PDF SAA-C03 Study Guide

AWS Config is a service designed to assess, audit, and evaluate the configurations of AWS resources. It continuously monitors and records your AWS resource configurations and allows you to automate the evaluation of recorded configurations against desired configurations. By starting a configuration recorder, AWS Config will capture changes to supported resource types as configuration items—without the need to modify any of the existing resources. This provides a full history of configuration changes and is specifically intended for exactly this use case.

AWS Documentation Extract:

“AWS Config provides a detailed view of the configuration of AWS resources in your AWS account. This includes how the resources are related to one another and how they were configured in the past so you can see how the configurations and relationships change over time.”

“You can start the configuration recorder, which will record the configuration changes of the supported resources in your AWS account.”

(Source: AWS Config documentation, What is AWS Config?)

Other options:

B: CloudFormation drift detection only works for resources created and managed by CloudFormation and requires stacks.

C: Amazon Detective is used for analyzing and investigating security findings, not for resource configuration tracking.

D: AWS Audit Manager is used for automating evidence collection to help with audits, not for tracking resource configurations.

Explanation (AWS Docs):

DynamoDB Accelerator (DAX) is a fully managed, in-memory cache specifically for DynamoDB. It reduces read load and latency without requiring code changes (only SDK config). This is the least development effort.

“Amazon DynamoDB Accelerator (DAX) is a fully managed, highly available in-memory cache for DynamoDB that delivers microsecond read performance and requires minimal application changes.”

— Amazon DAX

Option B:A gateway endpoint for S3 allows traffic to S3 without using public IPs and integrates with route tables.

Option D:Deploying EC2 instances in a private subnet with a NAT gateway enables outbound internet connectivity for other requirements without public IPs.

Option A:Egress-only internet gateways are for IPv6 traffic and do not work for IPv4 in this context.

Option C:Interface endpoints are not required for S3 as gateway endpoints are more suitable and cost-effective.

Option E:A customer gateway is for hybrid connectivity (e.g., on-premises), not suitable for this case.

AWS Documentation References:

VPC Endpoints

Amazon S3 Gateway Endpoints

Amazon API Gateway supports multiple API types: REST, HTTP, WebSocket, and gRPC. HTTP APIs are a newer, lightweight option that support JWT authorizers natively, enabling secure, scalable authentication for APIs with JSON Web Tokens.

HTTP APIs can integrate with ALBs as a backend target, providing direct connectivity and simplified API management with JWT authentication built in.

REST APIs support JWT but are more feature-rich and complex, often used for legacy or more complex use cases, and have higher costs and latency. WebSocket APIs are for real-time, bidirectional communication, which is not requested here. gRPC APIs support RPC calls but are less common for public HTTP-based APIs with JWT auth.

Therefore, HTTP API with JWT authorizers is the best fit for this use case.