Requirement Summary:
Developer uses AWS IAM Identity Center (SSO) with AWS CLI / SDKs
Initially working fine
Now receiving AccessDenied errors
No changes to config or scripts
Key Understanding:
IAM Identity Center credentials are temporary and time-limited. When you use SSO-based access via the AWS CLI (aws sso login), it obtains temporary credentials stored in the local cache.
By default, these expire in 1 hour (can be extended).
Evaluate Options:
A). Permissions to CLI binary changed
Unlikely - this would produce execution errors, not AccessDenied from AWS API B). Permission set lacks required permissions Then the error would have occurred from the beginning, not after time C). IAM Identity Center credentials expired Most likely - user hasn't refreshed credentials using aws sso login again After expiration, API calls fail with AccessDenied D). Developer is calling the wrong AWS account Would likely show different types of errors (AccountNotFound, etc.) SSO and AWS CLI: https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sso.html Troubleshooting SSO CLI: https://docs.aws.amazon.com/cli/latest/userguide/sso-configure-profile-token.html

Using a dead-letter queue (DLQ) with Amazon SQS is the most operationally efficient solution for handling unprocessable messages.
Amazon SQS Dead-Letter Queue:
A DLQ is used to capture messages that fail processing after a specified number of attempts.
Allows the application to continue processing other messages without being blocked.
Messages in the DLQ can be analyzed later for debugging and resolution.
Why DLQ is the Best Option:
Operational Efficiency: Automatically defers messages with errors, ensuring the queue is not blocked.
Analysis Ready: Messages in the DLQ can be inspected to identify recurring issues.
Scalable: Works seamlessly with Lambda and SQS at scale.
Why Not Other Options:
Option A: Logs the messages but does not resolve the queue blockage issue.
Option C: FIFO queues and 0-second retention do not provide error handling or analysis capabilities.
Option D: Alerts administrators but does not handle or store the unprocessable messages.
Steps to Implement:
Create a new SQS queue to serve as the DLQ.
Attach the DLQ to the primary queue and configure the Maximum Receives setting.
Using Amazon SQS Dead-Letter Queues
Best Practices for Using Amazon SQS with AWS Lambda

Why Option C is Correct:SQL Server Always On availability groups require a shared storage solution.
Amazon FSx for Windows File Server provides the shared storage necessary to implement Always On availability groups in a highly available configuration.
Why Other Options are Incorrect:
Option A: A single EBS volume cannot provide shared storage for Always On availability groups.
Option B: RDS does not support SQL Server Always On availability groups.
Option D: S3 is not a suitable storage tier for SQL Server database operations.
AWS Documentation References:
Amazon FSx for Windows File Server

Requirement Summary:
Lambda function accesses RDS for MySQL
Credentials are currently hardcoded in code (insecure)
Must enable automated credential rotation every 30 days
Option A: Use AWS Secrets Manager + automatic rotation
Best and secure option
Secrets Manager allows:
Secure storage of secrets
Integration with RDS for automatic rotation
Scheduled rotation every X days (e.g., 30 days)
Lambda can fetch credentials via SDK (GetSecretValue)
Option B: Use SSM Parameter Store + rotation
SSM does not support automatic rotation of secrets.
You'd need to build custom rotation logic = higher operational overhead.
Option C: Encrypted S3 + Object Lambda rotation
Not intended for credential storage.
S3 is not a secrets management system, and Object Lambda does not perform rotation.
Option D: SSM + EventBridge rotation
No native integration between Parameter Store and EventBridge for secret rotation.
You'd need to build custom Lambda functions = higher maintenance.
Secrets Manager rotation for RDS: https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotating- secrets.html Secure retrieval in Lambda: https://docs.aws.amazon.com/secretsmanager/latest/userguide/retrieving- secrets_lambda.html Integration with RDS MySQL: https://docs.aws.amazon.com/secretsmanager/latest/userguide
/integrating_rds_config.html