AWS Certified Solutions Architect – Professional — Question 382

Your team has a tomcat-based Java application you need to deploy into development, test and production environments. After some research, you opt to use
Elastic Beanstalk due to its tight integration with your developer tools and RDS due to its ease of management. Your QA team lead points out that you need to roll a sanitized set of production data into your environment on a nightly basis. Similarly, other software teams in your org want access to that same restored data via their EC2 instances in your VPC.
The optimal setup for persistence and security that meets the above requirements would be the following.

Answer options

• A. Create your RDS instance as part of your Elastic Beanstalk definition and alter its security group to allow access to it from hosts in your application subnets.
• B. Create your RDS instance separately and add its IP address to your application's DB connection strings in your code Alter its security group to allow access to it from hosts within your VPC's IP address block.
• C. Create your RDS instance separately and pass its DNS name to your app's DB connection string as an environment variable. Create a security group for client machines and add it as a valid source for DB traffic to the security group of the RDS instance itself.
• D. Create your RDS instance separately and pass its DNS name to your's DB connection string as an environment variable Alter its security group to allow access to It from hosts in your application subnets.

Correct answer: C

Explanation

Creating the RDS instance independently of Elastic Beanstalk ensures database persistence so that the data is not lost if the Elastic Beanstalk environment is terminated or rebuilt. Utilizing the RDS DNS endpoint is a best practice because RDS IP addresses can dynamically change. By establishing a dedicated client security group and referencing it in the RDS security group rules, you securely and easily grant access to both the Elastic Beanstalk instances and other EC2 instances in the VPC.