Governance Flashcards
What is needed for creating AWS Organizations
Logging Account (which will hold S3 buckets for logging to Cloudtrail)
Primary Account for using for consolidated billing
How to create Global Policy for accounts in AWS Organizations and only way to restrict what root account can do
Service Control Policy (SCP)
How to Share RIs across multiple accounts
AWS Organizations
&
AWS RAM
Free service that allows you to share AWS resources with other accounts such as VPC and Transit Gateways
AWS RAM
TRUE or FALSE AWS RAM can only share resources with accounts in your AWS Organization
False, can also do it with accounts that are outside your org
If you need to share resources in the same region which AWS service should you use?
AWS RAM
If you need to share VPC resources cross-regionally what should you use?
VPC Peering
If I have a temp employee that needs access across my AWS accounts what can I do?
Give them temporary Role access
Inventory Management and control tool to see what you have in your AWS account, enforce standards, and notify you when state of architecture changes
AWS Config
3 Key functionalities of AWS Config
Query resources
Create Rules to enforce what is happening (prevent public S3 buckets) for compliance
Can tell history of env
TRUE or FALSE AWS Config Rules can have remediation steps taken automatically
True, can setup Automation Documents or use Lambda
Fully managed AD service for when we want to migrate everything to AWS for AD management
Microsoft AD
Fully managed AD for when we want to leave AD on-prem
AD Connector
Easy to use tool that allows us to visualize our cost in reports and can allocate costs on resource tags
AWS Cost Explorer
Service I can use to forcast how much I will spend based on my billing history.
AWS Cost Explorer
Allows Organizations to easily plan and set expectations across cost, allocate spend, and can set alerts when getting close to budget.
AWS Budgets
4 types of budgets that can be used with AWS Budgets
Cost Budgets
Usage Budgets
Reservations Budget
Savings Plan Budgets
Where does AWS CUR publish billing reports as CSV
To centralized S3 bucket
How can costs be broken down in AWS CUR
time span,
service and resource
tag
AWS service that has most comprehensive set of cost and usage data
AWS CUR (Cost and Usage Reports)
What services does AWS CUR integrate with?
Athena
Redshift
Quicksight
Services that work with AWS Compute Optimizer Resources
EC2
ASG
EBS
Lambda
Supported Account types with AWS Compute Optimizer Resources
Standalone
Member Account
Management Account in an Organization
Compatibile service with AWS Compute Savings Plans
EC2, Lambda, and Fargate
How to get higher savings plan if just want to save with EC2 instances not necessarily other Compute resources
EC2 Instance Savings
Save $$ on Sage Maker
SageMaker Savings
What does AWS Compute Optimizer offer?
Recommendations based on usage metrics in your account
What are 5 things Trusted Advisor checks for
cost optimization,
preformance
security,
fault tolerance
service limit checks
Is Trusted Advisor a Paid service?
No, although you get some checks out of the box for free some are paid
How to set up alerts with Trusted Advisor?
SNS, and can use Eventbridge and Lambda to address problems
Orchastration service that automates account creation and security controls and monitor account usage which is an extension of AWS Organizations
AWS Control Tower
High level rules provide continous governance of AWS ENV created with Control Tower
Guardrails
Automated deployments of templates in either Org unit or Org using config rules can be done with which AWS Service
AWS Control Tower
How to manage Licenses in AWS in a centralized way and control visibility and usage of licenses across services
AWS License Manager
Provides visibility of resources, preformance, and availability of AWS services in AWS Accounts and attempts to give you timely alerts for preventions of potential problems
AWS Health
Dashboard showing all public health events going on in AWS
AWS Health Dashboard
Allows orgs to create managed catalogs of approved IT services that can be centralized managed with Orgs
AWS Managed Catalogs
What is a Catalog Template behind the scenes (which AWS Service)
CloudFormation Template
AWS Service that manages infrastructure and deployment tooling of applications IaC of serverless and container architectures
AWS Proton
Which template are supported with AWS Proton
Cloudformation
Teraform
6 Pillars of Well-Architected Framework
Operational Excellence
Reliability
Security
Preformance Efficency
Cost Optimization
Sustainability
Service that provides a consistent process that measures cloud architecture against 6 pillars
AWS Well-Architected Tool
What Service can be used to preform vulnerability scans on EC2 servers?
AWS Inspector
