Governance Flashcards
What Is AWS Organizations?
AWS Organizations is a free governance tool that allows you to create and manage multiple AWS accounts. With it, you can control your
accounts from a single location rather than jumping from account to account.
Key Features of AWS Organizations
-
Logging Accounts: It’s best practice to create a specific
account dedicated to logging. CloudTrail supports logs aggregation. -
Programmatic Creation: Easily create and destroy new AWS
accounts. - Reserved Instances: RIs can be shared across all accounts.
- Consolidated Billing: The primary account pays the bills.
- Service Control Policies: SCPs can limit users’ permissions.
What is SCP?
Service Control Policies: Once implemented, these policies will be applied to every single resource inside an account. They are the ultimate way to restrict permissions and even apply to the root account.
What Is AWS RAM?
AWS Resource Access Manager (RAM) is a free service that allows you to share AWS resources with other accounts and within your organization. AWS RAM allows you to easily share resources rather than having to
create duplicate copies in your different accounts.
RAM vs. VPC Peering
When should you use VPC peering or RAM?
Are you sharing resources within the same region? Use RAM.
Are you sharing across regions? Use VPC peering.
If RAM isn’t available and VPC peering is, that’s still a great option!
What is Cross-Account
Role Access?
As the number of AWS accounts you manage
increases, you’ll need to set up cross-account
access. Duplicating IAM accounts creates a security
vulnerability. Cross-account role access gives you
the ability to set up temporary access you can easily
control.
it is preferred to create cross-account roles
rather than additional IAM users.
What Is Config?
Config is an inventory management and control tool. It allows you to show
the history of your infrastructure along with creating rules to make sure it
conforms to the best practices you’ve laid out.
Config = Standards
For example, you’d use Config to ensure your S3 buckets aren’t publicly
readable or your users are using the approved AMI in their EC2 instances.
You can use Automation documents or Lambda to enforce your standards.
You can track previously deleted AWS resources using Config.
You can roll up all your results to a single region.
What Is Directory
Service?
AWS Directory Service is a fully managed version of Active Directory. It allows you to offload the painful parts of keeping AD online to AWS while still giving you the full control and flexibility AD provides.
It runs inside a VPC(private service).
What are the 3 types of Directory Service?
- Simple AD: Standalone directory powered by Linux Samba Active Directory compatible server.
-
Managed Microsoft AD: This is the entire AD suite. You can easily
build out AD in AWS. - AD Connector: Creates a tunnel between AWS and your on-premises AD. It is simply a proxy back to your on-premises AD. For example, you could have a service in AWS(fx AWS Workspaces) that needs to connect to an AD that you already have on-premises.
What Is Cost
Explorer?
AWS Cost Explorer is an easy-to-use tool that allows you to visualize your cloud costs. You can generate reports based on a variety of
factors, including resource tags.
Cost Explorer lets you build reports
Tags are one of the most important ways to track your
spend
Cost Explorer can estimate your spend for the upcoming month.
What Is AWS
Budgets?
AWS Budgets allow organizations to easily plan and set expectations around cloud costs. You can easily track your ongoing spend and
create alerts to let users know when they’re close to exceeding their allotted spend.
What are the 4 different types
of budgets?
- Saving Plans Budgets: “Is what we’re doing covered
by our savings plan?” - Reservation Budgets: “Are we being efficient with our RIs?”
- Usage Budgets: “How much are we using?”
- Cost Budgets: “How much are we spending?”
2 free every month.
What is AWS CUR?
AWS Cost and Usage Reports (CUR):
-
Comprehensive: The most comprehensive set of cost and usage data
available for AWS spending. - Publish: Publish billing reports to Amazon S3 for centralized collection.
-
Breakdown: Break costs down by the time span (hour, day, and
month), service and resource, or by tags. - Daily CSV: AWS CUR updates reports in Amazon S3 buckets once a day using CSV formats.
- Integrations: Easily integrate with AmazonAthena, Amazon Redshift, or Amazon QuickSight.
Use within Organizations at organization level, OU level, or member account level.
What Is AWS Compute Optimizer?
- Optimizes: Analyzes configurations and utilization metrics of your AWS resources
- Reporting: Reports current usage optimizations and potential recommendations
- Graphs: Provides graphical history data and projected utilization metrics
- Informed Decisions: Use graphs, metric data, and recommendations for moving or resizing resources
Which resources does AWS Compute Optimizer work with?
Amazon EC2
Auto Scaling Groups
Amazon EBS
AWS Lambda
Disabled by default. You must opt in to leverage AWS Compute Optimizer.
After opting in, enhance recommendations via activation of recommendation preferences (e.g., enhanced infrastructure metrics paid feature)
8 AWS Health Concepts
- AWS Health event: Notifications sent on behalf of AWS services or AWS
- Account-specific event: Events specific to your AWS account or AWS organization
- Public event: Events reported on services that are public, not specific to accounts
- AWS Health Dashboard: Dashboard showing account and public events, shows service health as well
- Event type code: Include the affected services and the specific type of event
- Event type category: Associated category — will be attached to every event
- Event status: Reports if the event is open, closed, or upcoming
- Affected entities: Which AWS resources are or may be affected by the event
