IAM, Route 53 & EC2 Flashcards
IAM identities?
IAM user, groups and roles
IAM working of policies ?
Policies attached to role or directly to user (inline policy). Role can be applied to a user or group of user or resource.
Types of policies ?
Managed policies (orange box), customer managed (editable) or inline
IAM policy components
Version, Statement (container for policy element), Sid (optional serial id), Effect (allow or deny), Principal (account, user or role), Action (list of actions), Resource, Condition (optional)
AWS access keys
2 keys per user for programmatic access
AWS Cognito?
Used for giving temporary access to AWS services when authenticates with external identity provider like Google, FB etc.
AWS Cloud 9?
Cloud based web IDE
Route 53 ?
Managed DNS by AWS. Gels very well with the AWS services.
Managing subdomains ?
WE can have different subdomains like app.humanityolympiad.org point to Ec2, www.humanityolympiad.org pointing to cloudfront and so on
Route 53 traffic flow ?
There are 7 routing policies within route 53. This is visual editor for working with them.
Route 53 routing policies ?
Simple (multiple IPs random), weighted (separate for each IP with weight), latency (lowest latency), failover (primary, sec site with health check), geolocation (based on origin location), geoproximity (bias values, region), multi-value (simple with failover)
AWS Route 53 Resolver ?
For in house data centre and AWS VPC
EC2 instance types ?
General, Memory, Compute, Accelerated Optimised, Storage Optimised
EC2 placement groups ?
Logical placement of instances for multi-tenant apps. Is free service.
EC2 userdata ?
Script that can be run before launching for initial setup
EC2 metadata ?
Instance details like AMI, IP etc curl /latest/meta-data
Instance Profiles ?
Permissions and roles for the Ec2
EC2 pricing models ?
On-demand (least commitment, pay what you use, experiments), Reserved instances (Long term value, upto 75% off, convertible option also, schedule for certain hours as well), Spot (biggest saving), Dedicated Host (no virtual isolation on but single tenants given)
AWS AMI are region specific ?
Ye
What do AMI hold ?
Root volume EBS, Launch permissions and block storage keeping track of what volumes to attach on start
ASG ?
Auto scaling groups allows to increase or decrease capacity. Will keep min capacity always based on health check.
ASG scaling policies ?
Target tracking (based on CPU, network, requests), Simple (legacy based on alarms), Scaling with steps (based on alarms and can escalate)
Attaching Load balancer and Scaling group ?
Classic load balancers can be directly attached to ASG, Application and Network through target group
ASG Launch Configuration ?
Used to setup the instance basics as to what AMI, type of instance etc will be used
ELB ?
Distributes incoming request to multiple traffics like EC2, containers, IP, Lambda functions
ELB rues of traffic ?
Listeners (looks for incoming traffic, for classic only this is present and directly attached to EC2), Rules (based on rules decide TG), TG (used to register EC2)
When to use ALB vs NLB ?
ALB is for web apps, NLB provides better latency so like in video games
ELB sticky session ?
Useful when we need to direct certain user to a particular TG only due to some local instance storage. Uses cookies for the same.
XFF header ?
X-Forwarded-For header used to forward the user IP to the EC2 as else gets ELB ip
ELB health checks ?
Redirects target to healthy but doesn’t kills the instance like Auto scaling group does
Cross Zone LB ?
Load distributed among all the Availability zones equally
ALB can direct based on headers, subdomain, query string ?
Yes called request routing
EFS ?
Elastic file system. Multiple EC2 instances in same VPC can have this file system. Grows and shrinks based on requirement.
EBS ?
Elastic Block Storage. Highly durable and available solution. Automatically replicated within AZs for protection.
Types of EBS ?
General purpose, Provisioned IOPS, Throughput optimised HDD, Cold HDD, EBS Magnetic
Moving EBS volumes to different AZ and Region?
For different AZ take snapshot, create AMI and launch in different AZ.
For different region take snapshot, create AMI, copy AMI and launch in different region
EBS encrypt an unencrypted volume ?
Take a snapshot, encrypt snapshot, create AMI and launch EC2
Can we share an encrypted snapshot ?
No
Instance store volume ?
A temporary storage attached to the host machine. For ephemeral storage.
Are snapshots incremental ?
Yes only the changes will be stored. Initial snapshot takes more time.
