RandomNuggets Flashcards
SQL
Too many connections error
ERROR 1040
Scale UP
Increase instance size
Scale UP
Increase max instances up to Max # of open shards
Scale Up
Increase # shards
S3
Encrypt all objects uploaded by their app to S3 with
SSE-S3
S3
Header used by SSE-S3
x-amz-server-side-encryption
Encryption
Encrypt plaintext data with a data key
then
encrypt the data key with a top-level plaintext master key.
Envelope Encryption
Requests
2 eventually consistent read requests are equal to
One STRONG read request
Deployments
Deploy new version to all EXISTING only
No new EC2
All at once
Deployments
New version in batches to Existing - no new resources
Rolling
CloudWatch
Collects system metrics and log files from EC2 and on premises servers
CloudWatch Agent
X-Ray
Trace and analyze user requests as they travel through API-Gateway to underlying services.
X-Ray
DynamoDB streams
Life expectancy is like a fly’s
24 hours
Dev Tools
CodeCommit is like
Git
Dev Tools
Code Build is like
Jenkins
Dev Tools
Automates code deployment to instances - EC2
Code Deploy
Authentication
A directory in Amazon Cognito
User pool
Shards
Two eventually Consistent
1 Read
Role
To assume a role an app calls AWS STS and passes the ARN of the role to use.
AssumeRole
Scale
Vertical
Scale Up
Scale
Horizontal
Adding More of what you have
Security
These are STATEFUL
Security Groups
Security
All outbound traffic
permitted
File
File system used with EC2
Elastic File System
EFS
Networking
Network device attached to EC2 to accelerate learning apps and High Performance Computing (HPC)
Elastic Fabric Adapter
Lambda
zipp archives
Distribution mechanism for libraries, custom run times and other dependencies
Layers
Lambda
Trigger and executer
Trigger
Lambda
Compute model
Serverless
Lambda
Stores code in S3 and encrypts it
At rest
Lambda
Package code and dependencies in a deployment package
Function
Lambda
Log streams are monitored by
CloudWatch
Lambda
To create lambda function
Upload deployment package
Lambda
Basic function settings
Description
Memory Usage
Execution timeout
Role
Lambda
If variables need to reference more than 1 function
Parameter Store
Authentication
Rotates keys or variables automatically
Secrets Manager
Lambda Edge
Run lambda functions to custom content that is delivered by CloudFront
LambdaEdge
Lambda. with *CloudFront
AFTER *
BEFORE. *
AFTER. *
BEFORE. *
Receives Request
Forwards Request
Receives Request
Forwards
ECS: Deployment
Service scheduler replacing current running version of container with latest # of tasks and or removed from service is controlled by deployment and config
MiN/MAX
Rolling
ECS: Deployment
Verify new deployment of a service before send prod traffic to it and must be configured to use ALB or NLB
Blue Green with AWS Code Deploy
Task Placement Strategy
Least available amount of CPU or Memory
Binpack
Task Placement Strategy
Place tasks randomly
Random
Task Placement Strategy
Evenly based on specified values - default is spread across AZs
Spread
Task Placement Strategy
The types can be
Combined
S3
For object > 5 GB - 5TB
Use Multi-part upload
S3
Pull out ONLY the data that you need from an object
S3 Select
CloudWatch
Metrics are by default
5 mins
CloudWatch
Can be
1 min
S3
Event histories recorded in S3 are recorded in
CloudTrail
S3
To make objects publicly readable
Get Object Permission
S3
Asynchronous copying of objects across buckets in different AWS regions
Cross Region Replication
S3
Cross Region Replication requirement
Source and Destination have versioning enabled
Different regions
S3 must have permission to replace from source to destination.
EFS
To access EFS in a VPC you create one or more
Mount targets in VPC
EFS
Automatically mount your file system using mount helper
fstab
Database
Atomicity/Consistency/Isolation/Durability
ACID
Aurora
Minimum storage
10 GB
Database
One or more DB instances and cluster volumes that manage data for them
DB Cluster
Database
Virtual database storage volume that spans multiple AZs with each AZ have a copy of the DB cluster
Cluster Volume
Cluster
Primary read/write ops and performs all data mods to cluster volume
Primary
Aurora
Each Aurora DB cluster has
One primary database
Aurora
Same storage volume as Primary DB
Aurora Replica
Aurora Endpoint
Current primary DB instance for DB cluster
Cluster
Aurora Endpoint
One available aurora replica for DB cluster
used for Read-Queries
Reader
Aurora Endpoint
Set of DB instances you choose when you connect aurora
Custom
performs load balancing
Aurora Endpoint
Specific DB instance within an aurora cluster
Instance
Aurora Integrity
Maintains 6 copies of data across
- AZs
Aurora Instance Type
Memory Optimized
xxx
Aurora Instance Type
Burstable Performance
xxx
Monitoring
When changes occur
RDS Events
Monitoring
Metrics in real time for OS
RDS Enhanced Monitoring
Monitoring
Monitor RDS DB instances load - for troubleshooting
RDS Performance Insights
DynamoDB
Allows you to query data in tables using ALTERNATE KEYS in addition to queries against the primary key
Secondary Index
DynamoDB
How many secondary indexes can be created on a table
1 or more
DynamoDB
Partition key and sort key different from those on table
Global Secondary Index
Up to 20
DynamoDB
Same partition key as table and DIFFERENT sort key
Local Secondary Index
DynamoDB
Stream records are organized into
Shards
DynamoDB Streams
Use with Lambda to create
Triggers
Lambda
Code that executes automatically whenever an event of interest appears in a stream
Trigger
DynamoDB Type
1 value - num, string, binary, boolean and null.
Scalar
Primary Keys
DynamoDB
Doc type can represent a complex structure with nested attributes like in a JSON doc, list or map
Document Type
DynamoDB
Set Type
Multiple scalar values
DynamoDB
Returns most up to data information
Strongly Consistent
DynamoDB
One Read Capacity unit
2 eventually consistent
up to. 4KB in size
DynamoDB
1 write per second up to 1 KB
Write Capacity Unit
DynamoDB
Prevents app from consuming too many capacity units
Throttling
DynamoDB
HTTP 400 (Bad Request) Provisioned Throughput Exceeded Exception
Throttled Request
Expression
Items within query results should be returned (all others are discarded)
Filter Expression
Query
Single query operation can return max of
1 MB
Query
Limit number of items that it returns
Query Operation
Query
Reads every item in a table or secondary index
Scan
Policy Element
ARN to identify resource of policy
Resource
Policy Element
Allow or Deny keyword
Action
Policy Element
Allow or Deny effect
Effect
Policy Element
User that policy is attached too
Principle
Authentication
Customers can sign into identity provider then obtain temporary security credentials from AWS Security Token Service - STS
Web Identity Federation
CloudWatch
An alarm is a
Single metric
CloudWatch
Monitor, store and access log files from CloudTrail or other service
CloudWatch Logs
CloudWatch
Match events and route them
CloudWatch Events
CloudTrail
Share logs between accounts on the trail of apes
CloudTrail Log Monitoring
Response
Microsecond response times - eventually consistent data
DAX
ELB
7th layer
Application Load Balancer
ELB
4th layer
Network Load Balancer
ELB
Time out value
60 Seconds
Route53
Public Hosted Zones are
Domain Names
Route53
Resource record sets that route traffic to resources
Records
Route53
Route traffic to S3 buckets, CloudFront distributions and other AWS resources
Alias Records
Route53
Info about your domain traffic
NAME: domain name or subdomain
TYPE: traffic route
Value
What records contain
Route53
Consecutive times endpoint must fail to respond to requests
Failure Threshold
Route53
Container for records information on how to route traffic
Hosted Zones
Route53
Translate domain names into IP addresses so that computers can communicate with eachother
Name Servers
Route53
Method of routing traffic from unhealthy resources to healthy ones
DNS Failover
Route53
Route internet traffic to single resource
you can specify multiple values
Simple Routing Policy
Route53
Route based on the LOCATION of users
Geolocation
Route53
Route traffic based on the location of resources and can route traffic to areas of bias.
Geoproxiimity
Route53
Resources in multiple locations and you want to route traffic that provides best latency.
Latency
Route53
Respond with up to 8 records selected at random
Multi-value Answer
Route53
Route traffic to multiple
Weighted
Route53
Information about the routing configuration you want to create.
Traffic Policy
Route53
Resolver
Regional
Route53 Resolver
endpoint specified by VPC
Inbound
Route53 Resolver
endpoint that forwards queries
Outbound
Route53
All records have same
Name
Type
Routing policy
Used when
you want all resources available a majority of the time
Route53
Use when you want a primary resource or group available all of the time and you want a secondary resource or group or resources on standby
Active-Passive Failover
VPC
Range of IP addresses
Subnet
VPC
Subnet connected to internet
Public
VPC
Subnet protected with security groups and nacls
Private
VPN
Connection requires a concentrator
Virtual Private Gateway
VPC
This is located in customers data center
Customer Gateway
VPN
Moveable from virtual private gateway to AWS Transit Gateway
AWS Site-to-Site Virtual Private Network (VPN)
VPC
Privately connect VPC to supported AWS services - does NOT leave AWS network
Private Link
VPC
Connection between YOUR VPC and a VPC in ANOTHER account that enables routing between them with overlapping CIDR blocks
VPC Peering
VPC
10.0.0.0/16
Primary CIDR block
ACL
Allows all traffic to flow in and out of associated subnets
Default
ACL
Captures information about IP traffic going to and from NICS in your VPC - in CloudWatch logs
Flow Logs
Security Group
Level
Instance
Security Group
Automatically Allowed
Stateful
Security Group
What does it do with rules
Evaluate them
Security Group
What does this apply to
EC2
Security Groups
When applied
When launching or at a later time
NACL
Level
Subnet
NACL
Rule disposition
Allow or Deny
NACL
Explicitly Allowed
Stateless
NACL
How are rules processed
In order
NACL
Associated with
All instances in the subnets associated with it.
IPV
Egress only
IPV6
VPC
Enable instances in private subnets to connect to the internet BUT prevent internet from accessing the instances and can support up to 55,000 connections
NAT Gateway
VPC
Uses Hub and Spoke
Transit Gateway
IAM
If you are the only person who works on an account
Create User
IAM
If others need to work in account that you are using that requires no other identity mechanism
Create User
IAM
If you use EC2 you should create
A Role
IAM
If you have an app on your mobile phone that makes requests to AWS
Create Role
IAM
If you have users authenticating in your corporate network and you want to federate then
Creat Role
Policies
Attached to multiple users, groups and roles
Managed
Stand-Alone
Policies
Imbedded directly into a single user, group or role.
Inline
Policies
Permission policies you attach to AWS resources such as S3
Resource Based
Policies
Resource based attached to roles that define which principle can assume them
Trust Policy
IAM Best Practice
Do not use this for day to day
Root account
IAM Best Practice
Create individual ones for each human being
User
IAM Best Practice
For permissions use these
Groups
