IAM Roles for Service Accounts (IRSA): IRSA allows you to associate an IAM role with a Kubernetes service account. This enables pods to assume the IAM role and access AWS resources securely.
Annotating Service Accounts: By annotating Kubernetes service accounts with the ARN of the IAM role, you establish the association required for IRSA.
OIDC Identity Provider: EKS clusters use OpenID Connect (OIDC) to authenticate service accounts. Setting up a trust relationship between the IAM role and the OIDC provider allows the Kubernetes service account to assume the IAM role.

The optimal solution for low-latency global caching with disaster recovery and cross-Region replication is to use Amazon ElastiCache Global Datastore for Redis OSS.
A Global Datastore enables fully managed cross-Region replication and supports automatic failover by promoting read replica clusters in another Region.
ElastiCache ensures encryption in-transit and at-rest, meeting compliance and security requirements.
It ' s a fully managed AWS-native feature, reducing operational effort compared to setting up DMS-based or snapshot-based replication manually.
Other options (A, C, D):
Require manual setup and management (e.g., custom DMS pipelines, snapshots).
Do not offer real-time replication or failover without manual intervention.
# Reference:
ElastiCache Global Datastore for Redis

AWS guidance is to deploy one NAT gateway per Availability Zone for production workloads to improve resiliency and avoid cross-AZ dependency. However, the question explicitly says only production requires high availability. In non-production environments, the company can reduce cost by keeping a single NAT gateway and updating private-subnet route tables to use that remaining gateway. This saves hourly NAT gateway charges while preserving internet egress for private subnets. Reducing Availability Zones would affect more than NAT cost and would also weaken overall environment design. NAT instances add operational overhead compared with a managed NAT gateway. A transit gateway is unrelated to this cost problem. Therefore, keeping one NAT gateway per AZ for production and reducing to one NAT gateway in non-production is the most cost-effective answer.

The requirement combines two key goals: reduce post-migration database administration/maintenance cost and minimize application rewrites for an existing Microsoft SQL Server application that relies heavily on T-SQL and stored procedures. Amazon Aurora PostgreSQL-Compatible with Babelfish is designed for this exact migration pattern: it helps applications written for SQL Server to run with reduced code changes by providing compatibility for commonly used SQL Server semantics, including T-SQL constructs, procedural logic, and SQL Server-style connectivity patterns (depending on feature usage). Aurora itself is a managed database service that reduces operational overhead compared to self-managed databases by offloading tasks such as provisioning, patching (within service capabilities), backups, and high availability patterns.
Option C (RDS for SQL Server) would indeed minimize rewrites because it keeps the engine the same, but it typically does not optimize operating costs as effectively as migrating off commercial SQL Server licensing
/edition costs; it also keeps you on the same engine family, which often carries higher license implications and may not meet the "minimize operating costs" intent as strongly as moving to Aurora PostgreSQL with Babelfish. Option B is not suitable because Redshift Spectrum is for analytics over data in S3, not for running an OLTP ecommerce database with stored procedures. Option D is also a mismatch: EMR is for big data processing frameworks, not a relational OLTP database replacement for SQL Server.
Therefore, A best balances lower ongoing operational cost with reduced refactoring effort by using Aurora's managed capabilities while leveraging Babelfish to ease SQL Server-to-PostgreSQL migration friction.

When on-premises DNS servers need to resolve private DNS names in a VPC, the correct pattern is to create a Route 53 Resolver inbound endpoint. The inbound endpoint allows DNS queries to flow from the on-premises environment into the VPC, where Route 53 can resolve VPC-specific names (such as private hosted zones or private resource records). Outbound endpoints (C) are for sending VPC DNS queries to on-premises, not the reverse. Verified Access (A) is unrelated to DNS resolution. Direct Connect (B) provides network connectivity but does not provide DNS forwarding capabilities. Therefore, option D is the correct design.
References:* Amazon Route 53 Resolver Developer Guide - Inbound and outbound endpoints* AWS Well- Architected Framework - Security Pillar: Hybrid DNS integration