AWS Flashcards
Check the ECR repository?
aws ecr describe-images –repository-name telematics/gmonstarparser
if image tags are needed:
aws ecr describe-images –repository-name telematics/gmonstarparser –image-ids imageTag=”2021.06.14-RC-1.0.47”
How to add tags to AWS ECR image?
MANIFEST=$(aws ecr batch-get-image –repository-name dockerhub/amd64/ubuntu –image-ids imageTag=16.04 –query ‘images[].imageManifest’ –output text)
aws ecr put-image –repository-name dockerhub/amd64/ubuntu –image-tag “test_date +%y%m%d.%H%M” –image-manifest “$MANIFEST”
How to log into kubernetes using AWS credentials?
export KUBECONFIG=/opt/kubeconfig/kube.config
aws eks update-kubeconfig –cluster-name fc-dev
Check tags of an AWS ECR Image
aws ecr describe-images –repository-name fcpls/xyz –image-id imageTags=dev.1234
IAM Group
IAM Users
IAM Role
Role - assumed by trusted entities - used for delegation.
Root user - has complete administration access.
Max 5000 users per account
Group can’t be nested.
IAM Users can assume a role.
All permissions implicitly denied.
Authentication methods
Signing certificate can be used for authentication for some services.
AWS Security Token Service
request limited privilege credentials for IAM/federated users.
global service
sts.amazonaws.com
all regions enabled.
Billing Alarm
Only root user can update anything related to billing.
Billing preferences > Receive Billing Alerts > CloudWatch > Specify conditions > SNS
Locations
Region
Availability Zone
Edge Location - Cache
Regional Edge Location - between AWS and Edge
Global networkVPC
Logically Isolated network assigned to user within a region.
172.31.0.0/16
Default 1 VPC is created in all accounts.
Default route table and internet gateway added.
3 subnets created in each AZ.
Route 53
Domain Name service
DNS management
Traffic Check
Avilability Check
Domain name registeration
EC2
Elastic Compute Cloud
Genral purpose - T, M
Reserved instance - 1 - 12 or 12 - 36 months Spot Instances Savings Plan Dedicated Hosts Scheduled Instances Capacity Reservations
Limits - increase with Support ticket
EBS
Block storage used for EC2
io1
gp2
AMIs
Amazon Machine Image = Launch Permissions + Snapshots + Block dedvice Mapping
EC2 Instance Metadata
Information that can be used to configure the application on the instance.
http://169.254.169.254/latest/meta-data/
EC2 User Data
Execute commands to configure the instance at the time of launch.
http://169.254.169.254/latest/user-data/
EC2 Instance Status Check and System Status Check
Instance - customer resposibility
System - AWS responsibility
For system - stop and then start the instance - this will change the host machine.
EC2 detailed Monitoring
frequency 1 minute from 5 minutes.
IP Addresses
Public IP - lost when instance stopped.
Private IP - lost when instance is terminated
Elastic IP - Charged when not used. Associated with the private IP. Can be transferred to other resources.
EC2 instance doesnt know anything about the public IP.
Internet Gateway
1:1 NAT Gateway
Translates Public IP to Private IP.
Jumphost/Bastion - Agent Forwarding
ssh-add -K xyz.pem
ssh -A ec2-user@
ssh ec2-user@
Pageant for windows machine.
NAT instances and Gateways
Network Address Translation
Instance managed by customer Manual scaling Not HA Assign Security Group Needs Elastic IP Enable Port Forwarding - disable, Source/Destination Check
Placement Groups
- Cluster - close together, tightly coupled.
- Partition - spread across logical partitions, groups of partitions, do not share resource. (Max 7 per AZ)
- Spread - Reduce correlated failure - distinct underlying hardware.
Elastic Load Balancing
Application layer 7 http https path, host, query string, parameter, sourceIP based routing Targets - IP, Lambda, Containers Sticky sessions
Network
layer 4 tcp udp tls
High performance, low latency, TLS offloading
static IP
UDP, IP address as target.
Connection timeout cant be defined
Assign elastic IPs for each node in an AZ
Classic
Layer 4 or layer 7
Old/deprecated
Connection Timeout can be defined
S3
Object storage service: Key Version ID Value Metadata Subresources Access Control Information
Name has to be unique
Region specific
EC2 Access to S3
EC2 Assume Role
Instance setting - attach role - created in previous step.
Auto Scaling for Load Balancer
CloudWatch monitors the parameters
e.g. CPU > 80% > Scaling group
- Create Launch configuration group (Can’t be modified)
- Create Auto Scaling group
i. keep group at initial size OR
ii. Scaling policies:
a. ALB request per count
b. Average CPU
c. Average network IN
d. Average network OUT - Scheduled action to increase instances.
The cooldown period is a configurable setting for your Auto Scaling group that helps to ensure that it doesn’t launch or terminate additional instances before the previous scaling activity takes effect so this would help. After the Auto Scaling group dynamically scales using a simple scaling policy, it waits for the cooldown period to complete before resuming scaling activities.
Scaling policies for Load Balancer
- Target Tracking Scaling
- Simple scaling policy
- Step scaling policy
i. create an alarm
ii. specify action when alarm is triggered
Note: Step scaling the policy can continue to respond to additional alarms, even while a scaling activity or health check replacement is in progress.
Launch Templates and Launch Configuration
LC can’t be modified once created.
To change, create a copy and modify it.
LT is versioned. To edit, a new version of template can be created.
Auto Scaling health checks
Configure ASG to use ELB health checks. Otherwise if ELB cant connect to instance, ASG won’t create new instance.
Cross zone load balancing
Disabled, doesn’t consider if there are more instances in an AZ, both AZs get equal traffic.
If enabled, all instances get same amount of traffic, irrespective of AZ.
ELB for private instances
Configure ELB on Public subnet, then create target group, for corresponding AZ private subnet.
Note, ELB in Public subnet in AZ A cannot serve traffic to Instance in private subnet in AZ B.
Proxy Protocol Header
X-Forwarder Header
PPH - works on layer 4
XFH - works on layer 7
Used for passing the source IP address to the application.
Security groups
Stateful in nature.
All rules are evaluated.
Attached to ENI, so we can define rules with source source and destination as other security groups.
Can only define allow rules, can’t define deny rules.
SG membership can be changed while instance is running.
NACL
Network Access Control List
Attached to Subnet, mandatory to have at least 1 NACL on each Subnet.
List of rules are processed in order and first match is used.
Can define allow or deny rule.
Stateless
Doesn’t affect traffic if both instances are in same subnet.
Default NACL has everything allowed. Custom NACL has all deny.
Used to block traffic, i.e. malicious IPs.
VPC Peering Connections
Connecting 2 VPCs to be able to connect over private network.
Doesn’t support transitive connections.
Transit Gateway
Central gateway to direct multiple CIDRs over multipel networks.
VPC Endpoint Services
In destination VPC, we create an Endpoint service, and then on the source VPC we create an Endpoint.
Interface endpoint is an elastic network interface that allows a private IP address in a subnet to connect VPC resources to a number of AWS services, such as CloudFormation, Elastic Load Balancers (ELBs), SNS, and more.
Gateway endpoint is a target for a route in a route table to connect VPC resources to S3 or DynamoDB. Traffic is then routed from instances in a subnet to one of these two services.
Virtual Private Gateway
Customer Gateway
VPC side of VPN connection - Virtual Private Gateway
Customer side of VPN connection - Customer Gateway
Router
Connects all the networking components and are giverned by router table rules.
Egress only Internet Gateway
Stateful gateway to provide egress onlu access for IPV6 traffic
VPC
from /16 to /28
cant be changed once created.
CIDRs can’t overlap.
Subnet
should be within VPC CIDR can't be updated once created. Automatically connects to default route table. Can't have multiple AZ CIDR can't overlap with other subnet. first 4 IP and last IP are reserved. 172.31.10.0/24 - Network 172.31.10.1 - Gateway/Router 172.31.10.2 - DNS server 172.31.10.3 - Future use 172.31.10.255 - Network broadcast
Connecting to VPC
AWS Managed VPN AWS Direct Connect - not encrypted. AWS Direct Connect + VPN - encrypted AWS VPN Cloud Hub Software VPN Transit VPC VPC Peering AWS PrivateLink VPC Endpoints
VPC Sharing
Subnets can be shared with other AWS accounts within same AWS Org.
VPC Flow logs
Capture IP Traffic to and from network. Stored in CloudWatch Logs. 1. VPC 2. Subnet 3. Network Interface
CORPS
5 pillars
Cost Optimization Operation Excellence Reliability Performance Security
Route 53
Possible to have Domain registered in 1 account and have hosted zone in another AWS account.
Domain can be migrated to other providers using support team.
Hosted zone is collection of records.
Public zone
Private hosted zone. - needs enablednshostname and enablednssupport
Alias is R53, no charges, it can point to domain apex records as well. i.e. amazon.com
A record - 169.254.169.254
CNAME - my.amazon.com
Traffic Flow - create routing configurations - for complex scenarios where multiple policies are required.
Resolver - used in hybrid cloud
