A. Define targets of the patch policy by specifying node tags that match the company's tagging strategy.

B. Configure an AWS Lambda function to scan for new instances and to add the instances to the targets of the patch policy.

C. Create resource group

D. Add the existing instances to the resource group

E. Configure an AWS Lambda function to scan for new instances and to add the instances to the resource groups at regular interval

F. Attach the resource groups to the patch policy.

G. Create resource group

H. Add the existing instances to the resource group

I. Create an Amazon EventBridge rule that uses an appropriately defined filter to add new instances to the resource group

J. Attach the resource groups to the patch policy.

A. Ensure that the DNS resolution option and the DNS hostnames option are turned on in the VP

B. Add the synthetics:GetCanaryRuns permission to the VP

C. On the S3 bucket, add the IgnorePublicAcls permission to the CloudWatch Synthetics role.

D. Ensure that the DNS resolution option and the DNS hostnames option are turned off in the VP

E. Create a gateway VPC endpoint for Amazon S3. Add the permissions to allow CloudWatch Synthetics to use the S3 endpoint.

F. Ensure that the DNS resolution option and the DNS hostnames option are turned off in the VP

G. Add a security group to the canary to allow outbound traffic on the DNS por

H. Add the permissions to allow CloudWatch Synthetics to write to the S3 bucket.

I. Ensure that the DNS resolution option and the DNS hostnames option are turned on in the VP

J. Create an interface VPC endpoint for CloudWatc

K. Create a gateway VPC endpoint for Amazon S3. Add the permissions to allow CloudWatch Synthetics to use both endpoints.

A. Use Amazon Detective to continuously find and uninstall unauthorized modules from the instances.

B. Use Amazon GuardDuty to create and deploy an Amazon Machine Image (AMI) that includes only the approved modules.

C. Use AWS Systems Manager Run Command to install the approved modules on all running instances during an in-place update.

D. Use EC2 Image Builder to create and test an Amazon Machine Image (AMI) that includes only the approved module

E. Update the deployment workflow to use the new AMI.

A. Create an IAM group that has a policy that allows the ec2:RunInstances action when the CostCenter-Project tag is presen

B. Place all IAM users who need access to the application accounts in the IAM group.

C. Create a service control policy (SCP) that denies the ec2:RunInstances action when the CostCenter-Project tag is missin

D. Attach the SCP to the application OU.

E. Create an IAM role that has a policy that allows the ec2:RunInstances action when the CostCenter-Project tag is presen

F. Attach the IAM role to the IAM users that are in the application OU accounts.

G. Create a service control policy (SCP) that denies the ec2:RunInstances action when the CostCenter-Project tag is missin

H. Attach the SCP to the root OU.

A. Create a Route 53 Resolver inbound endpoin

B. Attach a security group to the endpoint to allow inbound traffic on TCP/UDP port 53 from the on-premises DNS servers.

C. Create a Route 53 Resolver inbound endpoin

D. Attach a security group to the endpoint to allow outbound traffic on TCP/UDP port 53 to the on-premises DNS servers.

E. Create a Route 53 Resolver outbound endpoin

F. Attach a security group to the endpoint to allow inbound traffic on TCP/UDP port 53 from the on-premises DNS servers.

G. Create a Route 53 Resolver outbound endpoin

H. Attach a security group to the endpoint to allow outbound traffic on TCP/UDP port 53 to the on-premises DNS servers.

A. Create a copy of the AM

B. Specify the destination S3 bucke

C. Set the launch permissionsto implicit.

D. Archive the snapshot that is associated with the AM

E. Specify the S3 bucket as the archive destination.

F. Create a store image tas

G. Specify the image ID and the destination S3 bucket.

H. Use the AWS CLI copy-image comman

I. Specify the image ID and the destination S3 bucket.