Udemy Course Flashcards
What is the Recycle Bin?
A recycle bin for EBS Snapshots and AMIs
ALBs can route traffic to different Target Groups based on which 4 things?
- URL Path
- Hostname
- HTTP Headers
- Query Strings
True or False; You can attach an Elastic IP address to Application Load Balancers?
False
What cookie names are reserved by the ELB (3)?
- AWSALB
- AWSALBAPP
- AWSALBTG
What is Server Name Indication (SNI)?
Server Name Indication (SNI) allows you to expose multiple HTTPS applications each with its own SSL certificate on the same listener.
What is the maximum number of Read Replicas you can add in an ElastiCache Redis Cluster with Cluster-Mode Disabled?
5
EBS Volumes are network drives or physical drives?
Network drives
True or False; EBS volumes are locked to an Availability Zone?
True
True or False; EBS volumes have a provisioned capactiy?
True
True or False; you can attach multiple EBS volumes to an EC2 instance?
True
What happens by default to EBS volumes attached to an EC2 instance, when the EC2 instance is terminated?
By default:
- the root EBS volume is deleted
- any other attached EBS volume is not deleted
True or False; EBS snapshots can be copied across AZs and Regions?
True
How much cheaper are EBS snapshots stored in the ‘archive tier’?
75%
How long do EBS snapshots in the archive tier take to be restored?
24 - 72 hours
Is it possible to retain deleted EBS snapshots?
Yes, in the recycle bin
How do you quickly restore an EBS snapshot?
Use Fast Snapshot Restore (FSR)
True or False; AMI can be used in any region?
False; they are region specific, but can be copied across regions
What type of disk to use with an EC2 instance if you require high-performance?
EC2 Instance Store
What are io1 / io2 (Provisioned IOPS) EBS Volumes best used for?
Highest performance SSD volume for mission-critical low-latency or high-throughput workloads
What is st1 (Throughput optimised) EBS Volumes used for?
Low cost HDD volume designed for frequently accessed, throughput-intensive workload
What is sc1 (Cold HDD) EBS Volumes used for?
Lowest cost HDD volume designed for less frequently accessed workloads
What EBS volumes can be used as boot volumes?
gp2/gp3 and io1/io2 only
Volume size of EBS volume gp2/gp3?
1GB - 16TB
gp3 baseline IOPS and throughput?
3000 IOPS and 125MB throughput
gp3 max IOPS and throughput?
16,000 IOPS and 1,000 MB throughput
True or False; gp3 IOPS and throughput can be scaled independently?
True
gp2 max IOPS?
16,000
True or False; gp2 size of volume and IOPS are linked?
True
gp2 how many IOPS do you get per GB of volume?
3
io1/io2 volume size?
4GB - 16TB
io1/io2 max PIOPS?
64,000 for Nitro EC2 instances and 32,000 for other
True or False; io1/io2 PIOPS and storage size are linked?
False
io2 Block Express (EBS volume) volume size?
4GB - 64TB
Which EBS volume types support Multi-Attach?
io1/io2 family
io2 Block Express (EBS volume) latency?
sub-millisecond latency
io2 Block Express (EBS volume) max PIOPS and IOPS ratio?
Max PIOPS = 256,000 with an IOPS:GB ratio of 1,000:1
st1 use cases?
- Big data warehouses
- Log processing
st1 volume size
500GB - 15TB
sc1 volume size?
500GB - 15TB
sc1 use cases?
- Data that is infrequently accessed
- scenarios where lowest cost is important
st1 max IOPS and throughput?
500 IOPS and 500 MB throughput
sc1 max IOPS and throughput?
250 IOPS and 250 MB throughput
What is EBS multi-attach?
- Attach the same EBS volume to multiple EC2 instances in the same AZ
- Each instance has full read & write permissions to the high-performance volume
How many EC2 instances can you attach to an EBS multi-attach volume at a time?
Up to 16 instances
What file system must you use for EBS multi-attach?
A file system that’s cluster-aware (not XFS, EX4, etc)
What is EFS (Elastic File System)?
A managed NFS (network file system) that can be mounted on many EC2 instances
4 EFS use cases?
- content management
- web serving
- data sharing
- wordpress
What protocol does EFS use?
NFSv4.1
How is EFS access controlled?
Through security groups
What AMIs is EFS compatible with?
Linux based AMIs, not windows based AMIs
True or False; EFS requires capacity planning?
False; it scales automatically and is pay-per-use
What can EFS scale to?
- 1,000s of concurrent NFS clients with 10 GB / s throughput
- Petabytes-scale
What 2 modes does EFS have?
- Performance mode (set at EFS creation time)
- Throughput mode
What are the two EFS performance modes?
- General purpose (default): latency-sensitive use cases
- Max I/O: higher latency, throughput, highly parallel
What are the two EFS throughput modes?
- Bursting (1TB = 50MB + burst of up to 100 MBs)
- Provisioned: set your throughput regardless of storage size
What are the two EFS storage tiers?
- Standard: for frequently accessed files
- Infrequent Access: cost to retrieve files, lower price to storage
What are the 2 availability options for EFS?
- Standard: which is Multi-AZ
- One Zone: Single AZ
What are load balancers?
Load Balancers are servers that forward traffic to multiple servers (e.g., EC2 instances) downstream
What are Elastic Load Balancer health checks run against?
On a port and a route
What is an unhealthy response to an Elastic Load Balancers health check?
Any response that is not 200 (OK)
What are the 4 kinds of AWS managed Load Balancers?
- Classic Load Balancer (depreciated) (CLB)
- Application Load Balancer (ALB)
- Network Load Balancer (NLB)
- Gateway Load Balancer (GWLB)
3 protocols used by ALB?
- HTTP
- HTTPs
- Websockets
3 protocols used by NLB?
- TCP
- TLS
- UDP
What layer does the GWLB operate at?
Layer 3 (Network Layer)
3 different routing rules that ALB can use to route traffic to different target groups?
- Routing based on path in URL (example.com/users & example.com/posts)
- Routing based on hostname in URL (one.example.com & other.example.com)
- Routing based on Query String, Headers (example.com/users?id=123&order=false)
True or False; ALB has a port mapping feature to redirect to a dynamic port in ECS
True
4 types of ALB target groups?
- EC2 instances
- ECS tasks
- Lambda functions
- IP addresses (must be private IP addresses)
True or False; ALBs can route to multiple target groups?
True
At what level are ALB health checks performed?
At the target group level
How many requests per second can NLBs handle?
millions
What is the latency of NLB?
~ 100 ms
Does NLB have any static IPs?
Yes, 1 per AZ
Which type of ELB supports assigning Elastic IP?
NLB
3 types of NLB target groups?
- EC2 instances
- IP addresses (must be private IP addresses)
- Application Load Balancer
What is the the Gateway Load Balancer used for?
Analyse network traffic. It allows you to deploy, scale and manage a fleet of 3rd party network virtual appliances in AWS
What layer does the GWLB operate at?
Layer 3 - Network Layer (IP Packets)
What 2 functions does the GWLB combine?
- Transparent Network Gateway (single entry/exit for all traffic)
- Load Balancer (distributes traffic to your virtual appliances)
What protocol and port does GWLB use?
GENEVE protocol on port 6081
What are the GWLB target groups?
- EC2 instances
- IP addresses (must be private IPs)
Which load balancer allows Sticky Sessions?
ALB
How does the ELB enable Sticky Sessions?
By using cookies, which have an expiration date you control
What is the use case for sticky sessions?
Making sure that the user doesn’t lose his session data
What is a potential issue of enabling stickiness on an ELB?
It may bring imbalance to the load over the backend EC2 instances
What sticky session cookie names can’t be used (reserved for use by ELB)?
- AWSALB
- AWSALBAPP
- AWSALBTG
- AWSELB
What does Cross Zone Load Balancing do on an Elastic Load Balancer?
It distributes the balance evenly across all registered instances in all AZs
For Cross-Zone Load Balancing on Elastic Load Balancers, which load balancers have it enabled by default, and which charge for inter AZ data?
ALB:
- Enabled by default
- No charges for inter AZ data
NLB & GWLB:
- Disabled by default
- Charges for inter AZ data if enabled
What does an SSL certificate do?
It allows traffic between your client and your load balancer to be encrypted in transit (in-flight encryption)
What do SSL and TLS stand for?
Secure Sockets Layer and Transport Layer Security
Who issues public SSL certificates?
Certificate Authorities (CA)
What type of SSL certificate does a load balancer use?
X.509 certificate
What does Server Name Indication (SNI) do for Load Balancers?
It solves the problem of loading multiple SSL certificates onto one web server (to serve multiple websites)
How does SNI (Server Name Indication) work?
- It requires the client to indicate the hostname of the target server in the initial SSL handshake.
- The server will then find the correct certificate, or return the default one
What is Deregistration Delay?
The time to complete “in-flight requests” while the instance is de-registering or unhealthy
True or False; ELBs can check the health of your EC2 instances?
True
3 Auto Scaling Group Attributes
- Launch Template
- Min Size / Max Size / Initial Capacity
- Scaling Policies
8 attributes of an ASG Launch Template
- AMI + Instance Type
- EC2 User Data
- EBS Volumes
- Security Groups
- SSH Key Pair
- IAM Roles for your EC2 Instances
- Network + Subnets Information
- Load Balancer Information
True or False; it is possible to scale an ASG based on CloudWatch alarms?
True, an alarm monitors a metric (such as Average CPU, or a custom metric)
4 good metrics to scale an ASG on?
- CPUUtilisation - Average CPU utilisation across your instances
- RequestCountPerTarget - to make sure the number of requests per EC2 instance is stable
- Average Network In / Out - if your application is network bound)
- Any custom metric - that you push using CloudWatch
True or False; with RDS you can SSH into your instances?
False, it is a managed service
What is RDS - Storage Auto Scaling?
- Help you instance storage on your RDS DB instance dynamically
- When RDS detects you are running out of free storage, it scales automatically
- Avoids manually scaling your database storage
- You have to set the Maximum Storage Threshold (max limit for DB storage)
What are RDS read replica’s purpose?
Read Scalability
True or False; RDS read replicas are within the same AZ?
False; can be within the same AZ, Cross AZ or Cross Region
RDS read replicas use synchronous replication?
False, they use Asynchronous replication, so reads are eventually consistent
True or False; RDS read replicas can be promoted to their own DB?
True
True or False; for RDS DBs, applications must update the connection string to leverage read replicas?
True
For RDS Read Replicas, is there a network costs when data is replicated to the read replicas?
- Same region replication is free
- Cross region replication is NOT free
What is the reason to use RDS Multi-AZ?
Disaster Recovery
What type of replication does RDS Multi-AZ use?
Synchronous replication
True or False; RDS Multi-AZ uses multiple DNS names?
False; it uses one DNS name, with automatic app failover to standby
True or False; you can change an RDS database from single to multi-AZ with zero downtime?
True; it does this through via taking a snapshot and synchronisation
How does Aurora storage grow?
Automatically, in increments of 10GB
Aurora maximum storage size?
128 TB
How many read replicas can Aurora have?
15
How fast is failover in Aurora?
Instantaneous
How does Aurora achieve high availability?
- 6 copies of your data across 3 AZs
– 4 copies out of 6 needed for writes
– 3 copies out of 6 needed for reads
– Self healing with peer-to-peer replication
True or False; Aurora uses a shared storage volume?
True
True or False; Aurora reader endpoint performs connection load balancing?
True
What does the ‘Backtrack’ feature of Aurora do?
Restores data at any point of time without using backups
How are RDS DBs encrypted at-rest?
- Database master & replicas encryption using AWS KMS - must be defined at launch time
- If the master is not encrypted, the read replicas cannot be encrypted
- To encrypt an un-encrypted database, go through a DB snapshot and restore as encrypted
How are RDS DBs encrypted in-flight?
RDS DBs are TLS-ready by default, use the AWS TLS root certificates client-side
What are caches?
- Caches are in-memory databases with really high performance, low latency
- Helps reduce the load of database for read intensive workloads
- Help make your application stateless
True or False; using ElastiCache doesn’t require an application code changes?
False; ElastiCache involves heavy application code changes
ElastiCache - REDIS or MEMCACHED.
Multi-AZ with Auto-Failover?
Redis
ElastiCache - REDIS or MEMCACHED.
Multi-node for partitioning of data (sharding)?
Memecached
ElastiCache - REDIS or MEMCACHED.
Read Replicas to scale reads and have high availability?
Redis
ElastiCache - REDIS or MEMCACHED.
No high availability?
Memcached
ElastiCache - REDIS or MEMCACHED.
Data Durability using AOF persistence?
Redis
ElastiCache - REDIS or MEMCACHED.
Non persistent?
Memcached
ElastiCache - REDIS or MEMCACHED.
No backup or restore?
Memcached
ElastiCache - REDIS or MEMCACHED.
Backup and restore features?
Redis
ElastiCache - REDIS or MEMCACHED.
Multi-threaded architecture?
Memcached
For ElastiCache, what is Lazy Loading / Cache-Asaide / Lazy Population?
Cache is checked first, if cache hit, data is returned. If cache miss, data is read from the database and written to cache
Pros and Cons of Lazy Loading / Cache-Aside / Lazy Population for ElastiCace?
Pros:
- Only requested data is cached (the cache isn’t filled up with unused data)
- Node failures are not fatal (just increased latency to warm the cache)
Cons:
- Cache miss penalty that results in 3 round trips, noticeable delay for that request
- Stale data: data can be updated in the database and outdated in the cache
For ElastiCache what is Write Through?
Add or Update the cache whenever the database is updated
Pros and Cons of Write Through for ElastiCache?
Pros:
- Data in cache is never stale
- Reads are quick
- Write penalty vs read penalty (each write requires 2 calls)
Cons:
- Missing Data until it is added / updated in the DB. Mitigation is to implement Lazy Loading strategy as well
- Cache churn - a lot of the data will never be read
3 ways cache evictions can occur?
- You delete the item explicitly in the cache
- Item is evicted because the memory is full and it’s not recently used (LRU)
- You set an item time-to-live (TTL)
What is ElastiCache replication: Cluster Mode Disabled?
- One shard, all nodes have all the data
- One primary node, up to 5 replicas
- Asynchronous replication
- Primary node is used for read/write
- Other nodes are read-only
- Multi-AZ enabled by default for failover
- Helpful to scale read performance
What is ElastiCache replication: Cluster Mode Enabled?
- Data is partitioned across shards
- Each shard has a primary and up to 5 replica nodes
- Multi-AZ capability
- Up to 500 nodes per cluster
- Helpful to scale writes
What is DNS?
Domain Name System, it translates the human friendly hostnames into the machine IP addresses
What is a Zone File?
Contains DNS records
What is a Name Server?
Resolves DNS queries
What is Route 53?
- A highly available, scalable, fully managed and Authoritative DNS
- Also a Domain Registrar
- Has the ability to check the health of your resources
What is the ‘A’ record type?
Maps a hostname to IPv4
What is the ‘AAAA’ record type?
Maps a hostname to IPv6
What is a CNAME record?
It maps a hostname to another hostname
What are the requirements for a CNAME record?
- The target is a domain which must have an A or AAAA record
- Can’t create a CNAME record for the top node of a DNS namespace (Zone Apex), eg, example.com
What are NS records?
Name Servers for the Hosted Zone - control how traffic is routed for a domain
What is a Hosted Zone?
A container for records that define how to route traffic to a domain and its subdomains
True or False; in Route 53, TTL is mandatory for each DNS record
True, except for Alias records
Route 53; what is the difference between a CNAME and Alias?
CNAME:
- Point a hostname to any other hostname (app.mydomain.com => blabla.anything.com)
- ONLY FOR NON ROOT DOMAIN (aka. something.mydomain.com)
Alias:
- Points a hostname to an AWS Resource (app.mydomain.com => blabla.amazonaws.com)
- WORKS for ROOT DOMAIN and NON ROOT DOMAIN (aka mydomain.com)
- Free of charge
- Native health check
What do Route 53 Alias Records do?
- Maps a hostname to an AWS resource
- Always of type A/AAAA for AWS resource
What is the default TTL for Route 53 Alias records?
Alias records have no TTL
8 Route 53 Alias Records targets?
- ELBs
- CloudFront Distributions
- API Gateway
- Elastic Beanstalk environments
- S3 Websites
- VPC Interface Endpoints
- Global Accelerator
- Route 53 record in the same hosted zone
True or False; you can set an ALIAS record for an EC2 DNS name?
False
What are Route 53 Routing Policies?
- Define how Route 53 responds to DNS queries
- DNS does not route traffic, it only responds to the DNS queries
7 Route 53 routing policies?
- Simple
- Weighted
- Failover
- Latency based
- Geolocation
- Geoproximity
- Multi-Value answer
What is Route 53 simple routing?
- Typically routes traffic to a single resource
- Can specify multiple values in the same record, in which case a random one is chosen by the client
True or False; Route 53 simple routing can be associated with health checks?
False
True or False; Route 53 weighted routing can be associated with health checks?
True
True or False; Route 53 latency-based routing can be associated with health checks?
True, has a failover capability
True or False; Route 53 HTTP health checks are for public and private resources?
False; for public resources only
True or False; Route 53 Health Checks enable automated DNS failover?
True
3 type of Route 53 Health checks?
- Health checks that monitor an endpoint
- Health checks that monitor other health checks
- Health checks that monitor CloudWatch Alarms
How do Route 53 Health checks work?
- About 15 global health checkers will checker the endpoint health
- Healthy / unhealthy threshold is 3 (default)
- If > 18% of health checkers report the endpoint is healthy, Route 53 considers it Healthy, otherwise, it’s unhealthy
2 ways in which Route 53 health checks can pass?
- Only when the endpoint responds with the 2xx and 3xx status codes
- Health Checks can be setup to pass / fail based on the text in the first 5,120 bytes of the response
What are Route 53 calculated health checks?
- Combine the results of multiple health checks (children) into a single Health Check (parent)
- You can use OR, AND, or NOT
- Can monitor up to 256 Child Health Checks
- Specify how many of the child health checks needed to pass to make the parent pass
True or False; Route 53 health checks can’t access private endpoints (private VPC or on-premises resources)?
True, Route 53 health checkers are outside the VPC.
You can create a CloudWatchMetric and associate a CloudWatch Alarm, then create a Health Check that checks the alarm itself
What is Route 53 Geolocation Routing Policy?
- Routing based on user location
- Specify location by continent, country or by US state
- Should create a “Default” record in case of no match
What is Route 53 Geolocation Routing Policy?
- Route traffic to your resources based on the geographic location of users resources
- You have the ability to shift more traffic to resource based on the defined bias
What must be used with Route 53 Geoproximity routing policy?
Route 53 Traffic Flow
What is Route 53 Traffic Flow?
- It simplifies the process of creating and maintaining records in large and complex configurations
- Configurations can be saved as Traffic Flow Policy
True or False; Traffic Flow supports versioning?
True
What is Route 53 Multi-Value Routing Policy?
- Use when routing traffic to multiple resources
- Route 53 returns multiple values/resources
- Can be associated with Health Checks
True or False; Route 53 Multi-Value Routing Policy can be used as a substitute for having an ELB?
False
How do you use a 3rd Party Domain Registrar with Route 53?
1, Create a Hosted Zone in Route 53
2, Update NS Records on 3rd party website to use Route 53 Name Servers
What is a VPC?
a private network to deploy your resources (regional resource)
What are subnets?
Allow you to partition your network inside your VPC (availability zone resource)
What is a public subnet?
a subnet that is accessible from the internet
What is a private subnet?
a subnet that is not accessible from the internet
How do you define access to the internet and between subnets?
Use route tables
What do NAT Gateways / NAT instances do?
Allow your instances in your Private Subnets to access the internet while remaining private
What are NACLs?
- A firewall which controls traffic from and to subnets
- Can have ALLOW and DENY rules
- Are attached at subnet level
- Rule only include IP addresses
What are Security Groups?
- A firewall that controls traffic to and from an ENI / an EC2 Instance
- Can have only ONLY rules
- Rules include IP addresses and other security groups
NACL are stateless or stateful?
Stateless
Security Groups are stateless or stateful
Stateful
For Security Groups, how are rules evaluated for allowing / denying traffic?
All rules are evaluated before deciding whether to allow traffic
For NACLs, how are rules evaluated for allowing / denying traffic?
Rules are processed in number order when deciding whether to allow traffic
What are VPC flow logs?
- Capture information about IP traffic going into your interfaces (VPC Flow Logs, Subnet Flow Logs and ENI Flow Logs)
- Helps to monitor & troubleshoot connectivity issues
Where can VPC Flow Log data be stored?
S3 and CloudWatch Logs
What is VPC Peering?
- Connects two VPCs, privately using AWS’ network
- Makes them behave as if they were in the same network
What rule if there regarding VPC Peering and CIDR?
Peered VPCs must not have overlapping CIDR (IP address range)
What are VPC Endpoints
- VPC Endpoints allow you to connect to AWS Services using a private network instead of the public www network
- This gives you enhanced security and lower latency to access AWS services
What AWS services can be used with VPC Endpoint Gateway?
S3 & DynamoDB
What AWS services can be used by VPC Endpoint Interface?
Others services (S3 and DynamoDB are used with VPC Endpoint Gateway)
What is Site-to-Site VPN?
- Connect an on-premises VPN to AWS
- Connection is automatically encrypted
- Goes over the public internet
What is Direct Connect (DX)?
- Establishes a physical connection between on-premises and AWS
- The connection is private, secure and fast
- Goes over a private network
- Take at least a month to establish
True or False; Site-to-Site VPN and Direct Connect can access VPC Endpoints?
False
At what level are S3 buckets defined?
Region level
7 S3 Bucket naming rules
- Globally unique
- No uppercase, no underscore
- 3-63 characters long
- not an IP
- Must start with lowercase letter or number
- Must NOT start with the prefix xn–
- Must NOT end with the suffix -s3alias
S3 max object size?
5TB
When to use S3 multi-part upload?
If uploading more than 5GB
In an S3 Bucket Policy, what are resources?
Buckets and objects
In an S3 Bucket Policy, what is Effect?
Allow / Deny
In an S3 Bucket Policy, what are Actions?
Set of API to Allow or Deny
In an S3 Bucket Policy, what are Principal?
The account or use to apply the policy to
At what level is S3 versioning enabled?
Bucket level
What are the requirements of using S3 Replication (CRR & SRR)?
Versioning must be enabled in source and destination buckets
Is S3 replication synchronous or asynchronous?
asynchronous
In S3, what can you use to replicate existing objects (not just new objects)?
S3 Batch Replication
Does S3 Replication replicate delete markers?
Yes (optional setting)
True or False; S3 deletions with a version ID are replicated?
False (to avoid malicious deletes)
True or False; in S3 there is no “chaining” of replication?
True
7 S3 Storage classes?
- S3 Standard
- S3 Standard Infrequent Access (IA)
- S3 One zone Infrequent Access
- S3 Glacier Instant Retrieval
- S3 Glacier Flexible Retrieval
- S3 Glacier Deep Archive
- S3 Intelligent Tiering
What is S3 Glacier Instant Retrieval?
- Millisecond retrieval, great for data accessed once a quarter
- Minimum storage duration of 90 days
What is S3 Glacier Flexible Retrieval?
- Has different retrieval options
- Expedited (1 to 5 minutes)
- Standard (3 - 5 hours)
- Bulk (5 - 12 hours)
- Minimum storage duration 90 days
What is S3 Glacier Deep Archive?
- For term storage
- Standard retrieval (12 hours)
- Bulk retrieval (48 hours)
- Minimum storage duration of 180 days
What is S3 Intelligent Tiering?
- Move objects automatically between Access Tiers based on usage
- Small monthly monitoring and auto-tiering fee
- There are no retrieval charges
How do you decode AWS CLI STS errors?
sts decode-authorization-message
What is the URL for EC2 instance metadata?
169.254.169.254/latest/meta-data
True or False; using EC2 instance metadata you can retrieve the IAM Role name and IAM Policy?
False;
- IAM Role name: YES
- IAM Policy: NO
How do you use MFA with the CLI?
- You must create a temporary session by running the STS GetSessionToken API call:
aws sts get-session-token –serial-number arn-of-the-mfa-device –token-code code-from-token –duration-seconds 3600
What 8 programming languages are the official SDK in?
- Java
.NET
Node.js
PHP - Python
- Go
- Ruby
- C++
What is the API rate limit for DescribeInstances API for EC2?
100 calls per second
What is the API rate limit for GetObject API for S3?
5500 GET per second per prefix
How should you deal with intermittent API rate limit errors?
Implement Exponential Backoff
How should you deal with ConsistentAPI rate limit errors?
Request an API throttling limit increase
What is the service quota for running On-Demand Standard Instances?
1152 vCPU
What type of errors are 5xx errors?
Server errors
What type of errors are 4xx errors?
client errors
True or False; the exponential backoff retry mechanism is already included in the AWS SKD API calls?
True
For the AWS CLI Credentials Provider Chain, the CLI will look for credentials in what order?
1, Command Line options: –region, –output, and –profile
2, Environment Variables - AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and AWS_SESSION_TOKEN
3, CLI credentials file - aws configure
4, CLI configuration file - aws configure
5, Container credentials - for ECS tak
sks
6, Instance profile credentials - for EC2 Instance Profiles
For the AWS SDK Default Credentials Provider Chain, the Java SDK (example) will look for credential in what order?
1, Java system properties - aws.accessKeyId and aws.secretKey
2, Environment variables - AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY
3, The default credentials profile file - ex at: ~/.aws/credentials, shared by many SDKs
4, Amazon ECS container credentials - for ECS containers
5, Instance profile credentials - used on EC2 instances
What should you use to sign AWS HTTP requests?
Signature v4 (SigV4). If you use the SDK or CLI, the HTTP requests are signed for you
What are the 2 types of S3 Lifecycle rules?
- Transition Actions (configure objects to transition to another storage class)
- Expiration Actions (configure objects to expire (delete) after some time
True or False; S3 Lifecycle rules can be created for a certain prefix (eg: s3://mybucket/mp3/*)?
True
True or False; S3 Lifecycle rules can be created for certain object tags (eg, Department: Finance)?
True
True or False; with S3 Event Notifications, object name filtering is possible?
True (*.jpg)
How quick are S3 event notifications typically delivered?
Typically in seconds, but can sometimes take a minute or longer
4 S3 Event notification destinations?
- SQS
- SNS
- Lambda
- EventBridge
Benefits of using EventBridge with S3 Event Notifications?
- Advanced Filtering options with JSON rules (metadata, object size, name)
- Multiple Destinations (Step Functions, Kinesis Streams / Firehose)
- EventBridge Capabilities (Archive, Replay Events, Reliable delivery)
True or False; S3 automatically scales to high request rate, latency 100-200ms?
True
What API limits does S3 have?
Requests per second per prefix:
- 3,500 PUT/COPY/POST/DELETE
- 5,000 GET/HEAD
How to increase the S3 API limits?
Spread requests across multiple prefixes
What is S3 Transfer Accleration?
Increase object upload speed by transferring file to an AWS edge location which will forward the data to the S3 bucket in the target region
True or False; S3 Transfer Acceleration is compatible with multi-part upload?
True
What is S3 Byte-Range Fetches?
Parallelise GETs by requesting specific byte ranges
3 benefits of using S3 Byte-Range Fetches?
- Better resilience in case of failures
- Can be used to speed up downloads
- Can be used to retrieve only partial data (eg, the head of a file)
What is S3 Select and Glacier Select?
- Retrieve less data using SQL by performing server-side filtering
- Can filter by row & columns (simple SQL statements)
- Less network transfer, less CPU cost client side)
Four methods of encrypting objects in S3 buckets?
- Server-Side encryption with Amazon S3-Managed Keys (SSE-S3)
- Server-Side encryption with KMS Keys stored in AWS KMS (SSE-KMS)
- Server-Side encryption with Customer-Provided Keys (SSE-C)
- Client-Side Encryption
For S3 encryption SSE-S3, what header must you set?
“x-amz-server-side-encryption”:”AES256”
2 benefits of using SSE-KMS for S3 encryption?
- User control
- Audit key usage using CloudTrail
For S3 encryption SSE-KMS, what header must you set?
“x-amz-server-side-encryption”:”aws:kms”
True or False; you won’t be impacted by KMS limits when using SSE-KMS?
False; you might be
2 ways to “force encryption” in S3?
- Use a bucket policy and refuse any API call to PUT an S3 object without encryption headers
- Use the “default encryption” option in S3
What is CORS?
- Cross-Origin Resource Sharing
- Same origin: http://example.com/app1 & http://example.com/app2
- Different origins: http://www.example.com & http://other.example.com
- The request won’t be fulfilled unless the other origin allows for the requests, using CORS Headers
What must be enabled to use MFA Delete in S3?
Versioning must be enabled on the bucket
Who can enable/disable MFA delete?
Only the bucket owner (root account)
What are S3 access logs?
- For audit purposes, you may want to log all access to S3 buckets
- Any request made to S3, from any account, authorised or denied, will be logged into another S3 bucket
True or False; for S3 Access Logs, the target logging bucket can be in another region?
False
3 ways you can generate S3 pre-signed URLs?
- S3 console
- AWS CLI
- AWS SDK
What permissions are users given with a pre-signed URL?
They inherit the permissions of the user that generated the URL
Pre-signed URL expiration for URL generated through the S3 console?
1 min - 12 hours
Pre-signed URL expiration for URL generated through the AWS CLI?
- Max 168 hours
- Default 1 hour
What are S3 Access Points?
- Access Points can used used access S3 buckets.
- They can be granted read and / or write access to different buckets
- Making it easier to manage than complex buckete policies
What is S3 Object Lambda?
- Use AWS Lambda Functions to change the object before it is retrieved by the caller application
- Only one S3 bucket is needed on top of which we create an S3 Access Point and S3 Object Lambda Access Points
What CloudFront Origins can you have?
S3 Bucket
Custom Origin (HTTP):
- Application Load Balancer
- EC2 Instance
- S3 Website
- Any HTTP backend you want
What 3 things are CloudFront Caching cache based on?
- Headers
- Session Cookies
- Query String Parameters
How do you invalidate part of a CloudFront Cache?
By using the CreateInvalidation API
True or False; you can maximise CloudFront cache hits by separating static and dynamic content distributions?
True
How can you create Geo Restrictions in CloudFront?
By using an Allowlist or Blocklist
What can you use to distribute paid shared content to premium users over the world?
CloudFront Signed URL / Signed Cookies
True or False; the cost of data out is the same per edge location?
False; it varies per location
What are the 3 CloudFront price classes?
1, Price Class All: all regions - best performance
2, Price Class 200: most regions, but excludes the most expensive regions
3, Price Class 100: only the least expensive regions
What is CloudFront multiple origin?
Used to route to different kinds of origins based on the content type, using path patterns
What are CloudFront Origin Groups?
- Has one primary and one secondary origin, if the primary origin fails, the second one is used
What is CloudFront Field LEvel Encryption?
- Sensitive information is encrypted at the edge, close to the user
- Protects user sensitive information through application stack
- Adds an additional layer of security along with HTTPS
What are the basic steps of creating a docker container?
- Create Dockerfile
- Use Dockerfile to build Docker image
- Use Docker image to run docker container
True or False; on ECS with EC2 Launch Type; you must provision & maintain the infrastructure (the EC2 instances)?
True
On ECS, EC2 Launch Type, what must you run to register the ECS Cluster?
The ECS Agent
True or False; on ECS with Fargate Launch Type; you must provision & maintain the infrastructure (the EC2 instances)?
False, you just create task definitions
How does Fargate work?
- It is serverless
- You just create task definitions
- AWS just runs ECS Tasks for you based on the CPU / RAM you need
- To scale, just increase the number of tasks.
What are ECS Task roles
- Allows each task to have a specific role
- Use different roles for the different ECS services you run
- Task Role is defined in the task definition
Does ECS support load balancer integrations?
Yes, ALB and NLB
True or False; you can mount EFS file systems onto ECS tasks for both EC2 and Fargate launch types?
True
True or False; you can use S3 as a file system for ECS tasks for both EC2 and Fargate launch types?
False; S3 cannot be used as a file system
What is ECS Service Auto Scaling?
Automatically increase / decrease the desired number of ECS tasks
3 types are ECS Service Auto Scaling?
- Target Tracking (scale based on target value for a specific CloudWatch metric)
- Step Scaling (scale based on a specific CloudWatch Alarm
- Scheduled Scaling (scale based on a specified date/time (predictable changes))
What are EC2 Rolling Updates?
When updating from v1 to v2, we can control how many tasks can be started and stopped, and in which order
What are ECS Task Definitions?
Task definitions are metadata in JSON form to tell ECS how to run a Docker container
8 details contained with an ECS Task Definition?
- Image Name
- Port Binding for Container and Host
- Memory and CPU required
- Environmental variables
- Networking information
- IAM Role
- Logging configuration (eg CloudWatch)
How many containers can you define in a task definition?
Up to 10
How does Load Balancing work with ECS - EC2 Launch Type?
- We get a Dynamic Host Port Mapping if you define only the container port in the task definition
- The ALB finds the right port on your EC2 instances
- You must allow on the EC2 instance’s Security Group any port from the ALB’s Security Group
How does Load Balancing work on Fargate?
- Each task has a unique private IP
- Only define the container port (host port is not applicable)
True or False; it is best practice for each ECS Task Definition to have it’s own IAM Role?
True
What are ECS Data Volumes?
- Aloow you to share data between multiple containers in the same Task Definition
- Works for both EC2 and Fargate Tasks
When ECS places task, what process does it use to select container instances?
1, Identify the instances that satisfy the CPU, memory, and port requirements in the task definition
2, Identify the instances that satisfy the task placement constraints
3, Identify the instances that satisfy the task placement strategies
4, Select the instances for task placement
3 ECS Task PLacement Strategies
1, Binpack:
- Place tasks based on the least available amount of CPU or memory
- this minimises the number of instances in use (cost saving)
2, Random:
- Place the task randomly
3, Spread:
- Place the task evenly based on the specified value
True or False; you can mix ECS Task Placement Strategies?
True
What are 2 ECS Task Placement Constraints?
- distinctInstance (place each task on a different container instance)
- memberOf (places task on instances that satisfy an expression, eg, type t2.*. Usese the Cluster Query Language)
What is ECR?
- Elastic Container Registry
- Store and mange Docker images on AWS
- Private and public repository
- Fully integrated with ECS, backed by S3
- Access controlled through IAM
- Supports image vulnerability scanning, versioning, image tags, image lifecycle, …
What is Kubernetes?
Kubernetes is an open-source system for automatic deployment, scaling and management of containerised (usually Docker) application
Kubernetes is cloud-agnostic (can be used in any cloud)
What is EKS?
- Elastic Kubernetes Service
- It is a way to launch managed Kubernetes clusters on AWS
- It’s an alternative to ECS, similar goal but different API
- EKS supports EC2 if you want to deploy worker nodes or Fargate to deploy serverless containers
3 EKS Node Types
1, Managed Node Groups:
- Creates and manages Nodes (EC2 instances) for you
- Nodes are part of an ASG managed by EKS
- Supports On-Demand or Spot Instances
2, Self-Managed Nodes:
- Nodes created by you and registered to the EKS cluster and managed by an ASG
- You can use prebuilt AMI - Amazon EKS Optimised AMI
- Supports On-Demand or Spot Instances
3, AWS Fargate:
- No maintenance required; no nodes managed
What driver do EKS Data Volumes use?
a Container Storage Interface (CSI) compliant driver
What data volume can be used with EKS?
- EBS
- EFS (works with Fargate)
- FSx for Lustre
- FSx for NetApp ONTAP
What is Elastic Beanstalk?
- A managed service for deploying an application on AWS
- Automatically handles capacity provisioning, load balancing, scaling, application health monitoring, instance configuration…
- Just the application code is the responsibility of the developer
- We still have full control over the configuration
What are the Elastic Beanstalk components?
- Application: collection of Elastic Beanstalk component (environments, versions, configurations, …)
- Application Version: an iteration of your application code
- Environment:
– Collection of AWS resources running an pplication version (only one application version at a time)
– Tiers: web server environment tier & worker environment tier
– You can create multiple enviornments (dev, test, prod, …)
9 Elastic Beanstalk supported platforms?
- Go
- Java
- .NET
- Node.js
- PHP
- Python
- Ruby
- Packer Builder
- Docker (single container | Multi-container | Preconfigured)
If not supported, you can write your custom platform (advanced)
6 Options for Elastic Beanstalk Deployment Updates
- All at once (deploy all in one go)
- Rolling
- Rolling with additional batches
-Immutable - Blue / Green
- Traffic Splitting
What is Elastic Beanstalk Deployment - All at once?
- Turn off old, turn on new
- Fastest deployment
- Application has downtime
- Great for quick iteration in development environment
What is Elastic Bean Stalk Deployment - Rolling
- Turn off a few old, replace with new
- Application is running below capacity
- Can set the bucket size
- Application is running both version of the app simultaneously
- No additional cost
- Long deployment
What is the Elastic Beanstalk deployment - Rolling with additional batches
- Rolling, but new versions are added, before old are removed
- Application is running at capacity
- Can set the bucket size
- Application is running both versions simultaneously
- Small additional cost
- Additional batch is removed at the end of the deployment
- Longer deployment
- Good for production environment
What is Elastic Beanstalk Immutable Deployment?
- New app versions are deployed to new instances in a temporary ASG
- If ok, they are merged with the current (original) ASG
- Then the original instances are terminated
- Zero downtime
- High cost, double capacity
- Longest deployment
- Quick rollback in case of failures (just terminate new ASG)
- Great for production
What is Elastic Beanstalk Blue / Green Deployment?
- Not a ‘direct feature’ of Elastic Beanstalk
- Create a new “stage” environment and deploy v2 there
- Use Route 53 to setup weighted policies to redirect a little bit of traffic to the stage environment
- The new environment can be validated independently and roll back if issues
- Zero downtime and release facility
- Use Beanstalk, “swap URLs” when done with the environment test
True or False; Elastic Beanstalk has it’s own CLI?
True: EB CLI
What is the Elastic Beanstalk Deployment Process?
- Describe dependencies (requirements.txt for python)
- Package code
- Console: upload zip file (create new app version), and the deploy
- CLI: create new app version using CLI (uploads zip), and then deploy
- Elastic Beanstalk will deploy the zip on each EC2 instance, resolve dependencies and start the application
What is the Elastic Beanstalk Lifecycle Policy?
- Elastic Beanstalk can store at most 1,000 application versions
- If you don’t remove old versions, you won’t be able to deploy any more
- To phase out old application versions, use a lifecycle policy (based on time or space)
- Versions that are currently used won’t be deleted
- Option not to delete the source bundle in S3 to prevent data loss
What are Elastic Beanstalk Extensions?
- All the parameters set in the UI can be configured with code using files
Requirements:
- must be in the .ebextensions/ directory in the root of source code
- YAML / JSON format
- .config extensions (eg, logging.config)
- Able to modify some default settings using: option_settings
- Ability to add resources such as RDS, ElastiCache, DynamoDB, etc…
Resources managed by .ebextensions get deleted if the environment goes away
What service does Elastic Bean stalk use under the hood?
Elastic Beanstalk relies on CloudFromation
You can define CloudFormation resources in your .ebextensions to provision ElastiCache, an S3 Bcuket, anything you want!
True or False; it is possible to clone an Elastic Beanstalk environment?
True.
- You can clone an environment with the exact same configuration
- Useful for deploying a “test” version of your app
- All resources and configuration are preserved
True or False; after creating an Elastic Beanstalk environment, you can change the ELB type?
False; you have to migrate it
How do you migrate an Elastic Beanstalk app to have a different Elastic Load Balancer type?
1, Create a new environment with the same configuration except LB
2, deploy your application into the new environment
3, perform a CNAME swap or Route53 update
What is best practice for using RDS with Elastic Beanstalk?
- RDS can be provisioned with Beanstalk, which is great for dev / test
- This is not great for prod as the database lifecycle is tied to the Beanstalk environment lifecycle
- The best for prod is to separately create an RDS database and provide our EB app with the connection string
What do you provide to run your application in Elastic Beanstalk as a single Docker container?
Either provide:
- Dockerfile: Beanstalk will build and run the Docker container
- Dockerrun.aws.json(v1): describe where already built Docker image is (Image, Ports, Volumes, Logging etc)
True or FAlse; Beanstalk in Single Docker Container uses ECS?
False
What is Elastic Beanstalk Multi Docker Container?
Multi Docker container helps run multiple containers per EC2 instance in Elastic Beanstalk
What will Elastic Beanstalk Multi Docker Container create for you?
- ECS cluster
- EC2 instances, configured to use the ECS Cluster
- Load Balancer (in high availability mode)
- Task definitions and execution
What is required to create an Elastic Beanstalk Multi Docker container?
- Requires a config Dockerrun.aws.json (v2) file at the root of source code
- Dockerrun.aws.json is used to generate the ECS task definition
- Your Docker images must be pre-built and stored in ECR for example
How do you create your own Elastic Beanstalk Custom PLatform?
- Define an AMI using Platform.yaml file
- Build that platform using the Packer software (open source tool to create AMIs)
In Elastic Beanstalk, what is the difference between Custom Image vs Custom Platform?
- Custom Image is to tweak an existing Beanstalk Platform
- Custom Platform is to create an entirely new Beanstalk Platform
What is CodeCommit
Used for stoing our code
What is CodePipeline?
Used for automating our pipeline from code to Elastic Beanstalk
What CodeBuild?
Used for building and testing our code
