account for the organization can assign a delegated administrator to create new organization trails or manage existing organization trails.

https://docs.aws.amazon.com/awscloudtrail/latest/userguide/creating-trail-organization.html

Service control policies (SCPs)

Service control policies (SCPs) are a type of organization policy that you can use to manage permissions in your organization. SCPs offer central control over the maximum available permissions for all accounts in your organization. SCPs help you to ensure your accounts stay within your organization’s access control guidelines.

SCPs prevents users from disabling AWS Config or changing its rules

https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_scps_examples_config.html#example_config_1

66

AWS Config aggregator

AWS Config provides a detailed view of the configuration of AWS resources in your AWS account. With AWS Config, you can review changes in configurations and relationships between AWS resources, explore resource configuration histories, and use rules to determine compliance. An aggregator is an AWS Config resource type that collects AWS Config configuration and compliance data from multiple AWS accounts and Regions into a single account and Region to get a centralized view of your resource inventory and compliance.

A delegated administrator account is an account in an AWS Organizations that is granted additional administrative permissions for a specified AWS service. This means that in addition to the management account, you can also use a delegated admin account to aggregate data from all the member accounts in AWS Organizations without any additional authorization. With this capability, different teams in an organization (auditing, security, or compliance) can use separate accounts and aggregate organization-wide data in their respective administration accounts for centralized governance. This capability also eliminates the need for those teams to gain access to the management account to fetch the aggregated data.

https://aws.amazon.com/blogs/mt/org-aggregator-delegated-admin/

67

A virtual private cloud (VPC)

VPC is a virtual network dedicated to your AWS account. It is logically isolated from other virtual networks in the AWS Cloud. You can launch AWS resources, such as Amazon EC2 instances, into your VPC.

AWS PrivateLink

AWS PrivateLink is a highly available, scalable technology that you can use to privately connect your VPC to services as if they were in your VPC. You do not need to use an internet gateway, NAT device, public IP address, AWS Direct Connect connection, or AWS Site-to-Site VPN connection to allow communication with the service from your private subnets. Therefore, you control the specific API endpoints, sites, and services that are reachable from your VPC.

VPC peering

A VPC peering connection is a networking connection between two VPCs that enables you to route traffic between them using private IPv4 addresses or IPv6 addresses. Instances in either VPC can communicate with each other as if they are within the same network. You can create a VPC peering connection between your own VPCs, or with a VPC in another AWS account. The VPCs can be in different Regions (also known as an inter-Region VPC peering connection).

When you establish peering relationships between VPCs across different AWS Regions, resources in the VPCs (for example, EC2 instances and Lambda functions) in different AWS Regions can communicate with each other using private IP addresses, without using a gateway, VPN connection, or network appliance. The traffic remains in the private IP space. All inter-Region traffic is encrypted with no single point of failure, or bandwidth bottleneck. Traffic always stays on the global AWS backbone, and never traverses the public internet, which reduces threats, such as common exploits, and DDoS attacks. Inter-Region VPC peering provides a simple and cost-effective way to share resources between regions or replicate data for geographic redundancy.

86

List of lifecycle event hooks for an AWS Lambda deployment

An AWS Lambda hook is one Lambda function specified with a string on a new line after the name of the lifecycle event. Each hook is executed once per deployment. Here are descriptions of the hooks available for use in your AppSpec file.

• BeforeAllowTraffic – Use to run tasks before traffic is shifted to the deployed Lambda function version.
• AfterAllowTraffic – Use to run tasks after all traffic is shifted to the deployed Lambda function version.

See AppSpec ‘hooks’ section For an ECS deployment and an EC2/On-Premises deployment

https://docs.aws.amazon.com/codedeploy/latest/userguide/reference-appspec-file-structure-hooks.html

91

EventBridge

1. Specify an EventBridge rule as narrow as you can filter possible.
2. You can customize the text from an event before EventBridge passes the information to the target of a rule. Using the input transformer in the console or the API when you create a rule, the transformed event is sent to a target instead of the original event.

B. correct as well

Subscription filters didn’t act on the message (body, payload). They only acted on the message attributes before.

However, from 22 Nov 2022, AWS provides the payload-based message filtering option of SNS, which augments the existing attribute-based option, enabling you to offload additional filtering logic to SNS and further reduce your application integration costs.

https://aws.amazon.com/blogs/compute/introducing-payload-based-message-filtering-for-amazon-sns/

If a subscription doesn’t have a filter policy, the subscriber receives every message published to its topic. When you publish a message to a topic with a filter policy in place, Amazon SNS compares the message attributes or the message body to the properties in the filter policy for each of the topic’s subscriptions. If any of the message attributes or message body properties match, Amazon SNS sends the message to the subscriber. Otherwise, Amazon SNS doesn’t send the message to that subscriber.

92

Aurora DB clusters

An Amazon Aurora DB cluster consists of one or more DB instances and a cluster volume that manages the data for those DB instances. An Aurora cluster volume is a virtual database storage volume that spans multiple Availability Zones, with each Availability Zone having a copy of the DB cluster data. Two types of DB instances make up an Aurora DB cluster:

– Primary DB instance

– Aurora Replica

Aurora Global Database

Amazon Aurora Global Database is designed for globally distributed applications, allowing a single Amazon Aurora database to span multiple AWS Regions. It replicates your data with no impact on database performance, enables fast local reads with low latency in each Region, and provides disaster recovery from Region-wide outages.

Types of Aurora endpoints

Cluster endpoint – A cluster endpoint (or writer endpoint) for an Aurora DB cluster connects to the current primary DB instance for that DB cluster. This endpoint is the only one that can perform write operations such as DDL statements. Because of this, the cluster endpoint is the one that you connect to when you first set up a cluster or when your cluster only contains a single DB instance.

Reader endpoint – A reader endpoint for an Aurora DB cluster provides load-balancing support for read-only connections to the DB cluster. Use the reader endpoint for read operations, such as queries. By processing those statements on the read-only Aurora Replicas, this endpoint reduces the overhead on the primary instance. It also helps the cluster to scale the capacity to handle simultaneous SELECT queries, proportional to the number of Aurora Replicas in the cluster. Each Aurora DB cluster has one reader endpoint.

Custom endpoint – A custom endpoint for an Aurora cluster represents a set of DB instances that you choose. When you connect to the endpoint, Aurora performs load balancing and chooses one of the instances in the group to handle the connection. You define which instances this endpoint refers to, and you decide what purpose the endpoint serves.

Instance endpoint – An instance endpoint connects to a specific DB instance within an Aurora cluster. Each DB instance in a DB cluster has its own unique instance endpoint. So there is one instance endpoint for the current primary DB instance of the DB cluster, and there is one instance endpoint for each of the Aurora Replicas in the DB cluster.

RDS Multi-AZ

In an Amazon RDS Multi-AZ deployment, Amazon RDS automatically creates a primary database (DB) instance and synchronously replicates the data to an instance in a different AZ. When it detects a failure, Amazon RDS automatically fails over to a standby instance without manual intervention.

RDS read replica

A read replica is a read-only copy of a DB instance. You can reduce the load on your primary DB instance by routing queries from your applications to the read replica. In this way, you can elastically scale out beyond the capacity constraints of a single DB instance for read-heavy database workloads.

RDS cross-region read-write replica

By using cross-Region read replicas in Amazon RDS, you can create a MariaDB, MySQL, Oracle, PostgreSQL, or SQL Server read replica in a different Region from the source DB instance.

93

You can be notified when Amazon EC2 Auto Scaling is launching or terminating the EC2 instances in your Auto Scaling group. You manage notifications using Amazon Simple Notification Service (Amazon SNS).

For example, if you configure your Auto Scaling group to use the autoscaling: EC2_INSTANCE_TERMINATE notification type, and your Auto Scaling group terminates an instance, it sends an email notification. This email contains the details of the terminated instance, such as the instance ID and the reason that the instance was terminated.

98

AWS Control Tower offers a straightforward way to set up and govern an AWS multi-account environment. AWS Control Tower orchestrates the capabilities of several other AWS services, including AWS Organizations, AWS Service Catalog, and AWS IAM Identity Center (successor to AWS Single Sign-On), to build a landing zone in less than an hour. Resources are set up and managed on your behalf.

AWS Control Tower – Landing Zone

Automatically provisioned, secure, and compliant multi-account environment based on AWS best practices

Landing Zone consists of:

• AWS Organization – create and manage multi account structure
• Account Factory – easily configure new accounts to adhere to config and policies
• Organizational Units (OUs) – group and categorise accounts based on purpose
• AWS Config – to monitor and assess your resources’ compliance with Guardrails
• Service Control Policies (SCPs) – enforce fine-grained permissions and restrictions
• IAM Identity Center – centrally manage user access to accounts and services
• Guardrails – rules and policies to enforce security, compliance and best practices

For Security Hub:

• Designate the Security Hub delegated administrator. https://docs.aws.amazon.com/securityhub/latest/userguide/designate-orgs-admin-account.html
• When you turn on automatic enablement, Security Hub treats new accounts as member accounts when they are added to the organization.
  https://docs.aws.amazon.com/securityhub/latest/userguide/accounts-orgs-auto-enable.html
• Use new account assignment APIs for AWS SSO to automate multi-account access. https://aws.amazon.com/blogs/security/use-new-account-assignment-apis-for-aws-sso-to-automate-multi-account-access/

101

How to Create an Approval Flow for an AWS Service Catalog Product Launch Using AWS Lambda

https://aws.amazon.com/blogs/apn/how-to-create-an-approval-flow-for-an-aws-service-catalog-product-launch-using-aws-lambda/

Best Practices for AWS Organizations Service Control Policies in a Multi-Account Environment

https://aws.amazon.com/blogs/industries/best-practices-for-aws-organizations-service-control-policies-in-a-multi-account-environment/

104

112

How can I use system policies to control access to my EFS file system?

https://repost.aws/knowledge-center/access-efs-across-accounts

How can I grant directory access to specific EC2 instances using IAM and EFS access points?

https://repost.aws/knowledge-center/efs-access-points-directory-access

1. The VPCs of your NFS client and your EFS file system are connected using either a VPC peering connection or a VPC Transit Gateway. This allows Amazon Elastic Compute Cloud (Amazon EC2) instances from the same or different accounts, to access EFS file systems in a different VPC.

2. Your IAM role (Lambda role or any other role) has console or read access on both the Amazon EFS and NFS client resources.

3. In the EFS file system policy, add policy to allow ClientMount and ClientWrite for the access points for the Lambda.

122

To deploy an application in an different account from a centralized DevOps account:

1. CodeBuild in the centralized DevOps account triggers CodeDeploy in the account.
2. The CodeDeploy role assume a deployment IAM role in an application account.
3. The application deployment IAM role should have a trust relationship with the DevOps deployment IAM role allowing sts:AssumeRole action in its trust policy.
4. The application deployment IAM role should have the required access to the EKS cluster.

125

If your stack is stuck in the UPDATE_ROLLBACK_FAILED state after a failed update, then the only actions that you can perform on the stack are the ContinueUpdateRollback or DeleteStack operations. This is because CloudFormation requires further input from you to acknowledge that the stack is out of sync with the template that the stack is attempting to roll back to.

To retry the rollback and resolve the error, you can use ContinueUpdateRollback with either the CloudFormation console or AWS Command Line Interface (AWS CLI).

To resolve the error, you might need to raise limits, change permissions, or modify other settings.

https://repost.aws/knowledge-center/cloudformation-update-rollback-failed

127

Both SCIM and SAML are important considerations for configuring IAM Identity Center.

SAML 2.0 implementation

IAM Identity Center supports identity federation with SAML (Security Assertion Markup Language) 2.0. This allows IAM Identity Center to authenticate identities from external identity providers (IdPs). SAML 2.0 is an open standard used for securely exchanging SAML assertions. SAML 2.0 passes information about a user between a SAML authority (called an identity provider or IdP), and a SAML consumer (called a service provider or SP). The IAM Identity Center service uses this information to provide federated single sign-on. Single sign-on allows users to access AWS accounts and configured applications based on their existing identity provider credentials.

IAM Identity Center adds SAML IdP capabilities to your IAM Identity Center store, AWS Managed Microsoft AD, or to an external identity provider. Users can then single sign-on into services that support SAML, including the AWS Management Console and third-party applications such as Microsoft 365, Concur, and Salesforce.

The SAML protocol however does not provide a way to query the IdP to learn about users and groups. Therefore, you must make IAM Identity Center aware of those users and groups by provisioning them into IAM Identity Center.

SCIM profile

IAM Identity Center provides support for the System for Cross-domain Identity Management (SCIM) v2.0 standard. SCIM keeps your IAM Identity Center identities in sync with identities from your IdP. This includes any provisioning, updates, and deprovisioning of users between your IdP and IAM Identity Center(automatically).

For more information about how to implement SCIM, see Automatic provisioning. For additional details about IAM Identity Center’s SCIM implementation, see the IAM Identity Center SCIM Implementation Developer Guide.

https://docs.aws.amazon.com/singlesignon/latest/userguide/scim-profile-saml.html

132

This is about how to automatically block suspicious traffic with AWS Network Firewall and Amazon GuardDuty.

https://aws.amazon.com/ko/blogs/security/automatically-block-suspicious-traffic-with-aws-network-firewall-and-amazon-guardduty/

137