Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS SOA > 1. MAAREK > Flashcards

1. MAAREK Flashcards

1
Q
A

Multi-AZ Resharding:
Multi-AZ: Indicates support for running Redis in multiple availability zones (AZs) to enhance fault tolerance and high availability.

Resharding: Refers to the process of redistributing data across nodes, possibly to accommodate changes in the cluster size or improve load distribution.

Online and Offline Resharding:
Online Resharding: This suggests that the resharding process can be performed without taking the cluster offline, ensuring continuous availability.

Offline Resharding: In some cases, resharding might require the cluster to be taken offline temporarily. This can impact availability during the process.

Maximum of 5 Read Replicas (RR) per Cluster:
Read Replicas: Additional nodes that replicate the data from the primary node for read-heavy workloads.

Limitation: The cluster is configured to support a maximum of 5 read replicas.

Cluster Scaling:
Scaling: The ability to add or remove nodes dynamically to adapt to changing workloads.

Tasks Spread Across Nodes: This suggests that the cluster distributes tasks or data across its nodes to balance the load.

New Nodes Immediately Updated:
Dynamic Updates: Changes or additions to the cluster, such as the creation of new nodes, are immediately reflected in the cluster’s state.

Important Considerations:

High Availability (HA): Multi-AZ deployment and the ability to perform online resharding are key elements for ensuring high availability.

Performance: Read replicas and the ability to scale the cluster contribute to improved performance and the ability to handle increased workloads.
These features and capabilities are typical in a Redis cluster that is designed for scalability, fault tolerance, and high availability, which are essential for many production systems. If you have specific questions or if there’s a particular aspect you’d like more information on, feel free to ask!

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Memcached

A

Addition of New Nodes:
Horizontal scaling involves adding more nodes to the system to handle increased load.
New nodes can be dynamically added to the cluster.
Autodiscovery Function: There is a function in place that automatically discovers and updates all new nodes in the cluster.

Limit: The system is designed to handle a maximum of 40 nodes.

Vertical Scaling:
Node Upgrade Limitation:
Vertical scaling involves upgrading the existing nodes to handle increased load.
Limitation: Memcached nodes cannot be upgraded directly. Instead, the approach is to swap out the old node for a new one. This typically involves taking the old node offline during the process.

Empty New Nodes:
When adding new nodes through vertical scaling, these nodes start empty and do not retain the data from the old node.
Application Reload: To fill the new nodes with data, the application needs to reload the data. This implies a potential data migration or reloading process.

Offline Swap:
Vertical scaling often involves taking the old node offline during the swap process.

Data Loading Requirement:
The mention of “new nodes are empty” suggests that when a new node is introduced through vertical scaling, it doesn’t automatically inherit the data from the old node. The application needs to handle the reloading or migration of data.
Both horizontal and vertical scaling have their trade-offs and are chosen based on specific use cases and requirements. Horizontal scaling offers more flexibility in handling increased load dynamically, while vertical scaling involves upgrading the capacity of the existing resources to handle additional load. The decision between them often depends on factors such as system architecture, performance requirements, and the nature of the application

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

REDDIS RR vs RESHARDING

A

Read Replicas (RR) and resharding are two distinct concepts in the context of distributed systems like Redis.

Read Replicas (RR):
Purpose:
Read Scaling: Read Replicas are used to scale read operations in a distributed database system.
Improved Performance: By offloading read operations to replicas, the primary node is freed up to handle write operations.
Functionality:
Data Replication: Data from the primary node is replicated to the Read Replicas.
Read-Only: Read Replicas are typically read-only nodes, meaning that they can’t accept write operations.
Availability:
Fault Tolerance: Read Replicas provide fault tolerance. If the primary node fails, one of the replicas can be promoted to become the new primary.
Consistency:
Eventual Consistency: Depending on the replication mechanism, there might be some delay (latency) between the primary node and the replicas, resulting in eventual consistency.

Resharding:
Purpose:
Write Scaling: Resharding is a process used to scale write operations and distribute data more evenly across nodes in a cluster.
Dynamic Load Balancing: It allows for redistributing data to accommodate changes in workload or cluster size.
Functionality:
Data Redistribution: Resharding involves moving data from one set of nodes to another, typically to balance the load or accommodate changes in the cluster.
Availability:
Impact on Availability: Resharding might require taking the cluster offline temporarily or have some impact on availability during the process, depending on the implementation.
Consistency:
Maintaining Consistency: Resharding must ensure that data consistency is maintained during the redistribution process.
Key Differences:
Purpose: Read Replicas are primarily for read scaling, while resharding is for write scaling and dynamic load balancing.
Functionality: Read Replicas replicate data for improved read performance, while resharding redistributes data to optimize the distribution of writes.
Impact on Availability: Read Replicas provide fault tolerance without much impact on availability, while resharding might have some impact, especially if it involves taking the cluster offline temporarily.
In summary, Read Replicas and resharding serve different purposes in a distributed system. Read Replicas focus on improving read performance and fault tolerance, while resharding is about optimizing the distribution of writes and dynamically balancing the cluster.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Elasticache eviction issues

A

Eviction Scenario:
Cause: Low capacity in the system, leading to the need to remove data to make space for new data.
Solutions:
Scale Up or Scale Out:
Scale Up (Vertical Scaling):
Description: Increase the capacity of individual nodes by changing to larger nodes.
Advantages: This provides more resources (CPU, memory) to handle increased load.
Considerations: There might be limits to how much you can scale up, and larger nodes could be more expensive.
Scale Out (Horizontal Scaling):
Description: Add more nodes to the system to distribute the load.
Advantages: This provides increased capacity by distributing the workload across multiple nodes.
Considerations: This approach often offers better scalability, but it requires a distributed architecture.
Change Eviction Policy:
Description: Modify the eviction policy to allow for the early retirement of non-current data.
Example: You might consider changing the eviction policy to prioritize removing less frequently accessed or older data.
Considerations: This can help manage space more effectively, but it’s important to align the eviction policy with the application’s requirements.
Considerations:
Eviction Policy:
The choice of eviction policy depends on the nature of your application and the importance of different types of data.
Common eviction policies include
LRU (Least Recently Used),
LFU (Least Frequently Used), and others.

Monitoring:
Regularly monitor the system to identify trends in data access patterns and capacity usage.
Capacity Planning:
Plan for future growth and consider both vertical and horizontal scaling strategies.
Cost and Performance Trade-offs:
Consider the cost implications and performance trade-offs associated with scaling up or scaling out.
In summary, addressing eviction issues involves a combination of capacity planning, scaling strategies, and tuning the eviction policy to align with the application’s requirements. The choice between scaling up and scaling out depends on your specific use case and requirements.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Ssh syntax

A

ssh -i keypair.pem ec2-user @10.0.0.0

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Check which network adapter/interface is present in the instance

A

ethtool -i eth0

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Enhance Networking

A

Enabled by default on Amazon Linux2 AMI.
However, wether the instance type harnesses it depends on the instance type.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Changing instance type

A

Only ebs backed instances can have an instance upgrade.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Cluster placement advantage

A

Low Latence, High bandwidth high PPT

Best for HPC

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Partition placement

A
  • Max of 7 partitions per az
  • Can be across Azs
  • Partition information can be found in the instance’s metadata.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Partition placement use case

A

Application has to be partition aware(ability to distribute data across instances within the cluster)

Tightly linked distributed systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Ec2 Vcpu limits

A

Only applicable to On-demand and Spot instances

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Insufficient capacity error

A

Aws does not have free instance available for you in a particular az

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Ssh troubleshooting

A

Instance connect uses one of the reserved ip ranges for your region. As long as port 22 is opened, instance connect picks up one of the ip’s and connects. Be careful when whitelisting a CIDR range for ssh in-bound, because if the reserved range is not whitelisted, it is implicitly blacklisted.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Cloud watch Metrics types

A
  1. Basic (Default 5mins, enhanced 1minute)
    - CPU usage, CPU Credit
    - Disk (instance store only)
    - Network
    - Status check
  2. Custom (Default 1min, High Res1sec)
    - Ram
    - Application level
    - Requires an IAM role
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Procstat plugin

A

Collects system and application level metrics of individual processes for Cloudwatch agent (WINDOWS AND LINUX)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

Terminal
Upgrade privilege

A

~sudo su

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Terminal
Install Apache

A

~ yum install httpd

~ echo “Hello world” > var/www/html/index.html

To enable apache
~ sudo systemctl start httpd

To persist through system restarts
~ systemctl enable httpd

$(hostname)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Httpd server logs examples

A

~ cat var/log/httpd/access_log

~ cat var/log/httpd/error_log

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Cloudwatch Logs vs Metrics

A

Logs - Report(text files)
Metrics - measurements(graphs)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Troubleshoot ec2 status failure (system) ?

A

Migrate Instance to another host (Stop and start instance)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Cloudwatch system recovery (triggered by a configured CW Alarm

A

Maintains system’s public/private IP, Elastic IP, Metadata, and placement group.

Examples of problems that require instance recovery:

  • Loss of network connectivity
  • Loss of system power
  • Software issues on the physical host
  • Hardware issues on the physical host that impact network reachability

If your instance fails a system status check, then you can use CloudWatch alarm actions to automatically recover your instance. The recover option is available for over 90% of deployed Amazon EC2 instances. However, the recover option works only for system check failures, not for instance status check failures.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

AMI create volume permission

A

a created AMI can be encrypted or decrypted with the relevant permissions.

Can be shared privately(with an account or ARN)

permission to Copy can also be granted to the receiving account or organization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

EBS Multi-attach

A

only available to io1/io2

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

SSM Manager

A

By default, the SSM manager is already installed on Amazon Linux 2

The SSM manager can work on both vMs and on-premises instances

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Troubleshooting the SSM manager

A
  1. Permission issues
  2. Corrupt reinstall the agent
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Resource group purpose

A

To Automate patching and managing resources at group level

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

SSM Documents

A

the configuration scrip for all planned operations

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

SSM SSH

A

SSM does not need SSH or HTTP, the agent connects to ssm by itself

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

SSM Run command

A
  1. Executes the Document
  2. Error and Rate control
  3. Integrated with IAM and Cloudtrail
  4. Runs command on multiple instances and groups
  5. No need for SSH(Magical)
  6. Command output printed on the screen or can be sent to S3 or cloud watch
  7. Status can be viewd on console
  8. Can be invoked using events Brige
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

SSM get parameter

A

aws ssm get-parameters –names <parameter> <parameter></parameter></parameter>

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

SSM inventory

A

(SSM) Inventory is a feature that enables you to collect metadata from your managed instances. It provides a detailed view of your infrastructure, making it easier to understand its current state and track changes over time.

Here’s a brief overview of how SSM Inventory works:

Data Collection: You can configure SSM Inventory to collect information such as installed applications, network configurations, OS updates, and more from your EC2 instances or on-premises servers.

Resource Data Sync: Collected data can be stored in an Amazon S3 bucket or in an AWS Systems Manager Association. This allows you to centralize and aggregate inventory data from multiple AWS accounts and regions.

Querying and Reporting: You can use AWS Config or the AWS Systems Manager Console to query and generate reports based on the collected inventory data. This helps you understand the state of your resources and their configurations.

Automation: You can use inventory data to create automation workflows, such as triggering actions based on changes detected in the environment.
To set up SSM Inventory, you typically need to:

Configure Inventory Collection: Use SSM Documents to specify what inventory data you want to collect. These documents are associated with an inventory configuration.
Define Inventory Configurations: Create an inventory configuration that references your SSM Documents. This configuration specifies the type of data you want to collect.
Attach Inventory Configurations: Associate inventory configurations with your managed instances.
View and Query Data: Use the AWS Management Console, AWS CLI, or APIs to view and query the collected inventory data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

SSM State
manager

A

manages the state of nodes in a group, ensuring that the inventory is always equal to the defined state

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

SSM Inventory

A
  • data can be viewed on the console,
  • stored on s3,
  • Querried and analyzed using quicksight and Athena
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Elb Sticky Sessions

A

Always redirect a specific client request to a particular server/instance by adding a cookie to the request

Can cause load imbalance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

ELB Helth checks

A

If a target group contains only unhealthy targets, ELB routs requests across its unhealthy targets. This is usually the case during warmup/booting

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

ELB

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

ELB Access Logs

A

ELB Access Logs are encrypted by default

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Lambda permission

A

Resource policy - another resource invoking lambda (Synchronous invocation)

Execution Policy - Lambda polling another service for jobs(Asynchronous)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Lambda Function throttling

A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

DLM

A

DLM does not work with instance store

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

DLM

A
  • Uses Tags to identify resources
  • DLM Creates snapshots and AMIs
  • Cant be used to manage - Snapshots/AMIs created outsid DLM
  • can not be used to manage instance store backed AMIs
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

EBS Multi attach

A
  • Max 16 instances
  • File system that must be cluster-aware
  • can only happen within a single AZ
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

one iam role can contain multiple policies

A

true

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

New EBS prep

A

After EBS size is increased, partitioning must be carried out befor the new space is useable.

You cannot redue the size of an ebs volume

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

EFS Operations

A

certain operations can be performed on the go, while some cant.

In Place -
- LifeCycle Policy
- Throughput mode and provisioned throughput number
- EFS Access Point

Requires Migration (using Datasync)-
- encryption
- Decryption
- Performance mode(eg, max i/o)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

S3 Replication

A

replicates only newer objects,
in order to replicate older files, use s3 BatchReplication

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

S3 Analytics

A

requires 24-48hrs after activation in order to start generating data analysis reports.

Its recommendation does not work for Standard IA and Glacier

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

S3 Multi-Part

A

recommended for objects above 100MB

mandatory for objects > 5G

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

s3 Transfer acceleration

A

Upload and download

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

S3 select

A

retrieving only the data needed as against having to retrieve a bulk before filtering or ETL using sql. It’s only meant to use for a subset of data.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

S3 Batch operation

A

to perform bulk operations on existing S3 objects with a single request
eg,

modify object metadata
modify object properties
copy objects between s3 buckets
encrypt an unencrypted object
modify acl tags
restore objects from S3 glacier
invoke lambda function to perform a custom operation on an object

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

S3 inventory

A

comprehensive report on the objects in our bucket

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

S3 glacier

A

you can place a file into S3 Glacier same minute you create it.

Glacier operates two types of policy
Glacier Vault - like a bucket in Glacier

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

Glacier retrieval methods

A

Expedited (Minutes to seconds) - you will need to purchase capacity unit
Standard 3-5hrs
Bulk 5-12Hrs

** In between the restoration time, there has to be some sort of a Notification job to facilitate the asynchronous process; S3 Events Notification(restore initiated and complete) or Events bridge

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

Glacier Vault Policies

A

Strong access Policies for strict regulatory or compliance on the files in glacier.

Vault lock is immutable/irreversible

Vault lock is completed by re-entering the lock iD back into the vault lock

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

Upload files to glacier

A

This is not possible via the console, you would have to use the API, CLI or SDK

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

Multipart upload

A

Divide and conquer algorithms

Split and upload files in parallel, then concatenate them at the receiving end.

  • Multipart upload is done in part and in any order
  • recommended for uploading files >100MB and
  • mandatory for files >5GB

Use life cycle policies to handle the failed upload(There’s a lifecycle preset for Multipart)

**Multipart is only available via CLI/SDK

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

Athena

A

Serverless machine Queries and analysis files in S3 without moving the data using SQL.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

Athena best practice

A

use columnar data for cost savings. They perform fewer and faster scan. eg, (ORC, Apache Parquet)

Compress data for smaller retrievals
Partition your files to ease queries.

use folder/path structure to ease queries, directly querying a specific directory/prefix

Performs better with larger files

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

SSE KMS

A

Uses API calls to and from KMS for decryption, this may result into a situation whereby KMS may run into throttling.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

SSE-C

A

All SSE-C must be encrypted in transit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

Enforce TLS for client requests

A

condition

“aws:securetransport”: true

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

SSE-C on the console

A

Can only be done over CLI and not allowed in the console

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

MFA delete

A
  • Only Root user can enable
  • Can only be enabled via the AWS CLI, AWS SDK, or the Amazon S3 REST API
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

S3 Retention Mode

A

Compliance - Strict and immutable
Government - privileged principals can change versions and retention mode

retention period for both is fixed

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

S3 Legal Hold
(s3:PutLegalHold)

A
  • can protect the object indefinitely irrespective of the retention mode or period
  • the identity with the permission can deactivate this mode(internet or vpc)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

S3 access point policy

A

is a scaled-down bucket policy to specific prefixes.

this policy grants exclusive access to specific prefixes/directories and limits all access to that prefix

a single access point policy can contain access to more than one prefix

each access point will have its own DNS name

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

Gateway Policy

A

This is also known as an access point policy allowing access to a target prefix from the vpc

70
Q

Cross region access point

A

there’s an implicit creation of CRR when a cross-region access point is created.

71
Q

Fsx for Windows 💨

A

Fsx for windows can also be mounted on a Linux server

72
Q

Luster (Linux Cluster)

A

for HPC
R/W with S3 is seamless
accesible via Dx and VPN

resides on single AZ
Scratch file system - single copy of data
Persistent file system - Duplicates data in same az, but can persist data to S3

73
Q

fsx file gateway

A

gateway for windows

74
Q

Fsx net On Tap

A

for migrating NET ON TAP servers to AWS.
compatible with all popular OS

75
Q

Storage Gateway

A

file gateway
- Linux compliant
- file system(SMB,NFS) backs up to S3

Volume gateway
- For Block storage
- Cached or Stored gateway applies to the nature of the Local Configuration

76
Q

Storage Gateway Lifecycle management

A

File Gateway(Linux file system) - Restart

Volume gateway(Block Storage management) - Stop gateway, retart server, then start/ attach gateway

77
Q
A
78
Q

RDS on EC2 instance

A

Fully automated OS patching, fully managed DB, no user access for underlying instance

79
Q

RDS RR vs Multi AZ

A

RR
- Asynchronous
- On fail over promotion, application has to update read/writer endpoint

Multi-AZ
- Synchronous replication
- Inter AZ-Transfer fee = free
- Auto failover to Standby in case of AZ failure

80
Q

RDS Single to Multi AZ conversion

A

On the go, Zero downtime operation.

Just modify

81
Q

RDS EBS Autoscaling and threshold setting

A

the threshold sets a limit for the Autoscaling

82
Q

RDS IAM Auth

A

allows users to login to the database using their IAM credentials.

83
Q

RDS Deployment options

A

Multi-AZ DB Cluster
Creates a DB cluster with a primary DB instance and two readable standby DB instances, with each DB instance in a different Availability Zone (AZ). Provides high availability, data redundancy and increases capacity to serve read workloads.

Multi-AZ DB instance
Creates a primary DB instance and a standby DB instance in a different AZ. Provides high availability and data redundancy, but the standby DB instance doesn’t support connections for read workloads.

Single DB instance
Creates a single DB instance with no standby DB instances.

84
Q

troubleshooting RDS

A
  1. endpoint
  2. Security group ingress setting:
    protocol: MysQL/MariaDB
    port 3306
85
Q

RDS Best Practices

A

If one of these instances (secondary) is launched in a private subnet and the primary is launched in a public subnet, after a Multi-AZ failover the RDS instance becomes inaccessible to the public network because the promoted secondary (new primary) instance was launched in the private subnet.

  1. In addition to disabling public access at the subnet level, Amazon RDS provides a feature to enable or disable public access to the respective instances. Even if an instance is launched in a public subnet for any reason, it’s still possible to disable internet access to the instance by disabling public access. When you disable public access on the RDS instance, RDS end point resolve to private IP address only and accessible to the instances in the same VPC (or VPC connected via other means like VPC peering).
  2. If all your applications servers are in the same VPC as your RDS instance, consider disabling public access to the instance. Furthermore, to help developers or admins who need access to the RDS instance to perform required tasks, create bastion instances in the same VPC as the RDS instances. These bastion instances have public access (with proper security group rules), and users (developers and admins) can connect to the bastion instances via the internet and connect to the RDS instance from the respective bastion instances
  3. In addition to having least privilege to AWS APIs, it’s very important to perform regular audits on the security rules to ensure that public access to any instance isn’t enabled due to human or automation errors. In these cases, it’s recommended to use AWS Config to create rules to check for any changes and perform remediation automatically. For example, we can create an AWS Config rule to identify any RDS instances with public access enabled and perform remediation using managed rules (rds-instance-public-access-check). In a similar way, we can utilize existing managed rules or create custom rules to perform required checks and remediation.
  4. Restrict access to cloud users on Amazon RDS using IAM

5,6,7. Additional logging and monitoring

You can use the following services and features for additional logging and monitoring:

AWS CloudTrail – CloudTrail provides a record of actions taken by a user, role, or AWS service in Amazon RDS. CloudTrail captures all API calls for Amazon RDS as events, including calls from the Amazon RDS console and from code calls to Amazon RDS API operations. It’s important to monitor the API calls to understand the different operations performed by the users and applications in your AWS account. This can help you perform audits on different operations and manage permissions. It’s also helpful to provide an incident report when unintended operations are run on Amazon RDS resources. For more information, refer to Monitoring Amazon RDS API calls in AWS CloudTrail.

Amazon RDS recommendations – This feature is enabled by default and provides recommendations on different details related to the DB instances, read replicas, and parameter groups. These recommendations provide best practice guidance by analyzing DB instance configuration, usage, and performance data. For example, any pending engine version upgrades or instance maintenance operations are included in the recommendations. You can consider taking action on the provided recommendations immediately or in the following maintenance window.

Amazon RDS event notifications – Event notifications are the best way to track changes and get notifications when an Amazon RDS event occurs. For example, if you subscribe to a configuration change category for a DB security group, you’re notified when the DB security group is changed. This helps you address unintended changes immediately and take appropriate action to remediate them.

AWS Trusted Advisor – Trusted Advisor draws upon best practices learned from serving hundreds of thousands of AWS customers and helps close any security gaps in your AWS account. With respect to Amazon RDS security, Trusted Advisor checks for any security group access risks. For more information, refer to AWS Trusted Advisor check reference.
Automatic minor version upgrades

86
Q

Lambda residnce

A

outside vpc(in aws owned vpc
lambda can only talk to your public endpoints)

Launch Lambda in a vpc so as you do not have to expose your rds to the public

Once defined, lambda will create an ENI using the right permissions

87
Q

RDS TooManyConnections

A

lambda scales out and is overpowering the RDS, Solution? RDS PROXY

88
Q

RDS Proxy-Lambda connection

A

if the RDS Proxy is in a pubic subnet, then no need to deploy lambda in the vpc.

RDS closes idle collections(handles lambda scale-in)

RDS proxy supports IAM Auth

Supports DB Password Auth

is inherently Autoscaling

89
Q

DB Parameter group

A

Parameter Group is a collection of database engine parameter values that can be applied to one or more database instances. These parameter groups allow you to configure various settings for your RDS instance, including security, performance, and behavior.

A Parameter Group in Amazon RDS is a set of parameters that define the configuration settings for a particular database engine. These parameters can control various aspects of the database, such as memory allocation, logging, backup behavior, and security settings.
Importance: Parameter groups are important because they allow you to customize the behavior of your database instances without modifying the instance itself. This helps in maintaining consistency across multiple instances and makes it easier to manage and update configurations.
Use Cases:
Security: You can use parameter groups to set security-related parameters, such as controlling access, enabling encryption, or configuring SSL.
Performance: Parameters related to performance tuning, cache sizes, and query optimization can be adjusted using parameter groups.
Behavior: Parameters that govern the behavior of the database engine, such as the handling of connections, transaction timeouts, and logging, can be configured.
Dynamic Nature:

Explanation: Parameter groups are dynamic, meaning you can modify the parameter values in a group at any time, and these changes will be applied to the associated database instances.
Example: If you need to adjust the maximum number of allowed connections or change the log retention period, you can do so by modifying the parameter group without requiring a reboot of the RDS instance.
In summary, Parameter Groups in Amazon RDS play a crucial role in configuring and customizing the behavior of your database instances, and their dynamic nature allows for flexibility in adapting to changing requirements.

90
Q

DB Parameter group activation

A

DB instance always needs a restart in order to kickstart a parameer group into action

91
Q

DATABASE Restore

A

Both Backup and snapshots will create a new database. They do not do an in-place restore

92
Q

RDS Snapshot sharing

A

Manual snapshots can be shared, while Automated snapshots cannot be shared.

93
Q

RDS recommendations

A

Amazon RDS recommendations – This feature is enabled by default and provides recommendations on different details related to the DB instances, read replicas, and parameter groups. These recommendations provide best practice guidance by analyzing DB instance configuration, usage, and performance data. For example, any pending engine version upgrades or instance maintenance operations are included in the recommendations. You can consider taking action on the provided recommendations immediately or in the following maintenance window.

94
Q

RDS event notifications

A

RDS event notifications – Event notifications are the best way to track changes and get notifications when an Amazon RDS event occurs. For example, if you subscribe to a configuration change category for a DB security group, you’re notified when the DB security group is changed. This helps you address unintended changes immediately and take appropriate action to remediate them.

95
Q

S3 operations exclusive to CLI/SDK

A
  • Multipart upload
  • SSE-C
  • CSE must be encrypted(securetransportenable-true)
  • upload files straight to glacier
96
Q

RDS - Cloudwatch integration

A

to be able to access VM-level logs, Cloudwatch uses its native rds agent to gather system-level metrics

97
Q

RDS performance insights

A

once enabled(right click, modify), RDS performance Insight can filter metrics by
- By waits - which resource?(CPU,IO, etc)
- By SQL statements - which sql querry ?
- By Hosts - which Host
- By users - who?

98
Q

Aurora

A

Distributed writes ( two copies of write per AZ

99
Q

Aurora Reader/Writer Endpoints

A

both acts as a single access point to all RR and write heads. Under the hood, aurora performs Autoscaling on RR to maintain the required number of RR while maintaining a single access point; Reader endpoint.

Maintaining a Single Access Point (Reader Endpoint): Despite autoscaling on Read Replicas, Aurora maintains a single access point for read operations through the Reader endpoint. This simplifies the application’s connection management, as the application can always connect to the same endpoint for read operations, and Aurora handles the distribution of those reads across available replicas.

100
Q

Aurora Regional cluster

A

There’s a minimum instance requirement to enable a cross region cluster

101
Q

PITR vs Back tracking

A

PITR (Backup)- is a recovery process, and RDS/Aurora recovery involve restoring the db; spinning up a new db.

Backtracking - in-place restore, simply rewind to an earlier time (<=72hrs)

102
Q

Aurora RDS Encryption

A

Must be done at Launch time.

Optionally, on a running DB, encryption can only be done via snapshot and restore process.

103
Q

RDS and Aurora audit logs

A

short-term logs. Retainable logs would include the use of cloudwatch.

104
Q

Migrating RDS to Aurora

A

Yes, RDS snapshot can be migrated to Aurora

105
Q

RR promotion

A

Aurora follows the declared priority:
1. Highest priority is promoted first
2. Or the Replica with the largest size in a case of equal priority
3. else, a random Replica

106
Q

Elasticache

A

Makes our db stateless by taking off all the read workload from the db

Can be used to store session data to enhance statefulness

107
Q

Elsaticache connectivity

A

use of elasticache would neccesitate heavy application code changes

108
Q

Reddis

A

HA
Backup and restore features
Data durability
Multi-AZ with Auto-failover
Sets and sorted sets support

109
Q

memcached

A
  • Multinode for partitioning of data(Sharding), but all in a single AZ
  • No HA
  • No data persistence
  • No backup and restore
  • Multithreaded architecture
110
Q

Reddis cluster

A

Each reddis cluster has one write node and max 5 RR
All replicas are asynchronous
Primary Node does R/W
One shard = One cluster

Cluster mode disabled:
Data is replicated betweeen shards/Nodes

Cluster mode enabled:
Data is spread between shards

111
Q

Important metrics to monitor

A
  • Cache evictions(memory overload
  • swap usage
  • current Connection
  • CPU utilization
  • DatabaseMemoryUsagePercentage
  • NetworkBytesIn, NetworkBytesOut
  • ReplicationBytes
  • ReplicationLag
112
Q

RDS Storage scaling

A

you can only scale RDS storage once in 6Hours

113
Q

Aurora DB Automatic Backup

A

Can not be disabled

114
Q

AWS cloudwatch put-metric-data <–flag1 – flag2 –flagn>

A

for sending custom metrics to cloudwatch

115
Q

common CW metrics

A

put-metric-data
–namespace ‹value›
[–metric-name <value›]
[–metric-data <value›]
[–timestamp <value>]
[--unit < value›] [--value < value>]
[--dimensions <value›]
L--statistic=values <value>]
L--storage-resolution <value>]
[--cli-input-json | --cli-input-yam1]
[--generate-cli-skeleton <value>]</value></value></value></value>

116
Q

CW agent

A

unified cloudwatch just does a consistent put-metric-data API calls regularly

117
Q

CW Custom metrics

A

for sending Custom metrics eg, logged in users count, RAM, Disk space, etc

Resolution
Standard: 1min
High res: 1 or 5 or 15 or 30s

Accepts data point from upto -14days past to 2hrs retrospect.

Has the ability to segment metrics into attributes

118
Q

CW Dashboard xteristics

A
  • can display metrics from different accounts in different regions
  • you can change the time zone of the dashboard
  • you can setup automatic refresh
  • you can share dashboard with a non aws identity
119
Q

CW logs insight

A

Data Query feature/engine within cloudwatch that presents its result in both log lines(text) and a visualizer

results(logs) can either be exported(CreateExportTask API)
or saved for future use

Can querry multiple log groups simultaneously

120
Q

Log data consistency

A

Not near real time - log data can take upto 24hrs to become available for export.

121
Q

Cloudwatch logs subscription

A
  • for realtime log eventsfrom cloudwatch logs for processing and analytics.
  • data can be streamed to kineses
  • to lambda
  • you can specify the subscription filter of the target logs
122
Q

Cloudwatch Troubleshooting

A

The following issues can prevent the unified CloudWatch agent from pushing log events:
- Out-of-sync metadata caused by creating an Amazon Machine Image (AMI) after the CloudWatch agent is installed
- Using an outdated version of the CloudWatch agent
- Failure to connect to the CloudWatch Logs endpoint
- Incorrect account, Region, or log group configurations
- Insufficient AWS Identity and Access Management (IAM) permissions
- CloudWatch agent run errors
- Timestamp issue
To push log events to the CloudWatch service, the CloudWatch agent requires credentials from either the IAM user or the IAM role policy.

123
Q

VPC Flow logs definition ad scope

A

VPC Flow Logs is a feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC. Flow log data can be published to Amazon CloudWatch Logs and Amazon S3. After you’ve created a flow log, you can retrieve and view its data in the chosen destination.

124
Q

NAT Gateway best practice

A

To create a NAT gateway, you must specify the public subnet in which the NAT gateway should reside. You must also specify an Elastic IP address to associate with the NAT gateway when you create it. After you’ve created a NAT gateway, you must update the route table associated with one or more of your private subnets to point Internet-bound traffic to the NAT gateway. This enables instances in your private subnets to communicate with the internet.

125
Q

Cloudfront Headers

A

If you want CloudFront to cache different versions of your objects based on the device that a user is using to view your content, we recommend that you configure CloudFront to forward one or more of the following headers to your custom origin:
- CloudFront-Is-Desktop-Viewer
- CloudFront-Is-Mobile-Viewer
- CloudFront-Is-SmartTV-Viewer
- CloudFront-Is-Tablet-Viewer

you can’t set the cache behavior of a CloudFront distribution to forward the User-Agent header. This is configured in the Origin Custom Headers setting.

126
Q

VERSIONING

A

An IAM Administrator account can suspend Versioning on an S3 bucket, but only the bucket owner can enable/suspend the MFA-Delete on the objects.

127
Q

How CLF Creation policy and Wait condition works

A

if you install and configure software applications on an EC2 instance, you might want those applications to be running before proceeding. In such cases, you can add a CreationPolicy attribute to the instance and then send a success signal to the instance after the applications are installed and configured.
CreationPolicy:
AutoScalingCreationPolicy:
MinSuccessfulInstancesPercent: Integer
ResourceSignal:
Count: Integer
Timeout: String

128
Q

SQS - ASG Scaling

A

You can configure the scale-out policy to check the number of messages in your SQS queue and then verify that your Auto Scaling group has launched an additional EC2 instance. Similarly, you can test your scale-in policy by decreasing the number of messages in your SQS queue and then verifying that the Auto Scaling group has terminated an EC2 instance.

129
Q

SYSTEM MANAGER

A

Run Command - AWS System Manager Run Command to automate common administrative tasks and execute scripts remotely. Run Command enables you to automate common administrative tasks and perform adhoc configuration changes at scale.

Automation -it is used to create custom workflows and not to remotely configure managed instances at scale.

Session Manager - mainly used to quickly and securely access your Windows and Linux instances. It cannot automate administrative tasks and execute shell scripts remotely.

130
Q

Config Rules

A

Rules types
1. Managed Rules (Over 150)
2. Custom Rules (using Lambda)

Config can either be triggered or Scheduled

131
Q

Config Auto-remidiation

A

Using config to trigger SSM Automation to reverse a Non-compiant Service State back to compliant. The SSM Automation Can invoke a lambda function, but not config to Lambda directly

Aggregator - Centralize config findings from various accounts.
Stacksets will be a better option

132
Q

Egress only IPV6

A

You must update your route tables to route your IPv6 traffic.

For a public subnet, create a route that routes all IPv6 traffic from the subnet to the Internet gateway.

For a private subnet, create a route that routes all Internet-bound IPv6 traffic from the subnet to an egress-only Internet gateway.

133
Q

Route 53 Healthcheck types

A

You can create three types of Amazon Route 53 health checks:

  1. Health checks that monitor an endpoint - You can configure a health check that monitors an endpoint that you specify either by IP address or by domain name. At regular intervals that you specify, Route 53 submits automated requests over the internet to your application, server, or other resources to verify that it’s reachable, available, and functional. Optionally, you can configure the health check to make requests similar to those that your users make, such as requesting a web page from a specific URL.
  2. Health checks that monitor other health checks (calculated health checks) - You can create a health check that monitors whether Route 53 considers other health checks healthy or unhealthy. One situation where this might be useful is when you have multiple resources that perform the same function, such as multiple web servers, and your chief concern is whether some minimum number of your resources are healthy. You can create a health check for each resource without configuring notifications for those health checks. Then you can create a health check that monitors the status of the other health checks, and that notifies you only when the number of available web resources drops below a specified threshold.
  3. Health checks that monitor CloudWatch alarms - You can create CloudWatch alarms that monitor the status of CloudWatch metrics, such as the number of throttled read events for an Amazon DynamoDB database or the number of Elastic Load Balancing hosts that are considered healthy. After you create an alarm, you can create a health check that monitors the same data stream that CloudWatch monitors for the alarm.
134
Q

Failover Routing Policy

A

Unlike the Weighted, This routing policy does not let you control how much traffic is routed accross your resources. It’s 50-50

135
Q

CFN Creation Policy

A

You can associate the CreationPolicy attribute with a resource to prevent its status from reaching create complete until AWS CloudFormation receives a specified number of success signals or the timeout period is exceeded. To signal a resource, you can use the cfn-signal helper script or SignalResource API. AWS CloudFormation publishes valid signals to the stack events so that you track the number of signals sent.
The creation policy is invoked only when AWS CloudFormation creates the associated resource. Currently, the only AWS CloudFormation resources that support creation policies are AWS::AutoScaling::AutoScalingGroup, AWS::EC2::Instance, and AWS::CloudFormation::WaitCondition.

136
Q

Direct connect Gateway

A
137
Q

Route 53 Alias record

A

It is possible to create an Alias record that points to a resource in another account. In this case the fully qualified domain name of the ALB must be obtained and then entered when creating the record set. This is the most cost-effective option as you do not pay for Alias records and there is minimal configuration required.

138
Q

EC2 Instance Lifecycle

A

STOP/START (Amazon EBS-backed instances only):
We move the instance to a new host computer (though in some cases, it remains on the current host). Public IPV4 is changed

HIBERNATE (Amazon EBS-backed instances only):
We move the instance to a new host computer (though in some cases, it remains on the current host). Public IPV4 is changed. The RAM is saved to a file on the root volume

REBOOT/RESTART:
The instance stays on the same host computer. Rebooting an instance is equivalent to rebooting an operating system. Public IPV4 is changed

But Elastic IP is constant

139
Q

Cloudfront and Dynamic Contents

A

dynamic content are not cacheable on CloudFront edge locations

140
Q

Dealing With Custom AMI

A

You would have to install some default agents that should have natively come with the EC2 instance, such as SSM AGENT, etc

141
Q

Signed URL vs Signed cookies

A

Signed URL - One User Per file
Signed Cookies - Several Users to several files

142
Q

AWS Storage servicesEncryption status changing

A

S3 - Encrypts objects by default
EFS and RDS - Encryption status cannot be changed after deployment

143
Q

Http 403, 503

A

403 - Bucket policy issues
503 - High request rates for new buckets

144
Q

How to enable AWS Shield Standard

A

AWS Shield Standard is automatically enabled to all AWS customers at no additional cost. AWS Shield Advanced is an optional paid service.

145
Q

AWS Service Health Troubleshooting

A

Note that most AWS outages a limited to a single az. Therefore, in a Multi-Az app behind an ASG, service health info might not be useful

146
Q

Adding SSL cert to a cloudfront distribution

A

Once you have an SSL Cert through ACM, you need to add it to your cloudfront distribution, then update cache behavoir to reroute traffic to HTTPS

147
Q

Ec2 access to SSM

A

AWS Systems Manager requires an IAM role for EC2 instances that it manages, to perform actions on your behalf. This IAM role is referred to as an instance profile.
If an instance is not managed by Systems Manager, one likely reason is that the instance does not have an instance profile, or the instance profile does not have the necessary permissions to allow Systems Manager to manage the instance.

148
Q

Power of tags

A

Tags are used for organizing resources, not for controlling access. While they can be used in conjunction with IAM policies to allow or deny access, tags alone do not grant or deny access to Systems Manager. They are metadata to categorize your AWS resources and do not affect the operational aspects of AWS Systems Manager.

Special note on Usage:
User-defined tags are tags that you define, create, and apply to resources. After you have created and applied the user-defined tags, you can activate by using the Billing and Cost Management console for cost allocation tracking. Cost Allocation Tags appear on the console after you’ve enabled Cost Explorer, Budgets, AWS Cost and Usage reports, or legacy reports.
When using AWS Organizations, you must use the Billing and Cost Management console in the payer account to mark the tags as cost allocation tags. You can use the Cost Allocation Tags manager to do this.

149
Q

VPC Endpoints

A

Interface Endpoint(Paid): Is a private connection via ENI, therefore it requires security group settings to connect the instance’s private ip to the AWS service. Accessible via VPN, VPC peering

Gateway Endpoint(free and scales more): Is more like an AWS Public service. It only requires a Route table configuration to the endpoint. Once targeted from the route table, this configuration directly exposes the instance to DynamoDb and S3 bucket

150
Q

In order to share an encrypted snapshot with another account, Policy has to be reviewed and relevant permissions granted by the origin account

A

HAKIKA !

151
Q

Amazon Inspector (Amazon Antivirus)

A

Amazon Inspector is an automated vulnerability management service that continually scans Amazon Elastic Compute Cloud (EC2), AWS Lambda functions, and container images in Amazon ECR and within continuous integration and continuous delivery (CI/CD) tools, in near-real time for software vulnerabilities and unintended …
Amazon Inspector helps you discover potential security issues by using security rules to analyze your AWS resources. Amazon Inspector monitors and collects behavioral data (telemetry) about your resources.
To get started, you create an assessment target (a collection of the AWS resources that you want Amazon Inspector to analyze). Next, you create an assessment template (a blueprint that you use to configure your assessment). You use the template to start an assessment run, which is the monitoring and analysis process that results in a set of findings.

152
Q

CloudTrail Security

A

Enabling log file integrity validation in AWS CloudTrail allows for the detection of whether a log file was modified, deleted, or unchanged after CloudTrail delivered it. You can use AWS CLI commands to manually validate the integrity of the log files. This provides a cryptographically verifiable method of ensuring log files have not been altered.

153
Q

Memcached Scaling

A

Evictions occur when memory is over filled or greater than the maxmemory setting in the cache, resulting in the engine selecting keys to evict in order to manage its memory. The keys that are chosen are based on the eviction policy that is selected.

You cannot add read replicas to a Memcached cluster.

154
Q

ELB Healthcheck troubleshooting

A
  1. All Healthchecks failed = Misconfigured sg, no Route table route ,target not in service, etc
  2. HealthyHostCount dropping(eg, from 5 to 2) = health checks have failed, and the ALB has taken EC2 instances out of service
155
Q

Ec2 sending events to Events bridge

A

Amazon EC2 sends an EC2 Instance State-change Notification event to Amazon EventBridge when the state of an instance changes.
eg:
- pending
- running
- stopping
- stopped
- shutting-down
- terminated

156
Q

SSM

A

Run Command= To run live commands from managed or manual documents

Automation: More of like a complete pipeline of commands and events

State Manager: Maintain configuration consistency by reapplying configuration state,and view detailed configuration history and output. Quickly identify and remediate compliant and non-compliant machines across multiple accounts.

157
Q

Route Propagation

A

Route propagation allows a virtual private gateway to automatically propagate routes to the route tables. This means that you don’t need to manually enter VPN routes to your route tables. You can enable or disable route propagation. Edge association use to route inbound VPC traffic to an appliance

Route propagation enables the automatic propagation of routes from a gateway (like a transit gateway) to a route table.

158
Q

Shared Responsibility Model -OS

A

Managing the health of the Linux operating systems” is incorrect. The operating systems of EC2 instances are managed by customers, not AWS

159
Q

AD connector

A

Over VPN, using their on-premises Active Directory user accounts to login to AWS IAM. They would then be able to access the AWS Management Console.

160
Q

CW Logs vs Metrics

A

Metrics are containers for certain indexes about an instance or a service.

Logs are text report on anticipated or unanticipTED events

Note
Metrics:

Metrics are quantitative measures or data points that provide information about the performance or status of a system, service, or application.
They are typically numerical values that can be collected over time, allowing for the analysis of trends, patterns, and anomalies.
Metrics are used to monitor and evaluate the health and efficiency of a system, helping to identify issues or optimize performance.
Examples of metrics include response time, error rate, CPU usage, memory usage, and throughput.
Logs:

Logs are records or entries generated by a system, application, or service to capture information about events, activities, or transactions.
They are typically text-based and can include details about errors, warnings, user actions, and system events.
Logs serve as a chronological record of what has happened within a system, and they are crucial for troubleshooting, debugging, and auditing.
While logs can contain metrics, they also provide context and narrative information about the events that occurred.
In summary, metrics are quantitative measurements that help monitor the performance of a system, while logs are textual records that provide a detailed account of events. While metrics are often used for trend analysis and alerting, logs are essential for diagnosing and understanding the context of issues. Both metrics and logs are crucial components of effective monitoring and troubleshooting in various IT and software contexts.

161
Q

RDS

A
  • You cannot copy an automated DB snapshot.
  • Snapshots exist on S3 but you cannot directly work with them.
  • You cannot create multi-AZ standby instances in another account
162
Q

RDS Failover conditions/Troubleshooting

A

Amazon RDS handles failovers automatically so you can resume database operations as quickly as possible without administrative intervention. The primary DB instance switches over automatically to the standby replica if any of the following conditions occur:
* An Availability Zone outage.
* The primary DB instance fails.
* The DB instance’s server type is changed.
* The operating system of the DB instance is undergoing software patching.
* A manual failover of the DB instance was initiated using Reboot with failover.
- Failure on the primary database and the DB instance type being changed are both conditions that would cause a failover event to occur.

163
Q

AWS Guard duty

A

AWS GuardDuty operates at the application layer, which corresponds to the OSI model’s Layer 7 (Application Layer). GuardDuty is a managed threat detection service that continuously monitors for malicious activity and unauthorized behavior within your AWS accounts and workloads.

GuardDuty analyzes events and logs generated by various AWS services, such as CloudTrail logs, VPC Flow Logs, and DNS logs, to identify potential security threats. It uses machine learning, anomaly detection, and threat intelligence to detect activities such as reconnaissance, privilege escalation, and communication with known malicious IP addresses.

While GuardDuty operates at the application layer for analysis, it leverages data from multiple layers of the OSI model to provide a comprehensive view of potential security issues in your AWS environment. It’s important to note that GuardDuty focuses on detecting threats and suspicious activities within the application layer, which includes services and protocols operating at higher levels of the OSI model.

164
Q

AWS Service Catalog portfolio

A

When you share a portfolio using account-to-account sharing or Organizations, you are sharing a reference of that portfolio. The products and constraints in the imported portfolio stay in sync with changes that you make to the shared portfolio, the original portfolio that you shared. The recipient cannot change the products or constraints, but can add AWS Identity and Access Management (IAM) access for end users.

165
Q

Service Health vs Personal Health

A

AWS Personal Health Dashboard provides alerts and remediation guidance when AWS is experiencing events that may impact you. While the Service Health Dashboard displays the general status of AWS services, Personal Health Dashboard gives you a personalized view into the performance and availability of the AWS services underlying your AWS resources.
The dashboard displays relevant and timely information to help you manage events in progress and provides proactive notification to help you plan for scheduled activities. With Personal Health Dashboard, alerts are triggered by changes in the health of AWS resources, giving you event visibility, and guidance to help quickly diagnose and resolve issues.

166
Q

RDS Encryption

A

You can only enable encryption for an Amazon RDS DB instance when you create it, not after the DB instance is created. However, because you can encrypt a copy of an unencrypted DB snapshot, you can effectively add encryption to an unencrypted DB instance.
To do this you create a snapshot of your DB instance, and then create an encrypted copy of that snapshot. You can then restore a DB instance from the encrypted snapshot, and thus you have an encrypted copy of your original DB instance.

167
Q

Transfer accelleration

A

Transfer Acceleration: S3
Global accelerator; EC2, ELB, ECS
Accelrator uses Edge location to transfer files into AWS. More of like a reverse f CDN, etc

168
Q

Cloudwatch for ec2 Lifecycle

A

Using Amazon CloudWatch alarm actions, you can create alarms that automatically
**stop,
terminate,
reboot,
or recover your EC2 instances.

169
Q

Cloudfront Cache-hit/Cache-miss

A
170
Q

RDS Single to Multi-Az

A

click and apply with no downtime

choose apply Immediately

171
Q

ELB = EC2

A

There can be ELB connected to ec2 instances without Autoscaling group

172
Q

EC2 Rescue

A

EC2Rescue for EC2 Windows is a convenient, straightforward, GUI-based troubleshooting tool that can be run on your Amazon EC2 Windows Server instances to troubleshoot operating system-level issues and collect advanced logs and configuration files for further analysis. EC2Rescue simplifies and expedites the troubleshooting of EC2 Windows instances.

AWS SOA (47 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions