SOA-C02 Reviews Questions

To resolve the issue of the EC2 instance in a private subnet not being able to connect to external websites via HTTPS (port 443), it is necessary to adjust the security group settings:

Outbound Security Group Rules: Verify that the security group associated with the EC2 instance allows outbound traffic on port 443 to any destination (0.0.0.0/0). This rule is crucial because it enables the instance to initiate HTTPS connections to external websites.

Network ACLs: While the primary concern here is the security group, ensure also that the Network Access Control List (ACL) associated with the subnet permits outbound HTTPS traffic. However, the ACLs by default allow all outbound traffic unless specifically restricted.

Internet Connectivity: Since the instance is in a private subnet, ensure that it has a route to the internet through a NAT Gateway or NAT Instance located in a public subnet. Without this, the instance won't be able to reach external networks even if the security groups and ACLs are correctly configured.

By ensuring that the security group permits outbound HTTPS traffic, you address the most common configuration oversight that would prevent such connectivity.

To centrally store traffic logs for the website and ensure all data is encrypted at rest, using an Amazon S3 bucket with default server-side encryption is the best solution.

Create an Amazon S3 Bucket with Server-Side Encryption:

Open the S3 console and create a new bucket.

In the bucket properties, enable default server-side encryption using AES-256.

Configure CloudFront to Use the S3 Bucket as a Log Destination:

Open the CloudFront console.

Select the CloudFront distribution and configure the logging settings.

Specify the S3 bucket as the log destination.

Server-Side Encryption:

Ensure that the S3 bucket is configured to use server-side encryption with AES-256 by default, ensuring that all logs stored are encrypted at rest.

References:

Amazon S3 Server-Side Encryption

CloudFront Access Logs

Using AWS Systems Manager Patch Manager with a maintenance window is a best practice for automating OS patch management across instances in an Auto Scaling group.

Patch Manager: Allows for scheduled patching according to maintenance windows, ensuring minimal impact on application uptime.

RebootOption parameter: Setting this to RebootIfNeeded ensures patches are applied fully when a reboot is required.

AWS-RunPatchBaseline: This document automates the patching process and can be customized based on compliance requirements.

To allow the TTL (Time to Live) of individual pages to vary while adhering to the maximum and minimum TTL settings configured for the Amazon CloudFront distribution, setting cache behaviors directly at the origin is most effective:

Use Cache-Control Headers: By configuring the Cache-Control: max-age directive in the HTTP headers of the objects served from the origin, you can specify how long an object should be cached by CloudFront before it is considered stale.

Integration with CloudFront: When CloudFront receives a request for an object, it checks the cache-control header to determine the TTL for that specific object. This allows individual objects to have their own TTL settings, as long as they are within the globally set minimum and maximum TTL values for the distribution.

Operational Efficiency: This method does not require any additional AWS services or modifications to the distribution settings. It leverages HTTP standard practices, ensuring compatibility and ease of management.

Implementing the TTL management through cache-control headers at the origin provides precise control over caching behavior, aligning with varying content freshness requirements without complex configurations.