AWS Cloud Practicioner Flashcards
AWS Cloud Shell
AWS CLI in the browser
Pricing calculator
Allows to create an estimated price for an infrastructure (fe. the cost of 3 EC2 instances and 100GB of EBS for 1 year)
Billing Dashboard
Your bills for the previous months + forecast for the next month, less detailed
Cost explorer
Dashboard for filtering and sorting costs + forecast for the next 12 months, more detailed
Cost & Usage reports
Generates a regular .csv report (to an s3 bucket) about the costs of the AWS account, most detailed
Tags (Costs & Billing)
Adding tags to the resources will make the bills easier to read (fe. tagging instances by projects makes easier to see project total cost)
AWS Budget
Allow (email) notifications when you are near your budget, more complex, can work with forecasts
Billing alarms
Cloud watch based less complex version of budgets (notifications when you spent an amount of money), can’t work with forecasts (just the actual consumption)
Consolidated Billing
Creating a single bill for all accounts.
AWS Health dashboard
Lists all maintenance events effecting the used by the account (personal), also have a general version (every service)
Service quotas
You have some default limits for some resources (like number of EC2 instances)
Six pillars of cloud architecture (The Well-Architected Framework)
- Operational Excellence
- Security
- Reliability
- Performance Efficiency
- Cost optimisation
- Sustainability
The Well-Architected Tool
List of questions helping to evaluate the challenges during the designing phase of the application (how to follow the six pillars of cloud architecture)
Thrusted Advisor
Checks the system via Machine Learning to check does the system respects:
* Security
* Fault tolerance (similar to Reliability)
* Performance (similar to Performance Efficiency)
* Cost optimisation
* Service limits (similar to Sustainability)
Acceptable Use Policy
The list of forbidden actions via AWS
AWS Organisations
Allows to supervise user accounts from a centralised place
Service Control Policy
With Service Control Policies you can control which policies (and permissions) can be added to IAM users of an account (disabling root permissions is a good idea).
AWS Control Tower
It is technically a wizard which helps to set up the default best practices for AWS organisations
Cloud Formation
AWS-s built in Infrastructure as code Solution
Cloud Formation Designer
“Draw” an infrastructure as code template instead of writing it
AWS CDK
Allows you to write infrastructure as code via java/python/C# etc. code instead of .yaml or .json files
Resource Access manager
manage shared cloud resources
AWS Config
manage and control configurations on a central place
AWS Licence Manager
manage licences on multiple accounts
Systems Manager
Helps to manage large scale server fleets (or even multi account resources), and multiple applications running on them
Session Manager
Allows to connect EC2 instances (similar to EC2 Instance connect just more advanced) from the browser
AWS OpsWork
Non managed alternative of System Manager.
It uses Puppet or Chef for platform automation.
(Helps to manage large scale server fleets (or even multi account resources), and multiple applications running on them)
Service Catalog
creates configurable “templates” (using CloudFormation)
Proton
creates templates for serverless & container related tasks (subset of service catalog, they can be combined)
Launch Wizard
pre built (application) templates created by AWS
CloudWatch
Cloud watch collects application logs
Cloud watch also allows to see different metrics (cpu utilisation, number of uploaded files etc.)
VPC Flow logs
Flow logs are capturing all incoming and outgoing IP traffic of a, VPC/Subnet
It can be exported to CloudWatch
CloudWatch Dashboards
It is possible to set up dashboards in the CloudWatch (aggregating multiple charts in the same page)
CloudWatch Alarms
When a metrics (bytes stored in the bucket, cpu utilisation etc.) reaches a condition (5gb, 95% etc.) an alarm is triggered (SNS notification sent, auto scale triggered)
CloudWatch Agent
If we install CloudWatch Agent on an EC2 instance it allows more detailed logging
X-Ray
Follow data flowing trough your applications
IAM User
person
IAM User Group
put users into a user group and give/take permissions to ALL of them
IAM Roles
giving permissions to a service (fe to access another service)
IAM Permission
a single permission
IAM policy
group of permissions
IAM Identity Center
a more powerful way to allow signing in into multiple aws accounts
AWS Directory Service
he built in support for Microsoft Active Directory
CloudTrail
allows to follow the actions of the user accounts (who created/modified a resource/configuration), literally an uncleanable “history”
GuardDuty
allows to automatically detect suspicious activities (powered by machine learning)
AWS Config
forces compliance on services (shows if some resource is not compient) - enforcing compliance
AWS Artifact
download compliance reports (for example GDPR) - showing that AWS is compliant
AWS Audit Manager
generating Compliance reports (about your own implementations) - showing that you are compliant
AWS Inspector
scans containers and EC2 instances to discover vulnerabilities (like unpatched software backdoor) - preventive
AWS Detectie
investigating incidents (like CloudTrail, but not just for users but for instances too) - when the problem happened
WAF
Web Application Firewall - attachable to some services (like cloud front distributions) block requests based on their metadata (detecting an sql injection fe.)
NetworkFirewall
managed firewall provided by AWS, it protects entire networks (like NACL on steroids)
Firewall Manager Service
a centralised service to manage firewalls
Shield
protection agains DDoS attacks
KMS
Key Manage Service - data encryption, managed key storage (all services have a built in support, you just need to enable it)
CloudHSM
Cloud Hardware Security Module - data encryption, custom key storage
ACM
Aws Certificate Manager - transfer encryption, get and use ssl certificates to en-/decrypt all incoming/outgoing data
Secrets Manager
built in support for storing secrets (credentials) hidden from most of the users
AWS Macie
scans S3 buckets to discover vulnerabilities (like unprotected sensitive data fe. username/password pairs), or unintentionally public sensitive data
Security Hub
Central dashboard for the other security services:
* GuardDuty
* Inspector
* Macie
* IAM access analyser
* Firewall manager
* System manager
Credentials report
Generates a csv report about all users and their credentials (not the concrete values)
Access advisor
Shows which policies a user have, and when was it used last time
Access analyser
Shows which are potential unwanted (too much) policies of a user
AMI
Amazon Machine Image - image of a “VM” (OS + pre built software
User data
Scripts (shell/bash commands) executed on startup of the EC2 instance (optional)
EC2 Instance connect
Online “SSH” from the browser (like the AWS web console)
Pricing - On Demand
Pay what you use
Pricing - Spot Instances
Discounted, but lower priority (you get it if there is free capacity, but AWS will take it away if somebody else needs it, and pays more)