AWS Certified Security - Specialty

To provide AWS Lambda with access to an Amazon S3 bucket, the best solutions involve using IAM roles. Creating an IAM role for the Lambda function and attaching an IAM policy that allows access to the S3 bucket ensures that the Lambda function has the necessary permissions without exposing any secrets or keys. Additionally, attaching a bucket policy to the S3 bucket that specifies the IAM role as the principal provides a clear and secure way to control access through the IAM role.

AWS Certificate Manager (ACM) is specifically designed for managing and deploying SSL/TLS certificates on AWS services. It simplifies the process of provisioning, managing, and deploying SSL/TLS certificates. Using a custom SSL certificate that is stored in ACM is a valid and recommended option for securing communications with the website through HTTPS.

To develop a process to investigate and respond to potential security events while complying with AWS best practices, the security engineer should take the following steps. First, gather any relevant metadata for the compromised EC2 instance, enable termination protection, isolate the instance by updating its security groups to restrict access, and detach the instance from any Auto Scaling groups it is part of to prevent it from being terminated or replaced. This ensures the instance remains online but isolated. Second, use Systems Manager Run Command to invoke scripts that collect volatile data. This method is optimal as it minimizes operational overhead and ensures all activities during data collection are captured. Third, create a snapshot of the compromised EC2 instance's EBS volume for follow-up investigations and tag the instance with any relevant metadata and incident ticket information. Creating a snapshot preserves the compromised instance's non-volatile memory for forensic purposes. Together, these steps effectively manage the investigation with minimal operational overhead while preserving both volatile and non-volatile data.

To meet the company's requirements of notifying the security team while maintaining the same overall delivery speed, the most operationally efficient solution is to use Amazon Simple Notification Service (SNS) and CloudFormation Guard. Creating a custom rule in CloudFormation Guard allows compliance checks for resource configurations. This ensures that any non-compliant resources are identified before deployment, and the CI/CD pipeline can notify the security team via SNS. The use of CloudFormation Guard is more effective for compliance checks compared to aws cloudformation validate-template, which only checks for syntax errors. This approach integrates seamlessly into the existing CI/CD pipeline, ensuring no delay in the delivery speed.

To meet the requirements of migrating the application server to AWS while keeping the database on-premises with low latency and IPsec encryption, a combination of AWS Site-to-Site VPN and AWS Direct Connect is appropriate. AWS Site-to-Site VPN provides IPsec encryption for secure data transfer, while AWS Direct Connect offers a dedicated network connection for minimizing network latency, making this combination suitable for the scenario.