AWS Solutions Architect Similar Services Flashcards
Cognito user pool, or cognito identity pool?
Cognito provides
- authentication - (user sign up or sign in) support for Enterprise ID’s (microsoft AD), or social ID’s (amazon, facebook, google, etc.)
- authorization - sets of permissions or operations allowed for a user. Fine-grained access control to resources.
- user management - user lifecycles such as importing users, onboarding users, disabling users, and storing and managing profiles.
Cognito User Pools - Provide sign up and sign in functionality for mobile, web, or app user. No server infrastructure for users to authenticate, provides profiles to manage users, OpenID Connect and OAuth standard tokens, priced per monthly active users.
Cognito Identity Pools - Provides AWS credentials for accessing resources on behalf of users, supports rules to map users to different IAM roles, free.
RDS Vs. DynamoDB Key points
Pricing - RDS is a monthly charge for each database launched with the option to reserve a DB instance for a one or three year term and receive discounts in pricing, compared to on-demand instance pricing.
Dynamo DB charges for reading, writing, and storing data in DynamoDB tables, along with any optional features chosen.
DynamoDB supports ACID
DynamoDB uses filter expressions because it does not support complex queries.
Multi-AZ deployments for MySQL, MariaDB, Oracle, and PostgreSQL engine utilize synchronous physical replication.
Multi-AZ deployments for SQL server use synchronous logical replication
S3 vs. EBS vs. EFS
S3 is cheaper than EBS and EFS in pure storage costs
EBS and EFS have higher performance than S3
EBS is meant to be used as volumes for EC2 instances
S3 does not have a hierarchy (flat environment) for files unlike EFS
S3 offers eventual consistency for overwrite PUTS and DELETES in all regions
SWF vs. AWS Step Functions vs. SQS
SWF is a web service that makes it easy to coordinate work across distributed application components.
- In SWF tasks represent invocations of logical steps in applications
- Tasks are processed by workers which are programs that interact with SWF to get tasks, process them, and return results
- Coordination involves managing execution dependencies, scheduling, and concurrency in accordance with the logical flow of the application
AWS Step Functions are a fully managed service that makes it easy to coordinate the components of distributed applications and microservices using VISUAL WORKFLOWS.
- Define STATE MACHINES that describe your workflow as a series of steps, their relationships, and inputs and outputs.
- States represent an individual step in a workflow diagram.
- States can perform work, make choices, pass parameters, initiate parallel execution, manage timeouts, or terminate your workflow with a success or failure.
SQS is a message queue use by distributed applications to exchange messages through a poling model.
FIFO queues preserve the exact order in which messages are sent and received. standard queues provide a loose-FIFO capability that attempts to preserve the order of messages.
Cloudwatch Vs. Cloudtrail
Cloudwatch is a monitoring service for AWS resources and Applications.
- free basic monitoring for resources such as EC2, EBS, RDS DB, enabled by default.
- collect and track metrics, monitor log files, set alarms.
- can enable detailed monitoring for AWS resources to send metric data more frequently, with additional cost.
- reports on application logs
- a real time stream of system events describing changes to AWS resources
- delivers in 5 minute periods for basic monitoring and 1 minute periods for detailed monitoring.
- Cloudwatch Logs agent sends data every five seconds by default
Cloud trail is a web service that records API activity in your AWS account.
- Cloud trail is enabled by default.
- logs information on WHO made a request, services used, actions performed, parameters for actions, and response elements returned by services.
- Cloud trail logs are stored in S3 buckets OR a CLOUDWATCH logs log group.
- helps ensure compliance and regulatory standards.
- provides specific information on what occurred in AWS account
- Focuses more on AWS API calls made in AWS account
- Typically delivers event within 15 minutes of API call.
Datasync vs. Storage gateway
Think datasync when it comes to large, permanent migrations like the movement of historical data. Storage gateway is better when data needs to be transferred back and forth.
DataSync simplifies copying of large amounts of data to and from AWS storage services over the internet or over Direct Connect
- uses an agent which is a VM owned by the user and is used to read or write data from storage systems
- copies to S3, EFS, Fsx for Windows File server
- Uses NFS, SMB, or S3 API
- uses Snowcone
Storage Gateway is a hybrid cloud storage service that gives you on-premises access to virtually unlimited cloud storage by linking it to S3.
- Three types: File, Volume, and Tape
- Uses STORAGE GATEWAY APPLIANCE, a VM from Amazon which is installed and hosted on your data center
- uses iSCSI, SMB, NFS
CloudFront Vs. Global Accelerator
CloudFront
- Uses multiple sets of dynamically changing IPs
- Pricing is mainly based on data transfer out and HTTP requests
- uses Edge Locations to cache content
- designed for HTTP
Global Accelerator
- Provides a set of static IP addresses as a fixed entry point for your applications
- Charges a fixed hourly fee and an incremental charge over standard transfer rates (DT-Premium: Data Transfer-Premium fee)
- Uses Edge Locations to find an optimal pathway to nearest regional endpoint
- Best for TCP and UDP
EC2 HC vs. ELB HC vs. ASG HC
EC2 HCs are built in, if checks pass the overall status is OKAY. If one or more checks fail, the overall status is impaired.
Two Types:
-System status checks - these checks detect underlying problems with your instance that require AWS involvement to repair. Either wait for AWS or fix it yourself
-Instance Status Checks - monitor the software and network configuration of your individual instance. EC2 sends an ARP request to the ENI. These checks require the user to repair.
ELB HCs are configured using a specific protocol or port. HTTP/HTTPS return a code 200 if sucessful, a TCP HC succeeds on a succesful connection, an SSL HC succeeds if a handshake succeeds.
Do not support websockets.
ASG HCs come from EC2, ELB, or a custom HC.
if an ASG instance is marked as unhealthy, it is scheduled for replacement. this can be manually interrupted
cross-zone load balancing
load balancer nodes distribute incoming requests evenly across the Availability Zones enabled for your load balancer. Otherwise, each load balancer node distributes requests only to instances in its Availability Zone.
Storage Optimized Instances
Storage optimized instances are designed for workloads that require high, sequential read and write access to very large data sets on local storage.
They are optimized to deliver tens of thousands of low-latency, random I/O operations per second (IOPS) to applications.
Memory Optimized Instances
designed to deliver fast performance for workloads that process large data sets in memory,
Compute Optimized Instances
ideal for compute-bound applications that benefit from high-performance processors, such as batch processing workloads and media transcoding.
General Purpose Instances
They provide a balance of compute, memory, and networking resources, and can be used for a variety of workloads.
Vertical Scaling
means running the same software on bigger machines which is limited by the capacity of the individual server.
Horizontal scaling
adding more servers to the existing pool and doesn’t run into limitations of individual servers.
Does Elastic Beanstalk support Docker? What about Auto-scaling?
Elastic Beanstalk supports the deployment of web applications from Docker containers.
With Docker containers, you can define your own runtime environment.
You can choose your own platform, programming language, and any application dependencies (such as package managers or tools), that aren’t supported by other platforms.
Docker containers are self-contained and include all the configuration information and software your web application requires to run.
By using Docker with Elastic Beanstalk, you have an infrastructure that automatically handles the details of capacity provisioning, load balancing, scaling, and application health monitoring.
You can manage your web application in an environment that supports the range of services that are integrated with Elastic Beanstalk, including but not limited to VPC, RDS, and IAM.
Does ECS AUTOMATICALLY provide Service Auto Scaling, Service Load Balancing, and Monitoring with CloudWatch?
No. ECS supports auto scaling, load balancing and monitoring with cloudwatch, but these features must be enabled.
You will have to manually configure these things if you wish to use ECS.
AWS Consolidated Billing
You can use the consolidated billing feature in AWS Organizations to consolidate payment for multiple AWS accounts or multiple AISPL accounts.
With consolidated billing, you can see a combined view of AWS charges incurred by all of your accounts.
You can also get a cost report for each member account that is associated with your master account.
Consolidated billing is offered at no additional charge. AWS and AISPL accounts can’t be consolidated together.
Network Load Balancer
best suited for load balancing of TCP traffic where extreme performance is required.
Operating at the connection level (Layer 4), Network Load Balancer routes traffic to targets within Amazon Virtual Private Cloud (Amazon VPC) and is capable of handling millions of requests per second while maintaining ultra-low latencies.
Network Load Balancer is also optimized to handle sudden and volatile traffic patterns.
What port is RDP?
TCP 3389 and UDP 3389
What are the valid case scenarios in using Enhanced Networking?
When you need higher packet per second performance.
When you need consistently lower inter-instance latencies.
Enhanced networking uses single root I/O virtualization (SR-IOV) to provide high-performance networking capabilities on supported instance types. SR-IOV is a method of device virtualization that provides higher I/O performance and lower CPU utilization when compared to traditional virtualized network interfaces. Enhanced networking provides higher bandwidth, higher packet per second (PPS) performance, and consistently lower inter-instance latencies. There is no additional charge for using enhanced networking.
What is the only required section in CloudFormation?
The Resources section.
However, as you build your template, it might be helpful to use the logical ordering of the following list, as values in one section might refer to values from a previous section. Take note that all of the sections here are optional, except for Resources, which is the only one required.
- Format Version
- Description
- Metadata
- Parameters
- Mappings
- Conditions
- Transform
- Resources (required)
- Outputs
What is Blue/Green deployment?
Blue/Green deployment sets up a new green environment which uses entirely new AWS resources.
Blue/green deployments provide a level of isolation between your blue and green application environments.
It ensures that spinning up a parallel green environment does not affect resources underpinning your blue environment. This isolation reduces your deployment risk.
This ability to simply roll traffic back to the still-operating blue environment is a key benefit of blue/green deployments. You can roll back to the blue environment at any time during the deployment process.
Canary Deployment
Using a very small fraction of production traffic, to better reflect user traffic.
If you discover the green environment is not operating as expected, there is no impact on the blue environment. You can route traffic back to it, minimizing impaired operation or downtime, and limiting the blast radius of impact.
Does Route 53 support DNSSEC?
Amazon Route 53’s DNS services does not support DNSSEC at this time.
However, their domain name registration service supports configuration of signed DNSSEC keys for domains when DNS service is configured at another provider.
What are the route 53 supported DNS record types?
- A (address record)
- AAAA (IPv6 address record)
- CNAME (canonical name record)
- CAA (certification authority authorization)
- MX (mail exchange record)
- NAPTR (name authority pointer record)
- NS (name server record)
- PTR (pointer record)
- SOA (start of authority record)
- SPF (sender policy framework)
- SRV (service locator)
- TXT (text record)
egress-only Internet gateway
horizontally scaled, redundant, and highly available VPC component that allows outbound communication over IPv6 from instances in your VPC to the Internet, and prevents the Internet from initiating an IPv6 connection with your instances.
Take note that an egress-only Internet gateway is for use with IPv6 traffic only. To enable outbound-only Internet communication over IPv4, use a NAT gateway instead.
AWS hosts a variety of public datasets such as satellite imagery, geospatial, or genomic data that you want to use for your web application hosted in Amazon EC2.
If you use these datasets, how much will it cost you?
AWS hosts a variety of public datasets that anyone can access for free.
Previously, large datasets such as satellite imagery or genomic data have required hours or days to locate, download, customize, and analyze. When data is made publicly available on AWS, anyone can analyze any volume of data without needing to download or store it themselves.
Service Control Policies (SCPs)
AWS Organizations offers policy-based management for multiple AWS accounts. With Organizations, you can create groups of accounts, automate account creation, apply and manage policies for those groups.
Organizations enables you to centrally manage policies across multiple accounts, without requiring custom scripts and manual processes.
It allows you to create Service Control Policies (SCPs) that centrally control AWS service use across multiple AWS accounts.
Web Identity Federation
With web identity federation, you don’t need to create custom sign-in code or manage your own user identities.
Instead, users of your app can sign in using a well-known identity provider (IdP) —such as Login with Amazon, Facebook, Google, or any other OpenID Connect (OIDC)-compatible IdP, receive an authentication token, and then exchange that token for temporary security credentials in AWS that map to an IAM role with permissions to use the resources in your AWS account.
Using an IdP helps you keep your AWS account secure because you don’t have to embed and distribute long-term security credentials with your application.
The low network latency and high network throughput in a dedicated placement group was working fine for a couple of weeks, however, when you try to add new instances to the placement group that already has running EC2 instances, you receive an ‘insufficient capacity error’.
How will you fix this issue?
It is recommended that you launch the number of instances that you need in the placement group in a single launch request and that you use the same instance type for all instances in the placement group.
If you try to add more instances to the placement group later, or if you try to launch more than one instance type in the placement group, you increase your chances of getting an insufficient capacity error.
If you stop an instance in a placement group and then start it again, it still runs in the placement group. However, the start fails if there isn’t enough capacity for the instance.
If you receive a capacity error when launching an instance in a placement group that already has running instances, stop and start all of the instances in the placement group, and try the launch again. Restarting the instances may migrate them to hardware that has capacity for all the requested instances.
Lambda function default timeout? Maximum execution duration?
Default timeout is 3 seconds.
Maximum execution duration is 900 seconds, equivalent to 15 minutes.
