This solution uses CloudFront to serve the website securely over HTTPS using AWS Certificate Manager (ACM) for SSL certificates. Origin Access Control (OAC) ensures that only CloudFront can access the S3 bucket directly. AWS WAF with an IP set rule restricts access to the website, allowing only the on-premises IP address. Route 53 is used to create an alias record pointing to the CloudFront distribution. This setup ensures secure, private access to the website with low administrative overhead.
* Option A and B: S3 bucket policies and access points do not provide HTTPS support, nor do they offer the same level of security as CloudFront with WAF.
* Option D: Signed URLs are more suitable for temporary, expiring access rather than a permanent solution for on-premises employees.
AWS References:
* Amazon CloudFront with Origin Access Control

At 10 Mbps, the maximum transferable data in 30 days is far below 200 TB, making any online transfer (Options A, B, C) impossible within the time window.
AWS Snowball Edge storage-optimized devices support high-speed, offline bulk data migration of large datasets. Once the data is delivered to S3, FSx for Lustre can be linked to the S3 bucket to populate the Lustre filesystem.
DataSync cannot meet the time constraint over 10 Mbps. Storage Gateway is not designed for large-scale migrations.

To process each form exactly once and ensure no data is lost, using an Amazon SQS FIFO (First-In-First-Out) queue is the most appropriate solution. SQS FIFO queues guarantee that messages are processed in the exact order they are sent and ensure that each message is processed exactly once. This ensures data consistency and reliability, both of which are crucial for processing user-submitted forms without data loss.
SQS acts as a buffer between the web application server and the worker tier, ensuring that submitted forms are stored reliably and forwarded to the worker tier for processing. This also decouples the application, improving its scalability and resilience.
* Option B (API Gateway): API Gateway is better suited for API management rather than acting as a message queue for form processing.
* Option C (SQS Standard Queue): While SQS Standard queues offer high throughput, they do not guarantee exactly-once processing or the strict ordering needed for this use case.
* Option D (Step Functions): Step Functions are useful for orchestrating workflows but add unnecessary complexity for simple message queuing and form processing.
AWS References:
* Amazon SQS FIFO Queues
* Decoupling Application Tiers Using Amazon SQS

The IAM policy includes two statements:
1## Allow ec2:TerminateInstances on all resources
2## Deny ec2:TerminateInstances if the request does NOT come from:
* 192.0.2.0/24
* 203.0.113.0/24
AWS IAM policy evaluation rules state:
* Explicit Deny always overrides Allow.
* A request must meet all applicable conditions in the policy to be granted.
* aws:SourceIp condition applies when IAM actions are invoked via the public AWS APIs.
In this scenario, the administrator is not originating the request from one of the allowed CIDR blocks, so the Deny condition is triggered, overriding the Allow statement.
Therefore, the operation is blocked with:
403 AccessDenied: explicit deny
This matches the behavior described in the AWS IAM Policy Evaluation Logic used in the Security Pillar of the Well-Architected Framework:
* Explicit Deny > Allow > Default Deny
* IP-based Conditions restrict API calls originating outside approved network ranges Options A/B/C do not accurately reflect this explicit Deny condition behavior.

AWS Budgets is the correct service because it is built to track AWS costs and usage and to take action when thresholds are reached. In this scenario, the company explicitly doesnotwant automatic resource restriction, so the right pattern is to use budget thresholds and define an action path that supportsmanual review. AWS documentation explains that AWS Budgets can monitor costs and trigger budget actions, and it also supports forecast-based alerts, which help identify likely overruns as early as possible. Daily reports alone are slower and less proactive, while automatic restrictions violate the requirement. Service control policies are not the mechanism used to define spending thresholds themselves. A Budgets-based workflow is therefore the cleanest and most appropriate solution. (AWS Documentation)