SSE-KMS encrypts S3 objects using AWS Key Management Service (KMS). It allows the company to retain key management control, set key rotation policies, and provides full AWS CloudTrail audit logs of every key usage event.
AWS provides Gateway VPC Endpoints for Amazon DynamoDB and Amazon S3 free of charge. A Gateway VPC Endpoint routes traffic directly from the private subnet to DynamoDB via the AWS internal network without internet egress.
Using Amazon Simple Queue Service (SQS) buffers incoming requests, decoupling the web tier from worker EC2 instances so traffic bursts are queued safely without dropping requests.
Amazon Aurora Global Database uses storage-based replication across multiple AWS Regions with latency under 1 second and automatic failover in under 1 minute.
Amazon CloudFront Origin Access Control (OAC) restricts direct access to S3 buckets, ensuring requests must originate through CloudFront.
AWS Fargate is a serverless compute engine for containers that works with ECS and EKS. It eliminates the need to provision, configure, or scale EC2 instances.
Amazon EFS provides scalable, serverless POSIX-compliant file storage that can be concurrently mounted by thousands of EC2 instances across multiple AZs.
VPC Flow Logs captures information about the IP traffic going to and from network interfaces in your VPC, publishing raw traffic data to CloudWatch Logs or Amazon S3.
S3 Glacier Flexible Retrieval provides low-cost archive storage with standard retrieval options between 3 and 5 hours. (Deep Archive requires 12 hours).
Spot Instances offer spare EC2 capacity at up to 90% savings compared to On-Demand prices, perfect for fault-tolerant, flexible batch processing workloads.
AWS WAF helps protect web applications from common web exploits by allowing you to configure rules that block SQL injection, XSS, and bot traffic.
Aurora Global Database spans multiple AWS Regions, enabling fast local reads with sub-second replication latency across global regions.
AWS Direct Connect links your internal network directly to an AWS Direct Connect location over a dedicated physical fiber connection, bypassing the public internet.
Application Load Balancer operates at Layer 7 (HTTP/HTTPS) and features advanced path-based routing, host-based routing, and native SSL/TLS termination.
AWS Organizations allows you to centrally manage multiple AWS accounts and enforce Service Control Policies (SCPs) across account organizational units (OUs).
Amazon Route 53 is a scalable Cloud DNS web service that provides health checks and DNS failover routing to direct users to healthy application endpoints.
Elastic Fabric Adapter (EFA) is a network interface for EC2 instances that enables high-performance computing (HPC) and machine learning applications to bypass the OS kernel for sub-millisecond node communication.
Amazon ElastiCache allows you to deploy sub-millisecond, fully managed Redis or Memcached in-memory data stores to offload read traffic from RDS databases.
S3 Intelligent-Tiering automatically optimizes storage costs by moving granular objects between access tiers when access patterns change, with no retrieval fees.
AWS Config continually monitors and records resource configurations and evaluates them against desired compliance rules (e.g., flagging unencrypted storage).
Amazon Kinesis Data Streams enables real-time collection and processing of large streams of data records from thousands of sources concurrently.
AWS Elastic Beanstalk is an easy-to-use Platform-as-a-Service (PaaS) for deploying and scaling web applications developed with Java, .NET, PHP, Node.js, Python, Ruby, and Docker.
Amazon GuardDuty is an intelligent threat detection service that monitors CloudTrail logs, VPC Flow Logs, and DNS logs to identify unauthorized or malicious behavior.
AWS CloudFormation allows you to model, provision, and manage AWS and third-party resources by declaring them in automated JSON or YAML template files.
Amazon Macie uses machine learning and pattern matching to discover, monitor, and protect sensitive data (such as PII and financial records) stored in Amazon S3.
EBS io2 Block Express volumes deliver up to 256,000 IOPS and 4,000 MB/s throughput with sub-millisecond latency for demanding database workloads.
Sticky sessions bind a user session to a specific EC2 instance in a target group using HTTP cookies, ensuring stateful session continuity.
AWS Lambda is a serverless event-driven compute service that runs code directly in response to S3 upload triggers without server management.
Latency-based routing uses network latency measurements between users and AWS data centers to automatically route user requests to the region with the lowest latency.
AWS CloudHSM provides dedicated single-tenant Hardware Security Modules (HSMs) inside your VPC certified under FIPS 140-2 Level 3.
A company needs to store sensitive data in Amazon S3. Compliance requirements mandate that data must be encrypted at rest with keys managed by the company in AWS KMS, with an explicit audit trail of key usage. Which method satisfies this requirement?
How confident are you in this answer?