AWS Certified Database DBS-C01 Amazon Web Services Study Notes

https://docs.aws.amazon.com/dms/latest/userguide/CHAP_BestPractices.html#CHAP_BestPractices.LOBS ,

"AWS DMS migrates LOB data in two phases: 1. AWS DMS creates a new row in the target table and populates the row with all data except the associated LOB value. 2.AWS DMS updates the row in the target table with the LOB data." This means that we would need two tasks, one per phase and use limited LOB mode for best performance.

https://aws.amazon.com/about-aws/whats-new/2020/02/amazon-rds-data-api-now-supports-aws-privatelink/

The combination of changes that the database administrator must make to the database deployment to automate the collection of performance data are:

• Update the CloudFormation template to enable Amazon CloudWatch monitoring on the Aurora PostgreSQL DB instances. This will allow the database administrator to monitor the CPU utilization, memory usage, disk I/O, network throughput, and other metrics of the DB instances. CloudWatch monitoring is enabled by default for Aurora DB instances, but it can also be specified in the CloudFormation template using the MonitoringInterval property of the AWS::RDS::DBInstance resource1.
• Update the CloudFormation template to turn on Performance Insights for Aurora PostgreSQL. This will allow the database administrator to analyze the database load and identify the most resource-intensive SQL queries, hosts, or users. Performance Insights is a feature of Amazon RDS that provides an easy-to-use dashboard to visualize and troubleshoot database performance. Performance Insights can be enabled in the CloudFormation template using the PerformanceInsightsEnabled property of the AWS::RDS::DBInstance resource2.

The other options are not relevant or sufficient for the requirement of automating the collection of performance data for the Aurora PostgreSQL databases. For example:

• Turning on Amazon DevOps Guru for the Aurora database resources in the CloudFormation template is not necessary, as DevOps Guru is a service that uses machine learning to identify operational issues and risks across applications and infrastructure. DevOps Guru does not provide detailed performance data or analysis for Aurora PostgreSQL databases3.
• Turning on AWS CloudTrail in each AWS account is not sufficient, as CloudTrail is a service that records API calls and events for AWS services. CloudTrail does not provide performance data or analysis for Aurora PostgreSQL databases, although it can help with auditing and compliance4.
• Turning on and configuring AWS Config for all Aurora PostgreSQL databases is not relevant, as AWS Config is a service that tracks and evaluates the configuration changes of AWS resources. AWS Config does not provide performance data or analysis for Aurora PostgreSQL databases, although it can help with governance and security5.

Correct Answer: B

Explanation from Amazon documents:

Amazon Aurora PostgreSQL supports IAM authentication, which is a method of using AWS Identity and Access Management (IAM) to manage database access. IAM authentication allows you to use IAM users and roles to control who can access your Aurora PostgreSQL DB cluster, instead of using a traditional database username and password. IAM authentication also provides more security by using temporary credentials that are automatically rotated.

To enable IAM authentication on an existing Aurora PostgreSQL DB cluster, the database specialist needs to do the following :

• Modify the DB cluster settings to enable IAM database authentication. This can be done using the AWS Management Console, the AWS CLI, or the RDS API.
• Create IAM and database credentials for each user who needs access to the DB cluster. The IAM credentials consist of an access key ID and a secret access key. The database credentials consist of a database username and an optional password. The IAM credentials and the database username must match.
• Distribute the IAM and database credentials to the appropriate users. The users must keep their credentials secure and not share them with anyone else.
• Run the generate-db-auth-token command with the user names to generate a temporary password for the users. This command is part of the AWS CLI and it generates an authentication token that is valid for 15 minutes. The authentication token is a string that has the same format as a password. The users can use this token as their password when they connect to the DB cluster using a SQL client.

Therefore, option B is the correct solution to establish the credentials for the users to use to log in to the DB cluster. Option A is incorrect because adding the users’ IAM credentials to the Aurora cluster parameter group is not necessary or possible. A cluster parameter group is a collection of DB engine configuration values that define how a DB cluster operates. Option C is incorrect because adding the users’ IAM credentials to the default credential profile and using the AWS Management Console to access the DB cluster is not supported or secure. The default credential profile is a file that stores your AWS credentials for use by AWS CLI or SDKs. The AWS Management Console does not allow you to connect to an Aurora PostgreSQL DB cluster using IAM authentication. Option D is incorrect because using an AWS Security Token Service (AWS STS) token by sending the IAM access key and secret key as headers to the DB cluster API endpoint is not supported or secure. AWS STS is a service that enables you to request temporary, limited-privilege credentials for IAM users or federated users. The DB cluster API endpoint is an endpoint that allows you to perform administrative actions on your DB cluster using RDS API calls.