AWS Cloud Practicioner Flashcards
1
Q
AWS Cloud Shell
A
AWS CLI in the browser
2
Q
Pricing calculator
A
Allows to create an estimated price for an infrastructure (fe. the cost of 3 EC2 instances and 100GB of EBS for 1 year)
3
Q
Billing Dashboard
A
Your bills for the previous months + forecast for the next month, less detailed
4
Q
Cost explorer
A
Dashboard for filtering and sorting costs + forecast for the next 12 months, more detailed
5
Q
Cost & Usage reports
A
Generates a regular .csv report (to an s3 bucket) about the costs of the AWS account, most detailed
6
Q
Tags (Costs & Billing)
A
Adding tags to the resources will make the bills easier to read (fe. tagging instances by projects makes easier to see project total cost)
7
Q
AWS Budget
A
Allow (email) notifications when you are near your budget, more complex, can work with forecasts
8
Q
Billing alarms
A
Cloud watch based less complex version of budgets (notifications when you spent an amount of money), can’t work with forecasts (just the actual consumption)
9
Q
Consolidated Billing
A
Creating a single bill for all accounts.
10
Q
AWS Health dashboard
A
Lists all maintenance events effecting the used by the account (personal), also have a general version (every service)
11
Q
Service quotas
A
You have some default limits for some resources (like number of EC2 instances)
12
Q
Six pillars of cloud architecture (The Well-Architected Framework)
A
- Operational Excellence
- Security
- Reliability
- Performance Efficiency
- Cost optimisation
- Sustainability
13
Q
The Well-Architected Tool
A
List of questions helping to evaluate the challenges during the designing phase of the application (how to follow the six pillars of cloud architecture)
14
Q
Thrusted Advisor
A
Checks the system via Machine Learning to check does the system respects:
* Security
* Fault tolerance (similar to Reliability)
* Performance (similar to Performance Efficiency)
* Cost optimisation
* Service limits (similar to Sustainability)
15
Q
Acceptable Use Policy
A
The list of forbidden actions via AWS
16
Q
AWS Organisations
A
Allows to supervise user accounts from a centralised place
17
Q
Service Control Policy
A
With Service Control Policies you can control which policies (and permissions) can be added to IAM users of an account (disabling root permissions is a good idea).
18
Q
AWS Control Tower
A
It is technically a wizard which helps to set up the default best practices for AWS organisations
19
Q
Cloud Formation
A
AWS-s built in Infrastructure as code Solution
20
Q
Cloud Formation Designer
A
“Draw” an infrastructure as code template instead of writing it
21
Q
AWS CDK
A
Allows you to write infrastructure as code via java/python/C# etc. code instead of .yaml or .json files
22
Q
Resource Access manager
A
manage shared cloud resources
23
Q
AWS Config
A
manage and control configurations on a central place
24
Q
AWS Licence Manager
A
manage licences on multiple accounts
25
Systems Manager
Helps to manage large scale server fleets (or even multi account resources), and multiple applications running on them
26
Session Manager
Allows to connect EC2 instances (similar to EC2 Instance connect just more advanced) from the browser
27
AWS OpsWork
Non managed alternative of System Manager.
It uses Puppet or Chef for platform automation.
(Helps to manage large scale server fleets (or even multi account resources), and multiple applications running on them)
28
Service Catalog
creates configurable “templates” (using CloudFormation)
29
Proton
creates templates for serverless & container related tasks (subset of service catalog, they can be combined)
30
Launch Wizard
pre built (application) templates created by AWS
31
CloudWatch
Cloud watch collects application logs
Cloud watch also allows to see different metrics (cpu utilisation, number of uploaded files etc.)
32
VPC Flow logs
Flow logs are capturing all incoming and outgoing IP traffic of a, VPC/Subnet
It can be exported to CloudWatch
33
CloudWatch Dashboards
It is possible to set up dashboards in the CloudWatch (aggregating multiple charts in the same page)
34
CloudWatch Alarms
When a metrics (bytes stored in the bucket, cpu utilisation etc.) reaches a condition (5gb, 95% etc.) an alarm is triggered (SNS notification sent, auto scale triggered)
35
CloudWatch Agent
If we install CloudWatch Agent on an EC2 instance it allows more detailed logging
36
X-Ray
Follow data flowing trough your applications
37
IAM User
person
38
IAM User Group
put users into a user group and give/take permissions to ALL of them
39
IAM Roles
giving permissions to a service (fe to access another service)
40
IAM Permission
a single permission
41
IAM policy
group of permissions
42
IAM Identity Center
a more powerful way to allow signing in into multiple aws accounts
43
AWS Directory Service
he built in support for Microsoft Active Directory
44
CloudTrail
allows to follow the actions of the user accounts (who created/modified a resource/configuration), literally an uncleanable “history”
45
GuardDuty
allows to automatically detect suspicious activities (powered by machine learning)
46
AWS Config
forces compliance on services (shows if some resource is not compient) - enforcing compliance
47
AWS Artifact
download compliance reports (for example GDPR) - showing that AWS is compliant
48
AWS Audit Manager
generating Compliance reports (about your own implementations) - showing that you are compliant
49
AWS Inspector
scans containers and EC2 instances to discover vulnerabilities (like unpatched software backdoor) - preventive
50
AWS Detectie
investigating incidents (like CloudTrail, but not just for users but for instances too) - when the problem happened
51
WAF
Web Application Firewall - attachable to some services (like cloud front distributions) block requests based on their metadata (detecting an sql injection fe.)
52
NetworkFirewall
managed firewall provided by AWS, it protects entire networks (like NACL on steroids)
53
Firewall Manager Service
a centralised service to manage firewalls
54
Shield
protection agains DDoS attacks
55
KMS
Key Manage Service - data encryption, managed key storage (all services have a built in support, you just need to enable it)
56
CloudHSM
Cloud Hardware Security Module - data encryption, custom key storage
57
ACM
Aws Certificate Manager - transfer encryption, get and use ssl certificates to en-/decrypt all incoming/outgoing data
58
Secrets Manager
built in support for storing secrets (credentials) hidden from most of the users
59
AWS Macie
scans S3 buckets to discover vulnerabilities (like unprotected sensitive data fe. username/password pairs), or unintentionally public sensitive data
60
Security Hub
Central dashboard for the other security services:
* GuardDuty
* Inspector
* Macie
* IAM access analyser
* Firewall manager
* System manager
61
Credentials report
Generates a csv report about all users and their credentials (not the concrete values)
62
Access advisor
Shows which policies a user have, and when was it used last time
63
Access analyser
Shows which are potential unwanted (too much) policies of a user
64
AMI
Amazon Machine Image - image of a “VM” (OS + pre built software
65
User data
Scripts (shell/bash commands) executed on startup of the EC2 instance (optional)
66
EC2 Instance connect
Online "SSH" from the browser (like the AWS web console)
67
Pricing - On Demand
Pay what you use
68
Pricing - Spot Instances
Discounted, but lower priority (you get it if there is free capacity, but AWS will take it away if somebody else needs it, and pays more)
69
Pricing - Savings plan
Paying in advance for a year (for a minimal amount of compute power, every instance have a concrete amount of compute power required) getting a discount, but paying at least that amount even if you are not using it
70
Pricing - Reserved instances
Paying in advance, and specifying the concrete instance types (fe. “5* t2.micro”) similar to savings plan, but even less flexible
71
Pricing - Dedicated hosts
Dedicated hosts - renting a complete server (fe. compliance reasons, performance)
72
Pricing - Capacity reservation
Guarantees that there will be an instance available, but you pay “reservation fee”
73
Step functions
Allows the user to divide a complex tasks into steps
Defines how the steps can call each other (Azure Logic App)
74
Fargate
Serverless Container Execution Environment
75
ECS task
Instructions (code) to create a container from an image and run it
76
ECS service
A running task (container)
77
ECR
Elastic Container Registry is a managed container registry (like Docker Hub)
78
AWS batch
Tool to run batch operations
A batch operations requires running multiple complex workflows, sometimes involving multiple systems on regular (daily, monthly) basis
79
AWS Compute Optimizer
Uses Machine Learning to analyse the CloudWatch metrics of the compute services, and helps to optimise them (giving suggestions to upscale or downscale)
80
EBS
Elastic Block Store -
It is possible to add hard drives (volumes) to EC2 instances on start or later.
81
EC2 Instance store
The hard disk which is part of the machine running the EC2 instance
82
EFS
Elastic File System -
It possible to add a file system to any kind of application (EC2, ECS, Lambda etc.).
83
FSx for Lustre
A file system optimised for high performance file access workloads
84
EC2 Auto Scaling Group
AWS allows to dynamically adjust the capacity of the servers when you have huge load spikes.
85
Application Load Balancer
Load Balancer, better for web servers (HTTP/HTTPS), more configurable
86
Network Load Balancer
Load Balancer, better for “just data” (TCP/UDS), very fast
87
Target Group
Group of services (instances) which could get a delegated “work” by the load balancer.
88
S3 - Buckets
“entry points” of the storage, with globally unique name
89
S3 - bucket policies
Similar to security groups for other instances / or IAM policies for users
90
S3 - ACLs
The alternative of group policies (not recommended)
91
S3 storage type - standard
* Accessed multiple times
* Flexible, but expensive
92
S3 storage type - IA
* Accessed occasionally
* Cheaper, but reading the files costs extra money
93
S3 storage type - Glacier
* Nearly never accessed
* The cheapest option, but reading the file costs extra money
* You need to wait for the file (minutes to days)
94
S3 storage type - Inteligent tiering
* AWS analyses access patterns on the file, and decides which category is the best for it
95
S3 - Versioning
storing different versions of the file with the same name
96
S3 - Lifecycle management
moving files to a less expensive storage class after some time, fe. Logs can go to IA after a month, probably nobody opens them anyway
97
S3 - Inventory & Analytics
statistic about the files stored on the bucket
98
S3 - Object lock
making files non changeable/deletable, useful for compliance/legal reasons
99
S3 - Replication
making cross bucket replicas, even between buckets in different regions, requires enabled versioning
100
S3 - Data Encryption
data automatically encrypted on upload, and decrypted on download
101
S3 - Static website hosting
using S3 as a server for hosting a simple static website
102
RDS
Managed SQL Databases (running on an EC2 instance in the background)
103
Amazon Aurora
Fully PostgreSQL and MySql compatible database optimised for AWS with great scaleability and performance
It also have a serverless version
104
ElastiCache
Amazons managed implementation of in memory cache.
Supports Redis and Memcache
105
DynamoDB
Managed high performance NoSQL key-value Databases
106
DAX
DynamoDB Accelerator Built in Managed in memory cache for DynamoDB (like ElastiCache for RDS)
107
MemoryDB
key-value db, PERSISTENT in-memory storage
108
DocumentDB
document db, MongoDB compatible
109
Keyspaces
wide column db (flexible column format like Cassandra)
110
Neptune
Graph database
111
TimeStream
Time serve DB
112
Quantum Ledger
Immutable log data changes (centralised blockchain)
113
Managed Blockchain
Decentralised blockchain (ethereal compatible)
114
AWS Kinesis
When we need to store high frequency data (devices/sensors) we can use Kinesis service.
We don’t need that middle layer for less frequent data, but for high frequency data we need Kinesis to work as a buffer.
115
Redshift
* Storing the data in structured and formatted
* It is great for reporting & visualisation
* It is queryable (sql based)
116
Glue
Glue is a Serverless Managed Extract/Transform/Load service
117
EMR
Elastic Map Reduce -
Non managed Extract/Transform/Load service (you can use the Big Data platform preferred by you, fe. Hadoop)
118
Athena
Athena allows to query the extracted data from S3 / DynamoDB / CloudWatch (or other sources) via SQL (even if they are not an SQL DB)
119
Open Search
managed search service to search and analyse the data (runs on an instance in the background), elastic search alternative
120
QuickSight
can be used to build charts, reports and dashboard
121
ECR
Elastic Container Registry - a managed container registry (like Docker Hub)
122
Grafana
Grafana creates live interactive data visualisation, it is a QuickSight alternative
123
SQS
Simple Queue Service
- Pull / Push messages via a Queue
- Asynchronous processing
- Directly triggered from the code
124
SNS
Simple Notification Service
- Push messages directly to the subscribers
- Synchronous processing
- Directly triggered from the code
125
Event Bridge
Listens to events -> triggers actions
Synchronous processing
Indirectly triggered from the code (the code does not needs to know that the event is listened to and an action is triggered)
126
SES
Simple Email Service
Helps the user to send batch (mass) e-mails.
127
CloudMap
Registry of (assigned) resource names
It makes the creation of a micro service application easier (by registering/naming all the services)
128
API Gateway
It is a managed serverless RestAPI service (Helps creating RestAPIs without writing code)
129
AppSync
It is a managed GraphQL API service (It is a managed GraphQL API service)
130
Cognito
Cognito is a managed user authentication service (like the one in firebase)
131
Amplify
We can use it to “generate” back end services (for FE developers who have little AWS knowledge).
132
Elastic Beanstalk
Elastic Beanstalk helps to deploy web apps, and general workflows to the cloud in the simplest way.
It allows the user to configure everything (computing, storage, db, hosting, load balancing etc.) in a single place
It even allows to add Load Balancers and AutoScaling groups (more advanced use cases)
133
Lightsail
It is a web hosting provider (simple with lots of default options, but little configurability)
134
AppRunner
AppRunner simplifies deploying containers to the cloud via AWS.
135
Copilot
Copilot is a CLI that simplifies container and app creation & deployment to the cloud
136
Cloud9
Cloud based IDE, it runs on an EC2 instance under the hood
137
CodeGuru
Machine learning based, managed Sonar alternative
138
DevOpsGuru
Machine learning based cloud infrastructure analizator (Sonar for DevOps)
139
CloudCommit
A private Git repo in the cloud
140
CodeBuild
Managed execution environment (builds the code)
141
CodeArtifact
A managed artifact repository Nexus alternative
142
CodeDeploy
Allows to deploy code for different target (EC2, ECS, Lambda) with different strategies, manually or automated
143
CodePipeline
A managed Jenkins alternative
144
CodeStar
A simplified version of Code Pipeline (A managed Jenkins alternative) with lots of pre-configured blueprints
145
VPC
We can create a VPN like setup in the cloud.
Region based, every element of the VPC can communicate with each other.
Contains subnets.
146
Subnet
Inside VPCs we can group our instances into subnets, and control the connectivity of those subnets
AZ based (every subnet is in a single AZ)
We have two main type of subnets:
* Private subnet - only internal network access
* Public subnet - internet access
However all instances of a VPC can talk to each other, even if they are not on the same subnet
147
Elastic IP address
a “fix” (public) IP address
148
Security Groups
Security Group is like a firewall, controls the incoming and outgoing messages.
By default a security group filters the inbound traffic, but allows all outbound traffic.
Security Groups are stateful (if a request went out a response for it can come in).
Attached to instances.
Recommended way of security.
149
NACL
Network ACLs are firewalls for entire subnets.
By default NACLs are allowing all inbound and outbound traffic.
NACLs are stateless (we need to define rules for requests and responses too)
Security Groups are preferred over NACLs
150
VPC Peering
VPC Pairing opens a “channel” between 2 VPCs, aka. allows the instances of the VPCs to communicate with each other like they would be in a single VPC.
151
Transit gateways
Transit gateway does the same as VPC Pairing for multiple VPCs.
VPC Pairing opens a “channel” between 2 VPCs, aka. allows the instances of the VPCs to communicate with each other like they would be in a single VPC.
152
VPC Endpoints
You can create a VPC endpoint, and reach other AWS services (without going trough the global internet).
153
AWS PrivateLink
Amazons "intranet" around the globe. Provides faster and safer way of communication than the "real" internet.
154
AWS Direct Connect
Physical cable based connection between AWS and your data-center. Ultra fast, ultra safe, ultra expensive.
155
Internet Gateway
Connecting the (public) subnet to it will give internet access (in and out) to all instances of the subnet
156
NAT Gateway
Creates a one way (outgoing requests only) connection for the instances of the (private) subnet
157
S3 gateway
One type of VPC Endpoints, allows instances of a subnet to communicate with the S3 service via AWS PrivateLink.
158
Route 53
Domain Name System translates domains to IP addresses.
AWS Route 53 is Amazons own managed DNS.
159
Hosted zone
Configuration container, automatically created for every domain.
Add new records to the hosted zone to route incoming requests.
160
Records (routing)
Add new records to the hosted zone (to route incoming requests - coming from the internet trough that domain - to one of your services).
161
CloudFront
CloudFront is the managed CDN service of AWS.
If we are trying to access some web hosted content from far away (USA based server from Europe) it can cause high latency.
CDN networks are solving this problem by caching the content in various locations in the world, and routing the client to the closest cache (instead of the real server)
162
Edge Locations
Edge Locations are the “caches” used by CloudFront.
If we are trying to access some web hosted content from far away (USA based server from Europe) it can cause high latency.
CDN networks are solving this problem by caching the content in various locations in the world, and routing the client to the closest cache (instead of the real server)
163
AWS Global Accelerator
Improve user traffic performance via the AWS network (instead of the global internet)
164
S3 Transfer Acceleration
Improve network file speed to an AWS edge locations, and forward it via the AWS global network
165
ACM
Amazon Certificate Manager, allows to generally manage ssl certificates (and encryption) between services
166
Regions (Building blocks of the AWS infrastructure)
* The highest level of abstraction in AWS
* There are multiple Regions around the world (us-east-1, west-eu-2 etc.)
* Most of the services are region based, there are some exceptions (Global services like billing)
167
Availability zones (Building blocks of the AWS infrastructure)
* Every region contains at least 3 availability zones.
* They are fully independent (if one AZ goes down the others should remain active)
Every AZ contains 1 or more data centres.
* Some services are AZ based (like VPCs)
168
Edge Locations (Building blocks of the AWS infrastructure)
* Edge Locations are the “caches” used by CloudFront.
169
Local Zones (Building blocks of the AWS infrastructure)
Small AWS “regions” close to big metropolitan areas
* extra fast
* limited set of supported services
* Extends VPCs
170
Outposts (Building blocks of the AWS infrastructure)
* AWS servers, which you can add to your datacenter
* AWS managed infrastructure
* Hybrid system
* limited set of supported services
* Extends VPCs
171
Wavelength Zones (Building blocks of the AWS infrastructure)
* AWS servers, embedded into 5G networks (extremely fast)
* limited set of supported services
* Connectible into other services running in the region
