RANDOM Flashcards
ALB/NLB weighted routing Policy
Although ALB/NLB support weighted routing, they can only span availability zones.
SSL certificates Rotation condition
- NOT ELIGIBLE if imported.
- NOT ELIGIBLE if already expired.
Trusted advisor checks
Trusted Advisor continuously evaluates your AWS environment using best practice checks across the categories of
* cost optimization,
* performance,
* resilience,
* security,
* operational excellence,
* and service limits,
* and recommend actions to remediate any deviations from best practices.
does up to 50 service limit checks for Free
TA does not change settings or configuration. It just alerts you when you are either approaching or crossing a certain threshold.
7 core checks (basic or developer support)
* S3 Bucket Permissions - NOT OBJECTS
* Security Groups - Specific Ports Unrestricted
* IAM Use
* MFA on Root Account
* EBS Public Snapshots
* RDS Public Snapshots
Trusted Advisor vs Service Health Dashboard
Service Health Dashboard only provides information about the regional availability of a service. You should use AWS Trusted Advisor to monitor the service limits of the EC2 instance.
However, Personal Health is also available as a resource that details how the service situation affects your account
IAM Access Analyzer
Access Analyzer helps you identify the resources in your organization and accounts, such as Amazon S3 buckets or IAM roles, shared with an external entity. This lets you identify unintended access to your resources and data, which is a security risk. Access Analyzer identifies resources shared with external principals by using logic-based reasoning to analyze the resource-based policies in your AWS environment.
Access Analyzer helps identify resources in your organization and accounts that are shared with an external entity.
- Access Analyzer validates IAM policies against policy grammar and best practices.
- Access Analyzer generates IAM policies based on access activity in your AWS CloudTrail logs.
IAM Policy Simulator
An IAM tool used for simulating all the permissions available to an identity or resource
AWS Well-Architected Tool
The AWS Well-Architected Tool is primarily used to review the state of your applications and workloads by comparing it with the architectural best practices and guidance in AWS. This tool is not capable of showing a preview of an upcoming permission change that you are about to implement.
S3 inventory vs S3 Analytics
Amazon S3 inventory is one of the tools Amazon S3 provides to help manage your storage. You can use it to audit and report on the replication and encryption status of your objects for business, compliance, and regulatory needs. You can also simplify and speed up business workflows and big data jobs using Amazon S3 inventory, which provides a scheduled alternative to the Amazon S3 synchronous List API operation.
Amazon S3 inventory provides comma-separated values (CSV), Apache optimized row columnar (ORC) or Apache Parquet (Parquet) output files that list your objects and their corresponding metadata on a daily or weekly basis for an S3 bucket or a shared prefix (that is, objects that have names that begin with a common string).
S3 Analytics is primarily used to analyze storage access patterns to help you decide when to transition the right data to the right storage class. It does not provide a report containing the replication and encryption status of your objects.
S3 Select
S3 Select is only used to retrieve specific data from the contents of an object using simple SQL expressions without having to retrieve the entire Bucket/object. It does not generate a detailed report, unlike S3 Inventory.
IPV6 and EC2 types
EC2 instance is an m3.large instance type, which does not support IPv6. You must resize the instance to a supported instance type, for example, m4.large. Remember that configuring an IPv6 is just an optional step.
If you have an existing VPC that supports IPv4 only, and resources in your subnet that are configured to use IPv4 only, you can enable IPv6 support for your VPC and resources. Your VPC can operate in dual-stack mode — your resources can communicate over IPv4, or IPv6, or both. IPv4 and IPv6 communication are independent of each other. You cannot disable IPv4 support for your VPC and subnets; this is the default IP addressing system for Amazon VPC and Amazon EC2.
Enforce EBS Encryption
You can configure your AWS account to enforce the encryption of the new EBS volumes and snapshot copies that you create. For example, Amazon EBS encrypts the EBS volumes created when you launch an instance and the snapshots that you copy from an unencrypted snapshot.
Dealing with EFS **PercentIOLimit **
** $~ PercentIOLimit **- Shows how close a file system is to reaching the I/O limit of the General Purpose performance mode.
you can’t change the performance mode configuration of an EFS file system right away. You need to migrate the data to another file system configured with your desired performance mode.
If this metric is at 100 percent more often than not, consider moving your application to a file system using the Max I/O performance mode.
If the PercentIOLimit percentage returned was at or near 100 percent for a significant amount of time during the test, your application should use the Max I/O performance mode. Otherwise, it should use the default General Purpose mode.
o move to a different performance mode, migrate the data to a different file system that was created in the other performance mode. You can use DataSync to transfer files between two EFS file systems. Build a new EFS file system that is configured with Max I/O performance mode. Utilize AWS DataSync to migrate data to the newly created EFS file system.
ELB Access Logs
Elastic Load Balancing provides access logs that capture detailed information about requests sent to your load balancer. Each log contains information such as
the time the request was received,
the client’s IP address,
latencies,
request paths,
and server responses.
You can use these access logs to analyze traffic patterns and troubleshoot issues. Access logging is an optional feature of Elastic Load Balancing that is disabled by default. After you enable access logging for your application load balancer, Elastic Load Balancing captures the logs and stores them in the Amazon S3 bucket that you specify as compressed files. You can disable access logging at any time.
VPC Flowlogs
format
** [ENI, FROM iP, TO iP, FROM Port, TO Port, 1,2, BYTES, x#*###, xx####x, CONDITION, OK]**
** Acronyms**
Eni
From
To
From
To
Bytes
Ok
NACL Use case
NACL should only be used in Specific cases where a Particular IP Address needs to be whitelisted, or blocked, or in other fine grain Specific situations.
VPC peering
one to one peering Happens over apeering connection.
* Gets complicated over many VPCs
* VPC peering Limit - 125 VPCs
VPC Peering over transit gateway
Deployed into a Region, it allows for Any to Any vpc networking using Transit Gateway
Direct Connect
Direct Connect can connect to two Logical Connections
1. AWS Public Service
2. VPC
VPC Sharing Use case
Two Accounts sharing a Single subnet in a VPC for:
1. Extending CIDR quota; if you have exhausted your IP Address, you can create a new VPC and deploy resources into it.
2. Two different teams sharing subnet resources(once security group settings are opened)
3. Minimizing too many Peering connections
4. Separation of power; owner creates VPC and other users cant make changes
Cloudwatch Billing Alarm
Can be used to track spending threshold and Alert Admin appropriately
Cloudwatch 3rd Party Integration
AWS CloudWatch supports uploading custom metrics from 3rd Party Apps and sources using CLI and SDK.
To publish a single data point using CloudWatch for a new or existing metric, use the put-metric-data command with one value and the time stamp.
~$ aws cloudwatch put-metric-data –metric-name PageViewCount –namespace MyService –value 2 –timestamp 2018-10-10-14T08:00:00.000Z
Managing and Tracking Bills
The AWS-generated tag createdBy defines and applies to supported AWS resources for cost allocation purposes. To use the AWS-generated tags, a management account owner must activate it in the Billing and Cost Management console. When a management account owner activates the tag, it is also activated for all member accounts.
After the tag is activated, AWS starts applying the tag to resources that are created after the AWS-generated tag was activated. The AWS-generated tags are available only in the Billing and Cost Management console and reports, and doesn’t appear anywhere else in the AWS console, including the AWS Tag Editor. The createdBy tag does not count towards your tags per resource limit.
AWS Cost Explorer
Cost Explorer is a tool that enables you to view and analyze your costs and usage. You can explore your usage and costs using the main graph, the Cost Explorer cost and usage reports, or the Cost Explorer RI reports.
You can view data for up to the last 12 months, forecast how much you’re likely to spend for the next 12 months, and get recommendations for what Reserved Instances to purchase. You can use Cost Explorer to identify areas that need further inquiry and see trends that you can use to understand your costs.
AutoScaling LifeCycle Hook
As your Auto Scaling group scale-out or scale-in your EC2 instances, you may want to perform custom actions before they start accepting traffic or before they get terminated. Auto Scaling Lifecycle Hooks allow you to perform custom actions during these stages.
ALB Connection Draining
Connection draining only allows instances that are about to be deregistered to finish in-flight requests.
Elasticache key points
Resharding - Reddis
Online resharding and shard rebalancing allow you to scale your Redis cluster dynamically with no downtime and serve requests even while scaling or rebalancing.
Read Replica - Reddis
IAM Credential Report
The credentials report **lists all your IAM users in this account and the status of their various credentials. **After a report is created, it is stored for up to four hours
ELB Monitoring
ELB health checks are used to determine whether the EC2 instances behind the ELB are healthy or not. But it does not help in capturing the monitoring information for the ELB itself.
However, the Following are used for that purpose
* ELB Access Logs
* Cloudwatch Metrics
* CloudTrail
EC2 Restarting from a Pending State. Reasons
The following are a few reasons why your EC2 instance goes from the pending state to the terminated state immediately after restarting it:
- You’ve reached your EBS volume limit.
- An EBS snapshot is corrupt.
- The root EBS volume is encrypted and you do not have permission to access the KMS key for decryption.
- The instance store-backed AMI that you used to launch the instance is missing a required part (an image.part.xx file).
EC2 Region Quota limit Symptoms
If you have reached the maximum number of EC2 instances allowed for your AWS account in a specific region, you would not be able to launch any new EC2 instances until you terminate some existing instances.
