Designate an account to be the delegated Amazon GuardDuty administrator account.
Turn on GuardDuty for all accounts across the organization. In the GuardDuty administrator
account, create an SNS topic. Subscribe the SecOps team's email address to the SNS topic. In the same
account, create an Amazon EventBridge rule that uses an event pattern for GuardDuty findings and a
target of the SNS topic.

Create an AWS CloudFormation template that creates an SNS topic and subscribes the

SecOps team’s email address to the SNS topic. In the template, include an Amazon EventBridge rule uses an event pattern of CloudTrail activity for s3: PutBucketPublicAccessBlock and a target of the SNS topic. Deploy the stack to every account in the organization by using CloudFormation StackSets.

Turn on AWS Config across the organization. In the delegated administrator account, create an SNS
topic. Subscribe the SecOps team's email address to the SNS topic. Deploy a conformance pack that
uses the s3-bucket-level-public-access-prohibited AWS Config managed rule in each account and
uses an AWS Systems Manager document to publish an event to the SNS topic to notify the SecOps
team.

Turn on Amazon Inspector across the organization. In the Amazon Inspector delegated
administrator account, create an SNS topic. Subscribe the SecOps team’s email address to the SNS
topic. In the same account, create an Amazon EventBridge rule that uses an event pattern for public
network exposure of the S3 bucket and publishes an event to the SNS topic to notify the SecOps
team

Create a SysAdmin role in the operations account. Attach the AdministratorAccess policy to the
role. Modify the trust relationship to allow the sts:AssumeRole action from the workload accounts.

Create a SysAdmin role in each workload account. Attach the AdministratorAccess policy to the
role. Modify the trust relationship to allow the sts:AssumeRole action from the operations account.

Create an Amazon Cognito identity pool in the operations account. Attach the SysAdmin role as an
authenticated role.

In the operations account, create an IAM user for each operations team member.

In the operations account, create an IAM user group that is named SysAdmins. Add an IAM policy
that allows the sts:AssumeRole action for the SysAdmin role in each workload account. Add all
operations team members to the group.

Create an Amazon Cognito user pool in the operations account. Create an Amazon Cognito user for
each operations team member.

Use Auto Scaling lifecycle hooks to put instances in a Pending:Wait state. Create an Amazon
CloudWatch alarm for EC2 Instance Terminate Successful and trigger an AWS Lambda function that
invokes an SSM Run Command script to collect logs, push them to Amazon S3, and complete the
lifecycle action once logs are collected.

Use Auto Scaling lifecycle hooks to put instances in a Terminating:Wait state. Create an AWS Config
rule for EC2 Instance-terminate Lifecycle Action and trigger a step function that invokes a script to
collect logs, push them to Amazon S3, and complete the lifecycle action once logs are collected.

Use Auto Scaling lifecycle hooks to put instances in a Terminating:Wait state. Create an Amazon
CloudWatch subscription filter for EC2 Instance Terminate Successful and trigger a CloudWatch agent
that invokes a script to collect logs, push them to Amazon S3, and complete the lifecycle action once
logs are collected.

Use Auto Scaling lifecycle hooks to put instances in a Terminating:Wait state. Create an Amazon
EventBridge rule for EC2 Instance-terminate Lifecycle Action and trigger an AWS Lambda function
that invokes an SSM Run Command script to collect logs, push them to Amazon S3, and complete the
lifecycle action once logs are collected.

Create an SCP that includes a Deny statement for changes to the auditing application's IAM role.
Include a condition that allows the trusted administrator IAM role to make changes. Attach the SCP
to the root of the organization.

Create an SCP that includes an Allow statement for changes to the auditing application's IAM role
by the trusted administrator IAM role. Include a Deny statement for changes by all other IAM
principals. Attach the SCP to the IAM service in each AWS account where the auditing application has
an IAM role.

Create an IAM permissions boundary that includes a Deny statement for changes to the auditing
application's IAM role. Include a condition that allows the trusted administrator IAM role to make
changes. Attach the permissions boundary to the audited AWS accounts.

Create an IAM permissions boundary that includes a Deny statement for changes to the auditing
application’s IAM role. Include a condition that allows the trusted administrator IAM role to make
changes. Attach the permissions boundary to the auditing application's IAM role in the AWS
accounts.

Modify the CloudFormation template to include a parameter for the Lambda function code’s zip
file location. Create a new CloudFormation deploy action for us-east-1 in the pipeline. Configure the
new deploy action to pass in the us-east-1 artifact location as a parameter override.

Create a new CloudFormation deploy action for us-east-1 in the pipeline. Configure the new
deploy action to use the CloudFormation template from the us-east-1 output artifact.

Create an S3 bucket in us-east-1. Configure the S3 bucket policy to allow CodePipeline to have
read and write access.

Create an S3 bucket in us-east-1. Configure S3 Cross-Region Replication (CRR) from the S3 bucket
in eu-west-1 to the S3 bucket in us-east-1.

Modify the pipeline to include the S3 bucket for us-east-1 as an artifact store. Create a new
CloudFormation deploy action for us-east-1 in the pipeline. Configure the new deploy action to use
the CloudFormation template from the us-east-1 output artifact.

Automate patching and upgrading using AWS Systems Manager on EC2 instances and encrypt
Amazon EBS volumes by default.

Deploy Jenkins to an Amazon ECS cluster and copy build artifacts to an Amazon S3 bucket with
default encryption enabled.

Leverage AWS CodePipeline with a build action and encrypt the artifacts using AWS Secrets
Manager.

Use AWS CodeBuild with artifact encryption to replace the Jenkins instance running on EC2
instances.

Configure an event source of AWS Health, a service of EC2. and an event type that
indicates
instance maintenance. Target a Systems Manager document to restart the EC2 instance.

Configure an event source of Systems Manager and an event type that indicates a
maintenance window. Target a Systems Manager document to restart the EC2 instance.

Configure an event source of AWS Health, a service of EC2, and an event type that
indicates instance maintenance. Target a newly created AWS Lambda function that registers an
automation task to restart the EC2 instance during a maintenance window.

Configure an event source of EC2 and an event type that indicates instance
maintenance. Target a newly created AWS Lambda function that registers an automation task to restart the EC2
instance

Use an AWS Config conformance pack to deploy the account-part-of-organizations AWS Config
rule and to automatically remediate any noncompliant accounts.

Create an AWS Lambda function to create a ticket for AWS Support to add the account to the
Enterprise Support plan. Grant the Lambda function the support:ResolveCase permission.

Add an additional value to the control_tower_parameters input to set the AWSEnterpriseSupport
parameter as the organization's management account number.

Set the aft_feature_enterprise_support feature flag to True in the AFT deployment input
configuration. Redeploy AFT and apply the changes.

Add an IPv6 CIDR block to the VPC and the private subnet for the EC2 instances. Create route table
entries for the IPv6 network, use EC2 instance types that support IPv6, and assign IPv6 addresses to
each EC2 instance.

Assign each EC2 instance an IPv6 Elastic IP address. Create a target group, and add the EC2
instances as targets. Create a listener on port 443 of the ALB, and associate the target group with the
ALB.

Replace the ALB with a Network Load Balancer (NLB). Add an IPv6 CIDR block to the VPC and
subnets for the NLB, and assign the NLB an IPv6 Elastic IP address.

Add an IPv6 CIDR block to the VPC and subnets for the ALB. Create a listener on port 443. and
specify the dualstack IP address type on the ALB. Create a target group, and add the EC2 instances as
targets. Associate the target group with the ALB.

Launch the instances in a public subnet with Elastic IP addresses attached. Once the application is
installed and running, run a script to disassociate the Elastic IP addresses afterwards.

Set up a NAT gateway. Deploy the EC2 instances to a private subnet. Update the private subnet's
route table to use the NAT gateway as the default route.

Publish the application artifacts to an Amazon S3 bucket and create a VPC endpoint for S3. Assign
an IAM instance profile to the EC2 instances so they can read the application artifacts from the S3
bucket.

Create a security group for the application instances and allow only outbound traffic to the artifact
repository. Remove the security group rule once the install is complete.

A. Use an AWS Serverless
Application Model (AWS SAM) template to define the serverless application. Use AWS
CodeDeploy to deploy the Lambda functions with the Canary10Percent15Minutes
Deployment Preference Type. Use Amazon CloudWatch alarms to monitor the health of the
functions. 

B. Use AWS CloudFormation to publish a new stack update, and include Amazon
CloudWatch alarms on all resources. Set up an AWS CodePipeline approval action for a
developer to verify and approve the AWS CloudFormation change set. 

C. Use AWS
CloudFormation to publish a new version on every stack update, and include Amazon
CloudWatch alarms on all resources. Use the RoutingConfig property of the
AWS::Lambda::Alias resource to update the traffic routing during the stack update. 

D. Use
AWS CodeBuild to add sample event payloads for testing to the Lambda functions. Publish
a new version of the functions, and include Amazon CloudWatch alarms. Update the
production alias to point to the new version. Configure rollbacks to occur when an alarm is
in the ALARM state.

Check the ApproximateAgeOfOldestMessage metric for the SQS queue. Increase the Lambda
function concurrency limit.

Check the ApproximateAgeOfOldestMessage metnc for the SQS queue Configure a redrive policy
on the SQS queue.

Check the NumberOfMessagesSent metric for the SQS queue. Increase the SQS queue visibility
timeout.

Check the WriteThrottleEvents metric for the DynamoDB table. Increase the maximum write
capacity units (WCUs) for the table's scaling policy.

Check the Throttles metric for the Lambda function. Increase the Lambda function timeout.