AWS Flashcards
Check the ECR repository?
aws ecr describe-images –repository-name telematics/gmonstarparser
if image tags are needed:
aws ecr describe-images –repository-name telematics/gmonstarparser –image-ids imageTag=”2021.06.14-RC-1.0.47”
How to add tags to AWS ECR image?
MANIFEST=$(aws ecr batch-get-image –repository-name dockerhub/amd64/ubuntu –image-ids imageTag=16.04 –query ‘images[].imageManifest’ –output text)
aws ecr put-image –repository-name dockerhub/amd64/ubuntu –image-tag “test_date +%y%m%d.%H%M
” –image-manifest “$MANIFEST”
How to log into kubernetes using AWS credentials?
export KUBECONFIG=/opt/kubeconfig/kube.config
aws eks update-kubeconfig –cluster-name fc-dev
Check tags of an AWS ECR Image
aws ecr describe-images –repository-name fcpls/xyz –image-id imageTags=dev.1234
IAM Group
IAM Users
IAM Role
Role - assumed by trusted entities - used for delegation.
Root user - has complete administration access.
Max 5000 users per account
Group can’t be nested.
IAM Users can assume a role.
All permissions implicitly denied.
Authentication methods
Signing certificate can be used for authentication for some services.
AWS Security Token Service
request limited privilege credentials for IAM/federated users.
global service
sts.amazonaws.com
all regions enabled.
Billing Alarm
Only root user can update anything related to billing.
Billing preferences > Receive Billing Alerts > CloudWatch > Specify conditions > SNS
Locations
Region Availability Zone Edge Location - Cache Regional Edge Location - between AWS and Edge Global network
VPC
Logically Isolated network assigned to user within a region.
172.31.0.0/16
Default 1 VPC is created in all accounts.
Default route table and internet gateway added.
3 subnets created in each AZ.
Route 53
Domain Name service
DNS management
Traffic Check
Avilability Check
Domain name registeration
EC2
Elastic Compute Cloud
Genral purpose - T, M
Reserved instance - 1 - 12 or 12 - 36 months Spot Instances Savings Plan Dedicated Hosts Scheduled Instances Capacity Reservations
Limits - increase with Support ticket
EBS
Block storage used for EC2
io1
gp2
AMIs
Amazon Machine Image = Launch Permissions + Snapshots + Block dedvice Mapping
EC2 Instance Metadata
Information that can be used to configure the application on the instance.
http://169.254.169.254/latest/meta-data/
EC2 User Data
Execute commands to configure the instance at the time of launch.
http://169.254.169.254/latest/user-data/
EC2 Instance Status Check and System Status Check
Instance - customer resposibility
System - AWS responsibility
For system - stop and then start the instance - this will change the host machine.
EC2 detailed Monitoring
frequency 1 minute from 5 minutes.
IP Addresses
Public IP - lost when instance stopped.
Private IP - lost when instance is terminated
Elastic IP - Charged when not used. Associated with the private IP. Can be transferred to other resources.
EC2 instance doesnt know anything about the public IP.
Internet Gateway
1:1 NAT Gateway
Translates Public IP to Private IP.
Jumphost/Bastion - Agent Forwarding
ssh-add -K xyz.pem
ssh -A ec2-user@
ssh ec2-user@
Pageant for windows machine.
NAT instances and Gateways
Network Address Translation
Instance managed by customer Manual scaling Not HA Assign Security Group Needs Elastic IP Enable Port Forwarding - disable, Source/Destination Check
Placement Groups
- Cluster - close together, tightly coupled.
- Partition - spread across logical partitions, groups of partitions, do not share resource. (Max 7 per AZ)
- Spread - Reduce correlated failure - distinct underlying hardware.
Elastic Load Balancing
Application layer 7 http https path, host, query string, parameter, sourceIP based routing Targets - IP, Lambda, Containers Sticky sessions
Network
layer 4 tcp udp tls
High performance, low latency, TLS offloading
static IP
UDP, IP address as target.
Connection timeout cant be defined
Assign elastic IPs for each node in an AZ
Classic
Layer 4 or layer 7
Old/deprecated
Connection Timeout can be defined