EC2 Flashcards
How to move an EC2 volume from one region to another?
- Take snapshot of volume
- Create AMI from snapshot
- Copy AMI to new region
- Launch new EC2 instance in new region from copied AMI
How to move an EC2 volume to a new AZ?
- Take a snapshot of the volume
- Create AMI from snapshot
- Use the AMI to launch a new EC2 instance in the new AZ
Encryption state of snapshots of encrypted volumes?
snapshots of encrypted volumes are encrypted automatically
Encryption state of a volume restored from an encrypted snapshot
The restored volume is encrypted automatically
Can you share snapshots?
Yes, but only if they are unencrypted
How to encrypt an unencrypted root device volume?
- Create snapshot of root device volume
- Create copy of the snapshot and select the encrypt option
- Create an AMI from the encrypted snapshot
- Use the AMI to launch new encrypted instances
Alternate name for instance store volumes
Ephemeral storage
Instance store volumes vs. EBS backed instances
Instance store volumes will lose the data if the underlying host fails.
EBS backed instances can be stopped without data loss.
Both can be rebooted without losing data
Both will delete ROOT volumes on termination but EBS volumes have an option to keep the root device volume
ENI - acronym
Elastic Network Interface
ENI - definition/info
For basic networking; Can use multiple to create separate networks at low cost
EN - acronym
Enhanced network
EN - definition/info
For when you need reliable, high throughput.
Supports speeds between 10Gbps and 100Gbps
EFA - acronym
Elastic Fabric Adaptor
EFA - definition/info
For when you need to accelerate
High Performance Computing (HPC) OR
Machine Learning OR
If you need to do an OS by-pass
EC2 Network adapters
ENI - elastic network interface
EN - enhanced network
EFA - elastic fabric adaptor
Cloudwatch
Used to monitor performance
Can monitor most of AWS as well as apps running on AWS
Cloudwatch default vs detailed monitoring (EC2)
Will monitor every 5 mintutes by default
Will monitor every minute when detailed monitoring is turned on
CloudWatch vs CloudTrail
CloudWatch is about performance.
CloudTrail is about auditing; monitores API calls
What can you create with CloudWatch
Dashboards
Alarms
Events
Logs - aggregate, monitor, and store logs
EC2 Roles vs Access key + Secret access key
Roles are:
easier to manage
able to be assigned to an EC2 instance after it is created via the console & the command line
universal; able to be used in any region
Bootstrap scipts
Run when an EC2 instance first boots
Can be a powerful way of automating software installs and updates
Instance metadata
Information about an instance (like public/private IP)
curl http://169.254.169.254/latest/meta-data
Instance user data
The bootstrap script passed to EC2 instance on boot
curl http://169.254.169.254/latest/user-data
EFS - info
Supports NFSv4
Can support thousands of concurrent NFS connections
Data stored across multiple AZ’s within a region
Read after write consistency
EFS - scenario
distributed, highly resilient storage for Linux instances and Linux-based apps
FSx for Windows - scenario
centralised storeage for Windows based apps
FSx for Lustre - scenario
high-speed, high capacity distributed storage
For apps that do high performance compute (HPC), financial modeling, etc
Can store data directly on S3
EC2 storage mechanisms
EFS
FSx for Windwos
FSx for Lustre
EC2 placement groups
Clustered placement group
Spread placement group
Partitioned
Only certain types of instances can be launched in a placement group
Clustered placement group
low network latency / high network throughput
all instances on the same rack
recommended to use homogenous instances
Spread placement group
individual critical EC2 instances
Each instance on a seperate rack
Partitioned placement group
multiple EC2 instances
Each partition on a seperate rack than the other
HDFS, HBase, and Cassandra
Placement group by availability zone capabilities
Clustered - cannot span multiple AZs
Spread & Partitioned - can spread multiple AZs
Placement group name
must be unique
placement group merging
not possible
How to block malicious IP addresses
Using AWS WAF
Using Network ACLs
SR-IOV
Single root I/O virtualization
provides higher I/O performance and lower CPU utilization compared to traditional virtual network interfaces
When can you attach/replace an IAM role on an EC2 instance?
If no current role: Anytime
If current role: When the instance is in a running state
EC2 hypervisors
Xen - modified version of Xen Hypervisor
Nitro - new in-house version rolled out in 2017
EC2 nitro
latest gen EC2 instances that guarantee up to 64,000 IOPS
