AWS Keyword Assocation Flashcards
Alias Record
Route 53. S3. CloudFront Distributions. BOTH root and non root domain. no charge
Provides Amazon Route 53–specific extension to DNS functionality. Alias records let you route traffic to selected AWS resources, such as Amazon CloudFront distributions and Amazon S3 buckets. Offers weighted, geographic, and failover routing. You cannot set the TTL. It is set automatically by Route 53, which doesn’t charge for alias queries.
CNAME Record
ONLY FOR NON ROOT DOMAIN. charges. sub-domain.
in order to make a sub-domain, you add a cname record.
EX) capitalone.com –> sub-domain: jobs.capitalone.com
Maps a hostname to another hostname. Must always point to another domain name, never directly to an IP address. Can’t create same name as hosted zone. You DON’T need to use Route 53, charges for queries.
TTL
(Time To Live)
Route 53. New destination created, but users still being directed to old destination.
Used to automatically expire and delete data, which can help with data management, storage costs, and system architecture. Use IAM to regulate access to the TTL attribute. Ensure the TTL attribute has the same name across all items that need to be deleted.
Aurora Read Replicas or
Aurora Replicas
high availability. scale READ workloads. disaster recovery. read-intensive applications. Asynchronous.
Can be used to scale out reads across regions. They are read-only instances that increase compute capacity and distribute read workloads. They share the same storage as the source instance, which lowers costs and avoids copying data. They receive log streams from the writer instance and consume them by considering each log record.
Amazon Aurora
Compatible MySQL & PostgresSQL. Region DR
High performance. Scalability. Secure. Low Cost. Fully Managed. Monitoring. Replication. Serverless
Replicates your data with no impact on performance, enables fast local reads with low latency in each region, and provides disaster recovery from region-wide outages.
latency routing policy
Route 53. Queries. Apps that are accessed from multiple locations.
Use when you have resources in multiple AWS Regions and you want to route traffic to the region that provides the best latency.
(Relational Database Service)
RDS Multi-AZ
High availability. Data Replication. Read Replicas. Automatic Failover. Monitoring. Instance Replacement. Small production apps.
NOT suitable for high read load apps
Automatically creates a primary database (DB) instance and synchronously replicates the data to an instance in a different AZ.
Automatically fails over to a standby instance without manual intervention.
Session Policy
Limit Access and/or Permissions. IAM. REAL time.
Are inline policies in AWS Identity and Access Management (IAM) that limit users’ access to specific parts of an Amazon S3 bucket. They work by evaluating access in real time. They set the maximum permissions a user can have.
Use case:
- Give the same access to a group of users to a particular portion of an Amazon S3 bucket
- Lock down users so that they have access only to portions of a bucket where object prefixes contain their username
- Scope code permissions during sensitive operations
User Policy
defines the permissions of the IAM identity
User Role
a type of IAM identity that can be authenticated and authorized to utilize an AWS resource
Bucket Policy
Cross-Account permissions. AWS –> Another AWS
A type of resource-based policy that can be used to grant permissions to the principal that is specified in the policy. Principals can be in the same account as the resource or in other accounts. For cross-account permissions to other AWS accounts or users in another account, you must use a bucket policy.
Route 53
DNS. Latency-based routing. Route based on geographic location. Health monitoring & checks. Visual interface.
Highly available and scalable service that connects internet traffic to the appropriate servers. Allows users to tailor DNS routing policies to specific needs, such as reducing latency, enhancing application availability, and ensuring compliance. This customization empowers users to optimize their DNS configurations for performance, resilience, and adherence to regulatory requirements.
spot instances
URGENT computing. Flexibility. Low Price. Batch Jobs. Data analysis. Image processing. Distributed/short workloads.
When you place a request for a Spot instance, you specify the maximum price per hour, the instance type, and the availability zone.
Use Cases:
- Workloads that are resilient to failure.
- Flexible start and end time.
- Low Compute Price.
- Urgent computing needs for large amounts of ADDITIONAL capacity.
NOT suitable for critical jobs or DBs. less reliable
On-Demand Instances
unpredictable. short workload. predictable pricing, pay per second. Linux or Windows.
Use Case:
Recommended for short-term and un-interrupted workloads, where you can’t predict how the application will behave.
Reserved Instances
database. long workloads
Use Case:
Recommended for steady-state usage applications (think database)
Convertible Reserved Instances – long workloads with flexible instances
Savings Plan
Commitment to an amount of usage, long workload. Locked to a specific instance family & AWS region.
Use Case:
Flexible across:
* Instance Size (e.g., m5.xlarge, m5.2xlarge)
* OS (e.g., Linux, Windows)
* Tenancy (Host, Dedicated, Default)
Dedicated Hosts
Strong regulations. Compliance.
book an entire physical server, control instance placement. Most expensive.
Dedicated Instances
healthcare. single-tenant hardware. Isolate EC2
no other customers will share your hardware, but can be shared with other instances of the same AWS account that are NOT dedicated instances.
Capacity Reservations
guaranteed EC2 capacity. short term, uninterrupted workloads
reserve capacity in a specific AZ for any duration
EC2 Instance store
local. I/O performance. Buffering. Caching. Temporary storage and data. High performance.
A storage volume that acts as a physical hard drive. It provides temporary storage for Amazon EC2 instance. The data in an instance store persists during the lifetime of its instance. If an instance reboots, data in the instance store will persist.
DynamoDB
Near real time. Millions of transactions. Low latency. Throughput Management. TTL. Strong READ consistency. Partitioning for horizontal scaling. Replication across multiple AZs. NoSQL database. No maintenance. Serverless. Fully managed. Highly available.
In DynamoDB, tables, items and attributes are the core components that you work with. Simply put, a table is a collection of items and each item is a collection of attributes.
Use Case:
- best suited to store data in key-value pairs.
- can be combined with Lambdas
Transit Gateway
Supports IP Multicast. Maximize VPN throughput.
Connects your Amazon Virtual Private Clouds (VPCs) and on-premises networks through a central hub. This connection simplifies your network and puts an end to complex peering relationships. Transit Gateway acts as a highly scalable cloud router—each new connection is made only once.
- For having transitive peering between 1000’s of UPC & on-premises hub & spoke connection
- can work cross region
- can peer across region
- works with direct connect gateway VPN connections
Security Groups
Stateful. Allows INbound traffic to necessary ports
applied at the instance level. Instance can have multiple SGs. protects the resource
DocumentDB
fully managed, cloud-native, NoSQL database service that’s compatible with MongoDB
Use Case:
It’s a good choice for storing online profiles because you can store each user’s profile efficiently
NACL Network Access Control List
Stateless. YOU must allow BOTH inbound and outbound traffic.
Are like firewalls controlling traffic to and from subnet. Accepts everything inbound/outbound associated with subnets. DO NOT modify default, must create new ones. Protects the network. Can only be associated with 1 subnet.
Use Case:
Great way to block specific IPs at subnet level.
Kinesis Data Streams
ingest. REAL time. producers. consumers. managed scaling (shards). Replay capability.
build custom applications that process or analyze streaming data for specialized needs. manages the infrastructure, storage, networking, and configuration needed to stream your data at the level of your data throughput. Once data is inserted can’t be deleted.
provisioned: planned capacity
on demand: unknown capacity
Kinesis Data Firehose
NEAR real time. Auto Scaling. NO data storage. Fully managed. No admin. Serverless. Batches.
Simplifies the process of loading data streams into AWS data stores:
- S3
- Amazon Redshift (copy through S3)
- Amazon Open Search
CANNOT send data to dynamoDB
Athena
- Queries will be simple and will run on-demand.
- Minimal changes to the existing architecture.
Serverless Queries. ADHOC. Complex. Columnar Data. Compressed Data. Partition. Complex analysis
Serverless, interactive query service that allows users to analyze data in Amazon S3 using SQL. Define Schema, then start query. only pay for queries ran. Partition to improve performance.
Use Case:
- best for quick adhoc queries, log analysis, smaller DB, interactive queries.
- Commonly used with Amazon Quicksight for
reporting/dashboards
Redshift
OLAP(online analytical processing). Faster/repeatable/complex Queries. Quicksight. Tablue. Business Intelligence.
Columnar data storage and parallel query engine
Based on PostgresSQL but not used for OLTP
faster queries, joins & aggregation thank to indexes
2 modes: provisioned or cluster
Lets you access and analyze data without all of the configurations of a provisioned data warehouse. Resources are automatically provisioned and data warehouse capacity is intelligently scaled to deliver fast performance for even the most demanding and unpredictable workloads.
Use Case:
best for complex, large, fast queries / datasets. Business intelligence apps.
SQS FIFO
decoupling but in a strict order
exactly once delivery, removes duplicates. Not sending too many messages into SQS.
300 withOUT batching
3000 WITH batching
EFA (elastic fabric adapter)
High network performance. minimize latency. high message rates. Scalability.
direct access to the high-speed network infrastructure. A network device that can be attached to an EC2 instance to accelerate HPC & ML. Enabled at no cost
cloudformation
IaC (infrastructure as code), disaster recovery. reusable infrastructure template
used when we need to repeat an architecture in different environments, different regions, or even different AWS accounts.
glue
Apache Spark. Metadata. Serverless. ETL.
Managed extract, transform, and load (ETL) service. Useful to prepare and transform data for analytics. prevent re-processing old data
ECR (elastic container registry)
store/manage/deploy docker images
access controlled through IAM
integrated with Amazon ECS and Amazon EKS, allowing you to store, run, and manage container images
ECS (elastic container service)
Fargate. Docker. EC2.
Is a fully managed container orchestration service. ECS allows you to easily run, scale, and secure Docker container applications on AWS.
ECS Fargate launch type
docker. microservices, short-term tasks, serverless, scaling out capacity. billed based on task size. Auto manages upgrades.
ECS EC2 launch type
docker. traditional apps, more control over infra, cost based on memory of each instance type, maintenance.
EKS (elastic kubernetes service)
open source. Nodes (EC2 instances). EKS Pods.
Amazon’s managed Kubernetes, an open-source system that automates the management, scaling, and deployment of containerized applications.
SSE KMS (key managed service)
encryption for an AWS service
advantages: user control, audit key usage using cloudtrail
your principal needs DescribeKey and Encrypt permissions on the KMS key used to encrypt bucket data
GLB (Gateway Load Balancer)
layer 3 (network). Inspection purposes.
Enable you to deploy, scale, and manage virtual appliances with a single entry and exit for traffic. Doesn’t act as a proxy or terminate connections. It ONLY forwards traffic.
Use Cases:
balancing on network gateway level
managing traffic between cloud and on premises environments across diff regions
VPC Peering
direct communication
CANNOT establish on premises connectivity with AWS
VPC Sharing
resource sharing. centrally managed.
Firewall Manager
Security. centralized management.
Security Management Service that helps you to centrally configure & manage firewalls. Allows you to create and apply security policies consistently, ensuring that your security rules are enforced across your organization.
NOT used for traffic inspection & filtering
