Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Gaukhar > Compute & Load Balancing > Flashcards

Compute & Load Balancing Flashcards

1
Q

EC2 Main Family Types

A

R - need lots of RAM - in-memory caches
C - need lots of CPU - compute/database
M - balanced, (think medium) - general/ web app
I - need good local I/O (instance storage) - databases
G - need GPU - video rendering/machine learning
T2/T3 - burstable up to capacity, baseline average
T2/T3 - unlimited burst, baseline average

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

EC2 Placement Groups

A
  • Cluster - all instances within same AZ - low latency. Good for HPC.
  • Spread - max 7 instances per group per AZ - critical applications
  • Partition - same AZ but across different partitions, can scale to 100s of instances per group. Good for Cassandra, Kafka, Hadoop
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Can you modify EC2 Placement Groups?

A

Yes. Stop. Use CLI modify-instance-placement. Start

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

EC2 Launch Types

A
  • On-demand - short workload, predictable pricing, reliable
  • Spot - short workload, cheap, can afford to lose instances, can be up to 90% cheaper
  • Reserved - long workloads
  • Convertible Reserved - long workloads, with the flexibility to convert the instance types
  • Schedule Reserved - specific schedule
  • Dedicated Instances - no other customer will share hw
  • Dedicate Host - entire physical server, control instance placement, for licenses that operate at the core or CPU socket level, CAN define host affinity at reboots
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

EC2 Instance Recovery

A

Can use CW alarm to monitor Instance or System Status and recover using EC2 Instance Recovery Action retaining same:
- private, public, elastic ip, placement group, metadata

can then send an alert to SNS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Does ASG support Spot Fleet?

A

Yes, mix of on-demand and spot instances (setup max willing to pay), can have a mix of instance types
Target Capacity can be huge 10,000 per spot/ec2 fleet, 100,000 per region per fleet. Supports EC2 standalone, ASGs, AWS Batch (Managed Compute Env), ECS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

How to upgrade ASG AMI?

A
  • Modify launch configuration/template
  • Manually terminate all instances (can use CloudFormation)
  • ASG will start launching new instances loading new launch configuration/template
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

ASG Lifecycle Hooks

A
  • Action before an instance is in service or is terminated

eg cleanup, log extraction, special health check etc

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

ASG Health Checks

A
  • EC2 Status

- ELB Health checks (HTTP-based)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

EC2 Spot Block

A

Block ppot instances for 1 to 6 hours without interruptions. In rare situation instances can be reclaimed. Batch jobs, data analysis or workloads that are resilient to failures

No critical jobs or databases

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

ECS ALB integration

A

Supports dynamic port mapping

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Fargate

A

is like ECS but serverless, just task need task definitions. No more EC2 :)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

ECS Security

A

Two levels of roles:
- EC2 instance roles to have ECS permissions, so that ECS agent can work correctly
- ECS Task level IAM task roles. Trust relationship example
“Principal”: {
“Service”: “ecs-tasks.amazonaws.com”
},
“Action”: “sts:AssumeRole”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

ECS Secrets

A

Can inject from SSM Paramater Store & Secrets Manager
To inject sensitive data into your containers as environment variables, use the secrets container definition parameter.

To reference sensitive information in the log configuration of a container, use the secretOptions container definition parameter.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

ECS Networking

A

none - no network connectivity, no port mappings
bridge - Docker virtual container-based networking
host - bypass Docker networking, use underlying host networking
awsvpc - every task on the instance gets own ENI and private IP
– Default for Fargate
– Monitoring, VPC flow logs, SGs, enchanced security

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

ECS - Autoscaling

A

Task level, on classic will need to also scale underlying EC2 on Fargate automatcally handled
CAN use RAM as metric to enable following scaling strategies:
- Target Tracking
- Scheduled Scaling
- Step Scaling

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

ECS Spot instances

A

Supported in both ECS classic (cheaper, but more unreliable trigger drain mode on shut down of a spot instance) and Fargate (can specify baseline number of tasks)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

AWS Lambda Integrations

A
  • Thumbnail creation in S3, store to S3 and put metadata in DynamoDb for caching
  • Serverless cron job, through scheduled CW event.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Lambda Limits

A

RAM - 128MB -> 3GB
More RAM more CPU, the second CPU gets added after 1.5GB
Timeout is 15 minutes
Has 512 MB temp storage
Deployment package 250MB max including layers
Concurrency execution - 1000 soft limit can be increased

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Lambda Latency Considerations

A

Cold invocation - 100 ms
Warm invocations - a matter of ms
New feature “provisioned concurrency” to keep invocations warm
Hops to API Gateway or CloudFront will add ~100ms
Use X-ray to debug end-to-end latency

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Lambda Security

A
  • IAM roles to grant access to other services
  • Execution Roles (Resource based policy) to allow:
    • other AWS services to invoke the lambda
    • other Accounts to invoke or manage lambda
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Lambda in VPC

A
  • Is a deployment option
  • By default, it in AWS network can access public internet and services (DynamoDB)
  • In VPC, gets ENI and can have SGs assigned to it
  • To talk to external API
    • Needs public subnet NAt Gw and IGW - option 1
    • Use Dynamo DB VPC Endpoint Gateway, the private access route to DynamoDB from the private subnet, needs route table configuration - option 2 (better solution)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Lambda Logging, Tracing and Monitoring

A
  • Make sure execution role has permissions to write to CW Logs
  • X-ray can be enabled via lambda configuration, also need IAM role permissions to access X-ray
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Lambda Sync

A

Invocations from CLI, SDK and APIG are synchronous

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

Lambda Async

A

S3, SNS, CW events. Retries 3 times on errors, need to ensure the processing within lambda is idempotent. Can define DLQ with SNS or SQS as targets.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Lambda Event Source Mapping

A

Records need to be polled from the source, order is preserved except SQS.
If function fails, the entire batch will be re-processed untill success, meaning:
- Kinesis, DynamoDB streams will stop shard processing, or you can send failed events to SNS or SQS
- SQS FIFO stop unless DLQ is defined

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

Lambda Destinations

A

Send results to a destinations:

  • Asynchronous invocations -> can send to different destinations based on success or failure
  • Destinations: SNS, SQS, Lambda, EventBridge bus
28
Q

DLQ vs Destinations

A

Destinations you can also send to Lambda or EventBridge bus

29
Q

SQS DLQ

A

SQS itself can be configured to send to DLQ

30
Q

Lambda versions

A
  • $LATEST mutable,
  • version immutable, have dedicated ARN = code + configuration
  • all versions are accessible
  • versions support aliases (dev, test)
  • aliases are mutable
31
Q

Lambda Aliases

A
  • Versions support aliases (dev, test)
  • Aliases are mutable, and have dedicated ARNs
  • Enable blue/green deployments by assigning weights to lambda functions
32
Q

Lambda & CodeDeploy

A

CodeDeploy can help automate traffic shifting for aliases

  • Linear: grow traffic every N minutes
  • Canary: 10% - 5 minutes, no errors? roll out 100%
  • Can create Pre and Post traffic hook for testing canary, and deciding whether to rollback
  • All At Once
33
Q

Load Balancers

A
  • CLB - HTTP(S),TCP
  • ALB - HTTP(S), WebSockets
  • NLB - TCP, TLS, UDP, WebSockets

can be either in private or public subnet and as a result IP address

34
Q

What is the purpose of certificate SAN?

A

Subject Alternative Name (SAN) Certificates can secure multiple fully qualified domain names with a single certificate.

35
Q

ALB

A

Layer 7, supports HTTP2, and redirects (ex. from HTTP to HTTPS)

  • Multiple applications across machines (target groups)
  • Multiple applications on the same machine (containers)
36
Q

ALB Routing to target groups

A
  • url based
  • hostname
  • query strings
  • headers
  • can route to multiple target groups
37
Q

ALB and lambda

A

It is possible to have lambda as part of the target group, with the embedded health check

38
Q

ALB target groups

A
  • EC2 instances can be managed by ASG
  • ECS tasks
  • Lambda functions, HTTP is transformed into JSON
  • IP addresses (must be private)
  • Health checks are at the Target Group level
39
Q

NLB

A

Layer 4, Websockets, HTTP(S), TCP, UDP

  • Can handle millions of requests per second
  • NLB has 1 static IP per AZ and supports assigning Elastic IPs (helpful for whitelisting specific IP)
  • is commonly used with AWS Private link to expose a service internally
40
Q

NLB and lambda

A

not supported

41
Q

Why use Proxy Protocol with NLB?

A

Proxy protocal, send additional connection info: sender, destination. You can retrieve originating client IP address

42
Q

Cross-Zone Load Balancing

A

Each LB always distributes evenly across all registered instances in all AZs
CLB - not default, no charge if enabled
ALB - default, can’t switch it off, no charge
NLB - not default, pay for cross-zone load balancing if enabled

43
Q

Load Balancers and Stickiness

A

Available in CLB and ALB, through session cookies, so same client goes to same backend instance. Cookie has an expiration date which can be edited. Use case: so that the client doesn’t lose the session data. Alternative would be to cache session data in ElasticCache or DynamoDb

44
Q

API Gateway

A
  • Authorizaton
  • OpenAPI support
  • API keys, throttling
  • resp/req transformations
  • API versioning
  • Caching
  • CORS
  • Endpoint can be AWS API (ex. trigger step function)
45
Q

API Gateway Limits

A
  • 29 seconds timeout

- 10MB max payload size

46
Q

API Gateway in front of S3

A

Use lamda to generate presigned url to pass to client to upload the file on its own end, since API Gateway payload limit is only 10MB

47
Q

API Gateway Endpoint types

A
  • Edge-Optimized. Default (for global clients, better latency). Uses Cloudfront edge locations. APi Gateway itself still lives in one region
  • Regional. (all clients in one region). Could manually combine with CloudFront for caching and distribution
  • Private. Only accessible from a given VPC. using interface VPC endpoint (ENI). Use resource policy to define access.
48
Q

API Gateway Caching

A
  • Settings are per method.
  • Default TTL 300s. Min 0s. Max 1 hour.
  • Clients can invalidate cache using headers. Cache-Control: max-age:0. Needs proper IAM authorization.
  • Ability to flush cache immediately
  • Cache encryption option
  • Capacity from 0.5GB - 237GB
49
Q

API Gateway Secrity

A
  • Load SSL certificates and have Route53 define CNAME
  • CORS
  • Resource policy, defining who can access (users, ip, cidr, vpc, vpce)
  • Execution role policies to invoke AWS API (eg lambda)
50
Q

API Gateway Authentication

A
  • IAM user credentials in headers through SigV4
  • Lambda Authorizer (OAuth, SAML, 3rd party)
  • Cognito User Pools (Client authenticates with Cognito gets token, passes a token, API Gateway knows how to verify Cognito token out of the box using Cognito User Pool)
51
Q

Route53 Records - Managed DNS

A 
A - hostname to IPv4
AAAA - hostname to IPv6
CNAME - hostname - hostname
ALIAS - hostname to AWS resource (ELBs, CloudFront, S3 Bucket, Elastic Beanstalk)
-- Can be used for root apex record
52
Q

Route53 - Routing Policies

A
  • Simple - hostname to a single resource, no health checks no failover, if multiple values are returned the client will choose the random one
  • Weighted - health checks, weights do not need to be summed to 100
  • Failover (Acitve - Passive) - Active health check mandatory
  • Latency - based on user to designated AWS region, has failover if you enable health checks
  • Geo location - should create default if no matches found
53
Q

Route53 - Multivalue Routing

A

Client chooses which record to use if fails no need to re-issue DNS lookup. Up to 8 records. Can associate health checks with the records

54
Q

Route53 - Private DNS

A
  • Must enabled VPC settings, enableDNSHostnames & enableDNSSupport
55
Q

Route53 - Health checks

A
  • Calculated Health checks (health checks monitoring other health checks, how many must pass to pass the parent healthchecks)
  • Health checks monitoring CW alarms (eg throttles of DynamoDB, alarms on RDS, custom metrics, etc)
  • Health checks themselves can trigger CW alarms
  • Based on response code or text (first 5120 bytes)
56
Q

Route53 - Health Checks and Private Hosted Zones

A

Since health checks are outside of private VPCs, you can:

  • Assign public ip address to resource
  • Check health of external resource the internal resource relies on, eg database
  • Configure internal resource to use CW metric and setup alarm which is used by health check
57
Q

Route53 Health Check automatic multi-region failover RDS

A
  1. Have EC2 instance monitor DB health and expose rest endpoint OR CW Alarm
  2. Use 1. as Health Check resources
  3. Raise CW Alarm in 2. fails
  4. Raise CW Event or SNS topic when 3. happens
  5. Trigger lambda to update DNS record in Route53 to point at read replicate
  6. Promote read replicas to be primary
58
Q

Route53 - Sharing central private DNS

A
  1. Establish connectivity using VPC peering

2. Use CLI to associate VPC with the central private hosted zone (one association per account)

59
Q

EC2 with Elastic IP

A
  • User Elastic IP re-assign to provide failover to secondary standby EC2 instance
  • Cheap, easy but does not scale
60
Q

Stateless WebApp with horizontal scaling

A

Multiple EC2, DNS query A record with 1 hour TTL, can get outdated info, clients must have logic to deal with hostname failure resolution, adding new instance may not receive traffic due to TTL

61
Q

ALB + ASG

A

Route53 Alias Record 1 hour TTL pointing at ALB with HealthChecks and Multi-AZ pointing at ASG, new instances available right away, time to scale is slow due to EC2 startup and bootstrap times (pre-built AMI can help)
Cannot handle massive peak (need pre-warm), could lose a few requests. CW used for scaling ASG.

62
Q

ALB + ECS on EC2 in ASG

A

Same as ALB + ASG, Docker, increased parallelism thanks to multiple task replicas enabled by dynamic port mapping. Tough to auto-scale ECS on EC2

63
Q

ALB + ECS on Fargate

A

ALB + ECS on EC2 in ASG, time to be in service much quicker

64
Q

ALB + Lambda

A

Limited to Lambda Runtimes, seamless scaling (limited to 1000 functions), can combine with WAF, good for hybrid, cheaper alternative to API Gateway + Lambda at the cost of more advanced API Gateway features

65
Q

API Gateway + Lambda

A

More expensive, Pay per request, seamless scaling, soft limits 10000 requests on API gateway/1000 lambda (can be raised), authentication, rate limiting, API keys, caching, lambda cold start can increase latency, use XRay to debug, limited to 10MB payload

Gaukhar (14 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions