SAA Flashcards
1
Q
What are the rules concerning S3 bucket names?
A
- They have to be globally unique (no two buckets can have the same name, even if they are created within two different regions, or AWS accounts).
- They have to use DNS name-like rules (only lowercase, can’t have a - in the name, may start with a digit or character).
- Have to be 3-63 characters long.
- Cannot be IP address-like.
2
Q
EC2 health checks vs. ELB for ASG
A
- EC2 health checks deal with HOST/INSTANCE issues
- ELB can monitor app health
- ASG using ELB checks detect and replace failed apps/instances
3
Q
Serverless in AWS
A
Lambda API Gateway DynamoDB Step Functions S3 SQS/SNS
4
Q
Max managed IAM policies per group
A
10
5
Q
Role permissions policy
A
Defines what permissions STS gives the identity who assumes a role
6
Q
What is split view in DNS?
A
When there are two zones, a private and a public, and they have the same DNS record
7
Q
Define what a logical resource and a physical resource is within CloudFormation.
A
A logical resource is the resource defined in code format while the physical resource is the real resource that is actually created in AWS by the logical resource.
8
Q
Route targets
A
- Can be IPs
- Can be gateway objects such as IGW, VGW, VPC endpoints, VPC peers, NAT gateways, etc.
9
Q
How many objects and how much data can S3 store?
A
S3 can store an unlimited number of objects and an unlimited amount of data.
10
Q
SQS security
A
Public service Queue policy (resource policy)
11
Q
RTO
A
Recovery Time Objective: How long from the point of failure it will take to recover the system to an operational state
12
Q
What is RTMP?
A
Real-Time Messaging Protocol, owned by Adobe. CloudFront has an option to distribute this type of content.
13
Q
Snowball/Edge/Mobile
A
- Migrate data to or from S3 faster than you could with an internet connection (high-capacity, suitcase-sized storage).
- Consider when you have high data volume and a bad internet connection.
14
Q
Bootstrap
A
- Giving startup commands to an instance
- Configure OS
- Install apps
- Configure apps
- Steps occur after base AMI is installed
- Done via user data for EC2
15
Q
Route 53 latency
A
Resolves to record that provides the lowest latency and so ideally best performance
16
Q
What is the maximum retention period for RDS automatic backups?
A
35 days
17
Q
SQS
A
- Standard or FIFO queues
- 256 KB messages
- Short poll: Queue messages or nothing
- Long poll: Wait for messages (fewer API calls)
18
Q
Bucket — object versioning
A
- Can be enabled and paused, not disabled
- Every object gets a version ID
- Deleted objects just have a delete marker added
- Required for CRR
19
Q
Improving RTO
A
- Automated recovery
- Automated healing
- Efficient restore processes
20
Q
VPC Flow Logs
A
Monitors IP traffic metadata -> S3 or CloudWatch Logs
21
Q
EMR
A
- Elastic MapReduce
- Analysis of “big data” (unstructured and semi-structured)
- Cluster (master, core, task)
- HDFS cluster file system
- EMRFS: S3-based cluster file system
22
Q
What are the types of CloudWatch Events sources?
A
- Pattern
- Scheduled
23
Q
Access keys
A
- Long-term credentials associated with an IAM user
- Give permissions the user has
- Don’t expire
24
Q
S3 CRR
A
- Cross-region replication
- Object replication from source bucket to destination bucket in a different region
- Not retroactive; one way only
- DR or read in different region for performance reasons
25
CloudTrail trail
- Lets you configure what to log
- What regions
- Global events
- Global trail
- Where -> S3 / CloudWatch Logs
26
Kinesis vs. SQS
- Kinesis for streaming (ingestion)
- Multiple consumers, rolling window, no removals
- SQS decoupling, work queue, one consumer per message
27
Direct Connect encryption
- No
| - Can be added, public VIF + IPSec VPN
28
What is the only way to restrict the root user?
When utilizing AWS Organizations, you can create a service control policy and attach it to the account OU restricting access.
29
Internet gateway HA
- It's HA by design
- You can't make two for one VPC
- You don't need to make two for one VPC
- One IGW covers all public subnets in the VPC
- Works with IPv4 and IPv6
30
What is ::/0?
- Represents all IPv6 addresses
| - Generally used for the IPv6 default route
31
Reserved Instances
- Regional: No capacity reservation, just discount
| - Zonal: Discount and capacity reservation
32
DynamoDB streams
- Ordered record of change to a DynamoDB table; four different view types
- KEYS_ONLY
- NEW_IMAGE
- OLD_IMAGE
- NEW_AND_OLD_IMAGE
33
Describe alias records.
An extension of CNAME. Can be used like an A record with the functionality of a CNAME and none of the limitations. Can refer to AWS local services, and AWS doesn't charge for queries of alias records against AWS resources.
34
What is the benefit of having multiple Availability Zones within a region?
Availability Zones provide isolated infrastructure and services that allow for building highly available, fault-tolerant solutions within the same region.
35
VPC Flow Logs monitoring points
- VPC
- Subnet
- ENI
36
CloudWatch Logs components
- Log group: Related data (/var/log/secure) settings, filters, retention
- Log stream: Data for a specific instance or thing
- Filled with log events (date and time; message)
37
S3 object storage
- Flat structure
- Can't be mounted as a file system (natively)
- Can be accessed at scale, high performance
- Media/large objects/secure
38
What can assume roles in IAM?
- IAM users
- AWS services
- External accounts
- Web identities
39
Types of IP in VPC
- IPv4 internal (inside VPC CIDR)
- IPv4 public (dynamic, it changes when EC2 is stopped and started)
- IPv4 Elastic IP: Static, created and associated with ENI (no change if allocated)
- IPv6: All addresses are public
40
Route 53 simple
- One record set
- www -> IP
- www -> another name
- domain -> MX
41
Instance families
- Compute Optimized
- Memory Optimized
- Storage Optimized
- General Purpose
- Accelerated Computing
42
Private subnet
- Allocate public IP set to false
| - No default route to IGW
43
Groups an IAM user can be a member of
10
44
What is the maximum time a Lambda function can run?
15 minutes
45
CloudFront
- Global content delivery network for static and dynamic content
- Accesses one or more origins (S3/custom)
- Caches on edge locations and regional caches
46
DynamoDB indexes
- Projection: What attributes are in the index
- ALL = same as table
- KEYS = just keys
- Selected: Whatever you want
47
DynamoDB table
- Per region
- Unique ARN
- PK and (optionally) SK
- Local secondary indexes
- Global secondary Indexes
- Streams
48
What does CloudWatch Logs do?
- Log ingestions and management
- Log search
- Metric filter
- App and OS logs via agent
49
Kinesis Data Firehose
- Persistently store data on S3
- Send to other services (Redshift)
- Modify in flight using SQL
50
VPC interface endpoint
- Used for everything except DDB and S3
- ENIs in VPC
- DNS names for services resolving to endpoints
- Private DNS overrides service default
- No route table changes
51
S3 permissions
- Identity policies on USERS (same account only)
- ACL on objects and bucket (old style)
- Bucket policy: Applies to anyone accessing bucket (cross-account/public access)
52
Network sizes
- /32 = 1 IP
- /31 = 2 total addresses: point-to-point links
- /30 = 4 total: 2 usable, 1 network, 1 broadcast
- /29 = 8 total: 6 usable, 1 network, 1 broadcast
- /28 = 16 total: 14 usable, 1 network, 1 broadcast
- /24 = 256 total
- /22 = 1024 total
53
EBS volume
- gp2: General purpose SSD
- io1: High IO SSD
- st1: Throughput magnetic/mechanical
- sc2: Cold storage, cheap, archival
- Network-attached BLOCK storage
- ONE INSTANCE AT A TIME
- BELONGS TO ONE AZ
54
ECS
- Elastic Container Service
- EC2 container service
- Or using Fargate (managed server) container service
- Docker containers
55
True or False: By default, S3 content is stored encrypted.
False
56
Service control policy
- A permissions boundary for a MEMBER account
- What services an account _can_ use
- What services an account _can't_ use
57
How many resources can a CloudFormation template have?
200. If additional resources are needed, you can nest and reference other stacks.
58
Number of access keys per IAM user
2
59
True or False: Edge locations check the regional cache first before hitting the origin to get an object.
True
60
What is cost-effectiveness/efficiency?
Choosing the right products/services that have the minimum upfront and ongoing costs
61
Event-driven
- An architecture where compute isn't running 24/7/365. Instead, it runs in response to an event.
- S3 upload -> Lambda
- SQS message on queue -> Lambda
- Change to AWS Account -> CloudWatch Events -> Lambda
62
How are Availability Zones identified?
With a single letter following the region's code
63
RPO
Recovery Point Objective: The time between a failure and the last successful backup. How much data you will lose.
64
Public subnet
- Allocate public IP set to on
- Route table with default route at IGW
- VPC needs an attached IGW
65
Which AWS product uses stacks, layers, and recipes?
OpsWorks
66
SQS message lifecycle
- Poll
- Process
- Delete
OR
- Poll
- Process
- Message reappear (visibility timeout)
67
SQS FIFO queue
- Default 3,000 messages per second; 300 non-batching
- Guaranteed once only
- Guaranteed order
68
When to use SAML2.0 federation
- Corporate identity store (MS/ADFS)
- Need to get access to AWS resources using those identities
- SAML assertion swapped by STS for temp credentials via `AssumeRoleWithSAML`
69
Static website
- Bucket accessible with HTTP/S
- Requires world-readable permissions
- Can set index/error.html
- Useful to offload static content away from expensive compute servers
70
What is a volume gateway?
- Presents via iSCSI; block storage (network hard drive like EBS)
- Volume stored: Data is on gateway; snapshots to S3
- Volume cached: Data is on S3; local cache on virtual appliance
- Data is stored in volumes; not accessible directly via S3
71
Max size encryption/decryption using a CMK
4 KB
72
Improving RPO
- More regular backups
| - Constant backups
73
What are VPC endpoints?
Gateway objects created within a VPC. They can be used to connect to AWS public services without the need for the VPC to have an attached internet gateway and be public.
74
What are the two types of application state?
- Stateful (stored on the server)
| - Stateless (stored outside of the server)
75
Describe a DNS TXT record.
Used for descriptive text in a domain. Often used to verify domain ownership.
76
Which AWS service is a PaaS environment designed for developers to host their code?
Elastic Beanstalk
77
What are the advantages of asymmetric keys?
- Doesn't require sharing a common secret; the key holder holds the private key that needs to be kept secret and safe while anyone can have and use the public key to encrypt text that is only intended for the key holder or decrypt text that is created by the key holder
- Therefore, not easy to impersonate the key holder (unless private key is itself compromised)
78
Sticky sessions
Send incoming connections to the same instance for the duration of the session (LB generates a cookie).
79
IaaS
- Infrastructure as a Service (e.g., EC2)
| - You purchase a VM or an operating system.
80
Elasticity
- Automation of the provisioning and un-provisioning of resources
- Horizontal scaling
81
DB types/engines
- Key-value = DDB
- Wide column key-value = DDB
- Document DB = DocumentDB
- Columnar DB = Redshift
- Relational = Aurora/RDS
- Ad-hoc = Athena
82
AssumeRole
- _Not_ login
- You become the role temporarily
- STS gives you short-term credentials
83
Step Functions
- Handle long-running tasks involving AWS services and humans
- Can coordinate Lambda
- Decisions/parallel flows
- Serverless via "state machines"
- Like Simple Workflow service (without servers)
- Use it if you need serverless flows longer than 15 minutes
84
Direct Connect
- Physical 1 or 10 Gbps connection
- Requires BGP
- Public VIF (public services) and private VIF (VPC) run on top
- NOT ENCRYPTED
85
Instance types
- T3
- T2
- M5
- C3, etc.
- Governs the capabilities (CPU type, mem type, GPU, burst, etc.)
86
Route 53 geolocation
- Allows resolution to occur to a local area-based record
- Country
- Continent
- Global default
87
Give five examples of when to use an IAM role.
1. Company merger
2. Grant access to an AWS service
3. Cross-account access
4. Web identity federation
5. Break-glass–style extra access
88
AMI
- Amazon Machine Image
- Config container + EBS snapshot(s)
- Base system install
- Custom AMI with prebakes config/applications
- Can be shared and copied between regions
89
EBS encryption
- EBS encryption uses an AWS/EBS KMS CMK
- EC2 host performs encryption and decryption on data _to_ and _from_ EBS (at-rest encryption)
- Any snapshots are encrypted
- OS is unaware
90
If you lose your secret access key, can you generate a new one?
No. You will need to create a new access key.
91
Default max managed policies per role and per user
10
92
CloudFront regional cache
Larger cache that can hold objects for longer. Can deliver to edge location rather than origin fetch.
93
Can you edit a launch template or launch configuration?
No
94
True or False: Read replicas can be Multi-AZ.
True
95
SSE-S3
- S3 handles keys _and_ encryption/decryption
- S3 admin can always decrypt objects
- AES-256
96
Route 53 failover
- Primary and secondary
- Primary passes health check = used
- Primary fails health check = secondary used
- Used for HA/maintenance
- S3 backup for website
97
Load balancer architecture
- Nodes in each subnet
- Nodes have public IP (internet facing) or private (internal)
- Each node gets one/number of nodes percentage of traffic
- Nodes distribute to back-end instances (or _just_ in AZ if cross-zone is disabled)
98
Instance metadata
- http://169.254.169.254/latest/meta-data/
- It's where role credentials are taken from
- It's where cloud-init gets the bootstrap comments from
- It's where an instance can find out its public IP/DNS
99
DynamoDB trigger
Lambda function being invoked when records are added to the stream
100
EBS snapshots
- Stored in S3
- Incremental: First = full; second = change from first
- If volume is encrypted, the SNAP is encrypted
- Can be copied between regions
- Can be used to create new volumes
101
Athena
- Serverless querying
- Ad-hoc querying
- Billed for data scanned
- Great for a wide range of data formats
- No modification to source data
102
PaaS
- Platform as a Service (e.g., Elastic Beanstalk)
| - You provide code/application; the vendor supplies the environment.
103
What are roles for?
- Services can assume to get permissions
- External identities can assume to get permissions
- IAM users can assume to get different permissions
- ALL ARE TEMP CREDENTIALS
104
Multipart upload
- Splits object into X parts; uploads in parallel
- Speed benefit, reliability benefits
- Recommended for 100 MB+
- Required for 5 GB+
- If a part fails, _just_ that part is retried
105
Trust policy
Defines what can assume a role
106
Bastion host/jump box
EC2 instance in a public subnet configured to accept connections (usually RDP or SSH). Once connected, can "jump" and access private resources.
107
What is a monolithic architecture?
An architecture in which all the application layers are coupled within the same application
108
Cluster placement group
- Locate EC2 instances close
- Full bandwidth between all instances in placement group
- AZ locked when first instance launched
- Ideally, launch all instances at once and same type. Otherwise, you may have capacity issues.
109
Do instance OS's have public IPs?
No. An EC2 instance's OS _never_ sees its IPv4 public IP. The internet gateway converts the private IPv4 to public IPv4 or elastic when traffic leaves.
110
- Principal:
- Authorization:
- Identity:
- Authentication:
- Principal: The account or system requesting access or authorization
- Authorization: Verifying the principal against the identity
- Identity: Objects that are authorized and require authentication to access resources
- Authentication: Checking if the identity is allowed or denied access to a resource
111
What is 0.0.0.0/0?
- Represents _all_ IPs
| - Usually used for the default IPv4 route
112
SSE-KMS
- S3 handles encryption and decryption
- KMS handles keys
- S3 admin can't by default access objects; needs KMS - CMK permissions too
113
Instance roles
- IAM role
- Instance profile
- STS temp credentials available from metadata
- http://169.254.169.254/latest/meta-data/
114
AWS organization
- MASTER ACCOUNT
- MEMBER ACCOUNTS
- Consolidated billing
- Account restrictions
115
CloudWatch components
- Data points: CPU usage at this time
- Metrics: Data points (CPU) over time
- Alarm: If metric = this, more than this, less than this -> ALARM
- Alarm state = OK, ALARM, INSUFFICIENT DATA
- Alarm can notify (SNS) take action ASG/EC2
116
SNS
- Publisher/subscriber
- Messages 256 K -> Topics
- Topics send _all_ to subscribers
- Can have filters for subscribers
- Subscribers can be email, Lambda, queues, mobile push, HTTPS
117
Which AWS product uses applications, environments, and application versions?
Elastic Beanstalk
118
Vertical scaling
- SCALE-UP
- SCALE-DOWN
- Increasing or decreasing the size of a compute resource
119
CloudTrail
- Captures account events (APIs/logins)
- Management events
- Optionally data events (S3 and Lambda)
120
What is an IAM policy?
It is a JSON document that defines whether requests are allowed or denied. On its own, it does nothing. Needs to be associated.
121
S3 Intelligent-Tiering
- Moves between Standard and IA
- No movement fee
- No retrieval fee
- Just an object-based admin fee
- Use for uncertain access patterns
122
Egress-only internet gateway
- Used for IPv6 to allow outgoing _only_
- IPv6 are all public IPs
- An internet gateway allows incoming and outgoing for IPv6
- Otherwise the same
123
Max IAM users in one AWS account
5,000
124
Asymmetric encryption
A public key can be used to encrypt data that only a corresponding private key can decrypt.
A private key can _sign_ data that can be confirmed as valid using a public key.
125
What is a tape gateway?
- Virtual Tape Library
- Presents via iSCSI
- Virtual Tape Drive / Library -> S3
- Virtual Tape Shelf -> Glacier
- Migrate backups to AWS or reduce backup overhead.
126
S3 One Zone-IA
- Replicated in only one AZ, not three
- Cheaper, better value
- Less important data or reproducible
127
S3 Transfer Acceleration
- Uploads from a local endpoint through to the bucket
- Uses AWS global network
- Speed improvements
128
Redshift
- Column based
- _Not_ for transactions
- For reporting
- Petabyte
- Can be copied and have snapshots taken
129
NAT
- Network address translation
- Allowing multiple private IPs to access the internet in an outgoing way via one public IP
- It's what your home internet router does
130
DynamoDB local secondary index
- Created with table
- Share RCU and WCU with table
- Alternative SK; must already have an SK on table
131
Name the three types of placement groups.
1. Cluster
2. Partition
3. Spread
132
7-layer OSI model
1. Physical
2. Data Link
3. Network
4. Transport
5. Session
6. Presentation
7. Application
133
DBaaS
- Database as a Service (e.g., DynamoDB/RDS — RDS is between DBaaS and IaaS)
- You purchase a "database" or "table."
134
Long-term credentials
- Username and password
| - Access keys
135
What are groups for?
Container/organizing users
136
Pre-signed URL
- Generates a URL for an object with security included
- Can be used for reads and writes
- The URL has the permissions of the person generating it
- Can generate URLs for objects you can't access
137
What type of structure is S3?
S3 is a flat file structure. It cannot contain folders. When you create a "folder" within S3, it is actually not a folder — it is an object.
138
Partition
- Provide the performance of DDB
- 1,000 WCU
- 3,000 RCU
- 10 GB data
139
When to use scheduled ASG scaling
- When you have a known event
- Busy periods of the month/week
- Busy times of the day
- Non-busy times
- Can pre-launch so things are ready before
140
Are VPC flow logs updated in real time?
No
141
IAM resilience
IAM is a global service.
142
What storage can be mounted in EC2?
- EBS: One EC2 instance
- EFS: Many Linux instances
- Storage Gateway: Edge case, iSCSI
- _Not_ S3
143
OAI
- Origin access identity
- Virtual identity that can be associated with a CloudFront distribution and then used to restrict a bucket to that distribution
144
DynamoDB ITEM
- One partition key (PK)
- And optionally one sort key (SK)
- Up to 400 KB of data per ITEM
- Attribute length + attribute names + keys
145
What are the three types of DNS health checks?
1. Endpoint
2. Status of other health checks
3. State of CloudWatch alarms
146
Fanout
- PUBLISHER -> SNS -> QUEUE1/2/3 ... SUBSCRIBERS
- Message duplication
- Parallel processing
- Different bit rates
147
DMS
- Database Migration Service
- Replication instance
- Source -> target
- Allows gradual migration; no admin overhead
- Schema Conversion Tool (SCT)
148
What ways can a user get IAM policies?
- Inline: User or groups they are a member of
| - Managed: Associated with user or groups they are a member of
149
Which AWS service is based on Chef?
OpsWorks
150
Console login
Normally username, password, and optionally MFA
151
Enhanced networking
- SR-IOV
- Lower CPU usage for higher speeds
- Higher speeds
- Lower, more consistent latency
- Less jitter (latency variance)
152
Lifecycle policies
- Move objects between tiers
- Remove objects after a period
- Works with versioning
153
What is elasticity?
The ability of a system to dynamically scale up or down to manage the increase or decrease in demand
154
EC2 resilience
EC2 occupies one subnet, one AZ, uses EBS, one AZ. If the AZ fails, the instance fails.
155
S3 Standard
- The default storage tier
| - High availability, high durability
156
DynamoDB global secondary index
- Created at any time
- Own RCU and WCU
- Alternative PK and SK
- Data is replicated from table; always eventually consistent
157
VPC IPs
- VPC has a CIDR
- Subnets have a range
- In every subnet
- Normally .0 (or whatever the network IP is) is reserved
- Network+1 is the VPC router in each subnet
- Network+2 is the DNS in the subnet
- Network+3 is reserved
- Broadcast (subnet last IP) is reserved
158
When to use Snow*
- Snowball Edge: 10 TB -> 10 PB
| - Snowmobile: Single location, 10 PB+, max 100 PB
159
Role switching
Assuming a role in another AWS account via the console UI — you become the role in the other account and have its permissions via the console
160
When to use on-demand instances
- Short term
- Unknown usage
- Can't tolerate interruption
- Bridge the gap between reserved and spot
161
Docker
- Container
- Runs on top of a base OS and Docker host
- Lightweight
- Contains only the differences made from the base image, apps, dependencies, etc.
162
RDS and Aurora security
- Security group associated with the instance
| - NACL on the subnets
163
Firewall
- An appliance that can filter incoming or outgoing IP traffic
- Allowing it, blocking it
- NACLs and security groups are similar to firewalls
164
Kinesis
- Real-time streaming (IoT/sensor)
- Stores 24 hours of rolling data; can be seven days
- Shards allow scaling
- 1 shard = 1,000 records/s, 1 MB in, 2 MB out
165
Short-term/temporary credentials
- Generated by STS
- Time limited
- IAM role
166
VPC IPv6
- AWS-allocated IPv6 range
- Allocate subsets to subnets
- Configure instance/other service to use
- Needs IPv6 routes
- IGW or egress-only internet gateway
167
Lambda
- Function as a Service
- Runtime up to 15 minutes
- Pay only for time running
- Execution role (IAM role) provides permissions
- Can be invoked by CloudWatch Events, S3, SNS, and much more
- Can integrate with ALB/API Gateway
- Public or private (VPC)
168
API Gateway
- API hosting endpoints as a service
- HA/scalable
- Can invoke Lambda, and store directly into DDB
- Public service
- Avoids the need to self-host APIs
169
What is KMS?
- Key Management Service
- Manages CMKs (customer master keys)
- Encrypt and decrypt
170
Lambda execution role
The IAM role a Lambda function assumes when it invokes
171
NAT gateway
- NAT as a service
- Occupies a public subnet, uses an Elastic IP, needs an IGW
- _Not_ HA — you need one per AZ for true HA
- Private subnets need default route pointing at NATGW
172
Envelope encryption
- Using multiple keys to encrypt
- Data -> Key A -> Encrypted Data
- Encrypted Data -> Key B -> Encrypted Encrypted Data
173
ASG 1:1:1
- Quick way of doing HA
- Min 1, Max 1, Desired 1
- Failed instances are instantly rebuilt
- Good for smaller sites
174
IAM
- Identity and Access Management
- Trusted by the account
- IAM can create and trust identities
175
S3 limits
- 100 buckets per account
- No limit on number of objects
- Objects = 0 bytes to 5 TB per object
- GLOBALLY UNIQUE BUCKET NAME
176
What is an ARN?
- Unique identifier for any AWS thing
| - arn:::::
177
What does a launch template/configuration do?
- Contains the WHAT
- What you want to launch (AMI, keys, size, config)
- Used by ASGs
178
Glacier
- Data archiving
- Not immediate access; retrieval time takes
minutes to hours
179
VPC VPN
- Highly available IPSec VPN
- VGW (one per VPC) -> Customer Gateway (CGW) via one VPN connection (two tunnels)
- HA = two CGWs and two VPNs
180
What is the EC2 instance metadata URL?
http://169.254.169.254/latest/meta-data/
181
Bucket default encryption
- Default to apply if object PUT doesn't specify anything
| - Can be overridden
182
ENI
- Elastic network interface
- VPC network interface
- SGs are attached to ENIs, not instances
- Instance has a default ENI
- Can have others — each with its own set of SGs
- ENIs have private IPs
183
If groups are not real identities, then why is it possible to attach policies to them?
Attaching policies to groups is, in effect, attaching the policy to the users who are members of the group.
184
Aurora and RDS backups
- Up to 35 days automatic backup
- Manual snapshots (last until deleted)
- Point in time
185
Benefits of SQS queue
- Decoupling
| - Scaling working group (using ASG + CW + SQS)
186
Elastic Transcoder
- Serverless transcoding of media
- SRC -> DESTINATION
- Can be manual; can be automatic using S3 events + Lambda
187
Horizontal scaling
- SCALE-OUT
- SCALE-IN
- Adding or removing compute resources
188
Network ACL
- Stateless: All traffic consists of initiating and return
- Accessing EC2 on port 80 incoming = return traffic on a high random port outgoing
- NACL needs two rules (in and out) for everything
- NACL can explicitly DENY
- NACLs apply to subnets; only affect traffic crossing subnet
- _Cannot_ reference logical objects
- _Cannot_ apply to instances
189
Lambda vs. Step Functions vs. EC2
- EC2 if heavy CPU and constant need
- Lambda for event-based, less than 15 minutes, serverless
- Step Functions for longer multi-Lambda flows
190
Max IAM users in a group
Equal to max IAM users in an account
191
Standard-IA
- Designed for less frequently accessed data — same levels of durability and availability. Retrieval fee.
- Important data but not commonly accessed
192
Route 53
- Global DNS service
- Public and private (inside one or more VPCs)
- Globally resilient
193
EFS
- Network file system (Elastic File System)
- Uses S3 — Standard and IA
- Accessible from Linux EC2 or Linux on-prem
- Can be mounted as a file system; good for shared storage
- _Not_ public
194
- Can a CMK leave the region?
| - Can a CMK leave KMS?
- No
| - No
195
Encryption at rest
Data is encrypted before being written to disk and decrypted when read from disk.
196
When to use web identity federation
- When you have a "web scale"/"mobile app"
- More than 5,000 users or don't want to make IAM users
- Or users have their own IDs (Twitter/FB/Amazon/Google)
- Swap ID token for temp credentials via STS `AssumeRoleWithWebIdentity`
197
Is EBS a shared file system?
No
198
EBS resilience
- EBS volume = one AZ
- AZ fails, EBS volume fails
- EBS volume attached to instances in the same AZ only
- Snapshots to S3
199
What credentials can a group have?
None
200
When to use ID federation in general
- Too many users for 5,000 IAM limit
| - Same reason you _want_ to use external identities (admin overhead, efficiency, minimize duplication)
201
Proxy server
- Accepts a connection (e.g., HTTP)
- Makes a connection on your behalf and passes the response to you
- Corporate web caches are a proxy server
- Can filter based on DNS name
202
Identity federation
- Trusting another IdP to verify someone is who they say they are. Using that trusted identity to allow access to your systems via an ID swap.
- SAML 2.0
- Web identity
203
What is the maximum configurable IOPs on a volume and instance?
64,000 for a volume and 80,000 for an instance
204
Route 53 weighted
- Record weight / total weight = chance of being used
- Allows gradual migration
- Allows distribution
- A/B testing
205
What is STS?
Security Token Service: It is responsible for creating short-term access keys that can be used by principals who have assumed a role to access the resources that the role has permissions for.
206
Instance role
IAM role + instance profile allows an instance to assume a role and STS temp credentials to be available in the metadata
207
Subnets
- Subnet belongs to a VPC and an AZ
- Subnet has a range of IPs inside the range of the VPC
- Subnet ranges cannot overlap in the VPC or be outside of the VPC range
- Can have IPv4 or IPv6
208
What happens when an object is deleted from a versioned bucket?
The object versions are not actually deleted; S3 adds a marker to indicate the object was deleted.
209
What is the benefit of having multiple Availability Zones within a region?
Availability Zones provide isolated infrastructure and services that allow for building highly available, fault-tolerant solutions within the same region.
210
CloudWatch metrics that need agent
- Memory utilization
- Process memory utilization
- Process CPU utilization
211
Direct Connect HA
No... 1 physical connection
| HA = 2 Direct Connects or 1 Direct Connect and 1+ VPN
212
Consolidated billing
MASTER ACCOUNT gets billing for all member accounts. Volume discounts and reservations are pooled.
213
EC2 startup priority
- Reserved (with capacity reservation)
- On-demand
- Spot
214
What is an EC2 instance?
- Virtual machine running on an EC2 host
- Allocation of vCPU and vMem
- Attached network (ENI)
- Attached storage (EBS)
215
VPC peering
- Links _two_ VPCs with a private, software-based, HA connection
- Is _not_ transitive routing
- VPC 1VPC 2VPC 3 does _not_ mean 1 and 3 can connect.
- Routes need adding (peer is a gateway object)
- Can secure using SG and NACL
216
True or False: Restoring an RDS snapshot requires re-configuration of security groups.
True
217
Internet gateway (IGW)
- 1:1 relationship between IGW and VPC
- IGW is normally the default route for IPv4 and IPv6
- Converts between private IP and public IP
- Allows public instances to access the internet
218
Fault tolerant/fault tolerance
A system designed to work through failure without any user impact. ASG + LB and external session state.
219
Virtual private cloud (VPC)
- A private network
| - Isolated from other VPCs in your account in your region. Highly available, assuming you make subnets in multiple AZs.
220
Standard SQS queue
- At least once delivery
- Best effort ordering
- Scale to nearly infinite levels
221
Symmetric encryption
- The same key is used to encrypt and decrypt.
| - Fast, but you need to worry about how to get the key to the other party.
222
Encryption in transit
Data is encrypted before being sent to a server or sent from a server
223
Serverless
- Architecture where you manage little to no constantly running compute
- Function as a service (FaaS), event-driven and third-party services are used to build a service
224
What does CloudWatch Events do?
- Takes an event source
- Delivers to a target
- Event-driven actions
225
CLB -> ALB
- Almost always cheaper
- Multiple SSL per ALB
- Content rules (DNS name/path)
- More services as targets (Lambda, containers, etc.)
226
ASG
- Auto Scaling groups
- Support elasticity
- Use the _what_ from templates/configs
- Control the where/_how_
- Min/Max/Desired/Subnets
- Scaling policies: Simple/stepped/target tracking/scheduled
227
Aurora
- Enhancement of RDS MySQL/PostgreSQL
- Cluster shared storage (no need to allocate upfront)
- Replica (writer/reader) in as many AZs as you need
- Reader = scaled reads
- Much faster, all SSD vs. RDS
228
Types of CMK
- Customer Managed Key: Rotation and key policy
- AWS Managed Key: Service default
- AWS Owned Key: Not visible, cross-client functions
229
FaaS
- Function as a Service (e.g., Lambda)
| - You provide a function; the vendor provides a runtime environment and everything else. Huge scalability, low cost.
230
Security group
- Stateful (one rule, allows return traffic)
- Applied to ENIs (and thus instances)
- Can't explicitly DENY, only ALLOW
- Default is to DENY
- Can reference other SG, other objects, themselves, and IP/CIDR
231
RDS
- MySQL/PostgreSQL/MariaDB/Oracle/MSSQL
- HA: Single-AZ or Multi-AZ — standby _not_ usable
- Read replicas can scale reads
- Not cluster-based; each instance has own storage
232
1 RCU
- 1 operation of 4 KB max p/s strongly consistent
| - 2 x eventual consistent
233
What are the contents of an IAM trust policy?
- Principal: The entity (or type of entities) that can assume the role
- Effect: Allow or Deny
- Action: STS:AssumeRole
234
When to use reserved instances
- Known usage patterns
- Constant CPU
- Unchanging
- One to three years
- Cost-conscious
- Want to reserve capacity
235
Permission priority
1. Explicit Deny
2. Explicit Allow
3. Implicit Deny (Default)
236
VPN vs. Direct Connect
- VPN: Quick to set up, cheap, can be moved, supports cheaper non-BGP consumer hardware, uses internet data
- Direct Connect: Longer to set up, lower latency, better consistency of latency, better performance
237
IAM users
- Identity
- Can have policies
- Can be in groups
- Can be referenced via ARN
- U & P, access keys
- Can have MFA
- NO TEMP CREDENTIALS
238
S3 SSE-C
- S3 handles encryption and decryption
| - Customer supplies keys and plaintext data
239
SaaS
- Software as a Service (e.g., Netflix, O365, Spotify)
| - An application, end to end, is provided.
240
Dedicated hosts
- EC2 hosts that are dedicated to you
- Useful for restrictive licensing
- Or security concerns/restrictions
241
EBS optimized
- Dedicated network path for storage
- Independent of data networking
- High speeds, less contention
242
High availability vs. fault tolerance
- HA: Allows systems to recover quickly after failures
| - FT: Allows systems to operate through a failure with no user impact
243
High availability
- A system that can automatically and quickly recover from failure; designed to maximize availability.
- ASG + LB
244
Aurora Serverless
- Serverless relational DB
- Uses Aurora Capacity Units (ACUs)
- Can scale all the way to zero, and spin up when data access needed (10–20 seconds)
- Very good option for variable load relational DB
245
VPN HA
- At the AWS side, assuming two tunnels. Not at the customer side (one CGW).
- Two VPN connections and two CGWs required for HA
246
Bootstrap vs. AMI bake
- Bootstrap: More customizable
- AMI bake: Faster and immutable
- If software takes 20 mins, and you need new instances up quicker, then AMI bake.
- Can do a mixture
247
Does VPC Flow Logs capture traffic contents?
No
248
When to use spot instances
- When you want the cheapest EC2 compute
- When you can tolerate failure/restarts/interruptions
- Great for ad-hoc scaling, worker pools, analysis with EMR
249
1 WCU
= 1 operation of 1 KB max per second
250
API and CLI login
- Access keys
| - _Not_ username and password
251
Routes and route tables
- A route says, "for traffic to this destination, send it here"
- A route table is a group of routes
- Traffic matches a route
- For multiple matches, the higher the prefix (/XX), the more priority the match
- If equal prefix, static routes are preferred, then dynamically learned
- Direct Connect is preferred over dynamic VPN
252
What is DAX?
- In-memory cache for DynamoDB reads
- Microsecond response
- Specifically designed for DDB
253
What are the well-architected pillars?
- Operational excellence
- Security
- Reliability
- Performance efficiency
- Cost optimization
254
DynamoDB table performance
- On-Demand: Per operation charge
| - Provisioned: Charge per WCU and RCU
255
Instance sizes
- Governs memory, CPU, and general speed
- nano
- micro
- small
- medium
- So on...
256
CloudTrail event history
- Default configuration
| - 90-day history
257
Billing models
- On-Demand: Default, per second
- Spot: Using AWS spare capacity, can be interrupted, ~80% discounts
- Reserved: Pay upfront for discounted rate, good for known usage
258
What is Storage Gateway?
- Allows storage migration
- Allows storage extension
- Uses S3 as backing store
- Public service: Public internet connection or DX public VIF
- Tape gateway (VTL), file gateway, volume gateway
259
What are IAM users for?
Identities: Human, application, service
260
VPC gateway endpoint
- Used for S3 and DynamoDB
- Access to public endpoints for those services without IGW or NATGW
- Uses prefix lists with the target of the endpoint
- No DNS used
261
CloudWatch
- Monitoring and metrics for AWS services
| - Custom things with agent, including on-premises
262
What is a file gateway?
- Storage Gateway
- Shares via SMB (Windows sharing)
- Files are stored as S3 objects
- Capacity extension or back up to S3
263
Glacier Deep Archive
- Cold archive
| - Hours retrieval time
264
VPC endpoints
- Provide secure access to public services in a VPC
without needing IGW or NATGW
- Used to highly secure private VPCs
265
NAT instance
- EC2 instance configured to perform NAT
| - SRC/DST Check = off
266
What is ElastiCache?
- In-memory cache; key-value and simple data types
- MemcacheD (simple, fast)
- Redis (more fully featured, complex)
267
Why are launch templates better than launch configurations?
- New features (e.g., T3 unlimited, elastic GPU)
- Versions
- Inheritance
- Can be used to manually launch instances
