Adrian Cantrill Cards Flashcards
CLB VS ALB
- ALB can route based on Layer 7
- can handle multiple domains and can understand URL path
- can handle multiple SSL Certs so permits consolidation onto a single ALB
- CLB cannot understand Layer 7!
- ALB Supports ECS, Lambda, etc.
When to use site-to-site VPN
- Managed Service
- HA by design
- Connect non-AWS to AWS
- Quick to set up and secure
Reserved instance billing
- Used for constant steady-state usage
- You exchange flexibility for discounts
- Generally 1- or 3 year commitment, with options for 0 upfront or partial upfront, or full upfront.
Lambda key facts
- Billed for execution time: max 15 mins.
- Cold start (running environment created from new)
- Warm start (environment reused)
- Execution policy = IAM role providing permissions.
Service control policies
Account permissions boundaries. Limit what all users in an account can do, even the root user. Do not apply to the master account.
Relational databases
- RDS Oracle
- RDS MySQL
- RDS MariaDB
- RDS PostgreDB
- RDS Aruora
- RedShift (column)
VPC
- Isolated network
- network blast isolation
- One or more IPv4 CIDRs (/28->/16)
- Can have IPv6 allocated
- Region resilient
CloudHSM
- Uses industry standard API
- Same architecture as KMS (CMK/DEK)
- FIPS 140-2 level 3
- Exclusive control
CLB end-to-end encryption
- For an unbroken end-to-end encryption connection, pick a TCP listener so that the LB won’t decrypt the connection. The CLB doesn’t need any SSL cert installed on it.
7-Layer ISO model
- Layer 7: Application
- Layer 6: Presentation
- Layer 5: Session
- Layer 4: Transport
- Layer 3: Network
- Layer 2: Data Link
- Later 1: Physical
Please Do Not Throw Salty Peanut Away
When not to use Site-to-Site VPN
- Low latency
- Consistent latency
- High Speed
- Non-internet transit
CloudFront geo restriction
- White list/Black list
- Location only (country code)
- Cannot use any other field/aspect of customer sessions
What is an edge location?
- A smaller infrastructure unit. Edge locations are capable of running limited edge computing and are generally used by CloudFront for content distribution. They are located as close to major population center as possible.
What is an AZ
- An availability zone (an isolated unit of AWS infrastructure).
- A region can have one or more AZs.
- One failing AZ should be isolated from others.
- AZs might be 1 building or more.
- AZs can have many isolated units of compute, storage, and networking.
Internet gateway
- Associated with one VPC and a VPC can have one IGW
- Translate Private IP to and from Public/EIP
- Needs an RT (Route Table) route
- Highly available by design across all AZs used for public internet access IPv4/6
S3 transfer acceleration
- Provides new endpoint (via CloudFront).
- ````````````````````````````````````````
S3 transfer acceleration
- Provides new endpoint
- Uses the AWS global network for transit
- Entry point is a local CF (CloudFront) location, backhauled to bucket location
- MUCH faster than using S3 directly
EMR types
- Master Node (can only have one in a EMR cluster)
- Core Nodes
- Task Nodes
CLB vs ALB
- ALB can route based on Layer 7
- ALB can handle multiple domains and can understand URL paths
- ALB can handle multiple SSL Certs, so permits consolidation onto a single ALB
- CLB cannot understand Layer 7
- ALB supports ECS, Lambda, etc.
Persistent Data
- Data that exists beyond the lifetime of the thing it’s attached to. An EBS volume continues operating after a machine is shut down, restarted, or terminated (if that option is selected)
Cross-zone load balancing
- A setting that is default on ALB and optional on CLB. Allows an ELB node to distribute connections to instances/targets outside its AZ for a more even distribution of connections across AZs.
X-Forwarded-For
The ‘X-Forwarded-For’ request header helps you identify the IP address of a client when you use an HTTP or HTTPs load balancer. It adds the source IP of the original front-end viewer (The originating IP address of a client connecting to a web server through an HTTP proxy or a load balancer).
CloudFormation stack
- Created from a template. Maps logical resources in a template to physical resources in AWS. The lifecycle of a stack is linked to resources. Creations, updates, and deletions to the stack do the same to physical resources.
IAM Group
- Not a principle; cannot be referenced in policies
- Has IAM users as members
- Can have policies associated (inline or managed)
- cannot be “logged in to” - has no credentials.
AWS GraphDB service
- Neptune
CloudFormation template
- Used to create a stack
- Parameters, resources, mappings, conditions, and outputs
- Apply a template (YAML/JASON) to create one or more stacks
Proxy Protocol
- If TCP is used for the front and back end, the LB makes a connection to your instance. The ELB’s IP will show as the source. Proxy Protocol includes an additional field with the original source IP address. (TCP only)
What can you control with CloudFront behaviour?
- Protocol policy
- Path patterns
- Http methods
- Query String forwarding
- Cookie forwarding
- Lambda function association
- Object caching
- HTTP caching
- Request header caching
- Object compression
- TTL
- Viewer access restrictions
You want to ensure that you capture authentication activities on your account in CloudTrail. These are not API calls. How can you do this?
- Enable Management events (default) when configuring a Trail.
Note: The CloudTrail Event history feature supports only management events. Not all management events are supported in event history.
What are the global and regional characteristics of S3?
- S3 is a global service with region specific presence. Buckets are globally available and unique. But objects live in a particular region. Each account has a limit of 100 buckets, but unlimited prefixes.
What AWS services provides data that can be useful through Athena?
- Athena can access logs from CloudTrail, CloudFront, all Load Balancers, and Amazon VPC Flow Logs.
You want to query a cats table based on appointment type. The partition key is catID and the sort key is cat name. How can you efficiently query based on another column?
- To speed up queries on non-key attributes, you can create a global secondary index. A global secondary index contains a selection of attributes from the base table, but they are organised by a primary key that is different from that of the table. The index key does not need to have any of the key attributes from the table. It doesn’t even need to have the same key schema as a table.
How can you restore a database after deleting the Master?
- Database backups enable you to restore a database even after the Master is gone. However, they have a default retention period of 35 days, after which they will be deleted. (Sean - this is referring to AWS auto-backup).
How can you restrict access to S3 objects within a date range?
- Use S3 ACLs.
What purchasing options can you use to pay for RedShift compute nodes?
- On-demand or
- Reserved instances
Note: spot instances is not available for RedShift compute nodes
How do EC2 instances, on-premise VMs and servers become manageable by SSM?
- By installing Systems Manager Agent, applying appropriate IAM permissions (EC2 only) and activations for on-premise servers.
What are the four invocations for a Lambda@Edge function?
- Viewer request
- Viewer response
- Origin request
- Origin response
You want to keep CloudTrail events longer than 90-day retention period. What can you do?
- Configure Trails to deliver CloudTrail events to S3. And optionally enable file encryption and validation to prevent files from tampering.
Note: by default, log files are stored indefinitely
What are the two sides of a CloudFront edge called?
- The Origin, origin protocol, and origin fetch are where the cached content originate.
- The Viewer and Viewer Protocol are the client side or the edge.
Yu create a DynamoDB table with a partition key of CatID. Your CatIDs range from 0001 to 0004. You end up with lots of records for each cat, exceeding 10GB per cat. You notice that performance for reading and writing starts to slow down. What could be the problem?
Dynamo has had to create more partitions for each CatID. But since the partition key is CatID, Dynamo still limits the RCU/WCUs to 3000/1000 across all partitions for that CatID. You need to consider a partition key that has more values than 0001-0004.
You’ve configured VPC peering between VPC A and VPC B. When you try to ping an EC2 instance in B from A, you don’t get a response. What would you check?
- Check the default route table for the subnet in A where the pinging instance lives. It needs to have a route to the CIDR range of VPC B, configured as a Peering Connection with the ID of the peering connection. The same is true of VPC B, which needs a default route table entry for VPC A.
- Check NACL for both VPCs to ensure there are no inbound or outbound restrictions.
- Lastly, check the security groups for both sides of the communication to ensure sufficient allowances for inbound and outbound traffic between the two. (Me: such as ICMP protocol is allowed)
How does AWS IoT enable you to communicate with devices or systems from other manufacturers?
- AWS uses MQTT, which is an industry standard protocol that other devices and systems likely use.
Me:
What is MQTT stands for MQ Telemetry Transport. It is a publish/subscribe, extremely simple and lightweight messaging protocol, designed for constrained devices and low-bandwidth, high-latency or unreliable networks.
What service can you use when your data security requirements need FIPS 140-2?
- KMS or CloudHSM comply with FIPS 140-2
Note:
KMS provides only AWS API access. It does not provide industry standard API access.
(CloudHSM provides exclusive control)
What is separation of roles in KMS?
Administration of KMS, such as key management, may not have permissions to decrypt keys or data. Users of KMS may not have admin privileges, but can ask KMS to encrypt and decrypt data.
What is a CloudFormation Custom Resource?
A customer resource is a resource either in AWS or 3rd party that a CloudFormation template asks for as part of the stack. It uses messaging: SNS or Lambda, to trigger that resource to create/update/delete
Me: a custom resource is a resource that is not available as AWS CloudFormation resource types. Custom resource enable you to write custom provisioning logic in template logic in the template that AWS CF runs anytime you create, update or delete stacks.
When using S3 transfer acceleration, what is the endpoint that the client uses for a bucket?
- CloudFront local endpoint. Then the upload traverses the AWS backbone
What is CORS?
Cross origin resource sharing. This is a security measure that a server can use to control what other servers can access resources on it.
When using S3 transfer acceleration, what is the end point that the client uses for a bucket?
- A CloudFront local endpoint. Then the upload traverses the AWS global network.
How can a resource in a private subnet access Amazon S3?
By creating an private access point, in this case a private access point gateway. This was my answer. Need to revisit. It is correct, but not complete
What kind of transformation can you do to a Firehose stream?
Use a Lambda function to manipulate records or change the format to Parquet or ORC with a checkbox
Me: when you enable Kinesis Data Firehose data transformation, Kinesis Data Firehose buffers incoming data up to 3 MB by default (the size can be adjusted via API). Firehose then invokes the specifies Lambda function asynchronously with each buffered batch using the AWS Lambda to Kinesis Data Firehose.
Apache ORC: the smallest, fastest columnar storage for Hadoop workloads
Apache Parquet is a columnar storage format for Hadoop workloads
When configuring instance types for an ElasticSearch cluster, what choices should you consider?
The master node has much lower CPU and memory requirements, so it can be smaller. The data nodes to do the work and should be bigger
How does RedShift ensure durability of your data in the cluster
Each of the slices on your compute nodes have the advertised amount of data available to them according to the Management Console. But Redshift also reserves the same amount for replication of slice from other nodes, similar to RAID 5 with a disk array.
What’s a Logical Resource in CloudFormation?
The name the template uses to describe physical resources that CF creates. The physical resources acquire cryptic IDs only at the time of creation. The logical resource makes it easier to identify those resources.
What are some of the constraints of a DX connection?
Each connection has a bandwidth limit. Not encrypted, must have BGP support for routing
Where is the cluster in an Aurora Serverless dB?
It’s in the VPC you specify when creating the cluster. Aurora Serverless allocates ACUs into your cloister from a warm pool it maintains for all customers. The proxy manages connection from your applications to the cluster and movement of the ACUs in and out of your VPC. The proxy also manages migrating cache data from one ACU to another when capacity changes. Keep in mind, Serverless uses the same Cluster Storage Volumetier that Aurora uses, so Serverless is only managing the compute tier since the storage tier is already Serverless and multi-tenant.
What are the various node types of an EMR cluster?
An EMR cluster can have only one Master node. It also can have Core Nodes that run HDFS and manage tasks. And optionally Task Nodes which executes tasks but have no storage system. You cannot change the Master node instance type after creating the cluster. You can change Core and Task node instances types.
Since RDS doesn’t allow root access to the console, how can admins manage the configuration of the database?
Parameter groups and option groups provide the parameters admins need.
What can you do to improve the performance of a Lambda function?
Declare resource objects as singletons outside of the lambda_handler() (me: it like a global variable in c to avoid instantiation for each Lambda function instance). They may be available to the next instance of the function, but declare them as NULL and do NULL checks in the handler or sub-functions.
Me: state dehydration and cold start up library loading slows Lambda function down. So Lambda function will have a better performance when it is stateless and a programming language that loads fast.
What are the two types of groups EMR can use for managing instances?
Uniform instance Groups and Fleet instance Groups
How can you introduce new versions of an API without breaking applications that depend on the current version?
Use stages (me: see Lambda function versioning as an example)
How can you configure ElasticSearch for the best HA?
Configure three master nodes: the master and two eligible masters. Also have at least three data nodes across AZs. By having three of each, ES can use a quorum to determine the next election if one fails (me: assuming that only one AZ will fail in a given time).
What are the three minimum parts to an IAM policy statement?
Effect, Action, Resource. And additionally, Condition
What’s the fastest way to recover to a previous point of an Aurora DB?
Backtrack instead of restore from a backup.
What is the main network security difference between ALB and NLB
ALBs terminate the client request then establish a new connection to the target group because encryption operates at layer 7. NLBs examining only the layer four header, simply pass on the layer 5+ portion of the packet which may or may not be encrypted. This enables an end-to-end pass-through of encrypted layer 7, improving performance (me: and allow for end-to-end encryption (better data protection)
You are configuring a Classic Load Balancer but need to allow a few different HTTP response codes for success. How can you do that?
Use an ALB and enumerate the various HTTP response codes for the health check. CLB doesn’t support Layer 7 where HTTP resides.
What are the goals of CloudFormation template portability?
Design it to run in any account or location without modifications or user input.
You are design a ticket sales system using DynamoDB as the order database. You want to ensure that you always have the capacity you need no matter how many customers arrive at your site. What’s the best way to ensure that capacity on Dynamo?
On-demand capacity will always manage the RCU/WCU and storage requirements for the incoming load. Auto scaling sets and upper limits and can be slow. Provisioned capacity also sets a limit.
You are using DynamoDB for ticket sales. When tickets for a particular event go on sale, you want to ensure that when a customer selects a ticket for purchase, you hold that ticket until they complete the purchase. What’s the simplest way to do that?
Define the updates to the ticket availability and the purchase steps as a transaction. That way, DynamoDB commits all of the updates as a single atomic unit.
me: each transaction can include up to 10 unique items or up to 4MB of data, including conditions.
TransactWriteItems
TransactReadItems
Three read options:
- eventual consistency
- strong consistency
- transactional
Two for write:
- standard
- transactional.
Transactions are enabled for all single-region DynamoDB tables and are disabled on global tables by default.
Items are not locked during a transaction. DynamoDB transactions provide serialisable isolation. If an item is modified outside of a transaction while the transaction is in process, the transaction is canceled and an exception is thrown with details about which item or items cause the exception.
You can connect to VPC from using VPC peering. You can also connect to VPC from VPC A. But VPC B can’t connect to VPC C. What’s likely the problem?
me: The question is not properly written
Answer from LinuxAcademy:
VPC peering is not transitive. VPC B need to have a VPC peering connection to VPC C.
What is the key qualities of a Serverless architecture?
- Event driven
- Capable of scaling from very low capacity to very high capacity
- Only pay for what the demand requires.
me: it question implies Lambda Serverless, not e.g. DynamoDB on-demand. DynamoDB is a Serverless database service.
When should you use on-demand?
When the application positively needs the capacity and the demand is not steady, e.g. sparky.
How many security groups can a subnet have?
Subnets don’t have security groups. Security groups are assigned to network interfaces.
You need to implement a solution for [social networking, knowledge graphs, fraud detection, recommendations]. What database solution should you choose?
Neptune is a graph DB that is highly scalable with 15 read replicas across three AZs in a region. It can hold up to 64 TB of data with encryption at rest.
What are the 4 invocation methods for a Lambda@edge function?
Viewer request and viewer response
Origin request and origin response
You create a database credential using a secure string in Parameter Store. The client application needs to use this string to connect to a database. What permissions does the application needs?
Access to Parameter Store and access to master key (CMK) used to encrypt the credentials in Parameter Store.
You have a web application has UDP endpoints. What kind of ELB should you use?
Classic LB or ALB. NLB does not support UDP, only TCP.
What cryptography standards does Cloud HSM support?
PKCS#11, java cryptography extensions (JCE), Microsoft cryptoNG (CNG). These are APIs. It does not provide any AWS APIs, meaning that it cannot integrate with other AWS Services offering encryption.
CloudHSM also supports FIPS 142-2 at level 3 which is higher than KMS. (Me: FIPS 142-2 at level 2)
What are the three things you can do with a CloudFormation update Stack operation?
Create, Update or Delete resources
What are some ways to minimise costs with Athena?
Since customers pay for Athena by the amount of data it scans, reduce the amount of data scanned by partition data, organise it into columnar format to reduce the number of columns Athena sees during a query.
What data format does Athena support?
XML, JSON, CSV, TSV, Apache Avro, Apache ORC and Apache Parquet
me:
Avro is a row-oriented remote procedure call and data serialisation framework developed within Apache’s Hadoop project. It uses JASON for defining data types and protocols, and serialises data in a compact binary format.
What do VPC flow logs record?
What don’t they record?
- Metadata about network traffic into and out of the VPC, including address, port, protocol and more. Logs do not include information about DHCP, AWS DNS, or license activation requests. This is not a network monitor.
What are the various endpoints in Aurora?
The cluster endpoint refers to the master for read and write. The reader endpoint refers to all replicas as a cluster. Readers get directed to any replica, improving scalability of Aurora for read-intensive workload. Instance endpoints refer to any specific instance. Custom endpoints allows you to configure groups of instances behind an endpoint.
me: Amazon Aurora typically involves a cluster of DB Instances instead of a single instance. Each connection is handled by a specific DB instance. When you connect to an Aurora cluster, the host name and port that you specify point to an intermediary handler called an endpoint. Aurora uses endpoint mechanism to abstract these connections. Thus, you don’t have to hardcore all the host names or write your own logic for load balancing and rerouting connections when some DB Instances aren’t available.
For certain Aurora tasks, different Instances or groups of Instances perform different roles. For example, the primary instance handles all the data definition language (DDL) and data manipulation language (DML)statements. Up to 15 Aurora Replicas handle read-only query traffic.
What is a REST API?
They are uni-directional request/response calling patterns that use HTTP semantics with query string arguments. Behind the API, a service performs a task and returns the result to the caller.
What are the four key terms for ECS?
- Cluster — the collection of resources ECS can use to run your containers
- Service — ECS or Fargate runtime responsible for managing container tasks
- Task definition — a configuration file that tells ECS what containers it should create and how they interact with the outside world;
- Container definition —
What are the five-step approach to answering an exam question?
- Identify significant points in the question.
- Identify similar answers, but understand the differences.
- Look for disqualifying facts in answers, based on point 1.
- Eliminate any generally bad answers.
- Pick between remaining answers using judgement.
You want to create a CloudTrail that captures global events and performs the same behaviour in all regions without the risk of duplicate trails. You want to be sure that all of the accounts in your organisation do the same. What’s the easiest way to do this?
Configure a Trail with ‘Apply to all regions’ selected and ‘Apply to my Organisation’.
What are the three states a CloudWatch alarm can have?
OK, Alarm, Insufficient Data
How does S3 maintain versions of objects
Only if versioning is enabled, S3 creates new versions with the same name (me: same name but with unique IDs, each and every object stored in S3 have globally unique object ID regardless versioned or not). Objects have object IDs that are unique. Versions can live in different storage tiers in S3 using lifecycle policies. Delete actions mark objects for deletion.
me: when versioning is enabled, a simple DELETE cannot permanently delete an object. Instead, Amazon S3 inserts a delete marker in the bucket, and that maker becomes the current version of the object with a new ID. When you try to GET an object whose current version is a delete marker, Amazon S3 behaves as though the object has been deleted ( event though it has not been erased) and return a 404 error.
To permanently delete versioned objects, you must use DELETE ObjectVersionId.
What are some of the constraints of a DX connection?
Formerly, Public VIFs were limited to a region
Formerly, Private VIFs are attached to a VPG which is associated with a VPC
Now using BGP, the Public VIF advertises all public zone AWS service endpoints in all regions.
*Public zone endpoints do not require or event allow a DX to a access the Internet
Now, using DX gateway, customers can use a single Private VIF to a DXGW, then connect to any VPGW in any region; DX GW uses BGP to advertise the networks it can access back to the VIF, reducing admin overhead.
*These Private VIFs are not transitive.
What service can you use when your data security requirements need FIPS 142-2?
KMS or CloudHSM comply with FIPS 142-2.
Note: KMS provides only AWS API access. It does not provide industry standard API access. On the contrary, CloudHSM provides only the industry standard API PKCS#11, JCE (Java cryptography extension) and CNG (Microsoft cryptoNG) and it is not integrated with AWS services to prove crypto services like KMS does.
Describe the seven different instance type and what each best supports.
DR Mc GIFT PX
Dr. Mc Gift PX
DR Mc FIGHT PX
You want to be able to have multiple applications receive messages from a queue. You also want to late applications to replay messages from an earlier time. Your team wants to use SUS. What do you suggest?
SQS does not support multiple consumers of messages on a queue nor does it support replay. You should recommend kinesics data streams for this requirement.
Your Kinesis Data Analytics (SQL) application requires input data to contain certain fields. What can you do to solve that?
Use a Lambda function pre-processor on the KDA application. The Lambda function can inspect each message and any missing field with default values.
Where do Lambda functions live in the AWS network?
me: AWS Public zone or in your VPC.
By default, they live in a region but outside the customer’s VPC. It thus has access to the internet. Customers can also configure VPC Lambda functions where all the networking restrictions do the subnet and security group apply. The VPC Lambda function still runs in a sandbox outside of the VPC and exposes itself through an ENI in the VPC. For this reason, cold starts are even slower.
New: RemoteNAT enables multiple VPC Lambda functions to share the same network interface in a VPC, thus speeding up the start time.
What are some of the design goals that a memory cache like ElastiChache can provide?
Reduce latency for database lookups, improved availability if the cache is HA, stateless micro service design support by offloading state to a cache, and reduced costs/impact on databases by offloading cache-able reads to the memory cache.
What are some of the CloudFormation Update behaviours for: EC2, RDS, AutoScaling Group, EBS?
- Update with no interruption
AWS CF updates the resource without disrupting operation of that resource and without changing the resource’s physical ID. for example, if you update any property on an AWS::CloudTrail::Trail resource, AWS CloudFormation updates the trail without disruption. - Update with some interruption
AWS CF updates the resource with some interruption and retains the Physical ID. for example, if you update certain properties on an AWS::EC2::Instance resource, the instance might have some interruption while AWS CloudFormation and AWS CF and Amazon EC2 reconfigure the instance. - Replacement
AWS CF recreates the resource during an update, which also generates a new physical ID. AWS CF creates the replacement resource first, changes references from other dependent resources to point to the replacement resource, and then deletes the old resource. For example, if you update Engine property of an AWS::RDS::DBInstance resource type, AWS CouldFormation creates a new resource and replaces the current DB instance resource with the new one.
AutoScaling Group: no interruption
you can use the AutoScalingRollingUpdate policy to control how AWS CF handles rolling updates or an Auto Scaling group. This common approach keeps the same Auto Scaling group, and then replaces the old instances based on the parameters that you set.
EBS: change instance type - replacement
Change size, interruption
EC2:
Resizing - interruption
Change type - replacement
Moving to a different AZ, replacement
What is the role f a standby in Aurora DB?
There is no standby in Aurora. Replicas, up to 15 per region, serve as promotable to master instances.
What is envelope encryption?
KMS facilitates progressive encryption: a CMK encrypted a data encryption key (DEK) which encrypts data. The encrypted DEK then used to decrypt data (after it is decrypted by using the CMK).
What’s the ideal scope of a Lambda function?`
A small function that does something narrow and well. Accept an input, and produce an output.
me: just like an RESTful function in a micro-service architecture - do one thing, and do it well.
Someone deleted a role to access your RDS database. What tool should you use to see who did that?
CloudTrail events log all API activities in your account. The user who deleted an IAM role will appear there as an event.
What are some options for HA using Direct Connect?
Lower cost option: One DX, one VPN over internet
Better performance option: two DX — separate customer routers, separate links to DX location, separate DX location routers (me: have a physically separated redundant DX link)
You’re designing a voting system and recording the votes in DynamoDB. You expect certain locales to be much busier than others. But you need to use to a partition key of postal code to organise you data. What can you do to manage hot spots in your partitions?
DynamoDB enables Adaptive Capacity by default. This allocates RCU/WCU dynamically across partitions while still staying below the total hard limit of the table.
Me: Instant Adaptive Capacity (new 2019)
- Scalability and performance even for imbalanced workload:
* Dynamic partitioning for storage and throughput
* Automatic isolation of frequently accessed items
* Automatic boosting if table is consuming less than provisioned.
Note: max capacity (high water mark) will be automatically increased (on-demand model)
What are the seven states of a Step Function state machine?
Task, pass, choice, fail, succeed, parallel, wait.
What is a web socket API?
A persistent session-oriented protocol/API best suited for data streaming, interactive applications, event management applications.
What makes a subnet public?
The VPC must have an IGW, and the subnet must have a default route to the IGW by associating with a VPC route table that has a route to the IGW.
How can CloudTrail events integrate with CloudWatch?
Configure a Trail to stream to a CloudWatch Log Group
How can CloudTrail events integrate with CloudWatch?
Configure a Trail to stream to a CloudWatch Log group
What resources can an account share to other accounts using Resource Groups?
Subnets, Transit Gateways, resolver rules, license configurations.
Accounts cannot share subnets inside of the default VPC, nor use subnets that are owned by the owner of the resource. Likewise, a share cannot share security groups not owned by the resource owner. The resource owner can remove sharing from resources in use by others and those shares will continue until released.
What are the appropriate instance types for various EMR scenarios?
Long-Running Clusters and Data Warehouses On-Demand: On-Demand or instance-fleet mix Spot or instance-fleet mix
Cost-Driven workloads: Spot Spot Spot
Data-Critical workloads On-Demand: On-Demand Spot or instance fleet mix
Application Testing: Spot Spot Spot
What’s the best way to handle the base load of an application?
Use reserved instances in the necessary AZs
How is this snippet from a CloudFormation template not reusable?
“BucketName”: “lapix12345”
It’s specifying a value that needs to be globally unique. Thus, any use of the template after the first run will not be able to create the bucket since it will be a duplicate name.
What evaluations does IAM consider when determining a principle’s effective permissions?
Organisational boundaries->user/role boundaries->role policies->effective permissions
What are the four key terms for ECS?
Cluster - the collection of resources ECS can use to run your containers
Service - ECS or Fargate runtime responsible for managing container task
Task definition - a configuration file that tells ECS what containers it should create and how they interact with the outside world;
Container definition - a configuration file which is used in a task definition to describe the different containers that are launched as part of a task
You want to revert to a previous configuration of an environment in Elastic Beanstalk. What’s the best way to do that?
Save all your configurations. Then, you can revert to a saved configuration.
How can CloudTrail events integrated with CloudWatch?
By configuring a Trail to stream to a CloudWatch Log Group
How can you create a private CDN distribution using CloudFront?
Use a Behaviour that restricts viewer access based on signed URLs or signed cookies.
What’s the most reliable way to delete physical resources from a CloudFormation stack?
Use CF to delete the stack completely. It uses the Logical/Physical resource mapping to track all resources it created so that it can delete them using the template.
How can you avoid message fees incurred by using IoT Topics?
Publish message to $aws/rules/rule name which sends the message directly to an IoT Rule without the pub/sub features of IoT Topics.
Due to CCPA guidelines, you want to ensure that IAM Sales_Managers don’t see customers’ name and address information except zip code and state in your DynamoDB database. What can you do to restrict viewing of these attributes in the Customers table?
Create an IAM policy that Allows all the actions on the Dynamo table that the Sales_Managers (and others who adopt this policy) need. Use a Condition that uses a variable that looks for the ID of the SalesRep_ID requested in the query. Only allows access to the records associated with this Sales_Manager.
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"dynamodb:GetItem",
"dynamodb:BatchGetItem",
"dynamodb:Query",
"dynamodb:PutItem",
"dynamodb:UpdateItem",
"dynamodb:DeleteItem",
"dynamodb:BatchWriteItem"
],
"Resource": ["arn:aws:dynamodb:*:*:table/table-name"],
"Condition": {
"ForAllValues:StringEquals": {
"dynamodb:Attributes": [
"column-name-1",
"column-name-2",
"column-name-3"
]
},
"StringEqualsIfExists": {"dynamodb:Select": "SPECIFIC_ATTRIBUTES"}
}
}
]
}
How does DynamoDB implement Global Tables?
It uses Streams to capture all changes to one table to the other tables in other regions. You configure a Global Table by enabling Streams (Old and New), then adding Regions where you want to replicas. All tables are masters and stream their changes to the other replicas.
What types of identity federation can you employ?
Web Identity Federation, SAML and cross account trust
If your application requires very fast failover in the event of an AWS AZ failure, which Aurora model is best?
Aurora provisioned with read replica instances will promote to Master within 1 minute. Aurora serverless needs to create ACU, Proxy and connections in the new AZ, which will take longer.
ACU: Aurora Capacity Unit
Aurora Serverless and Failover:
If the DB instance for an Aurora Serverless DB cluster becomes unavailable or the Availability Zone (AZ) it is in fails, Aurora recreates the DB instance in a different AZ. We refer to this capability as automatic multi-AZ failover.
This failover mechanism takes longer than for an Aurora Provisioned cluster. The Aurora Serverless failover time is currently undefined because it depends on demand and capacity availability in other AZs within the given AWS Region.
Me: when you work with Aurora without Aurora Serverless (provisioned DB clusters), you can choose your DB instance class size and create Aurora Replicas.This model works well with when the database workload is predictable, because you can adjust capacity manually based on the expected workload.
With Aurora Serverless, you can create a database endpoint without specify the DB instance class size. You set the minimum and maximum capacity. With Aurora Serverless, the database endpoint connects to a proxy fleet that routes the workload to a fleet of resources that are automatically scaled. Because of the proxy fleet. Aurora Serverless manages the connections automatically. Scaling is rapid because it uses a pool of “warm” resources that are always ready to service requests. Storage and processing are seperate, so you can scale down to zero processing and pay only for storage.
Aurora Serverless introduces a new serverless DB engine mode for Aurora DB clusters. Non-Serverless DB cluster use the provisioned DB engine mode.
How can a CloudFormation template allow for a range of values for a resource option that users need to choose when launching the template?
Reference a resource option. Elsewhere in the script, enumerate all the valid values for that option. Optionally, provide a default so that the user does not have to make a choice.
Your customer needs to transfer file archives from their data centre to AWS for Amazon Glacier. You find out that the total file size adds up to 7TB. They want the files in place on AWS in the next three weeks. What transfer method will you recommend?
- Snowball >= 10TB
- SnowEdge >= 10 TB with Edge comput
- Snowmobile >= 100TB, arrange.
File Gateway. Snowball becomes economical only from 10TB or higher and when time is short. In this case, the customer has time and the amount of data is less than 10TB.
Me: this recommendation assumes that the link bandwidth is big enough and the file transfer does not impact all other activities on the link.
You want to query a cats table based on appointment type. The partition key is catID and the sort key is cat name. How can you efficiently query based on another column?
To speed up queries on non-key attributes, you can create a global secondary index. A global secondary index contains a selection of attributes from the base table, but they are organised by a primary key that is different from that of the table. The index key does not need to have any of the key attributes from the table. It doesn’t even need to have the same key schema as a table. (me: The global secondary index creates a new table that is hidden)
When should a customer use a VPN rather than DX?
- When speed of setup is critical; VPN takes minutes, DX takes days - weeks
- Cost can be lower for spiky or sporadic usage
- When network QoS is not critical. VPN performance depends on customer router CPU due to encryption; the ISP network connection over the internet is not consistent.
How does DynamoDB implement Global Tables?
It uses Stream to capture all changes to one table to the other tables in other regions. You configure a Global Table by enabling Streams (Old and New), then by adding Regions where you want replicas. All tables are masters and stream their changes to the other replicas.
What is in a launch configuration?
(Me: launch configuration is immutable after saving)
- AMI,
- instance type,
- purchase options: on-demand, RI, sport,
- IP addressing,
- user data,
- CW detailed monitoring option,
- amount and type of storage,
- key pair.
To make changes after saving, you must create a completely new launch config, then change the LC association in the AS group.
How can a resource in a private subnet access Amazon S3？
Configure a VPC Endpoint (Gateway type). Configure the endpoint to update the route table for the private subnet needing access. This avoid NAT gateways or egress-only IGWs, leaving the private subnet private.
What sizing options does Aurora offer?
Provisioned, parallel query, or Serverless
What does an Athena data catalog table include?
The table is a set of columns that have the name and data type of the fields in the data files you want to query. It also contains a pointer to the S3 location where these data files sit.
Your customer wants to get out of managing their messaging infrastructure. They use a number of standard APIs and protocols with their applications. They require that all communications with the messaging system be private, not over internet. They also want a highly available solution. What will you recommend?
Amazon MQ offers support for a number of standard protocols and is an open source project, so the API is likely familiar to the customer. Unlike SQS and SNS, Amazon MQ is deployed with private endpoints in the customer’s VPC with no public access required for applications within the VPC. It’s also available in an active/standby configuration across multiple AZs in a region.
(Me: MQ is not fully integrated with AWS eco-system such as monitoring using CloudWatch, CloudTrails, etc. control plane or the data plane).
What are the four EBS storage types and what are they best suite to do?
- General Purpose gp2: SSD
Default for most workloads. Burst to 3,000 IOPS with credits 1GB - 16TB. - Provisioned IOPS SSD io1: SSD
Mission critical, sustained IOPS
Suited for Large database 4GB - 16TB
Provisioned IOPS to 64,000
- Throughput Optimised st1: HDD Low cost Frequently accessed data, streams, media; not boot volume 500GB - 16TB 500 IOPS
- Cold HDD sc1: HDD Low cost Infrequent access Not boot volume 500 GB - 16 TB 250 IOPS
What does a container contain?
Applications and the required library versions
What’s the difference between tasks launched in EC2 vs. Fargate mode?
With EC2, you define the instance type and are responsible for the cluster. With Fargate, you don’t. You define tasks and let ECS/Fargate obtain the container hosts to run those tasks.
How can you configure a custom origin for CloudFront distribution over a private WAN connection?
You can’t. Any origin server must offer public access to CloudFront.
What does AWS Shield do beyond WAF?
Shield is a DDoS protection layer in front of WAF. Standard is free and always on (me: network layer DDoS protection). Advanced provides WAF, DDoS mitigation’s, visibility and reporting, DDoS response team support, and cost protection due to attacks. Shield also protects EIPs.
Where does your Redshift cluster live in the AWS network?
In a VPC you specify. By default, it uses the default VPC, but you can specify a customer VPC in your account. To access S3 data, you need to configuration NAT or internet gateway for the public S3 endpoint, or create a VPC endpoint for S3.
What are some things you can do in a CloudFormation template to ensure portability?
- using default values in parameter lists (avoiding human input),
- use ParameterStore for system and customer values,
- Pseudo Parameters for CF-wide values such as region, partition, account ID, stack ID and more,
- Intrinsic Functions (for AZs in a region, more),
- Don’t specify the PhysicalID or a resource (and CF will create a unique one for you.
How does HVM improve performance of virtualised machines?
HVM uses newer generation of CPUs that allows guest OSs to interact with CPU, memory, network, local storage and the motherboard bypassing the hypervisor.
Unlike paravirtualisation, HVM avoids emulation, speeding up performance of guest OSs.
Next, AWS introduced Nitro in 2017, bringing hardware virtualisation to all aspects of the guest OS access to the hardware. This results in near bear metal performance.
What EC2 metrics can CloudWatch not see by default
Memory, file system, applications. For these, customers need to install the CloudWatch Agent.
What are three common modes of creating an EMR cluster?
Long running - create, continue to run jobs, queries , host databases
Interactive - create, then log on using SSH and work from the console
Transient - create, run a job, terminate.
What is CORS?
Cross origin resource sharing. This is a security measure that a server can use to control what other servers can access resources on it (me: using http)
What are some of the features that Aurora serverless offers microservice/serverless applications that make it an attractive option as an RDBMS?
Very low latency connections and REST APIs for queries. Also it doesn’t involve cluster infrastructure running a customer’s environment.
How does EMR deploy cluster nodes in a VPC?
All nodes are in a single AZ, subnet and security group for minimum latency (me: and data movement cost - cross AZ data traffic will be charged at a price)
Where can you manage access and other configurations such as retention period and event filters, for CloudWatch Logs?
At the Log Group level which is a group of related Log Streams
How can you deliver /var/log log file events to CloudWatch Logs?
Install CloudWatch Agent on the EC2 instance. Configure it to tail the logs in /var/logs. It will pick up each entry in the log file and send them as Log events using a Log Stream.
When using OpsWorks, where does your application code live?
It lives outside of OpsWorks in a repository you specify, such as Git.
You provide the URL and the credentials to OpsWorks in the Apps recipe, you specify the deployment targets using a deployment recipe.
What is a REST API?
They are uni-directional request/response calling patterns that use
HTTP semantics with query string arguments. Behind the API, a service performs a task and returns the result to the caller.
How can applications access Aurora Serverless DB w/o connection strings?
Enable the Data API to expose the REST APIs of the database through the Proxy layer.
You’re designing an application that needs messages from an order entry from. The message must be in the exact order they occurred without duplicates. You expect the load to be around 6,000 messages per minute. What messaging option should you use?
SQS FIFO supports up to 300 messages per second with guaranteed ordering and no duplicates.
What network options does ElasticSearch offer?
ElasticSearch cluster run in a dedicated network not part of the customer’s account. For private VPC access, ElasticSearch will expose itself to the customer VPC using interface endpoints. The customer can assign a security group to the cluster. For public access, the cluster is accessible directly from the internet.
What are the various fault domains in AWS?
AZs, regions, global edge services
Your DocumentDB cluster is struggling to keep up with write demand.
What are your options for improving performance?
Scale UP the instance type(s) of the cluster to a larger EC2 type. Since there is only one write instance, the only option is scaling UP.
What is the role of a standby in Aurora DB
There is not standby in Aurora DB. up to 15 read replicas in a region, all are promotable to master instances.
What are the global and regional characteristics of S3?
S3 is a global service with region-specific presence. Buckets are globally globally available and unique. But objects live in a particular region. Each account has a limit of 100 buckets, but unlimited prefixes.
How can you protect your CloudFront distributions from malicious activity?
Configure WAF in front of the CF distribution
You select VPC1 for your ALB. You then select AZ1, AZ2, and AZ3. What does the ALB deploy?
The ALB Service is outside of the VPC across the regions. ALB will deploy an ALB node with the appropriate IP address in each AZ you’ve selected.
You’re not able to ping the host name of an instance in another VPC from a bastion in a different VPC. You have VPC peering configured and all routes, NACLs, security group and routes are configured correctly. What else could be the problem.
Make sure Requestor and Acceptor DNS resolution is configured for the peering connection. This will ensure that the requestor doesn’t need to go over the Internet for the ping.
Me: (AWS 2016)
You can now enable resolution of public DNS host name to private IP addresses when queried from the peering VPC. This functionality is also supported cross-account so the two VPCs can be in different accounts.
You can enable DNS resolution support for VPC peering using AWS Management Console, AWS CLI, through SDKs.
How can you restore a database after deleting the Master?
Database (auto) backups enable you to restore a database even after the Master is gone. However, they have a default retention period of 35 days, after which they will be deleted.
How does DocumentDB log its activities?
Using logs it exports to CloudWatch Logs using a service-linked role.
What is the max size of a DB that you can configure for an Aurora Serverless database?
You don’t configure capacity on Aurora Serverless. You configure Aurora Capacity Units (ACUs) which are 1 CPU and 2GB of RAM.
What is separation of roles in KMS?
Administrators of KMS such as key management may not have permissions to decrypt Keys or data. Users of KMS may not have admin privileges, but can ask KMS to encrypt or decrypt data.
How can you improve the chance of keep sport instances you need for a workload?
Spot fleet
How can you have reference data to join in a Kinesis Data Analytics (SQL)?
Put reference data in S3 then define a reference table that enables the SQL query to treat the lookup data as a table.
What can you use to monitor data across your accounts from a single master account?
(Me: the question is not clear)
Guard Duty uses ML to monitor a number of AWS data sources, such as VPC flow logs, R53, CloudTrail, threat intel, CloudWatch events, account activity.
It generates findings into the Guard Duty console. A trusted IP list excludes these IPs from Guard Duty scanning. Threat lists tell GD additionally what to watch across all accounts.
How does OpsWorks fit in to the range of tools like CloudFormation and Elastic Beanstalk?
OpsWorks offers most of the control over deployments that CloudFormation offers, but still provides minimal config options. It offers Chef or Puppet as the deployment frameworks.
How can you ensure you can get the capacity you need when you need it?
On demand capacity reservations. No up-front, but you get the capacity when you need it.
(Me: no pricing discount which is apply to account billing in regions, On demand capacity reservations is applied to AZs. Can be cancelled at any time)
Where does an EC2 instance reside?
In a region, an AZ, a subnet, behind a security group.
What platforms does Elastic Beanstalk support?
Docker, multi-container Docker, java, node.js, tomcat, python, ruby, .NET, Go, PHP, Docker Go, Docker GlassFish, Docker Python.
How do applications running on EC2 get their credentials to access other AWS services?
If the instance is running as an IAM role, the IAM role info is available in the instance meta data for the application to use
Instance profile - if you use console to create a role for EC2, the console automatically creates an instance profile and give the same name as the role;
If you manage via CLI, you create roles and instance profiles as seperate actions - you must know the names of your instance profile
Instance Metadata - data about your instance that you can use to configure or manage the running instance. Instance metadata is divided into categories, for example, host name, events, and security groups.
Although you can only access instance metadata and user data from within the instance itself, the data is not protected by authentication or cryptographic methods. Anyone who has direct access to the instance, and potentially any software running on the instance, can view its metadata. Therefore, you should not store sensitive data, such as passwords or long-lived encryption keys, as user data.
How does a Lambda function get permission to access AWS resources?
Assign it an execution role appropriate for what it needs to access.
You perform a DynamoDB query using the partition key and a filter. You notice that the charges for your queries haven’t gone down in spite of the filter returning very few items. What could be the problem.
Query filters do not reduce the amount of items that DynamoDB searches for the query results. Only sort keys do that.
What’s the easiest way to enable traffic between resources in a VPC?
Have them all use the same security group. That security group should have a rule that ALLOWS traffic from that same security group ID.
Protocol type, Protocol number, Ports, Source IP
All Traffic, All, All, ‘The Security Group ID’
When should you use Spot?
When the application can tolerate loss of an instance, such as big data systems, stateless web clusters, or dev test or experiments what time of finish is not critical.
What are the key qualities of a serverless architecture?
- Hardware platform or cluster and capacity scaling are fully managed,
- pay only what you use (compute and resources),
- suitable for unknown usage pattern or spiky workload (non-steady workloads).
- Event driven.
What are the feature differences between ELB types?
Application Load Balancer
- Feature rich, layer 7 load-balanced platform
- Content-based routing allows requests to be routed to different applications behind a single load balancer: path based routing or host-based routing
- support for micro-services (Lambda) and container based applications, including deep integration with Amazon Elastic Container Service (Amazon ECS)
It is a best practice that you upload SSL Certificates to ACM. If you’re using certificate algorithms and key sizes that aren’t currently supported by ACM or the associated AWS resources, then you can also upload an SSL certificate to IAM using CLI.
Application Load Balancer
- (HA) Automatically scales capacity to handle the number of incoming requests
- (Health checks) ALB allows the user specify a range of HTTP response codes that define instance health
- (Sticky session) ALB only supports the cookies generated by the load balancer
- (VPC support) Yes, but without EC2-classic
- (Dynamic Port Mapping) Yes, ALB supports dynamic port mapping using the EC2 Container Service
- (Supported protocol) HTTP, HTTPS, HTTP/2, WebSockets
- (CloudWatch metrics) Per port and path monitoring, Range HTTP response codes, Connection per hour, Overall traffic volume
- (Access Logs) ALB supports type of request (HTTP, HTTPS, HTTP/2, WebSockets), and the target Amazon Resource Name.
- (Backend Server AuthN) Supported by ALB
- (Deletion Protection) Supported by ALB
- (Path-Based Routing) Supported by ALB
Me: if you are building an API and wanted to leverage AuthN/Z, request validation, rate limiting, SDK generation, direct AWS service backend, use AWS API Gateway. If you want to add Lambda to an existing web app behind ALB you can now just add it to the needed route.
API gateway integrates with IAM natively, it has done all the heavy lifting for you.
ALB vs API Gateway:
https://serverless-training.com/articles/api-gateway-vs-application-load-balancer-technical-details/
How many slices do RedShift nodes have?
Two or sixteen for DC2 node type or four or sixteen for RA3 node type. The leader node distributes work to the slices. The Load or Copy commands get data from e.g. S3 and distribute it to the slices. Slices have dedicated storage and CPU capacity. When loading data, the leader node distributes it according to your distribution style configuration: all, even, key or auto.
You have a website that uses Adobe Flash. You want to improve performance by distributing that element from CloudFront. What kind of distribution should you use?
RTMP (Real Time Media Protocol) is only option that supports Adobe Flash.
When you allocates 5 RCUs to a table, how much data can you read?
4 KB/sec. That can be five read operations of 4K or less, one or more operations of more than 4K. Also, Dynamo caches up to 300 CUs so that they’re available for spikes.
What’s a regional cache in CloudFront?
It’s a region-based cache of the origin server content. This is the first place a CDN server checks on an origin fetch. If this misses, then the fetch goes to the origin.
If you configure a single node Redshift cluster, where is the leader node? If you configure a two-node cluster, where is it?
If only a single node, the leader and compute nodes are co-located on a single instance. Greater than one, Redshift creates a dedicated leader node free of charge. So the two-node example will include three instances.
What are the three behaviour options for updating a resource in CloudFormation?
Update with no interruption (e.g. updating a CloudTrail property)
Update with some interruption (e.g. change an instance type)
Replacement (e.g. change the engine type of an RDS database)
How can you grant access to public website users to page content hosted in S3 static web hosting?
Create a bucket policy that allows principal:* (me: anonymous access)
What is the difference between HTTP redirect and forward (ALB)
With forward, the ALB forwards the HTTP request and arguments to the destination you’ve configured in the ALB forwarding rule. (Me: server side redirect)
With redirect, the ALB returns a different URL to the client browser that the browser then needs to use to make the request again. This slightly slower than forwarding. (Me: client side redirect)
What services does Amazon Directory Service Include?
Simple AD, Microsoft Active Directory (AD), AD connector, Amazon Cloud Directory, and Amazon Cognito.
Amazon Cloud Directory enables you to build flexible cloud-native directories for organising hierarchies of data along multiple dimensions. While traditional directory solutions, such as Active Directory and other LDAP-based directories, limit you to a single hierarchy, Cloud Directory offers you the flexibility to create directories with hierarchies that span multiple dimensions. For example, you can create an organisational chart that can be navigated through separate hierarchies for reporting structure, location, and cost centre.
What’s the difference between a VM and a Container
VMs run on top of a hypervisor， abstracting the hardware。
VMs contain the OS and applications.
The isolation boundary is the VM.
Many VMs can run on the same hypervisor
Containers run on top of the OS but further isolate applications.
With a container engine, like Docker, applications and their dependencies can run isolated from each other on the same OS/VM.
Containers don’t have dedicated memory like a VM does, so you can pack more applications on hardware by using containers rather than just using VMs.
But, containers are not isolated from each other regarding security.
Containers can start very quickly compared to VMs in seconds, sometimes MS.
(Me: things are changing fast in AWS, e.g. Lambda is running inside a VM that is so light it can compete with container in resources they consumes and cold start time and at the same time have the security isolation at a VM level)
What constraint does a NAT device address?
It provides a single IPV4 address for all devices behind it, saving on scarce IPV4 addresses. IPV6 doesn’t have this constraint, thus NAT isn’t as relevant in IPV6.
What are the four invocation methods for a Lambda@Edge function?
- Viewer Request
- Viewer Response
- Origin Request
- Origin Response
What can you do with object locking in S3
Legal holds and retention polices. This prevents objects from deletion.
Versioning must be enabled.
Object locks must be set at time of creating the bucket
me: To use Amazon D3 object lock, follow these basic steps:
1. Create a new bucket with Amazon S3 object lock enabled.
2. (Optional) Configure a default retention period for objects placed in the bucket.
3. Place the objects that you wanted to lock in the bucket.
4. Apply a retention period, a legal hold, or both, to the objects that you want to protect.
(Me: With Amazon S3 object lock, you can store objects using a write-once-read-many (WORM) model. You can use it to prevent an object from being deleted or overwritten for a fixed amount of time or indefinitely. Amazon S3 object lock helps you meet regulatory requirements that required WORM storage, or simply add another layer of protection against object changes and deletion.
-A retention period specifies a fixed period of time during which an object remains locked.
- A legal hold provides the same protection as a retention period, but it has no expiration date. Instead, a legal hold remains in place until you explicitly remove it. Legal holds are independent from retention periods.
An object version can have both a retention period and a legal hold, one but not the other, or neither.
Amazon S3 object lock works only in versioned buckets, and retention periods and legal holds apply to individual object versions. When you lock an object version, Amazon S3 stores the lock information in the metadata for that object version. Placing a retention period or legal hold on an object protects only the version specified in the request. It doesn’t prevent new versions of the object from being created. If you. Put an object into a bucket that has the same key name as an existing, protected object, Amazon S3 creates a new version of that object, stores it in the bucket as requested, and reports the request as completed successfully. The existing, protected version of the object remains locked according to its retention configuration.)
What is CORS?
Cross Origin Resource Sharing is a security measure that a server can use to control what other servers can access resources on it.
What platforms does Elastic Beanstalk support?
- Docker,
- multi-Container Docker,
- Docker Python,
- Docker GlassFish,
- Docker Go,
- tomcat,
- python,
- java,
- node.js,
- .NET,
- Go,
- PHP
- Ruby
What are the various traffic routing types available in R53?
- Simple
- Failover
- Weighted
- Geo location
- Geo-proximity
- Latency
- Multi-value answer.
Me:
geo-proximity - use when you want to route traffic based on the location of your resources and, optionally, shift traffic from resources in one location to resources in another.
multi-value - use when you want Route 53 to respond to DNS queries with up to eight healthy records selected at random.
You want to add more nodes to your Redshift cluster for more storage capacity. You want the fastest downtime for writes as possible. You’d also like to change the node type to a smaller instance. What option should you use?
Create a new instance and switch over then done.å
How can you get more capacity on an EBS volume?
Configure the volume to a larger size.
Me:
You can resize an EBS volumes without downtime.
1. Login to your AWS console
2. Choose “EC2” from the services list
3. Click on “Volumes” under EBS menu
4. Choose the volume that you want to resize, right click on “Modify Volume”
The above steps will increase the “physical’ size of the disk attached to the instance.
You’ll then need to log on to the instance to resize the partition of the disk and resize the file system on that partition.
How to deploy an EMR cluster in a VPC
EMR cluster is deployed in a subnet of your chosen in your VPC to minimise the latency. Security Groups will be added and they are fully managed by Amazon EMR.
When the cluster is launched, Amazon EMR adds security groups based on whether the cluster is launching into VPC private or public subjects.
Security Groups are managed by Amazon EMR.
To manage the cluster on a VPC, Amazon EMR attaches a network device to the master node and manages it through this device. If you modify this device in any way, the cluster will fail.
Create a cluster using the Amazon EMR console
- Open the console
- Choose Create Cluster
- Choose Go to advanced options
- In the Hardware Configuration section, for Network， select the VPC ID
- Select Subnet ID
- Configure NAT instance and S3 endpoint if haven’t already done so.
What options can you use to control access to S3 objects?
Resource policies, identity polices, and Access Control List (ACL)
What are the network modes you can define in a container task?
Network Mode valid values:
- none
- bridge
- awsvpc
- host
Bridge — allow all containers to interact with internal networking to the host.
Host — map containers to host networking; e.g. map container port 80 to host port 80; can only run one container on a host with the same host networking requirement.
AWS VPC — map a VPC ENI to a container task. This is how Fargate works. If using EC2 mode, this can produce a lot of ENIs. Some EC2 instance types have ENI limits, so the ECS may only be able to launch a few containers.
(The above maybe outdated. Check out reinvent 2019 on Fargate: there will only be one ENI in VPC for fargate).
These networking types are for Linux. For Windows, the only networking type is NAT.
awsvpc — network mode give Amazon ECS tasks the same networking properties as Amazon EC2 instances: when you create the awsvpc network mode in your task definitions, every task that is launched from that task definition gets its own elastic network interface (ENI) and a primary private IP address.
The task networking feature simplifies container networking and gives you more control over how containerised applications communicate with each other and others services within your VPC.
What are the seven states of a Step Functions State machine?
- Task
- Wait
- Succeed
- Fail
- Pass
- Parallel
- Choice
How does a Lambda function get permission to access AWS resources?
Assign it an execution role appropriate for what it needs to access.
You want to reduce the number of Classic Load Balancers you’re running. You have several websites. What can you do?
Replace the classic load balancers with an ALB and configure
- the forwarding rules to each of the different websites.
- An SSL cert for each website you support.
How can you improve the chance of keep spot instances you need for a workload?
Provisioning a spot fleet.
How does a document dB achieve relationships as an RDBMS does with separate tables and reference keys?
Documents can contains embedded objects like sub-documents, lists and arrays, similar to how an RDBMS schema would have these things as separate tables with reference keys to join them.
You’re using Kinesis Data Streams to deliver a stream of data to applications. You notice that you’re not getting the capacity you configure across three shards—well less that 3 MB per second. Your producing application is using PutRecord (not the KPL) to write records. What could be the problem?
You may not have three partition keys that you’re rotating evenly while PUTting records. Thus, you’re maximising one shard, but under-using the others.
Me:
Advantage of Using the KPL
KPL has two modes: sync and async, async provides high performance.
KPL implements complex logics so that you don’t have to.
KCL make it easy for consumer-side developers (Java)
- Producer monitoring using CloudWatch. KPL emits throughput, error, and other metrics to CloudWatch and configurable to monitor at the stream, shard, or producer level.
KPL is not the same as AWS SDK. AWS SDK directly work with Kinesis Data Stream APIs
Each shard can support up to 1000 put records per second.
Max size of a data blob (the payload before base64 encoding) within one record is 1 MB.
You are configure a Classic Load Balancer but need to allow a few different HTTP response codes for success. How can you do that?
Use an ALB and enumerate the various HTTP response codes for the health check. CLB doesn’t support Layer 7 where HTTP resides.
(Me: CLB supports HTTP, HTTPs and TCP)
Before you start using Elastic Load Balancing, you must configure one or more listeners for your Classic Load Balancer. A listener is a process that checks for connection requests. It is configured with a protocol and a port for front-end (client to load balancer) connections, and a protocol and a port for back-end (load balancer to back-end instance) connections.
CLB supports
- HTTP
- HTTPS (secure HTTP)
- TCP
- SSL (secure TCP)
What resources can an ALB target for traffic?
Instances, IP addresses or a Lambda function.
Instance or IP addresses can include EC2 instances, ECS or EKS containers.
How do EC2 instances, on-premise VMs and servers become manageable by SSM?
- By installing Systems Manager Agent on these VMs.
- Applying appropriate IAM permissions (EC2 only)
- Activations for On-premise servers.
What network options does ElasticSearch offer?
ElasticSearch clusters run in a dedicated network not part of the customer’s account. For private VPC access, ElasticSearch will expose itself to the customer VPC using interface endpoints. The customer can assign a security group to the cluster. For public access, the cluster is accessible directly for the internet.
Me:
- Cannot be hosted in your VPC (or AWS’ public zone, like S3)
- interface endpoint for private access
- customer can assign security group to the cluster
- internet for public access
-
What are some advance features of Amazon MQ that SNS/SQS does not have?
- Reliable ordered messaging
- Message groups
- Composite messaging (Me: queue and topic? Or SNS + SQS)
And more …
Me:: - Easy to migrate existing messaging service
- Support existing protocols
AWS MQ (Apache activeMQ) it has two main concepts: topic and queues With a queue, you can have multiple consumers of a queue and each message will be delivered once; if there are no consumers when the message arrives, it sits in the queue until a consumer arrives. With a topic you can have multiple consumers and each message will be delivered in December to each consumer, but if a consumer is offline when a message arrives they miss it.
SQS offers serverless queues - you don’t have to pay for the infrastructure, just the messages you send and receive.
SNS is comparable to serverless topics. It will notify your services when a message arrives, but if you’re offline you can miss it. SNS can feed into SQS, so if you have some service that may be up and down, you can guarantee it gets SNS messages by queueing them in SQS for it to consume on its schedule.
What are the three components of Amazon ElasticSearch?
- ElasticSearch (Lucerne)
- Logstash or Beats, and
- Kibana for visualisation
Me:
Logstash: collect, Parse, Transform Logs
Beats: are lightweight data shippers that you install as agents on your servers to send specific types of operational data to ElasticSearch. Logstash has a larger footprint, but provides a broad array of input.
Your customer wants to transfer 120TB of data quickly to AWS s3. What method will you recommend?
Two 80TB snowballs daisy-chained together.
Each Snowball can hold 50 or 80TB. Daisy-chaining avoids having to partition the source data and instead, treat the two snowballs as a single storage unit of 160TB.
50TB — US region only.
Question: how many snowball devices can be daisy-chained together?
Where can you manage access and other configurations such aa retention period and event filters, for CloudWatch Logs?
At the CloudWatch Log Group level, which is a group of related Log Streams.
You want to deliver all CloudTrail events to CloudWatch Logs in a security account to make sure they’re safe and can’t be deleted. How can you do this?
You can have CloudTrail deliver log files from multiple AWS accounts into a single Amazon S3 bucket. For example, you have four AWS accounts IDs 1111111111, 222222222, 33333333333, and 44444444444444, and you want to configure CloudTrail to deliver log files from all four of these accounts to a bucket belonging to account 1111111111111. Steps are:
- Turn on CloudTrail in the account where the destination bucket will belong (1111111111111 in this example). Do not turn on CloudTrail in any other accounts yet.
- Update the bucket policy on your destination bucket to grant cross-account permissions to CloudTrail.
- Turn on CloudTrail in the other accounts you want (222222222222, 333333333333, 444444444444 in this example). Configure CloudTrail in these accounts to use the same bucket belonging to the account that you specified in step 1 (1111111111111111 in this example).
If you have created an organisation in AWS Organisations, you can create a trail that will log all events for all AWS accounts in that organisation. This is sometimes referred to as an organisation trail. You can ask choose to edit an existing trail in the master account and apply it to an organisation, making it an organisation trail. Origination trails log events for the master account and all member accounts in the organisation.
How does a Lambda function get permission to access AWS resources?
assigned it an execution role appropriate for what it needs to access
When querying data using Athena, the select statement needs to refer to a table. What is that table?
It’s one of the schema definitions that describes the columns and data types of the data. You create them using the Athena interface, API or CLI, or the Glue Data Crawler can create them.
What service can you use when your data security requirements need FIPS 142-2?
- AWS KMS service (only AWS API access)
2. CloudHSM service (industry API/protocol such as #PKCS11
What is a CloudWatch Logs Metric Filter?
It allows you to exclude events from a stream based on a text pattern
What is a CMK?
Customer Master Key. this is the core of KMS.
When crypt or decrypt a data key, the execution is inside KMS. Master key is kept in KMS, it cannot be exported.
CMK is used by the envelop encryption method: master key is used to encrypt data keys, data keys are used to encrypt data.
Note, RedShift employs more layered data protection, but the concept is the same.
KMS is regional, it cannot be shared across region. E.g. data encrypted in one region, cannot be decrypted in another region.
S3 bucket object cross region replication deployed complex key management to achieve the safe data transfer.
How does S3 charge for usage?
me: Based on the object storage type, size and outbound data transfer volume (no inbound data transfer fee)
Based on the storage tier
1. Standard Storage (1 month/minimum, no min duration), requests (PUT/GET), and transfer out.
2. IA - same as Standard except 1 month min for 128 MB storage, fee for retrieval.
3. One Zone (Reduced durability): same as IA, but cheaper
4. Intelligent Tiering: for a fee, IT moves your object to the optimum price tier. You still pay the tier.
Lifecycle rules can do this according to your explicit policies. Lifecycle rules can only go in one direction, not back and forth like intelligent Tiering.
What is the difference between updating a stack and using a change set?
The workflow for updating a stack is no different from creating a stack: the user defines the resource updates then executed the new/modified stack template.
Change Sets allow a junior developer to create the template for change, but simply save and notify others of the proposed change, without having permissions to run the Change Set. Senior developer can review the Change Set then run it if approved.
me: Updating a stack does not provide any release management process control, such as review and approve process before the changes going to be made.
What are the two components/polices of an IAM role?
Trust Policy, defining who can assume the role.
Permissions policy, defining what the role can do.
What a CloudWatch Log Stream?
A sequence of Log Events from the same source.
A log event is a line from CloudWatch containing the CloudWatch Log timestamp and the event message, also containing a timestamp of the actual event time.
How can you authenticate a request using ALB?
ALB supports federated identity such as OAUTH, and if configured, it will forward the request to the IDP such as Facebook before letting the request through to the target group.
Me: OpenID Connect compliant IdP. It works with Amazon Cognito.
What can you do with object locking in S3
Legal holds and retention policies. This prevents object from deletion. Versioning must be enabled. Object locks must be set (me: enabled) at time of creating the bucket.
me:
- S3 bucket must enable versioning and locking during creation.
- Object locking applies to a particular object version.
- It is Write Once Read Many times (WORM) - it is immutable once locked.
- An object version can have all the locking permutations (none, retention, retention + Legal hold, Legal hold)
- Locking can be removed manually.
What are some of the constraints of a DX connection?
- Formerly, Public VIFs were limited to a region
- Formerly, Private VIFs are attached to a VPG which is associated with a VPC
- NOW using BGP, the Public VIF advertises all public zone AWS service endpoints in all regions
* Public Zone endpoints do not require or even allow a DX to access the internet - NOW using DX Gateway, customers can use a single Private VIF to a DX GW, then connect to any VPGW in any region; DX GW uses BGP to advertise the networks it can access back to the VIF, reducing admin overhead
* These Private VIFs are not transitive.
Me: when to order a DX, a few things to know (or requirements)
Takes time to establish,
expensive to maintain,
Must chose a speed: < 1GB, 1GB, 10GB
Must establish a single mode finer connection between the data location and DX Partner location.
must have a router at the data location that supports BGP, w/MD5 authentication, VLAN (802.11q), completes LOA/?
Must have a router at DX location
What are the four key terms for ECS?
- Managed Cluster -
- Managed container runtime - e.g. Fargate
- Task definition
- Container definition
What sizing options does Aurora offer?
- Serverless
- Provisioned
- Parallel query
How does ACM supply certificates to an EC2 instance
ACM only supports certain AWS services that explicitly intergrate with it, such as CloudFront, ELB, ElasticBeanstalk (EBS), and API Gateway. R53 also uses ACM for DNS checks during certificate issuing (to ensure that you own the domain).
- CloudFront
- ELB
- EBS
- API Gateway
- Route 53 (for domain ownership validation)
Me: ACM does not supply certificates to an EC2 instance
What are the most common services that can provide data for Redshift
- S3
- Kinesis (Firehose)
- Data Pipeline
Me:
AWS Data Pipeline is a web service that helps you reliably process and move data between different AWS compute and storage services, as well as on-premises data sources, at specified intervals.
With AWS Data Pipeline, you can regularly access your data where it’s stored, transform and prop EDS it at scale, and efficiently transfer the results to AWS services such as Amazon S3, Amazon RDS, Amazon DynamoDB, and Amazon EMR.
1. S3
2. RDS
3. DynamoDB
4. EMR
How does DocumentDB log it’s activity?
Using logs that it exports to CloudWatch Logs using a server-linked role.
What AWS services are globally resilient to failure?
- IAM,
- R53
- CloudFront
All are global services.
How can you have multiple applications processing the same message on an SNS topic?
Use SQS fan out.
Create several SQS queues. Get the ARN of each queue, then configure the SNS topic to publish to these ARNs. Each will get the message and be able to process it as they need.```
How can you grant access to public website users to page content hosted in S3 static web hosting?
Create a bucket policy that allows principal:*
me: Set S3 policy to allow anonymous access to the S3 bucket or the pages in question.
If you want very low latency replication across regions for an Aurora DB and you want to promote a replica to Master in lease than one minute, what options do you have?
Aurora Global Database replicates cluster volume data from one region to a cluster volume in another in less than 1 second. Replicas in other regions attached to that region’s cluster volume for low-latency read replicas. They can promote to Master in less than one minute. This is lower latency and faster promotion time than MySQL cross-region read replication.
In a DynamoDB table, what is the minimum requirement for an item?
A Primary Key.
A primary key can have just have a partition key (hash). It can also have a sort key, which is another column. The combination of the two columns must be unique. E.g., the columns could be SSID and appointment date. In this case, the appointment data must be unique for every unique SSID.
Data types for the columns can be string, binary, or number.
You want to ensure that your CloudFront edge location connections to your S3 origin using TLS1.2. How can you do that?
(Me: this is a tricky question. It is test the following line (understanding)):
S3 is not a custom origin and CF configuration will match the same protocol as the client connection. (Me: whatever client set, S3 will match it. If client use http, S3 will use http)
If you need a different protocol to the origin, configure a custom origin. When specifying an origin such as www., the Origin configuration offers several TLS options and protocol policies
Me: when your origin is an S3 bucket, you options for using HTTPS for communications with CloudFront depend on how you’re using the bucket.
- If your S3 bucket is configured as a website endpoint, you cannot configure CloudFront to use HTTPS to communicate with your origin because S3 doesn’t support HTTPS connection in that configuration.
- When your origin is an S3 bucket that supports HTTPS communication, CloudFront always forwards requests to S3 by using the protocol that viewers used to submit the requests.
The default setting for the Origin Protocol Policy setting is Match Viewer and cannot be changed.
Where does an EC2 instance resides?
In a region, an AZ, a VPC, a subnet, behind a security group.
What services does Amazon Directory Service include?
- Simple AD
- MS Active Directory (AD)
- AWS AD connector
- AWS Cloud Directory
- Cognito
How Many slices do RedShift nodes have?
2, 4 and 16 depends on the node type.
2 or 16
4 or 16
- The leader node distributes work to the slices.
- The Load or Copy commands get data from e.g. S3 and distribute it to the slices.
- Slices have dedicated storage and CPU capacity.
- When Lorain data, the leader node distributes it according to your distribution style configuration: all, even key or auto.
What are the network modes you can define in a container task?
Linux:
- none
- bridge
- host
- aws vpc - map a VPC ENI to a container task. This is how Fargate works. If using EC2 mode, this can produce a lot of ENIs.
Windows:
1. NAT
You want to update a web page with new items that arrive in your ecommerce catalog. You’re using DynamoDB as an item database. What’s the simplest way to do this with minimal code and dependencies?
Enable DynamoDB Streams for New items. Then create a trigger (Lambda function) that captures the new items and updates a web page.
What’s in an AS Group?
- Name
- LC template (Launch Template)
- version
- Min
- Max
- Desired instance count
- VPC
- Subnets
- Health checks
- Load balancing
- Scaling policies
- Change notifications
- Tags
What are the two classes of producers to a Kinesis Firehose stream?
KDS (Kinesis Data Stream) Direct PUTs (using Kinesis API directly)
Me: you can configure Amazon Kinesis Data Streams to send information to a Kinesis Data Firehose delivery stream.
Important:
If you use the Kinesis Producer Library (KPL) to write data to a Kinesis data stream, you can use aggregation to combine the records that you write to that Kinesis data stream. If you then use that data stream as a source for your Kinesis Data Firehose delivery stream, Kinesis Data Firehose de-aggregates the records before it delivers them to the destination. If you configure your delivery stream to transform the data, Kinesis Data Firehose de-aggregates the records before it delivers them to AWS Lambda.
What’s a regional cache in CloudFront?
It’s a region-based cache of the origin server content. This is the first place a CDN server checks on an origin fetch. If this misses, then the fetch goes to the origin.
How big can you provision an EFS volume?
You don’t provision EFS volume size. EFS allocate what you consume.
What types of identity federation can you employ?
- Web Identity Federation (OID Connect/OAuth)
- SAML
- Cross-account trust
What authentication options does Aurora DB offer to users?
Local DB users, or
IAM
When using S3 transfer acceleration, what is the endpoint that the client uses for a bucket?
a CloudFront local endpoint. Then the upload traverses the AWS backbone.
me: Edge location endpoint.
When might you use scheduled reserved instances?
to get the additional capacity a workload needs during predictable spikes in demand, like an ecommerce site.
me: When the traffic pattern is well known
What cryptography standards does Cloud HSM support?
it is FIPS 140-2 level 3 complaint
- PKCS#11 API
- JCE API
- Microsoft CryptoNG (CNG) API
It does not support AWS API, unlike KMS, only support AWS API.
It is not integrated with other AWS services offering encryption.
What can you do to improve the performance of a Lambda function?
Declare resource objects as a singletons outside of the lambda_handler(). They ‘may’ be available to the next instance of the function, but declare them as NULL and do NULL checks in the handler or sub-functions.
Who has permission to run an AMI?
The AMI creator’s account plus any other accounts the configuration names. It can also be public.
How does certification registration work with ACM?
- The owner enters registration information into the ACM form including the domain name.
- ACM validates the domain name using R53 or your other register
- Once validated, ACM issues the certificate containing public and private keys. Private keys is encrypted using KMS.
- The certificate is now available to any AWS integrated service.
- When these services need to use the private key to decrypt content, they use KMS to decrypt the key, hold it in the memory, and use it to decrypt the publicly encrypted content.
What is the simplest way to have connections to multiple VPCs from an on-premise network?
Transit Gateway.
Transit means that this service enables transitive connections from on-premise VPN connections to AWS VPCs. It support true hub and spoke topology.
It’s available through VPN and DX. It can attach to multiple AZs, accounts, and regions via transit gateway attachments for VPN or VPC.
Why would you use cross-stack references in Cloud Formation?
Cross-stack references allow you to isolate stacks according to role or frequency of change.
Using an export statement, one stack can announce the ID of a resource. Then, anther stack can import that ID and use it as part of its resource creation, e.g., reference a VPC ID when creating a new subnet or security group.
Cross-stack references re-use running stack resources, unlike nested stacks, which re-used templates but create new resources.
What’s the role of an auto scaling group and the launch configuration?
The AS group determines where and when to launch instances. The launch configuration determines how.
What factors should influence your choice of Redis over Memcached or the other?
- Complex data types: Redis
- Vertical scaling: Memcached supports multi-threading
- Horizontal scaling (read): Redis
- Backup and restore: Redis
- HA: Redis supports replication between nodes
- Transaction: Redis
- Geo-special data type: Redis
- Simple, limited feature set: Memcached
- Rich feature set: Redis
What can you control with CloudFront behaviours?
- Path patterns
- Protocol policy
- HTTP methods,
- HTTP caching
- Request header caching
- Object caching
- TTL
- Cookie forwarding
- Query string forwarding
- viewer access restrictions
- Object compression
- Lambda function associations
What are the EBS storage types and what are they best suited to do?
- General Purpose gp2: SSD
- Default for most workloads. Burst to 3,000 IOPS with credits, 1GB-16TB - Provisioned IOPS SSD io1: SSD
- mission critical, sustained IOPS Large databases, 4GB - 16TB, provisioned IOPS to 64,000 - Throughput Optimised st1: HDD
- low cost, Frequently accessed data, streams, media; not boot volume, 500GB-16TB, 500 IOPS - Cold HDD sc1: HDD
- low cost, infrequent access, not boot volume, 500GB - 16TB, 250 IOPS
You’re designing a voting system and recording the votes in DynamoDB. You expect certain locales to be much busier than others. But you need to use a partition key of postal code to organise your data. What can you do to manage hot spots in your partitions?
DynamoDB enables Adaptive Capacity by default. This allocates RCU/WCU dynamically across partitions while staying below the total hard limit of the table.
Me: this looks like an updated answer: you don’t need to do anything to managing hot spot any more. DynamoDB’s adaptive capacity will balance the load at the table level, not at the partition level so that unused RCU/WCU for a given partition can be used by the hot spot partition.
What destinations does Firehose support?
- S3
- RedShift
- ElasticSearch (+Kibana),
- Splint
- Kinesis Analytics!
What are some options to reduce costs when using S3 versioning?
If you want to retain versions indefinitely, assign versions to cheaper storage classes, like one zone IA. If you can use a lifecycle policy to delete older versions.
What platforms does Elastic Beanstalk support?
- Docker
- Multi-Container Docker
- Docker python
- Docker go
- Docker GlassFish
- PHP
- Go
- .NET
- Java
- Ruby
- Python
- Node.js
- tomcat
What are the feature differences between ELB types?
- ALB - Layer 7, SSL termination, integration with ACM for cert management, request forwarding based on URL path, support more than one domain, support target groups based on path or IP addresses, able to load balancing across AZs. Does not support TCP or UDP. Embedded WAF, has authentication capability and support Lambda function,
- ELB - high volume and low latency, support PrivateLink. TCP and UDP, support end to end SSL
What is a CloudWatch Log Group?
A container for a collection of Log Streams that share the same retention, monitoring, access control, and metric filters.
What’s the difference between an SCP and a permission boundary?
SCP is at Organisational level, permission boundary is at Identity level.
What is a VPC Router?
Every VPC has exactly one. It consumes one RFC 1918 IP address. It’s +1 of the subnet’s IP address.
What options can you use to control access to S3 objects?
Identity policies (SCP, Permission Boundary Policy), resource policies and ACL
In Parameter Store, what are the fields in the following parameter name: /myapp/demo/password?
The first two fields are the path components. The final field is the parameter name.
What AWS services provides data that can be useful through Athena?
Athena can access logs from
- CloudTrail
- CloudFront
- Load Balancers
- VPC Flow Logs
You want to keep CloudTrail events longer than the 90-day retention period. What can you do?
Configure Trails to deliver CloudTrail events to S3. Also enable file encryption and validation to protect the files from tampering.
(Me, could also stream event to CloudWatch log group)
What are some of the CloudFormation Update behaviours for: EC2, RDS, AutoScaling Group, EBS?
- EC2: some interruption (me: e.g. you can dynamically change the instance type by stop and start the instance)
- RDS: replacement
- AutoScaling: no interruption
- EBS: no interruption
What are the two sides of a CloudFront edge called?
- The origin, origin protocol, and origin fetch are where the cached content originate.
- The viewer, viewer protocol are the client side of the edge.
You create a DynamoDB table and provision it for 10,000 WCU but only 40GB of storage. You notice that it created 10 partitions before you added any data? What could be happening?
Partitions are based on
- Provisioned storage capacity, and
- provisioned RCU/WCU capacity.
Since you provisioned 10,000 WCUs and a partition can support only 1000 WCUs, DynamoDB created 10 partitions.
me: this time, the WCU limitation is a key decider, if WCU were not over the limit, then storage size limit would kick in and it would create four partitions because each partition can only support 10 GB.
You have a cluster of servers processing media files. The response time needs to be very fast. What’s the best storage option?
EFS
EFS: low, consistent latency, 10+ GB per second throughput.
EBS (provisioned IOPS): lowest, consistent latency, up to 2GB per second
Amazon EFS file systems are distributed across an I constrained number of storage servers. This distributed data storage design enables file systems to grow spastically to petabyte scale and enables massively parallel access from Amazon EC2 instances to your data. The distributed design of Amazon EFS avoids the bottlenecks and constraints inherent to traditional file servers. The distributed design of Amazon EFS avoids the bottlenecks and constraints inherent to traditional file servers.
This distributed data storage design means that multithreaded applications and applications that concurrently access data from multiple Amazon EC2 instances can drive substantial levels of aggregate throughput and IOPS. Big data and analytics workloads, media processing workflows, content management, and web serving are examples of these applications.
What factors should you influence your choice of Redis over Memcached or the other?
- Simple feature set: Memcached
- Rich feature set: Redis
- Vertical scaling: Memcached support multi-threading
- Horizontal scaling (read): Redis
- Transaction: Redis
- Backup and restore: Redis
- Complex data types: Redis
- Geo-special data type: Redis
- HA: Redis - supports replication between nodes
What things can you do to optimise performance of your EMR cluster?
- Provision the cluster in the same region as your S3 data
- Choose the appropriate instance type for the workload: general purpose M, compute optimised, storage, memory optimised
What kind of certification does ACM support?
X.509 v3 SSL or TLS
me: an SSL/TLS X.509 certificate is a digital file that’s for Secure Socket Layer (SSL) or Transport Layer Security (TLS). The certificate fulfils tow functions. First the certificate can assist with authenticating and verifying the identity of a host or site. Second, it enables the encryption of information exchanged via a website.
An SSL/TLS certificate is one of the most popular types of X.509 certificates, or a type of public key certificate which uses the X.509 standard. X.509 certificates contain a public key and the identity of a hostname, organisation, or individual. When a certificate authority (CA) signs them or another entity validates them, the owner of that certificate can leverage the public key to establish secure connections with another party or validate documents someone digitally signed using the corresponding private key.
You have a Kinesis Data Stream that you want to access only from several private VPCs to exchange data among producers and consumers in your origination. How can you ensure ensure that the VPCs don’t have to configure an Internet Gateway?
Kinesis Data Stream (KDS) supports VPC Endpoints (Private Endpoints).
What’s the fastest way to recover to a previous point of an Aurora DB?
Backtrack instead of restore from backup.
When fanning out SNS message to consumers and you need flexibility with consumer response time, what method should you choose?
You could choose Lambda functions, but they will invoke and process immediately. That may be a problem under heavy load depending on the resources the Lambda function needs for processing. For more flexible, de-coupled processing, SQS queues allow the consuming applications to work at their pace while the Queue holds the messages for processing.
How is this snippet from a CloudFormation template not reusable?
“BucketName”: “lapix12345”
No, it is not reusable - it’s specifying a value that needs to be globally unique. Thus, any use of the template after the first run will not be able to create the bucket since it will be a duplicate name.
Me:
What we could do to ensure the reusability:
1. Use default values for the Parameter List (avoiding human input)
2. Use Parameter Store for system and customer values
3. Pseudo Parameter for CF wide values, e.g. region, partition, account id, and more
4. Intrinsic function for AZs, VPCs, Subnet, and more
5. Don’t specify resource physical id, CloudFormation will produce unique physical ids at the time of resource creation.
What sizing options does Aurora offer?
Provisioned, Parallel Query or Serverless
When should you use On Demand?
When workload is not steady and peak time is irregular.
How can you restore a database after deleting the Master?
Restore from a backup. Be mindful that auto backup copy have a retention period of 35 days by default.
How does SNI make configuration a CloudFront distribution easier?
Because browers that support SNI only refer to the hostname they are trying to connect. Without SNI, the CloudFront configuration needs to specify a static IP address since that’s what older browsers will be using.
What resources can an account share to other accounts using Resource Groups?
- Subnets,
- Transit gateways,
- Resolver rules,
- License configurations.
Accounts cannot Share subnets inside of the default VPC, nor use subnets that are owned by the owner of the owner of the resource. Likewise, a share cannot share security groups not owned by the resource owner. Likewise, a share cannot share security groups not owned by the resource owner. The resource owner can remove sharing from resources in use by others and those shares will continue until released.
How does Elastic Beanstalk separate application versions?
It bundles applications by version in application source bundles.
Wha is a CloudFormation Custom Resource?
A custom resource is a resource either in AWS or 3rd party that a CF template asks for as part of the stack. It uses messaging: SNS or Lambda, to trigger that resource to Create/Update/Delete itself.
You have an ECS cluster that is a web application tier for your application. You want to easily compose all tiers of the application. What option should you use?
Use an OpsWorks stack and compose the web tier using the ECS cluster. Compose the other tiers natively in OpsWorks.
How can application access an Aurora Serverless dB w/o connection string?
Enable the Data API to expose the REST APIs of the database through the Proxy Layer.
What purchasing options can you use to pay for Redshift compute nodes?
- On-demand
2. Reserved instances
How can You configure NAT gateways for HA in a region?
Configure one per AZ, each in a public subnet.
Me: and instances in the private subnets connect to it
If you need an analytics solution handling up to two petabytes of data with rapid query performance, what is your best AWS option?
me: EMR or Redshift?
Redshift can handle up to two petabytes. When properly designed and optimised, databases in Redshift can query multiple petabytes of data and return results in seconds.
Me: two key points - up to two petabytes, query in seconds.
How many security groups can a subnet have?
Subnets don’t have security groups. Security groups are assigned to network interfaces (ENI).
You want to grant access to a service running in your VPC to a VPC in another account. What’s one way to do that without exposing your service to the internet?
VPC peering allows this. Configure the security group of the trusting VPC with the accountID and subnetID of the trusted consumer. This only works within the same region. Across regions, use the VPC ID of the requesting VPC.
- PrivateLink,
- VPC peering
- Transit Gateway
How can you resurrect access to S3 objects within a date range?
Use S3 ACL
Me: ACLs are resource-based access policies that grant access permissions to buckets and objects.
By default, the owner, which is the AWS account that created the bucket, has full permissions.
Each permission you grant for a user or group adds an entry in the ACL that is associated with the bucket.
Where do Lambda functions live in the AWS network?
- By default, they live in a region but outside the customer’s VPC. It thus has access to internet.
- Customers can also configure VPC Lamba functions where all the network restrictions of the subnet and security group apply. The VPC Lambda function still runs in a sandbox outside of the VPC and exposes itself through an ENI in the VPC. For this reason, cold starts are even slower.
NEW: remoteNAT enables multiple VPC Lambda functions to share the same the same network interface in a VPC, thus speeding up the start time.
What EC2 metrics can CloudWatch not see by default?
- Memory,
- File system
- Applications.
For these, customers need to install the CloudWatch Agent.
What are the four EBS storage types and what are they best suited to do?
- General purpose SSD gp2: SSD
Default EBS type, boot volume, 1GB-16TB, 3,000 IOPS burst with credits - Provisioned IOPS SSD io1: SSD
Mission critical, sustained throughput larger databases, provisioned IOPS to 64,000 IOPS
4GB - 16TB - Optimised HDD st1: HDD
frequently accessed data, streams, media, Not boot volume, low cost, 500 IOPS, 500GB - 16TB - Cold HDD: HDD
infrequent accessed data, not boot volume, lowest cost, 250 IOPS, 500GB-16TB
What are some of the features that Aurora Serverless offers micro service/Serverless applications that make it an attractive option as an RDBMS?
- Very low latency connections and REST APIs for queries.
2. Also, it doesn’t involve cluster infrastructure running in a customer’s environment.
How do applications running on EC2 get their credentials to access other AWS services?
If the instance is running as an IAM role, the IAM role info is available in the instance meta data for the application to use.
http://169.254.169.254/latest/meta-data …./credential
Me: instance profile?
Why would you use cross-stack references in CloudFormation?
Cross-stack references allow you to isolate stacks according to role or frequency of change.
Using export statement, one stack can announce the ID of a resource. Then, another stack can import that ID and use it as part of its resource creation, e.g. , reference a VPC ID when creating a new subnet or security group.
Cross-stack references re-use running stack resources, unlike nested stacks, which re-used stack templates but create new resources.
How can you provide Layer 7 firewall protection from incoming threats?
AWS WAF is a layer 7 firewall that can run in front of CloudFront, API Gateway or ELB. It combines conditions and rules then uses a web ACL to grant or deny traffic.
Me: a web access control list (web ACL) gives you fine-grained control over the web requests that your Amazon CloudFront distribution, Amazon API Gateway API, or Application Load Balancer responds to.
You can use criteria like the following to allow or block requests:
1. IP address origin of the request
2. Country of origin of the request
3. String match or regular expression (Reyes) match in a part of the request
4. Size of a particular part of the request
5. Detection of malicious SQL code or scripting
etc.
This criteria is provided inside the rules that you include in your web ACL and in rule groups that you use in the web ACL. It’s specified in the rule statement.
How do EC2 instances, on-premise VMs and servers become manageable by SSM?
By installing the SM agent on the VM and servers to be managed and applying appropriate IAM permissions (EC2 only) and activation for on-premise servers.
How does Kinesis Data Analytics (SQL) generate a result set from the SQL query?
KDA uses an in-application output stream that serves as the result set.
The KDA SQL application can direct the result set to KDS, KDF.
Also, a SQL application can send errors to an in-application error stream that goes to a different destination.
How does DocumentDB achieve HA?
Similar to AuroraDB, it separates compute from storage.
You decide what type and how many dB instances you want across AZs in a region.
The Master is the read/write node.
The other instances are Read instances (replicas) that can promote to Master.
They all interact with the Cluster Storage Volume which manages six copies of all data across three AZs.
What’s the most reliable way to delete physical resources from a CloudFormation stack?
Use CF to delete the stack completely. It uses the Logical/Physical resource mapping to track all resources it created so that it can delete them using the template.
You have configured VPC peering between VPC A and VPC B. When you try to ping an EC2 instance in B from A, you don’t get a response. What should you check?
me: for both VPC 1. Routing 2. Security group 3. NACL
When assigning a security group to an EC2 instance, what is really happening?
You’re assigning it to the primary network interface, not the instances.
When using OpsWorks, where does your application code live?
It lives outside of OpsWorks in a repository you specify, such as Git. You provide the URL and the credential to OpsWorks in the Apps recipe. Likewise, you specify the deployment targets using a deployment recipe.
What are the benefits of using CloudFormation stack sets?
Stack sets enable an account admin to run stack templates across multiple accounts and multiple regions.
The two sides of the transaction are the Admin account and Target account. It also requires two defined roles: AWSCloudFormationStackSetAdministrationRole and the AWSCloudFormationExecutionRole.
How does a document db achieve relationships as an RDBMS does with separate tables and reference keys?
Documents can contain embedded objects like sub-documents, lists and arrays, similar to how an RDBMS schema would have these things AWS separate tables with reference keys to join them.
Me: joined during the record creation - need to know the relationship before hand, cannot support adhoc queries like RDBMS do.
You have a cluster of servers processing media files. The response time needs to be very fast. What’s the best storage option?
Performance:
Per-operation latency
EFS - lowest, consist latency
EBS provisioned IOPS - low, consist latency
Throughput scale
EFS - 10+ GB per second
EBS Provisioned IOPS - up to 2 GB per second
What are CloudFormation nested stacks and how are they different from cross-stack references?
Nested stacks are static template statement that include template references to other templates. They declare the order of resource creation and reference another template.
On execution, they create new resources in order of the dependency statements. Unlike cross-stack references that refer to running resources, nested stacks create new resources by reuse template code.
me:
Nested stack reuses existing stack templates as part of its stack for creating new resources
Cross-tack reuses running stack resources as part of its stack to create new resources
What is the difference between an SCP and a Permission Boundary?
SCPs offer central control over the maximum available permissions for all accounts in your organisation, allowing you to ensure your accounts stay within your organisation’s access control guidelines.
A permissions boundary is an advanced feature for using a managed policy to set the maximum permissions that an identity-based policy can grant to an IAM entity
Me: Permission Boundary is a new IAM feature that makes it easier for you to delegate permissions management to trusted employees. As your organisation grows, you might want to allow trusted employees to configure and manage IAM permissions to help your organisation scale permission management and move workloads to AWS faster. For example, you might want to grant a developer the ability to create and manage permissions for an IAM role required to run an application on EC2.
A permissions boundary is an advanced feature that allows you to limit the maximum permissions that a principle can have.
What is an SSM document?
It configures SSM, defining what SSM does.
It can be in JSON or YAML
It controls all the functionality of SSM in your account.
They are similar to CloudFormation templates.
You create a database credential using a secure string in Parameter Store. The client application needs to use this string to connect to a database. What permissions does the application need?
Access to Parameter Store and access to the customer master key (CMK) used to encrypt the credential in Parameter Store.
What’s the fastest volume type available to EC2?
Instance storage type.
It’s IOPS up to 80,000 IOPS and 1,750MB/s throughput. Me: it does not sound correct.
EBS provisioned IOPS: up to 64,000 IOPS.
How does a lunch template improve on launch configuration?
Multi security groups, additional network interfaces, additional storage volumes, advanced configurations: elastic graphics, elastic inference, T2/T3 unlimited
Also, you can modify and reused LTs; they can be the starting point for a new LT or version them with updates.
What evaluations does IAM consider when determining a principal’s effective permissions?
Organisational boundaries (SCP)—>user/role boundaries (permissions boundary policy)—>role policies (identity permissions policy) —> effective permissions
Me: resource access control list is not a policy?
What are some options to reduce costs when using S3 versioning?
If you want to retain versions indefinitely, assign versions to cheaper storage classes, like one zone IA, otherwise, you can use a lifecycle policy to delete older versions.
You want to be able to have multiple applications receive messages from a queue. You also want late applications to replay messages from an earlier time. Your team wants to use SQS. What do you suggest?
SQS does not support multiple consumers of messages on a queue or does it support replay. You should use Kinesis Data Streams for this requirement.
What is a web socket API?
A persistent session-oriented protocol/API best suited for data streaming, interactive applications, event management applications.
What advantages does CloudFormation bring to disaster recovery design?
By automating DR through CF, organisations can opt for lower-cost backup and restore or pilot-light techniques because CF will do the recovery faster than manual operations. This faster recovery may make the normally faster but more expensive Warm or active-active techniques less necessary for some organisations.
Where do Lambda functions live in the AWS network?
- By default, they live in a region outside the customer’s VPC. It thus has access to the internet.
- Customers can also configure VPC Lambda functions where all the networking restrictions of the subnet and security group apply.
- The VPC Lambda function still runs in a sandbox outside of the VPC and exposes itself through an ENI in the VPC.
- For this reason, cold starts are even slower. (May not true, see blow update)
NEW: RemoteNAT enables multiple VPC Lambda functions to share the same network interface in a VPC, thus speeding up the start time.
How can you provide Layer 7 firewall protection from incoming threats?
AWS WAF is a layer 7 firewall that can run in front of ELB, CloudFront or API Gateway. It combines conditions and rules then uses a web ACL to grant or deny traffic.
What’s the order of evaluation IAM uses to determine if a principal has a permission on a resource?
Explicit deny, explicit allow, implicit deny
What are the various endpoints in Aurora?
- The cluster endpoint refers to the Master for read and write.
- The reader endpoint refers to all replicas as a cluster.
Readers get directed to any replica, improving scalability of Aurora for read-intensive workloads. - Instance endpoints allow you to configure groups of instances behind an endpoint.
How does ELB/ALB deploy for HA?`
xLBs deploy to an AZ with an ENI in any subnet that need to be exposed the LB (me: exposing the target groups to xLBs)
What are the types scaling policies?
- Step scaling (based on %CPU load increase),
- target tracking (tracking overall CPU level on all instances),
- simple (no steps)
Wth step scaling and simple scaling, you choose scaling metrics and threshold values for the CloudWatch alarms that trigger the scaling process.
AWS strongly recommend that you use a target tracking scaling policy to scale on a metric like average CPU utilisation or the RequestCountPerTarget metric from the Application Load Balancer.
The main issue with simple scaling is that after a scaling activity is started, the policy must wait for the scaling activity or health check replacement to complete and the cool down period to expire before responding to additional alarms. Cool down periods help to prevent the initiation of additional scaling activities before the effects of previous activities are visible.
In contrast, with step scaling the policy can continue to respond to additional alarms, even while a scaling activity or health check replacement is in progress.
You are using Kinesis Data Streams to deliver a stream of data to applications. You notice that you’re not getting the capacity you configured across three shards - well less than 3MB per second. Your producing application is using PutRecord (not the KPL) to write records. What could be the problem?
You may not have three partition keys that you’re rotating evenly while PUTting records. Thus, you’re maximising one shard, but under-using the others.
What kind of port work well for NACL outbound traffic rules?
An ephemeral port - one that specifies a range of port numbers to avoid having to have a matching outbound rule for all inbound rules.
A network access control list (ACL) is an optional layer of security for your VPC that acts as a firewall for controlling traffic in and out of one or more subnets.
Ephemeral ports:
If an instance in your VPC is the client imitating a request, your network ACL must have an inbound rule to enable destined for the ephemeral ports specific to the type of instance (Amazon Linux, Windows Server 2008, and so on).
In practice, to cover the different types of clients that might initiate traffic to public-facing instances in your VPC, you can open ephemeral ports 1024-65535. However, you can also add rules to the ACL to deny traffic on any malicious ports within that range. However, you can also add rules to the ACL to deny traffic on any malicious ports within that range. Ensure that you place the deny rules earlier in the table that the allow rules that open the wide range of ephemeral ports.
Ephemeral:
Lasting for a very short time.
“fashions are ephemeral: new ones regularly drive out the old”.
What’s the best way to handle the base load of an application?
Reserved Instance in the necessary AZs
Where is the cluster in an Aurora Serverless db?
- It’s in the VPC you specify when creating the cluster.
- Aurora Serverless allocates ACUs into your cluster from a warm pool it maintains for all customers.
- The proxy manages connections from your applications to the cluster and movement of the ACUs in and out of your VPC.
- The proxy also manages migrating cache data from one ACU to another when capacity changes.
- Keep in mind, Serverless uses the same Cluster Storage Volume tier that Aurora uses, so Serverless is only managing the compute tier since the storage tier is already serverless and multi-tenant.
Why use NACLs for managing traffic to resources when security groups might be easier?
Some services don’t support security groups. Only NACLs will work.
For RDS MySQL, what locations can you specify for the read replicas?
- Same AZ, another AZ in the region, or another region.
- Replication is asynchronous.
- Direct replicas from the Master are Tier 1.
- You can specify Tier 2 replicas off the Tier 1 replicas as well.
- You can promote a RR to Master. This is useful for rapid DR in another region.
What is a CloudWatch Log Group?
A CloudWatch Log Group is a collection of log streams that have the same retention period, access permission, monitoring and metric filters.
Where is the public IP address of an EC2 instance?
me: an internet gateway is a horizontally scaled, redundant, and highly available VPC component that allows communication between your VPC and the internet.
An internet gateway serves two purposes: to provide a target in your VPC route table for internet-routable traffic, and to perform network network address translation (NAT) for instances that have been assigned public IP addresses.
In internet gateway supports IPv4 and IPv6 traffic. It does not cause availability risks or bandwidth constraints on your network traffic.
IGW enable access to or from the internet for instances in a subnet in a VPC. IGW is for a region, not for a particular subnet.
What’s a logical Resource in CloudFormation?
- The name the CF template uses to describe physical resources that CF creates.
- The physical resources acquire cryptic IDs only at the time of creation.
- The logical resource make it easier to identify those physical resources.
Since RDS doesn’t allow root access to the console, how can admins manage the configurations of the database?
Parameter group and options groups provides the parameters admins need.
What are the HA options for VPN?
- no HA: a single Customer Gateway device, single internet connection, and single tunnel endpoint;
- Partial HA: a single Customer Gateway device, single Internet connection, and two tunnel endpoints in separate AZs;
- HA: two Customer Gateway devices, two internet connections, and two tunnel endpoints in separate AZs for each network connection, this uses dynamic routing/BGP
(Me: the on-premise side need to have a router support BGP).
What are the appropriate instance types for various EMR scenarios?
- Long-Running Clusters and Data Warehouses On-Demand On-Demand or instance-fleet mix Spot or instance-fleet mix.
- Cost-Driven workloads Spot Spot Spot
- Data-Critical workloads On-Demand Spot or instance-fleet mix
- Application Testing Spot Spot Spot
Me:
When you set up a cluster, you choose a purchasing option for EC2 instances. You can choose to use On-Demand instances, Spot Instances, or both.
your choice to use instance groups or instance fleets in your cluster determines how you can change instance purchasing options while a cluster is running. If you choose uniform instance groups, the instance type and purchasing option apply to all EC2 instances in each instance group, and you can only specify the purchasing option for an instance group when you create it.
If you choose instance fleets, you can change purchasing options to fulfil a target capacity that you specify.
When querying data using Athena, the select statement needs to refer to a table. What is that table?
- It’s one of the schema definitions that describes the columns and data types of the data.
- It can be created manually using Athena Interface, API or CLI, or
- It can be created automatically using Glue Data Crawler.
How does DocumentDB manage backups?
- The DocumentDB Cluster Storage Volume takes daily snapshots and stores them in S3.
- DocumentDB also records incremental transactions between snapshots to provide point-in-time recovery.
- You also define a retention period for all data.
What are the benefits of using CloudFormation stack sets?
- Stack sets enable an account admin to run stack templates across multiple accounts and multiple regions.
- The two side of the transaction are the Admin account and Target account.
- It also requires two defined roles:
- AWSCloudFormationStackSetAdminstrationRole
- AWSCloudFormationStackSetTargetRole?
How can NACLs allow traffic from another security group?
They cannot reference other resources, only ports and IP address ranges. Security groups, however, can refer to the ID of another security group to allow traffic from it.
What’s the difference between a VM and a Container?
VM
1. VMs run on top of a hypervisor, abstracting the hardware.
2. VMs contain the OS and applications.
3. The isolation boundary is VM.
4. Many VMs can run on the same hypervisor.
Container
1. Containers run on top of the OS but further isolate applications.
2. With Container engine, like Docker, applications and their dependencies can run isolated from each other on the same OS/VM.
3. Containers don’t have dedicated memory like a VM does, so you can pack more applications on hardware by using containers rather than just using VMs.
4. But, containers are not isolated from each other regarding security.
5. Containers can start very quickly compared to VMs — in seconds, sometimes MS.
Your customer wants to get out of managing their messaging infrastructure. They use a number of standard APIs and protocols with their applications. They require that all communications with the messaging system be private, not over the internet. They also want a highly available solution. What will you recommend?
Amazon MQ offers support for a number of standard protocols and is an open source project, so the API is likely familiar to the customer. Unlike SQS or SNS, Amazon MQ is deployed with private endpoints in the customer’s VPC with no public access required for applications within the VPC. It’s also available in an active/standby configuration across multiple AZs in a region.
What does an AMI contain?
- Region
- The owner
- Launch permissions
- Architecture (32-bit or 64-bit)
- OS,
- Storage for the root device.
- Block device mapping of all storage volumes?
Once created, the AMI creates snapshots of any EBS volumes described in the AMI and holds pointers to them.
If the instances type uses instance volumes, the AMI creation bundles the instance definition and instance store into files and saves them to S3.
What kind of transformation can you do to a Firehose stream?
Use a Lambda function to manipulate records or change the format to Parquet or ORC with a checkbox.
What data file formats does Athena support?
- CSV
- TSV
- XML
- JSON
- Parquet
- ORC
How does OpsWorks fit in to the range of tools like CloudFormation and Elastic Beanstalk?
OpsWorks offers most of the control over deployments that CloudFormation offers, but still provides minimal config options. It offers Chef or Puppet as the deployment framework.
Me:
OpsWorks is for development deployment vs SSM is for operational support.
CloudFormation defines AWS Resources that needs to be created/updated/deleted while Elastic Beanstalk provides a versioned application hosting environments.
Is Redshift suitable for DSS, HIPPA or other security standards?
Redshift compliants with DSS, HIPPA and other security standards by supporting encryption in transit and at rest. It uses KMS (AWS Key Management Service) or CMK (Customer Master Key) for encryption keys.
When configuring instance types for an ElasticSearch cluster, what choices should you consider?
The master node has much lower CPU and memory requirements, so it can be smaller. The data nodes do to work and should be bigger.
What’s in an AS Group?
- Name
- LC template & version
- Min, Max and desired instance count
- VPC,
- Subnet
- Health check
- Load balancing
- scaling policies,
- Change notifications
- Tags
Launch template defined where and what
Scaling configuration defines when
What does AWS shield do beyond WAF?
Shield is a DDoS protection layer in front of WAF.
Standard is free, Shield Advanced provides WAF, DDoS mitigation, visibility and reporting, DDoS response team support, and cost protection due to attacks. Shield also protects EIPs。
me： AWS Shield Advanced for EIP extends the coverage of DDoS cost protection， which safeguards against scaling charges as a result of a DDoS attack。
How does HVM improve performance of virtualised machines？
HVM uses newer generation of CPUs that allow guest OS to interact with CPU, memory, network, local storage and the motherboard bypassing the hypervisor.
Unlike paravirtualisation, HVM avoids emulation, speeding up performance of guest OSs.
Next, AWS introduced Nitro in 2017, bringing hardware virtualisation to all aspects of the guest OS access to the hardware. This results in near bare metal performance.
What are the four types of traffic that NACLs can affect between two subnets?
Inbound traffic and outbound traffic
Subnet A —> Subnet B; Subnet B —> Subnet A
- SA outbound rules
- SB inbound rules
- SB outbound rules
- SA inbound rules
What are the differences between AMI baking and user data/bootstrapping?
AMI baking isn’t flexible but faster launch.
User data is more flexible but possibly slower.
Where can you manage access and other configurations such as retention period and event filters, for CloudWatch Logs?
at the CloudWatch Log Group level, which is a group of related (collection of) Log Streams.
What AWS services provide data that can be useful through Athena?
Athena can access logs from
- CloudTrail
- CloudFront
- VPC Flows Logs
- Load Balancers
Why can’t an EC2 instance in a private subnet not receive internet traffic from a NAT gateway?
A NAT gateway has a public IP address, but that’s used only for returning inbound traffic from an outgoing request by a private instance.
How does Kinesis Data Analytics (SQL) solve SQL’s requirement for a table to query?
KDA has in-application input streams that are virtual tables for the SQL query.
These tables take input from KDS or KF and place the message as records in the stream. Or, they place a number of records in the Virtual Tables according to the duration of a window defined in the SQL procedure.
Who has permission to run an AMI?
- The AMI creator’s account plus any other accounts the configuration names.
- It can also be public.
How can you introduce new versions of an API without breaking applications that depend on the current version?
Use the version stages capability provided.
You want to grant access to a service running in your VPC to a VPC in another account. What’s one way to do that without exposing your service to the internet?
VPC Peering allows this.
Configure the security group of the trusting VPC with the accountID and subnetID of the trusted consumer. This only works within the same region.
Across regions, use the VPC ID of the requesting VPC.
What are the key features of Amazon MQ?
It’s a message broker based on Apache MQ.
It support standard APIs such as AMQP, MQTT, OpenWire or STOMP.
It can function as a queue or topic and supports cardinality of 1:1 or 1:n
What is Aurora DB multiple master?
In a multi-master cluster, all DB instances can perform write operations.
There isn’t any failover when a writer DB instance becomes unavailable, because another writer DB instance is immediately available to take over the work of the failed instance.
We refer to this type of availability as continuous availability, to distinguish it from the high availability (with brief downtime during failover) offered by a single-master cluster.
Describe the seven different instance types and what each best supports.
DR McGIFT PX (DR McGIFPIX?)
- D for Density
- R for RAM
- M - main choice for general purpose apps
- C for Compute
- G for Graphics
- I for IOPS
- F for FPGA
- T - cheap general purpose (think T2 micro)
- P for Graphics (think Pics)
- X - Extreme Memory
- General purpose
- Memory optimised
- Storage optimised
- Network optimised
- Big data optimised
- Floating point computation optimised
- GPU
- ARM based
What are the various traffic routing types available in R53?
Six in total:
- Simple
- Failover
- Geolocation
- Weighted
- Latency
- multi-value answer
- Geo-proximity
What are the three minimum parts to an IAM policy statement?
- Effect
- Action
- Resource
Optional:
- Condition
- Principal (resource policy only)
How does AWS IoT Gateway provide always-available access to things?
The IoT Gateway maintains device status in device shadows. These are always available even though things may have sporadic access to the Gateway.
How can you find out popular objects, or access to encryption fields in CloudFront?
CloudWatch can report on metrics from CF, CloudTrail can report on API calls, and AWS config can report on configuration changes over time.
What’s a regional cache in CloudFront?
- It’s a region-based cache of the origin server content.
- This is the first place a CDN server checks on an Origin fetch.
- If this misses, then the fetch goes to the origin.
How can you configure a custom origin for CloudFront distribution over a private WAN connection?
You cannot.
Any custom origin server must offer public access to CloudFront.
How does Data Pipeline reference parameters?
{parameter_name}
You can use a parametrised template to customise a pipeline definition. This enable you to create a common pipeline definition but provide different parameters when you add the pipeline definition to a new pipeline.
When you create the pipeline definition file, specify variables using the following syntax: #{myVariable}.
It is required that the variable is prefixed by my. For example, the following pipeline definition file, pipeline-definition.json, including the following variable: myShellCmd, myS3InputLoc, and myS3outputLoc.
A pipeline definition has an upper limit of 50 parameters.
Your customer is ready to move a very large amount of media files to AWS to host their video play out operations using Elemental. The video files add up to over 130PB. What do you recommend for the transfer solution?
Use two Snowmobiles. Each Snowmobile can hold up to 100PB of data. Connected together, the transfer operation will see a single 200PB storage area.
What cryptography standard does CloudHSM support?
PKCS#11, Java Cryptograph Extensions (JCE), MS CryptoNG (CNG). CloudHSM does not support AWS APIs.
CloudHSM compliant with FIPS 140-2 at level 3
KMS does not support CloudHSM.
What’s the most scalable way to install the CloudWatch agent on existing EC2 instances?
Use SSM run commend to install CloudWatch agent on existing EC2 instances.
You have a large file in S3 that contains all the sales records for each day. You perform queries on that data, mostly where data=[a single day]. You notice that your five-node cluster shows CPU activity on only one node even though you have distribution style of All. What could be the problem?
The Leader node can only distribute data by file. So a single file is all going to a single compute node. To take better advantage of the cluster, you should pre-process the large file into five, ten or any multiple of five files.
Me: is this a EMR cluster?
When fanning out SNS messages to consumers and you need flexibility with consumer response time, what method should you choose?
SQS
What is the five-step approach to answering an exam question?
- Identify significant points in the question
- identify similar answers, but understand the differences
- Look for disqualifying facts in answers, based on #1
- Eliminate any generally bad answers.
- Pick between remaining answers using judgement.
What service can you use when your data security requirements need FIPS 140-2?
CloudHSM or KMS, they both comply with FIPS 140-2.
CloudHSM at Level 3, while AWS KMS at level 2.
CloudHSM support KPCS#11, Java Cryptography Extensions (JCE), MS CryptoNG (CNG), it does not provide AWS API access
KMS provides AWS API access only.
You select VPC1 for your ALB. You then select AZ1, AZ2 and AZ3. What does the ALB deploy?
The ALB service is outside of the VPC across the regions. ALB will deploy an ALB node with the appropriate IP address in each AZ you’ve selected.
How can you deliver /var/logs log file events to CloudWatch Logs?
Install the CloudWatch agent on the EC2 instance.
Configure it to tail the logs in /var/logs. It will pick up each entry in the log file and send it them as Log events using a Log Stream.
How do applications running on EC2 get their credentials to across other AWS services?
If the instance is running as an IAM role, the IAM role info is available in the instance meta data for the applications to use.
What types of messaging does Amazon MQ support?
- Topics,
- Queues,
- Virtual Topics
Virtual Topics allows a single publisher to a topic deliver messages to any number of subscribes through a fan-out technique, similar to SNS fan out.
You create a database credential using a secure string in Parameter Store. The client application needs to use this string to connect to a database. What permissions does the application need?
Permission to access the Parameter Store and permission to access the CMK used to encrypted the credentials stored in Parameter Store.
What are the three components of Amazon ElasticSearch?
- ElasticSearch (Lucene)
- Logstash or Beats
- Kibana for visualisation
What are some of the design goals that a memory cache like ElasticCache can provide?
Reduced latency for database lookups, improved availability if the cache is HA, stateful micro service design support by offloading state to a cache, and reduced costs/impact on databases by offloading cache-able reads to the memory cache.
How does a NACL affect traffic between two resources in a subnet?
It doesn’t. Only when traffic crosses a subnet do the NACL rules apply.
How does DocumentDB log its activity?
Using logs that it exports to CloudWatch Logs using a service-linked role.
How does Aurora Serverless manage ACUs when demand falls?
It can reduce ACUs to Zero if there is no demand, reducing costs.
What is an instance profile?
An instance profile is a container for an IAM role that you can use to pass role information to an EC2 instance when the instance starts.
What does an AMI Contain?
- Owner
- Launch permissions
- Architecture
- OS
- Block device mapping
Once created, the AMI creates snapshots of any EBS volumes described in the AMI and holds pointers to them.
If the instance type uses instance volumes, the AMI creation bundles the instance definition and instance store into files and saves them to S3.
All AMIs are categorised as either backed by Amazon EBS or backed by instance store. The former means that the root device for an instance launched from the AMI is an Amazon EBS volume created from an Amazon EBS snapshot. The latter means that the root device for an instance launched from the AMI is an instance store volume created from a template stored in Amazon S3.
Boot time for an instance:
Amazon EBS-backed AMI - usually less than 1 minute
Amazon instance store-backed AMI - Usually less than 5 minutes
What are some options to reduce costs when using S3 versioning?
If you want to retain versions indefinitely, assign versions to cheaper storage classes, like one zone IA.
Otherwise, you can use a lifecycle policy to delete older versions.
Your customer is ready to move a very large amount of media files to AWS to host their video play out operations using Elemental. The video files add up to over 130PB. What do you recommend for the transfer solution?
Two snowmobile daisy-chained together as one partition. Each snowmobile has 100PB capacity.
How can you achieve cross-region messaging availability with Amazon MQ?
MQ supports global brokers where brokers are deployed in AZs in multiple regions while keeping the entire Queue in sync.
What can you use for encryption if you need to be certain that AWS can never access your keys or data?
CloudHSM is only accessible to the customer.
KPCS#11, JCE and MS CNG are the stanard APIs you could use to interact with CloudHSM.
You’ve configured VPC peering between VPC A and VPC B. When you try to ping an EC2 instance in B from A, you don’t get a response. What should you check?
- default Route Tables associated with the subnets involved
- NACLs that associated with subnet on both sides - inbound and outbound rules
- Security Groups associated with the source EC2 instance or target EC2 instance.
What are the two types of group EMR can use for managing instances?
- Uniform Instance Groups and
2. Fleet Instance Groups
What I/O performance can S3 deliver?
3,500 puts
5,000 gets per object partition.
Me:
S3 must maintain a ‘map’ of each bucket’s object names, or ‘keys’. Traditionally, some form of partitioning would be used to scale out this type of map. Given that S3 supports a lexigraphically-sorted list API, it would stand to reason that the key names themselves are used in some way in both the map and the partitioning scheme … and in fact that is precisely the case: each key in this ‘keymap’ is stored and retrieved based on the name provided when the object is first put into S3 - this means that the object names you choose actually dictate how AWS manage the keymap.
Internally, the keys are all represented in S3 as strings like this:
bucket/keyname
Further, keys in S3 are partitioned by prefix.
How can you protect APIs on API Gateway?
You can place a WAF in front of an API Gateway.
Web Application Firewall (WAF) can protect APIs against a range of threats including DDoS, known IP blacklists and much more.
Me. AWS Shield or AWS Shield Advance can provide DDoS protection, not WAF. AWS Shield is placed in front of WAF.
How can you protect your CloudFront distribution from malicious activity?
Configure WAF in front of the CF distribution.
What are the various fault domains in AWS?
AZs, regions and global edge services
Why should APIs be serverless?
Because APIs need to run 24/7 on infrastructure someone needs to manage and pay for. Thus, it’s ideal for pay as you go serverless implementation.
Me: in other words, autoscaling and pay per request without provisioning max capacity to cater for peak load is a big win/cost saving and support team costs (multi-tenant share cost model).
How can resources in a VPC resolve private DNS names from on-premise resources?
Create a R53 Resolver outbound endpoint. Create mapping for the on-premise DNS names that refer to the on-premise DNS IP address.
With OpsWorks, what storage options can you choose for EC2 instances?
EBS or instance store.
How does SNI make configuring a CloudFront distribution easier?
Because browsers that support SNI only refer to the host by name that they are trying to connect. Without SNI, the CloudFront configuration needs to specify a static IP address since that’s what older browsers will be using.
What are the components of a container?
a Docker file describes the OS and other software components of the container using layers. It’s similar to a file system.
A container image is like the disk. Or like an AMI. It describe the running container. Container images live in Docker Registries. A container is a running container image.
Containers map to resource like ports.
What does Elastic Beanstalk do that CloudFormation does not?
It creates an environment (based on web application or worker application) and deploys your application version into that environment.
CF creates stacks, which provision AWS resources (create, update, delete), but NOT applications.
what instance run type options can you choose in OpsWorks?
24/7, time-based, or load-based.
How can you configure ElasticSearch for the best HA?
Configure three master nodes: the master and two eligible maters.
Also have at least three data nodes across AZs. By having three of each, ES can use a quorum to determine the next election if one fails.
(Me: this is minimum configuration for a HA ElasticSearch cluster)
Where does you RedShift cluster live in the AWS network?
- It lives in a VPC you specify.
- By default, it uses the default VPC, but you can specify a custom VPC in your account.
- To access S3 data, you need to configure a NAT or internet gateway for the public S3 point, or create a VPC endpoint for S3.
you want to ensure that you delete items in DynamoDB after a certain period of time. What’s the simplest way of implementing a retention policy?
Use Enable TTL and specify the epoch of the duration items should remain in the table. DynamoDB constantly checks the timestamp of items and marks them for deletion once they exceed their date + epic > today.
You want to revert to a previous configuration of an environment in Elastic Beanstalk. What’s the best way to do that?
Save all your configurations (as a version control). Then, you can revert to a saved configuration (thinking version rollback).
How does DynamoDB implement Global Tables?
It uses Streams to capture all changes to one table to the other tables in other regions.
You configure a Global Table by enabling Streams (Old and New), then by adding Regions where you want to replicas. All tables are masters and stream their changes to the other replicas.
You’ve decided you want to make your RedShift cluster accessible over the internet but you’re concerned about secure transmission and storage of data since you didn’t configure that with your private subnet choice. What options do you have now？
you can change the subnet to public and you can also enable encryption in transit and at rest.
When should a customer use a VPN rather than DX?
- When speed of setup is critical; VPN takes minutes, DX take days-weeks
- Cost can be lower for spiky or sporadic usage.
- When network QOS is not critical.
- VPN performance depends on customer router CPU due to encryption; the ISP network connection over the Internet is not consistent.
How can you restrict traffic to a container?
Use the AWS VPC network mode.
Configure the security group that the container’s VPC uses to control what traffic gets in and out.
what are the four key terms for ECS?
- Cluster - the collection of resources ECS can use to run your containers
- Service - ECS or Fargate runtime responsible for managing container tasks.
- Task definition - a configuration file that tells ECS what containers it should create and how they interact with the outside world;
- Container definition - Container definitions are used in task definitions to describe the different containers that are launched as part of a task.
what can you do with object locking in S3?
Legal holds and retention policies - this prevents objects from deletion.
prerequisite:
Versioning must be enabled.
Object locks must be set at time of creating the bucket.
What is an API integration?
It’s the code behind the API that the API invokes. This could be a mock or the real implementation. Implementations can include Lambda functions, other AWS service like DynamoDB queries, (know the others!), or custom services hosted on EC2 or containers.
How can you enable IPv6 on an application load balancer?
Select dual stack.
You want to add more nodes to your Redshift cluster for more storage capacity. You want the fastest downtime for writers as possible. You’d also like to change the node type to a smaller instance. What options should you use?
If you don’t need to change the node type, elastic resize is the fastest option. If you really need to also change the node type, then you’ll have to use classic resize, but it is the longest (24hr.) read-only mode.
Me:
Redshift now supports elastic resize across node types. Customers can change node types sighing minutes and with one simple operation using elastic resize.
Elastic resize across node type automates the steps of taking a snapshot, creating a new cluster, deleting the old cluster, and renaming the new cluster into a simple, quick, and familiar operation. Elastic resize operation can be run at any time or can be schedular to run at a future time. Customers can quickly upgrade their existing DS2 or DC2 node type-based cluster to the new RA3 node type with elastic resize.
what is the main network security difference between ALB and NLB?
- ALBs terminate the client request then establish a new connection to the target group because encryption operates at layer 7.
- NLB, examining only the layer 4 header, simply pass on the layer 5+ portion of the packet which may or may not be encrypted. This enables an end-to-end pass-through of encrypted layer 7 data, improving performance.
me: ALB will terminate the initial http request, modify it (add the X-Forwarded Headers）and initate a new http request directly to the instance。
If you need to terminate 100% on the instance itself you need to use NLB, not an ALB.
me:
ALB has a embedded WAF, it terminates SSL connections, client IP address is lost by
NLB supports SSL connection pass through, client IP address is preserved
What can you do to improve the performance of a Lambda function?
Declare resource objects as singletons outside of the lambda_handler(). They ‘may’ be available to the next instance of the function, but declare them as NULL and do NULL checks in the handler of sub-functions.
what are some ways to minimise costs with Athena?
Since customers pay for Athena by the amount of data it scans, reduce the amount of data scanned by partition data, organise it into columnar format to reduce the number of columns Athena sees during a query.
You are designing a ticket sales system using DynamoDB as the orders database. You want to ensure that you always have the capacity you need no matter how many customers arrive at your site. What’s the best way to ensure that capacity on DynamoDB?
On-demand capacity will always manage the RCU/WCU and storage requirements for the incoming load. Auto scaling sets an upper limit and can be slow. Provisioned capacity also sets a limit.
How can you restrict access to S3 objects within a date range?
Use S3 resource policy “condition” to define ACLs access limits
What I/o performance can S3 deliver?
3,000 puts and 5,000 gets per object partition.
You have an application that writes data to a Redshift database. The application introduced errors to the database, corrupting one table. What’s the fastest way to recover your database?
Do a restore of just the table. Restore it to a new table name, delete the old table, then rename the restored table to the old table name.
Since RDS doesn’t allow root access to the console, how can admins manage the configurations of the database?
Parameter groups and option groups provide the parameters admins need.
What AWS services are globally resilient to failure?
- R53
- IAM
- CloudFront
What is the priority of routes in a route table？
(Me: the order in the table doesn’t matter)
- Local
- Longest CIDR prefix (/32 is longest)
Me:
The routing table is used in order of most specific to least specific, e.g. A destination of 0.0.0.0 with a netmask of 0.0.0.0, i.e. your default route, is the least specific possible and so will always be applied last.
The ‘local’ table is the special routing table containing high priority control routes for local and broadcast addresses.
How has the Lambda architecture evolved?
Legacy Lambda used a three-tier architecture: the hypervisor stack (shared tenancy) with a guest OS running on that (account isolation), then a Sandbox, Lambda runtime, and function code ran on that (function isolation). The sandbox runs only one function, but as many instances as needed concurrently.
New Lambda is a two-tier architecture: the shared hypervisor stack, but now runs a micro VM dedicated to a Sandbox stack-shared tenancy->dedicate function tenancy. (Fire craker)
what’s in launch configuration?
- AMI
- Instance type
- Purchase option: on-demand, RI, spot
- IP addressing
- User data
- CW detailed monitoring option
- Amount and type of storage
- key pair
to make any changes after saving, you must create a completely new launch config., then change the LC association in the AS Group.
what is the priority of routes in a route table?
- Local
- Longest CIDR prefix (/32 is longest)
- Static over dynamic/propagated
- Routes learned from a DX connection
- Static routes learned from VPN
- Static routes learned from VPN BGP
what do VPC flow logs record? What doesn’t they record?
Metadata about network traffic into and out of the VPC, including address, port, protocol and more.
Logs do not include information about DHCP, AWS DNS, or license activation requests. This is not a network monitor.
Where can you deploy APIs with API GW?
In private and public VPCs, edge locations, and any region.
Me: in the console, there are three options for the endpoint type:
- Regional
- Edge optimised
- Private
Private APIs are only accessible through VPC endpoints for API Gateway. Create a VPC endpoints and add Resource Policy for the API to allow access.
when API requests predominantly originate from an EC2 instance or services within the same region as the API is deployed, a regional API endpoint, a regional API endpoint will typically lower the latency of connections and is recommended for such scenarios.
To create a regional API, you follow the steps in creating an edge-optimised API, but must explicitly set REGIONAL type as the only option of the API’s endpointConfiguration
what are the goals of CloudFormation template reuse?
The template is designed so that it can be run any number of times without user input.
(Me, this is just one of the Reuse goal for deployment automation)
What are the six categories of instance types and why would you choose them?
GCMAS
DR_McGIFT PIX
Me:
DR McGIFT PX
D - Density R - RAM (memory) M - Mainly general purpose C - Compute G - Graphics I - IOPS F - FPGA T - (think T2) Low cost burst-able general purpose P - (think Pics) Graphics X - Extreme memory
What does an Athena data catalog table include?
The table is a set of columns that have the name data type of the fields in the data files you want to query. It also contains a pointer to the S3 location where these data files sit.
You have a Kinesis Data Stream that you want to access only from several private VPCs to exchange data among producers and consumers in your organisation. How can you ensure that the VPCs don’t have to configure an Internet Gateway?
Kinesis supports VPC Endpoints (Private Endpoints)
When should a customer use a VPN rather than DX?
- Time is critical to set up a link, VPN in minutes, DX takes days or weeks even months
- Cost can be lower for spiky or sporadic usage
- When network QOS is not critical
- Consistent performance is not required - VPN performance depends on customer router CPU due to encryption; the ISP network connection over the internet is not consistent.
how does a launch template improve on launch configuration?
- Multi security groups
- Additional network interfaces
- Additional storage volumes
- Advanced configurations:
- elastic graphics
- elastic inference
- T2/T3 unlimited
- Also, you can modify and reused LTs; they can be the starting point for a new LT for a new LT or version them with updates.
Me: you can now use launch templates with Amazon EC2 Auto Scaling and Amazon EC2 Spot Fleet in you AWS CloudFormation templates.
Launch templates enable you to centrally make changes to launch parameters and control the roll out of these changes to Auto Scaling groups and Spot Fleet.
With T2 unlimited instances, you have the ability to sustain high CPU performance over any desired timeframe while still keeping your costs as low as possible. You simply enable this feature when you launch your instance; you can also enable it for an instance that is already running.
What is a web socket API?
A persistent session-oriented protocol/API best suited for data streaming, interactive applications, event management applications.
What are the two components/polices of an IAM role?
- Trust policy - defining who can assume the role
2. Permission policy - defining what the role can do
What is S3 Server Access Logging?
S3 logs all access requests on a bucket (source bucket) to a designated bucket (target bucket) for logging.
In order to block traffic a particular IP range, should you use a security group or NACL?
Only NACL can deny traffic. Security groups cannot.
Security groups deny by default, but allow by rule.
Me: The default network ACL is configured to allow all traffic to flow in and out of the subnets with which it is associated. Each network ACL also includes a rule whose rule number is an asterisk. This rule ensures that if a packet doesn’t match any of the other numbered rules, it’s denuded. You cannot modify or remove this rule.
What evaluations does IAM consider when determining a principal’s effective permissions?
The union of SCP (Service Control Policy :an Organisational boundary Policy), user/IAM Role permission boundary policy, IAM role permission policy determines a principal’s effective permissions.
What makes a subnet public?
The VPC must have an IGW, and the subnet must have a default route to the IGW by associating with a VPC route table that has a route to the IGW.
What destinations does Firehose support?
- S3
- Redshift
- Splunk
- Kinesis Analytics
How does Redshift ensure durability of your data in the cluster?
Each of he slices on your compute nodes have the advertised amount of data available to them according to the Management Console. But Redshift also reserves the same amount for replication of slice data from other nodes, similar to RAID 5 with a disk array.
How can you improve the chance of keep spot instances you need for a workload?
Use spot fleet
When should you use Spot?
When the application can tolerate loss of an instance, such as production: 1. big data systems, 2. Stateless web clusters Non-production: 3. Dev environment 4. Experiments.
How can you support more connections with an ALB?
ALB supports HTTP2 for up to 128 simultaneous connections. It will split them up to separate HTTP 1.1 connections to target groups.
Me:
Listener Configuration
Listeners support the following protocols and ports:
Protocols: HTTP, HTTPS
Ports: 1-65535
You can use an HTTPS listener to offload the work of encryption and decryption to your load balancer so that your applications can focus on their business logic. If the listener protocol is HTTPS, you must deploy at least one SSL server certificate on the listener. For more information, see Create an HTTPS Listener for Your Application Load Balancer.
Application Load Balancers provide native support for WebSockets. You can use WebSockets with both HTTP and HTTPS listeners.
Application Load Balancers provide native support for HTTP/2 with HTTPS listeners. You can send up to 128 requests in parallel using one HTTP/2 connection. The load balancer converts these to individual HTTP/1.1 requests and distributes them across the healthy targets in the target group. Because HTTP/2 uses front-end connections more efficiently, you might notice fewer connections between clients and the load balancer. You can’t use the server-push feature of HTTP/2.
How can you improve the chance of keep spot instances you need for a workload?
Spot fleet
How can you avoid message fees incurred by using IoT Topics?
Publish message to $aws/rules/rulename and which sends the message directly to an IoT Rule without the pub-sub features of IoT Topics.
when is it appropriate to use Data Pipeline vs Step Function?
Be careful and understand the context of the question.
Databases and data movement is best for DP.
you have a web application as UDP endpoints. What kind of ELB should you use?
CLB or ALB. NLB does not support UDP, only TCP.
Me: ALB does not support UDP. It supports HTTP, HTTPS, HTTP/2 and WebSockets
UDP Load Balancing
Today (24 June 2019) we are adding support for another frequent customer request, the ability to load balance UDP traffic. You can now use Network Load Balancers to deploy connectionless services for online gaming, IoT, streaming, media transfer, and native UDP applications. If you are hosting DNS, SIP, SNMP, Syslog, RADIUS, and other UDP services in your own data center, you can now move the services to AWS. You can also deploy services to handle Authentication, Authorization, and Accounting, often known as AAA.
You no longer need to maintain a fleet of proxy servers to ingest UDP traffic, and you can now use the same load balancer for both TCP and UDP traffic. You can simplify your architecture, reduce your costs, and increase your scalability.
Why would you want to take advantage of the optional Cloud Formation IAM role assignment for a stack template?
By default, CF runs under the identity of the user running. Some users, like junior DevOps members, may have restricted permissions in the AWS account. But if you grant the stack greater permissions, the junior developers can edit and run it while still having their restrictive permissions.
How does AWS IoT enable you to communicate with devices or systems from other manufactures?
AWS IoT use MQTT, which is a industry standard protocol that other devices and systems likely use.
What constraint does a NAT device address?
It provides a single IPv4 address for all devices behind it, saving on scarce IPv4 addresses. IPv6 doesn’t have this constraint, thus NAT isn’t as relevant in IPv6.
You have an ECS cluster that is a web application tier for your application. You want to easily compose all tiers of the application. What option should you use?
Use an OpsWorks stack and compose the web tier using the ECS cluster. Compose the other tiers natively in OpsWorks.
Me:
AWS OpsWorks Stacks simplified the process of launching and maintaining container instances for existing Amazon ECS cluster. To create or launch other Amazon ECS entities, such as clusters and tasks, use the Amazon ECS console, CLI or API. You can then associate a cluster with a stack by creating an ECS Cluster layer, which you can use to manage the cluster in AWS OpsWorks Stacks.
* OpsWorks and ECS Cluster is 1:1 mapping.
OpsWorks needs permission to interact with ECS on your behalf (aws-opsworks-service-role).
When should you use On Demand?
When the application positively needs the capacity and the demand is not steady.
How does Kinesis Data Analytics (SQL) generate a result set from the SQL query?
KDA uses an in-application output stream that serves as the result set. The KDA SQL Application can direct the result set to KDS, KDF.
Also, SQL application can send errors to an in-application error stream that goes to a different destination.
What authentication options does Aurora DB offer to users?
Local db users or IAM.
Who has permission to run an AMI?
The AMI Creator’s account plus any other accounts the configuration names. It can also be public.
What if you need physical access to your encryption hardware?
You need to run an HSM in your data centre. AWS does not provide access to CloudHSM. CloudHSM is a dedicated tenancy solution running on shared infrastructure, similar to EC2.
How does OpsWorks fit in to the range of tools like CloudFormation and Elastic Beanstalk?
OpsWorks offers most of the control over deployments that CloudFormation offers, but still provides minimal config options. It offers Chef or puppet as the deployment frameworks.
I don’t think the above answer is correct. See blow alternative.
CloudFormation is at infrastructure level, create/update/delete AWS resources described in a CloudFormation template. Elastic Beanstalk hides infrastructure details, provides an layer of abstraction so the user can focus on the application needs. OpsWorks manages the configurations for resources and applications that CloudFormation or EBS provisioned.
AWS CloudFormation provides a common language for you to describe and provision all the infrastructure resources in your cloud environment. Cloud formation allows you to use a simple test file to model and provision, in an automated and secure manner, all the resources needed for your applications across all regions and accounts. This file serves as the single source of truth for your cloud environment.
EBS: Abstraction from CloudFormation, Spin app from blueprints, no need to worry about every small detail of infrastructure.
OpsWorks: Configuration management inside those servers, change port, install newer software version, etc.
What resources can an account share to other accounts using Resource Groups?
- Subnets
- R53 resolver rules
- Transit gateway
- License configurations
Accounts cannot share subnets inside of the default VPC, nor use subnets that are owned by the owner of the resource. Likewise, a share cannot share security groups not owned by the resource owner. The resource owner can remove sharing from resources in use by others and those shares will continue until released.
When assigning a security group to an EC2 instance, what is really happening?
You’re assigning it to the primary network interface, not the instance.
What EC2 metrics can CloudWatch not see by default?
Memory, file system, Applications. For these, customers need to install the CloudWatch Agent.
What are the two key components of CloudWatch?
Metrics and alarms
What are some things you can do in a CloudFormation template to ensure portability?
- Use default values in parameter lists (avoiding human input),
- Use ParameterStore for system and custom values
- Pseudo Parameters for CF-wide values such as region, partition, accountID, stackID and more
- Intrinsic Functions for AZs in a region, AMI and more,
Don’t specify the physical ID of a resource and CF will create a unique one for you.
How can you grant access to public website users to page content hosted in S3 static web hosting?
Create a bucket policy that allows principal: *
me: Make the S3 publicly accessible.
Your DocumentDB cluster is struggling to keep up with write demand. What are your options for improving performance?
Scale UP the instance type(s) of the cluster to a larger EC2 type. Since there is only one write instance, the only option is scaling UP.
me: Scaling the write node vertically
You have a web application has UDP endpoints. What kind of ELB should you use?
NLB. NLB recently added support for UDP load balancing. Otherwise, CLB would be the only option.
What’s a CMK?
Customer Master Key.
This is the core of KMS. They encrypt the data that’s in KMS. Usually, the data is other encryption keys. They never leaving KMS, and because KMS is regional, they never leave the region.
what’s the difference between Updating a Stack and using a Change Set?
The workflow for updating a stack is no different from creating a stack: the user defines the resource updates then executes the new/modified stack template. Change Sets allow a junior developer to create the template for change, but simply save and notify others of the proposed change, without having permissions to run the Change Set. Senior developer can review the Change Set and run it if approved.
Due to CCPA guidelines, you want to ensure that IAM Sales_Manager don’t see customers’ name and address information except zip code and state in your DynamoDB database. What can you do to restrict viewing of these attributes in the Customers table?
Create an IAM policy that Allows all the actions on the DynamoDB table that the Sales_Managers (and others who adopt this policy) need. Use a Condition that uses a variable that looks for the ID of the SalesRep_ID requested in the query. Only allow access to the records associated with this Sales_Manager.
What are the various node types of an EMR cluster?
Master node,
Core nodes
Task nodes
An EMR cluster can have only one node, the Master node. It also can have Core nodes that run HDFS and manage tasks. And Task Nodes execute tasks but have no storage system. You cannot change the Master node instance type after creating the cluster. You can change Core and Task node instance types.
Me:
With Amazon EMR 5.23.0 and later, you can launch a cluster with three master nodes to support high availability of applications like YARN Resource Manager, HDFS Name Node, Spark, Hive, and Ganglia. The master node is no longer a potential single point of failure with this feature. If one of the master nodes fails, Amazon EMR automatically fails over to a standby master node and replaces the failed master node with new one with the same configuration and bootstrap actions.
However, unlike the master node, there can be multiple core nodes—and therefore multiple EC2 instances—in the instance group or instance fleet. There is only one core instance group or instance fleet. With instance groups, you can add and remove EC2 instances while the cluster is running or set up automatic scaling. For more information about adding and removing EC2 instances with the instance groups configuration, see Scaling Cluster Resources. With instance fleets, you can effectively add and remove instances by modifying the instance fleet’s target capacities for On-Demand and Spot accordingly. For more information about target capacities, see Instance Fleet Options.
Task Nodes
Task nodes are optional. You can use them to add power to perform parallel computation tasks on data, such as Hadoop MapReduce tasks and Spark executors. Task nodes don’t run the Data Node daemon, nor do they store data in HDFS. As with core nodes, you can add task nodes to a cluster by adding EC2 instances to an existing uniform instance group, or modifying target capacities for a task instance fleet. Clusters with the uniform instance group configuration can have up to a total of 48 task instance groups. The ability to add uniform instance groups in this way allows you to mix EC2 instance types and pricing options, such as On-Demand Instances and Spot Instances. This gives you flexibility to respond to workload requirements in a cost-effective way. When you use the instance fleet configuration for your cluster, the ability to mix instance types and purchasing options is built in, so there is only one task instance fleet.
where is the cluster in an Aurora Serverless db?
It’s in the VPC you specify when creating the cluster. Aurora Serverless allocates ACUs into your cluster from a warm pool it maintains for all customers. The proxy manages connections from your applications to the cluster and movement of the ACUs in and out of your VPC. The proxy also manages migrating cache data from one ACU to another when capacity changes. Keep in mind, Serverless uses the same Cluster Storage Volume tier that Aurora uses, so Serverless is only managing the compute tier since the storage tier is already serverless and multi-tenant.
What’s the difference between tasks launched in EC2 mode vs. Fargate mode?
With EC2, you define the instance type and are responsible for the cluster. With Fargate, you don’t. You define tasks and let ECS/Fargate obtain the container hosts to run those tasks.
me: The difference is in the container hosting layer - a hosting cluster needed to run the containers and the management of the cluster.
How can you protect APIs on API Gateway?
Web Application Firewall (WAF) can protect APIs against a range of threats including DDoS, Known IP blacklists and much more.
Me: WAF does not provide DDoS protection, AWS Shield and AWS Shield Advanced provides DDoS protection.
How can an application get messages from SQS without either short or long polling?
Use a Lambda function with event source mapping set to the arrival of messages in an SQS queue. This is an event-driven alternative to the usual polling approach of EC2-based applications.
What does AWS Shield do beyond WAF?
Shield is a DDoS protection layer in front of WAF.
Shield Standard is free and always on.
Shield Advanced provides WAF, DDoS mitigation’s, visibility and reporting, DDoS response team support, and cost protection due to attacks.
Shield Advanced also protects EIPs.
what are the benefits of using CloudFormation stack sets?
Stack sets enable an account admin to run stack templates across multiple accounts and multiple regions.
The two sides of the transaction are the Admin account and Target account. It also requires two defined roles: AWSCloudFormationStackSetAdmininstrationRole and the AWSCloudFormationExecutionRole.
What are the goals of CloudFormation template portability?
Design it to run in any account or location without any modifications or user input.
You want to ensure that your CloudFront edge location connects to your S3 origin using TLSv1.2. How can you do that?
S3 is not a custom origin and CF configuration will match the same protocol as the client connection.
If you need a different protocol to the origin, configure a custom origin. When specifying an origin such as www., the Origin configuration offer serval TLS options and protocol policies.
Your customer, a large, rural agricultural operation, needs to continuously stream IoT data from a fleet of hundreds of tractors, farm vehicles, produce processing sensors, and much more. They need to process this data before sending it to the cloud since there is so much repetition of little value. What data transfer technology will you recommend?
Snowball Edge can hold up to 100/80TB of data and including edge computing services such as IoT Greengrass, Lambda functions and GPU processors. This is ideal for remote locations with poor networking infrastructure and real time capabilities are not required.
You create a DynamoDB table with a partition key of CatID. Your CatID range from 0001 to 0004. You end up with lots of records for each cat, exceeding 10GB per cat. You notice that performance of reading and writing starts to slow down. What could be the problem?
DynamoDB has had to create more partitions for each CatID. But since the partition key is CatID, DynamoDB still limits the RCU/WCUs to 3000/1000 across all partitions for that CatID. You need to consider a partition key that has more values than 0001-0004.
Me:
- DynamoDB will split partition based on a) RCU/WCU 3000/1000 and b) storage size of 10GB
- This is no longer a limitation since the DynamoDB will balance the RCU/WCUs at the table level, not the partition level.
- On-demand capacity pricing option will autoscale RCU/WCUs according to the demand at the time. The other one is the provisioned throughput option.
There are a few downsides to DynamoDB that you should consider before choosing to use it in your production applications.
Strong vendor lock-in. DynamoDB is a proprietary solution and doesn’t have an open-source version, so if you ever decide to move away from using DynamoDB, you’ll be looking at a significant amount of work migrating to a different database solution. Some functionality, such as DynamoDB Streams, might be particularly hard to rebuild in a different database.
The cost structure can backfire with large datasets. There are two pricing options for DynamoDB: the on-demand option and the provisioned throughput option. While the on-demand pricing is a good fit for applications with “spiky” usage and relatively low average traffic, as average usage increases the on-demand pricing structure can become quite expensive.
No built-in caching. DynamoDB requires the access to your data to be mostly uniform. If you access a certain segment of your data (like the most recent entries) much more than others, you won’t have an out-of-the-box way to cache these recent items—excepting of course the DynamoDB Accelerator, which is proprietary and adds to your costs.
No support for JOIN operations. DynamoDB’s design doesn’t allow you to join data from across multiple tables. So if you need the data from multiple tables for a single operation, you’ll find DynamoDB to be more expensive, slower and more complicated for implementing JOINs than with a relational datastore.
How can you achieve cross-region messaging availability with Amazon MQ?
MQ supports global brokers where brokers are deployed in AZs in multiple regions while keeping the entire Queue in sync.
How can NACLs allow traffic from another security group?
NACLs cannot reference other resources, only ports and IP ranges. Security Groups, however, can refer to the ID of another security group to allow traffic from it.
Me:
NACLs does not provide traffic control inside a subnet. It only controls in/out bound traffic between subnets.
What factors should influence your choice of Redis over Memcached or the other?
- Simple, limited feature set - Memcached
- Vertical Scaling - Memcached: supports multi-threading
- Horizontal Scaling (read) - Redis
- HA - Redis: replicate to other nodes
- Backup/Restore - Redis
- Rich feature set - Redis
- Transaction - Redis
- Geo-special data type - Redis
You’re designing an application that needs message from an order entry form. The messages must be in the exact order they occurred without duplicates. You expect the load to be around 6,000 messages per minute. What messaging option should you use?
SQS FIFO supports up to 300 messages per second with guaranteed ordering and no duplicates.
Me:
- Identify significant points.
a) messages need to be in order of delivery
b) no message duplication
c) 6,000 message per minute ==> 100 per second
How does certificate registration work with ACM?
- The owner enters registration information into the ACM form including the domain name.
- ACM validates the domain name using R53 or your other registrar.
- Once validated, ACM issues the certificate containing public and private keys. Private key is encrypted using KMS.
- The certificate is now available to any AWS integrated service.
- When these services need to use the private key to decrypt content, they use KMS to decrypt the key, hold it in memory, and use it to decrypt the public key encrypted content.
what are the key features of Amazon MQ?
it’s a message broker based on Apache MQ. It supports the JMS API or protocol such as AMQP, MQTT, OpenWire or STOMP. It can function as a queue or topic and supports cardinality of 1:1 or 1:n.
Me:
- Supports many industry standard protocol
- Supports message topic and message queue
- Supports multiple regions and keeping messages in sync using global brokers
- Supports HA (Active/Standby in multiple AZs)
when assigning a security group to an EC2 instance, what is really happening?
You’re assigning it to the primary network interface, not the instance.
What is the network+2 address?
This is the reserved VPC address for the R53 resolver in the VPC.
In order to block traffic from a particular IP range, should you use a security group or NACL?
Only NACLs can deny traffic. Security groups cannot. Security groups deny by default, but allow by rule.
How can you deliver /var/logs file events to CloudWatch Logs?
- Install the CloudWatch agent on the EC2 instance.
- Configure it to tail the logs in /var/logs.
It will pick up each entry in the log file and send them as Log events using a Log Stream.
When you allocate 5 RCUs to a table, how much data can you read?
4 KB/Sec. That can be five read operations of 4K or less, one or more operations of more than 4K. Also, Dynamo caches up to 300 CUs so that they’re available for spikes.
What do VPC flow logs record? What don’t they record?
- Metadata about network traffic into or out of the VPC, including address, port, protocol and more.
- Logs do not include information about license activation, DNS and DHCP requests.
- This is not a network monitor.
How often does Redshift take snapshots?
Every 6-8 hours or every 5GB of data change, whichever comes first.
Amazon Redshift now provides more control over snapshots
Posted On: Apr 4, 2019
Amazon Redshift automatically takes incremental snapshots (backups) of your data every 8 hours or 5 GB per node of data change. You now get more information and control over a snapshot including the ability to control the automatic snapshot’s schedule.
Amazon Redshift now provides the ability to:
View snapshots that are not associated to any cluster so you can remove unnecessary snapshots
Bulk-delete snapshots to allow you to quickly delete unnecessary snapshots and reduce your S3 storage needs
Control your cluster’s automatic snapshot schedule using the snapshot scheduler. The snapshot schedule can be configured with a cron style granularity via an API or with the AWS Management Console. You can create a schedule and attach the schedule to your cluster to have full control of when automated snapshots are taken.
How does Aurora Serverless manage ACUs when demand falls?
it can reduce ACUs to zero if there is not demand, reducing costs.
Me:
Aurora Serverless maintains a warm pool of ACUs, and it moves the ACUs in or out of the warm pool into your cluster to match the demand changes.
How does Elastic Beanstalk support blue/green deployments?
You can create a new version of an application and environment. You can then choose to swap URLs so that the new version gets the production URL.
You are using DynamoDB for ticket sales. When tickets for a popular event go on sale, you want to ensure that when a customer selects a ticket for purchase, you hold that ticket until they complete the purchase. What’s the simplest way to do that?
Define the updates to the ticket availability and the purchase steps as a transaction. That way DynamoDB commits all the updates as a single atomic unit.
What are the two key components of CloudWatch?
Metrics and Alarms
How can you ensure you can get the capacity you need when you need it?
Me: this is referring to EC2 instance allocation. Sometimes an AZ could run out of capacity when an auto-scaling group needs to create new instance(s) for example.
Use on-demand capacity reservations. No up-front, but you get the capacity when you need it.
What is the network+2 address?
This is the reserved IP address for the R53 Resolver in a subnet of a VPC.
You’re designing a voting system and recording the votes in DynamoDB. You expect certain locales to be much busier than others. But you need to use a partition key of postal code to organise your data. What can you do to manage hot spots in your partition?
DynamoDB enables Adaptive Capacity by default. This allocates RCU/WCUs dynamically across partitions while still staying below the total hard limit of the table.
Me: DynamoDB accommodates your workload, not vice versa
Partitions don‘t matter； individule keys do
Swith capacity modes in order to optimise cost and performance。
Use provisioned mode
- Steady workloads
- Gradual ramps
- Events with known traffic
- Ongoing monitoring
Use on-demand mode
- Unpredictable workloads
- Frequently idle workloads
- Events with unknown traffic
- “Set it and forget it”
What authentication options does Aurora DB offer to users?
local db users or IAM
You can connect to VPC A from VPC B using VPC peering. You can also connect to VPC C from VPC A. But VPC B can’t connect to VPC C. What’s likely the problem?
VPC Peering is not transitive. VPC B needs to have a VPC Peering connection to VPC C.
You have a Kinesis Data Stream that you want to access only from several private VPCs to exchange data among producers and consumers in your organisation. How can you ensure that the VPCs don’t have configure an internet Gateway?
Create a private endpoint in each of the VPC that need to exchange data via KDS.
How can you have reference data to join in a Kinesis Data Analytics (SQL)?
Put reference data in S3 then define a reference table that enables the SQL query to treat the lookup data as a table.
For a resource in a private subnet, what’s the advantage of using a VPC endpoint to access an AWS service over using a NAT gateway?
Better performance since the traffic is over the AWS network. Also, more secure since the request never leaves the AWS network.
If you configure a single node Redshift cluster, where is the leader node? If you configure a two-node cluster, where is it?
Single node cluster, leader node and core node share the same instance.
Two-node cluster, leader is on a node on an instance by itself - the third instance added for free.
You need to implement a solution for [social networking, knowledge graphs, fraud detection, recommendations]. What database solution should you choose?
A graph database.
Neptune is a graph DB that’s highly scalable with 15 read replicas across three AZs in a region. It can hold up to 64 TB of data with encryption at rest.
You want to ensure that you capture authentication activities on your account in CloudTrail. These are not API calls. How can you do this?
Enable Management events (default) when configuring a Trail.
Me:
Create a Trail and enable it to capture global IAM events during the creation.
What’s the ideal scope of a Lambda function?
A small function that does something narrow and well. Accept an input, and produce an output.
Me: thinking micro-service architecture.
What can you use to monitor data across your accounts from a single master account?
Guard Duty uses ML to monitor a number of AWS data sources, such as VPC flow logs, R53, CloudTrail, threat intel, CloudWatch events, account activity.
It generates findings into the Guard Duty console. A trusted IP list excludes these IPs from Guard Duty scanning. Threat lists tell GD additionally what to watch across all accounts.
What are the three components of Amazon ElasticSearch?
- ElasticSearch (Lucene)
- Logstash or Beats
- Kibana for visualisation.
What network options does ElasticSearch offer?
ElasticSearch clusters run in a dedicated network not part of the customer’s account. For private VPC access, ElasticSearch will expose itself to the customer VPC using interface endpoints. The customer can assign a security group to the cluster. For public access, the cluster is accessible via internet.
What are some options for HA using Direct Connect?
- One DX, one VPN over internet
2. Two DX-separate customer routers, separate links to DX location, Separate DX location routers.
Since RDS doesn’t allow root access to the console, how can admins manage the configurations of the database?
Parameter groups and option groups provide the parameters admins need.
What resources can an ALB target for traffic?
- Instances,
- IP addresses
- A Lambda function.
Instance or IP addresses can include EC2 instances, ECS or EKS containers.
What are the three states a CloudWatch alarm can have?
Ok
Alarm
Insufficient data
What’s the maximum size of a dB that you can configure for an Aurora Serverless database?
you don’t configure capacity on Aurora Serverless. You configure Aurora Capacity Units (ACUs) which are 1 CPU and 2 GB of RAM.
Me: the above seems no longer correct.
Capacity Settings - Minimum Aurora capacity unit:
You set the minimum capacity unit for the DB cluster. Each capacity unit is equivalent to a specific compute and memory configuration. Based on the minimum capacity unit setting, Aurora Serverless automatically creates scaling rules for thresholds for CPU utilization, connections, and available memory. Aurora Serverless reduces the resources for the DB cluster when its workload is below these thresholds. Aurora Serverless can reduce capacity down to the minimum capacity unit
Capacity Settings - Maximum Aurora capacity unit:
You set the maximum capacity unit for the DB cluster. Each capacity unit is equivalent to a specific compute and memory configuration. Based on the maximum capacity unit setting, Aurora Serverless automatically creates scaling rules for thresholds for CPU utilization, connections, and available memory. Aurora Serverless provides more capacity for the DB cluster from warm pool of resources when its workload is above these thresholds. Aurora Serverless can increase capacity to the maximum capacity unit.
Me - the above referring to compute capacity only.
me:
The minimum storage is 10GB. Based on your database usage, your Amazon Aurora storage will automatically grow, up to 64 TB, in 10GB increments with no impact to database performance.
What does a customer need to install for an Customer Gateway? What’s the corresponding component in AWS?
The customer has a hardware gateway, usually a router, with IPSEC VPN capability and static or dynamic routing.
The AWS side needs a Virtual Private Gateway, which is the endpoint of the VPN tunnel, attached to a VPC. Many Customer Gateways can attach to a VPGW.
What sizing options does Aurora offer?
Provisioned Aurora, Parallel Query or Serverless
Your Kinesis Data Analytics (SQL) application requires input data to contain certain fields. Sometimes, message from your KDS source may be missing some fields. What can you do to solve that?
Use a Lambda function pre-processor on the KDA application. The Lambda function can inspect each message and add any missing fields fields with default values.
What are the network modes you can define in a container task?
- None (Linux)
- Bridge (Linux)
- Host (Linux)
- AWS VPC
- NAT - windows only
Bridge - allow all containers to interact with internal networking to the host.
Host - map containers to host networking; e.g. map container port 80 to host port 80; can only run one container on a host with the same host networking requirement.
AWS VPC - map a VPC ENI to a container task. This is how Farget works. If using EC2 mode, this can produce a lot of ENIs. Some EC2 instance types have ENI limits, so the ECS may only be able to launch a few containers.
These networking types are for Linux. For Windows, the only networking type is NAT.
How can applications access an Aurora Serverless db w/o connection strings?
Enable the Data API to expose the REST APIs of the database through the Proxy layer.
What are some of the features that Aurora Serverless offers microservice/serverless applications that make it an attractive option as an RDBMS?
Very low latency connections and REST APIs for queries. Also, it doesn’t involve cluster infrastructure running in a customer’s environment.
me:
Aurora Serverless can only be connected via PrivateLink inside a VPC. It does not accept public IP address.
It supports REST APIs through the proxy layer without needing connection strings for db query. Enable the Data API to expose the REST APIs of the database.
Limitations of Aurora Serverless
The following limitations apply to Aurora Serverless :
Aurora Serverless is available for the following:
Aurora MySQL version 1, compatible with MySQL version 5.6.
Aurora MySQL version 2, compatible with MySQL version 5.7. Select Aurora MySQL version 2.07.1 to be able to use Aurora Serverless with MySQL 5.7 compatibility.
Aurora with PostgreSQL version 10.7 compatibility.
The port number for connections must be:
3306 for Aurora MySQL
5432 for Aurora PostgreSQL
You can’t give an Aurora Serverless DB cluster a public IP address. You can access an Aurora Serverless DB cluster only from within a virtual private cloud (VPC) based on the Amazon VPC service.
Each Aurora Serverless DB cluster requires two AWS PrivateLink endpoints. If you reach the limit for AWS PrivateLink endpoints within your VPC, you can’t create any more Aurora Serverless clusters in that VPC. For information about checking and changing the limits on endpoints within a VPC, see Amazon VPC Limits.
A DB subnet group used by Aurora Serverless can’t have more than one subnet in the same Availability Zone.
Changes to a subnet group used by an Aurora Serverless DB cluster are not applied to the cluster.
A connection to an Aurora Serverless DB cluster is closed automatically if it stays open for longer than one day.
Binlog-based replication isn’t supported for Aurora Serverless DB clusters.
Aurora Serverless doesn’t support the following features:
Loading data from an Amazon S3 bucket
Saving data to an Amazon S3 bucket
Invoking an AWS Lambda function with an Aurora MySQL native function
Aurora Replicas
Backtrack
Multi-master clusters
Database cloning
IAM database authentication
Restoring a snapshot from a MySQL DB instance
Amazon RDS Performance Insights
Amazon Aurora Serverless is an on-demand, autoscaling configuration for Amazon Aurora. An Aurora Serverless DB cluster is a DB cluster that automatically starts up, shuts down, and scales up or down its compute capacity based on your application’s needs. Aurora Serverless provides a relatively simple, cost-effective option for infrequent, intermittent, or unpredictable workloads. It can provide this because it automatically starts up, scales compute capacity to match your application’s usage, and shuts down when it’s not in use.
What are the key qualities of a serverless architecture?
- Event driven
- Capable of scaling from very low capacity
- Pay only for the usage.
What are the three minimum parts to an IAM policy statement?
- Effect
- Action
- Resource
Optionally 4. Condition
How does DynamoDB implement Global Tables?
It uses Streams to capture all changes to one table to the other tables in other regions.
You configure a Global Table by enabling Streams (Old and New), then by adding Regions where you want to replicas. All tables are masters and stream their changes to the other replicas.
All the tables in different regions need to be added in the same replication group.
You want to keep CloudTrail events longer than the 90-day retention period. What can you do?
Configure Trails to deliver events to S3. Also enable file encryption and validation to protect the files from tampering.
How does S3 maintain versions of object?
Only if versioning is enabled, S3 creates new versions with the same name. Objects have object IDs that are unique. Versions can live in different storage tiers in S3 using lifecycle policies. Delete action mark object for deletion.
Me: the short version
When versioning is enabled, a simple DELETE cannot permanently delete an object.
Instead, Amazon S3 inserts a delete marker in the bucket, and that marker becomes the current version of the object with a new ID.
(Each object version deletion can be achieved by version expiration)
The NoncurrentVersionExpiration action applies to noncurrent object versions, and Amazon S3 permanently removes these object versions. You cannot recover permanently removed objects.
For more information, see Object lifecycle management.
The longer version:
You can delete object versions whenever you want. In addition, you can also define lifecycle configuration rules for objects that have a well-defined lifecycle to request Amazon S3 to expire current object versions or permanently remove noncurrent object versions. When your bucket is version-enabled or versioning is suspended, the lifecycle configuration actions work as follows:
The Expiration action applies to the current object version and instead of deleting the current object version, Amazon S3 retains the current version as a noncurrent version by adding a delete marker, which then becomes the current version.
The NoncurrentVersionExpiration action applies to noncurrent object versions, and Amazon S3 permanently removes these object versions. You cannot recover permanently removed objects.
For more information, see Object lifecycle management.
A DELETE request has the following use cases:
When versioning is enabled, a simple DELETE cannot permanently delete an object.
Instead, Amazon S3 inserts a delete marker in the bucket, and that marker becomes the current version of the object with a new ID. When you try to GET an object whose current version is a delete marker, Amazon S3 behaves as though the object has been deleted (even though it has not been erased) and returns a 404 error.
How can you provide Layer 7 firewall protection from incoming threats?
AWS WAF is a layer 7 firewall that can run in front of CloudFront, API Gateway or ELB. It combines conditions and rules then use a web ACL to grant or deny traffic.
What are some advanced features of Amazon MQ that SNS/SQS does not have?
Reliable, ordered messaging, message groups, composite messaging and more.
Me.
- Amazon MQ can be deployed into customer’s VPC
- With global message broker, messages can be synchronised across regions around world.
- It supports industry protocols for pub/sub best suited for compatibility for cloud migrating
- supports message topics and message queue.
You decided to optimise your DynamoDB table query performance by increasing the provisioned RCUs. You recently encountered a problem with erroneous records entering your database, so you restored a previous version from backup. Now the queries are performing slowly again. What could be the problem?
You restored from a backup that had the old RCU provisioning. Backup contain the data and the database settings.
What are the signanificant points?
- Database is a previous version
- Performance dropped
Question:
- does the number of RCUs configuration is stored with the database? When a database is restored, the old configuration is restored at the same time?
- more table partitions with the old database than the new one, and the adaptive capacity is not enabled?
Based on the offical answer, the RCU configuration is not part of the database. It is the backup process that backs up the database and its associated settings.
How can CloudTrail events integrate with CloudWatch?
Configure a Trail to stream to a CloudWatch Log Group.
When creating a stack using CloudFormation, how does CF track the status of the steps?
CF generates an event stream. Users can view the events in the CF console. Also, CF can send the events to SNS where applications and dashboards can subscribe to the events.
Since many of your queries filter on columns that aren’t in your partition key/sort key, you do mostly scan with filters. Your monthly costs are high, even though your scans only return small result sets. What’s the cause?
Query filter does not inference the amount of data the query results returned.
Where can you deploy APIs with API GW?
In private and public VPCs, edge locations, and any region.
Me: in the API Gateway console, there are three chooses:
- Regional (can be behind CloudFront or facing the public internet directly)
- Edge Optimised (internet —> CloudFront Distribution —> Edge Location —> [API Gateway] (region))
- Private （caller is from a VPC)
How does S3 maintain versions of objects?
Only if versioning is enabled. S3 creates new versions with the same name. Objects have object IDs that are unique. Versions can live in different storage tiers in S3 using lifecycle policies. Delete actions mark objects for deletion.
When creating a stack using CloudFormation, how does CF tracks status of the steps?
CF generates an event stream. Users can view the events in the console. Also, CF can send events to SNS where applications and dashboards can subscribe to the events.
When you allocate 5 RCUs to a table, how much data can you read?
4KB/sec. that can be five read operations of 4KB or less, one or more operations of more than 4KB, Dynamo caches up to 300 CUs so that they are available for spikes.
Each RCU read 4KB data per second, as such 5 RCUs can at max read 20KB data per second in five read operations.
What does a container contain?
Applications and required library versions
How can you have reference data to join a Kinesis Data Analytics (SQL)?
Put reference data in S3 then define a reference table that enables the SQL query to treat the lookup data as a table.
What are the benefits of using CloudFormation stack sets?
Stack Sets enables an account administrator to run the Stack templates across multiple accounts and regions.
The two sides of the transaction are the Admin account and Target account. It also requires two defined roles: AWSCloudFormationStackSetAdministrationRole and AWSCloudFormationExecutionRole.
You have an ECS cluster that is web application tier for your application. You want to easily compose all tiers of the application. What option should you use?
Use an OpsWorks stack and compose the web tier using the ECS cluster. Compose the other tiers natively in OpsWorks.
what does Elastic Beanstalk do that CloudFormation does not?
It creates an environment (based on web application or worker application) and deploys your application version into that environment.
CF creates stacks, which precision AWS resources (create, update, delete), but NOT applications.
What is CORS?
Cross Origin Resource Sharing. It is a security control that enables the resource owner to allow or deny resources sharing with request coming from a different origin.
What is a VPC Router?
Every VPC has exactly one. It consumes one RFC 1918 IP address. It’s +1 of the subnet’s IP address.
You want to ensure that you delete items in DynamoDB after a certain period of time. What’s the simplest way of implementing a retention policy?
Set a TTL against each record, DynamoDB will delete the items after the TTL is past.
If you want very low latency replication across regions for an Aurora DB and you want to promote a replica to Master in less than one minute, what options do you have?
Aurora Global Database replicates cluster volume data from on region to a cluster volume in another in less than 1 second. Replicas in other region attach to that region’s cluster volume for low-latency read replicas. They can promote to Master in less than one minute. This is lower latency and faster promotion time than MySQL cross-region read replication.
What are the appropriate instance types for various EMR scenarios?
Long-running Clusters and Data warehouses on-demand on-demand or instance-fleet mix Spot or instance fleet mix
Cost-Driven workloads Spot Spot Spot
Data-Critical workloads on-demand on-demand Spot or instance-fleet mix
Application testing Spot Spot Spot.
What is Aurora DB multiple master?
In a multi-master cluster, all DB instances can perform write operations. There isn’t any failover when a write operations. There isn’t any failover when a writer DB instance becomes unavailable, because another writer DB instance is immediately available to take over the work of the failed instance. We refer to this type of availability as continuous availability, to distinguish it from the high availability (with brief downtime during failover) offered by a single-master cluster.
Where is the cluster in an Aurora Serverless DB?
It’s in the VPC you specify when creating the cluster. Aurora Serverless allocates ACUs into your cluster from a warm pool it maintains for all customners. The proxy manages connections from your applications to the cluster and movement of the ACUs in and out of your VPC. The proxy also manages migrating cache data from one ACU to another when capacity changes. Keep in mind, Serverless uses the same Cluster Storage Volume tier that Aurora uses., so Serverless is only managing the compute tier Shinae the storage tier is already serverless and multi-tenant.
What can you do with object locking in S3?
- Legal holds
- Retention polices
This prevents objects from deletion. Versioning must be enabled. Object locks must set at the item of creating the bucket.
What if you need physical access to your encryption hardware?
You need to provision a HSM device in your own data centre. CloudHSM is not physically accessible.
CloudHSM is a dedicated tenancy solution running on shared infrastructure, similar to EC2.
How can a CloudFormation template allow for a range of values for a resource option that users need to choose when launching the template?
Reference a resource option. Elsewhere in the script, enumerate all the valid values for that option. Optionally, provide a default so that the user doesn’t have to make a choice.
What does an AMI contain?
- Owner
- Launch Permissions
- OS
- Architecture
- Block device mapping of all volumes
Once created, the AMI creates snapshots of any EBS volumes described in the AMI and holds pointers to them.
If the instance type uses instance volumes, the AMI creation bundles the instance definition and instance store into files and saves them to S3.
How can you restrict traffic to a container?
Use the AWS VPC network mode. Configure the security group that the container’s VPC uses to control what traffic gets in and out.
What does Elastic Beanstalk do that CloudFormation does not?
CloudFormation provision (create, update, delete) AWS resources but it not applications. EBS creates an environment (based on web application or worker application) and deploys your application version into that environment.
EBS is a layer on top of CloudFormation and abstracts the underlying infrastructure details.
What are the two main things that affect the charge for DynamoDB?
- Amount of RCU/WCU capacity units consumed by applications
- total size of data in the database.
an RCU is 4KB in charges. A WCU is 1 kB in charges. A read or write operation consumes RCUs/WCUs no mater how small the amount of data. And queries always consume an entire item, even if the statement only wants one column.
The only way to restrict the amount of data returned by a read query is to specify a PK and optionally a sort key, filtering the amount of data Dynamo returns.
Serverless: number of requests.
how does FSx achieve HA?
It doesn’t. It’s single AZ. You need to create multiple FSx in two or more AZ and do replication, such as DFS. Even multi-region.
What EC2 metrics can CloudWatch not see by default?
Applications and memory and file systems. Need to install CloudWatch agent on the EC2 instance to provide the metrics data.
How can you avoid message fees incurred by using IoT topics?
Public message to $aws/rules/rulename which sends the message directly to an IoT Rule without the pub/sub features of IoT topics.
How can you control access to resources in OpsWorks stacks?
Use the Permissions of the stack to grant, deny, show, manage, or delegate to the user’s IAM privileges over resources.
How does HVM improve performance of virtualisation machines?
HVM uses newer generation of CPUs that allow guest OSs to interact with memory, CPU, network, local storage, and motherboard bypassing hypervisor.
Unlike paravirtualisation, HVM avoids emulatio, speeding up performance of guest OSs.
Nitro, introduced in 2017, bring in hardware virtualisation to all expects of the guest OS access to the hardware, resulting a near bare metal performance.
What is REST API?
They are uni-directional request/response calling patterns that use HTTP semantics with query string arguments. Behind the API, a service performs a task and returns to the caller.
