Udemy Course Flashcards
What is the Recycle Bin?
A recycle bin for EBS Snapshots and AMIs
ALBs can route traffic to different Target Groups based on which 4 things?
- URL Path
- Hostname
- HTTP Headers
- Query Strings
True or False; You can attach an Elastic IP address to Application Load Balancers?
False
What cookie names are reserved by the ELB (3)?
- AWSALB
- AWSALBAPP
- AWSALBTG
What is Server Name Indication (SNI)?
Server Name Indication (SNI) allows you to expose multiple HTTPS applications each with its own SSL certificate on the same listener.
What is the maximum number of Read Replicas you can add in an ElastiCache Redis Cluster with Cluster-Mode Disabled?
5
EBS Volumes are network drives or physical drives?
Network drives
True or False; EBS volumes are locked to an Availability Zone?
True
True or False; EBS volumes have a provisioned capactiy?
True
True or False; you can attach multiple EBS volumes to an EC2 instance?
True
What happens by default to EBS volumes attached to an EC2 instance, when the EC2 instance is terminated?
By default:
- the root EBS volume is deleted
- any other attached EBS volume is not deleted
True or False; EBS snapshots can be copied across AZs and Regions?
True
How much cheaper are EBS snapshots stored in the ‘archive tier’?
75%
How long do EBS snapshots in the archive tier take to be restored?
24 - 72 hours
Is it possible to retain deleted EBS snapshots?
Yes, in the recycle bin
How do you quickly restore an EBS snapshot?
Use Fast Snapshot Restore (FSR)
True or False; AMI can be used in any region?
False; they are region specific, but can be copied across regions
What type of disk to use with an EC2 instance if you require high-performance?
EC2 Instance Store
What are io1 / io2 (Provisioned IOPS) EBS Volumes best used for?
Highest performance SSD volume for mission-critical low-latency or high-throughput workloads
What is st1 (Throughput optimised) EBS Volumes used for?
Low cost HDD volume designed for frequently accessed, throughput-intensive workload
What is sc1 (Cold HDD) EBS Volumes used for?
Lowest cost HDD volume designed for less frequently accessed workloads
What EBS volumes can be used as boot volumes?
gp2/gp3 and io1/io2 only
Volume size of EBS volume gp2/gp3?
1GB - 16TB
gp3 baseline IOPS and throughput?
3000 IOPS and 125MB throughput
gp3 max IOPS and throughput?
16,000 IOPS and 1,000 MB throughput
True or False; gp3 IOPS and throughput can be scaled independently?
True
gp2 max IOPS?
16,000
True or False; gp2 size of volume and IOPS are linked?
True
gp2 how many IOPS do you get per GB of volume?
3
io1/io2 volume size?
4GB - 16TB
io1/io2 max PIOPS?
64,000 for Nitro EC2 instances and 32,000 for other
True or False; io1/io2 PIOPS and storage size are linked?
False
io2 Block Express (EBS volume) volume size?
4GB - 64TB
Which EBS volume types support Multi-Attach?
io1/io2 family
io2 Block Express (EBS volume) latency?
sub-millisecond latency
io2 Block Express (EBS volume) max PIOPS and IOPS ratio?
Max PIOPS = 256,000 with an IOPS:GB ratio of 1,000:1
st1 use cases?
- Big data warehouses
- Log processing
st1 volume size
500GB - 15TB
sc1 volume size?
500GB - 15TB
sc1 use cases?
- Data that is infrequently accessed
- scenarios where lowest cost is important
st1 max IOPS and throughput?
500 IOPS and 500 MB throughput
sc1 max IOPS and throughput?
250 IOPS and 250 MB throughput
What is EBS multi-attach?
- Attach the same EBS volume to multiple EC2 instances in the same AZ
- Each instance has full read & write permissions to the high-performance volume
How many EC2 instances can you attach to an EBS multi-attach volume at a time?
Up to 16 instances
What file system must you use for EBS multi-attach?
A file system that’s cluster-aware (not XFS, EX4, etc)
What is EFS (Elastic File System)?
A managed NFS (network file system) that can be mounted on many EC2 instances
4 EFS use cases?
- content management
- web serving
- data sharing
- wordpress
What protocol does EFS use?
NFSv4.1
How is EFS access controlled?
Through security groups
What AMIs is EFS compatible with?
Linux based AMIs, not windows based AMIs
True or False; EFS requires capacity planning?
False; it scales automatically and is pay-per-use
What can EFS scale to?
- 1,000s of concurrent NFS clients with 10 GB / s throughput
- Petabytes-scale
What 2 modes does EFS have?
- Performance mode (set at EFS creation time)
- Throughput mode
What are the two EFS performance modes?
- General purpose (default): latency-sensitive use cases
- Max I/O: higher latency, throughput, highly parallel
What are the two EFS throughput modes?
- Bursting (1TB = 50MB + burst of up to 100 MBs)
- Provisioned: set your throughput regardless of storage size
What are the two EFS storage tiers?
- Standard: for frequently accessed files
- Infrequent Access: cost to retrieve files, lower price to storage
What are the 2 availability options for EFS?
- Standard: which is Multi-AZ
- One Zone: Single AZ
What are load balancers?
Load Balancers are servers that forward traffic to multiple servers (e.g., EC2 instances) downstream
What are Elastic Load Balancer health checks run against?
On a port and a route
What is an unhealthy response to an Elastic Load Balancers health check?
Any response that is not 200 (OK)
What are the 4 kinds of AWS managed Load Balancers?
- Classic Load Balancer (depreciated) (CLB)
- Application Load Balancer (ALB)
- Network Load Balancer (NLB)
- Gateway Load Balancer (GWLB)
3 protocols used by ALB?
- HTTP
- HTTPs
- Websockets
3 protocols used by NLB?
- TCP
- TLS
- UDP
What layer does the GWLB operate at?
Layer 3 (Network Layer)
3 different routing rules that ALB can use to route traffic to different target groups?
- Routing based on path in URL (example.com/users & example.com/posts)
- Routing based on hostname in URL (one.example.com & other.example.com)
- Routing based on Query String, Headers (example.com/users?id=123&order=false)
True or False; ALB has a port mapping feature to redirect to a dynamic port in ECS
True
4 types of ALB target groups?
- EC2 instances
- ECS tasks
- Lambda functions
- IP addresses (must be private IP addresses)
True or False; ALBs can route to multiple target groups?
True
At what level are ALB health checks performed?
At the target group level
How many requests per second can NLBs handle?
millions
What is the latency of NLB?
~ 100 ms
Does NLB have any static IPs?
Yes, 1 per AZ
Which type of ELB supports assigning Elastic IP?
NLB
3 types of NLB target groups?
- EC2 instances
- IP addresses (must be private IP addresses)
- Application Load Balancer
What is the the Gateway Load Balancer used for?
Analyse network traffic. It allows you to deploy, scale and manage a fleet of 3rd party network virtual appliances in AWS
What layer does the GWLB operate at?
Layer 3 - Network Layer (IP Packets)
What 2 functions does the GWLB combine?
- Transparent Network Gateway (single entry/exit for all traffic)
- Load Balancer (distributes traffic to your virtual appliances)
What protocol and port does GWLB use?
GENEVE protocol on port 6081
What are the GWLB target groups?
- EC2 instances
- IP addresses (must be private IPs)
Which load balancer allows Sticky Sessions?
ALB
How does the ELB enable Sticky Sessions?
By using cookies, which have an expiration date you control
What is the use case for sticky sessions?
Making sure that the user doesn’t lose his session data
What is a potential issue of enabling stickiness on an ELB?
It may bring imbalance to the load over the backend EC2 instances
What sticky session cookie names can’t be used (reserved for use by ELB)?
- AWSALB
- AWSALBAPP
- AWSALBTG
- AWSELB
What does Cross Zone Load Balancing do on an Elastic Load Balancer?
It distributes the balance evenly across all registered instances in all AZs
For Cross-Zone Load Balancing on Elastic Load Balancers, which load balancers have it enabled by default, and which charge for inter AZ data?
ALB:
- Enabled by default
- No charges for inter AZ data
NLB & GWLB:
- Disabled by default
- Charges for inter AZ data if enabled
What does an SSL certificate do?
It allows traffic between your client and your load balancer to be encrypted in transit (in-flight encryption)
What do SSL and TLS stand for?
Secure Sockets Layer and Transport Layer Security
Who issues public SSL certificates?
Certificate Authorities (CA)
What type of SSL certificate does a load balancer use?
X.509 certificate
What does Server Name Indication (SNI) do for Load Balancers?
It solves the problem of loading multiple SSL certificates onto one web server (to serve multiple websites)
How does SNI (Server Name Indication) work?
- It requires the client to indicate the hostname of the target server in the initial SSL handshake.
- The server will then find the correct certificate, or return the default one
What is Deregistration Delay?
The time to complete “in-flight requests” while the instance is de-registering or unhealthy
True or False; ELBs can check the health of your EC2 instances?
True
3 Auto Scaling Group Attributes
- Launch Template
- Min Size / Max Size / Initial Capacity
- Scaling Policies
8 attributes of an ASG Launch Template
- AMI + Instance Type
- EC2 User Data
- EBS Volumes
- Security Groups
- SSH Key Pair
- IAM Roles for your EC2 Instances
- Network + Subnets Information
- Load Balancer Information
True or False; it is possible to scale an ASG based on CloudWatch alarms?
True, an alarm monitors a metric (such as Average CPU, or a custom metric)
4 good metrics to scale an ASG on?
- CPUUtilisation - Average CPU utilisation across your instances
- RequestCountPerTarget - to make sure the number of requests per EC2 instance is stable
- Average Network In / Out - if your application is network bound)
- Any custom metric - that you push using CloudWatch
True or False; with RDS you can SSH into your instances?
False, it is a managed service
What is RDS - Storage Auto Scaling?
- Help you instance storage on your RDS DB instance dynamically
- When RDS detects you are running out of free storage, it scales automatically
- Avoids manually scaling your database storage
- You have to set the Maximum Storage Threshold (max limit for DB storage)
What are RDS read replica’s purpose?
Read Scalability
True or False; RDS read replicas are within the same AZ?
False; can be within the same AZ, Cross AZ or Cross Region
RDS read replicas use synchronous replication?
False, they use Asynchronous replication, so reads are eventually consistent
True or False; RDS read replicas can be promoted to their own DB?
True
True or False; for RDS DBs, applications must update the connection string to leverage read replicas?
True
For RDS Read Replicas, is there a network costs when data is replicated to the read replicas?
- Same region replication is free
- Cross region replication is NOT free
What is the reason to use RDS Multi-AZ?
Disaster Recovery
What type of replication does RDS Multi-AZ use?
Synchronous replication
True or False; RDS Multi-AZ uses multiple DNS names?
False; it uses one DNS name, with automatic app failover to standby
True or False; you can change an RDS database from single to multi-AZ with zero downtime?
True; it does this through via taking a snapshot and synchronisation
How does Aurora storage grow?
Automatically, in increments of 10GB
Aurora maximum storage size?
128 TB
How many read replicas can Aurora have?
15
How fast is failover in Aurora?
Instantaneous
How does Aurora achieve high availability?
- 6 copies of your data across 3 AZs
– 4 copies out of 6 needed for writes
– 3 copies out of 6 needed for reads
– Self healing with peer-to-peer replication
True or False; Aurora uses a shared storage volume?
True
True or False; Aurora reader endpoint performs connection load balancing?
True
What does the ‘Backtrack’ feature of Aurora do?
Restores data at any point of time without using backups
How are RDS DBs encrypted at-rest?
- Database master & replicas encryption using AWS KMS - must be defined at launch time
- If the master is not encrypted, the read replicas cannot be encrypted
- To encrypt an un-encrypted database, go through a DB snapshot and restore as encrypted
How are RDS DBs encrypted in-flight?
RDS DBs are TLS-ready by default, use the AWS TLS root certificates client-side
What are caches?
- Caches are in-memory databases with really high performance, low latency
- Helps reduce the load of database for read intensive workloads
- Help make your application stateless
True or False; using ElastiCache doesn’t require an application code changes?
False; ElastiCache involves heavy application code changes
ElastiCache - REDIS or MEMCACHED.
Multi-AZ with Auto-Failover?
Redis
ElastiCache - REDIS or MEMCACHED.
Multi-node for partitioning of data (sharding)?
Memecached
ElastiCache - REDIS or MEMCACHED.
Read Replicas to scale reads and have high availability?
Redis
ElastiCache - REDIS or MEMCACHED.
No high availability?
Memcached
ElastiCache - REDIS or MEMCACHED.
Data Durability using AOF persistence?
Redis
ElastiCache - REDIS or MEMCACHED.
Non persistent?
Memcached
ElastiCache - REDIS or MEMCACHED.
No backup or restore?
Memcached
ElastiCache - REDIS or MEMCACHED.
Backup and restore features?
Redis
ElastiCache - REDIS or MEMCACHED.
Multi-threaded architecture?
Memcached
For ElastiCache, what is Lazy Loading / Cache-Asaide / Lazy Population?
Cache is checked first, if cache hit, data is returned. If cache miss, data is read from the database and written to cache
Pros and Cons of Lazy Loading / Cache-Aside / Lazy Population for ElastiCace?
Pros:
- Only requested data is cached (the cache isn’t filled up with unused data)
- Node failures are not fatal (just increased latency to warm the cache)
Cons:
- Cache miss penalty that results in 3 round trips, noticeable delay for that request
- Stale data: data can be updated in the database and outdated in the cache
For ElastiCache what is Write Through?
Add or Update the cache whenever the database is updated
Pros and Cons of Write Through for ElastiCache?
Pros:
- Data in cache is never stale
- Reads are quick
- Write penalty vs read penalty (each write requires 2 calls)
Cons:
- Missing Data until it is added / updated in the DB. Mitigation is to implement Lazy Loading strategy as well
- Cache churn - a lot of the data will never be read
3 ways cache evictions can occur?
- You delete the item explicitly in the cache
- Item is evicted because the memory is full and it’s not recently used (LRU)
- You set an item time-to-live (TTL)
What is ElastiCache replication: Cluster Mode Disabled?
- One shard, all nodes have all the data
- One primary node, up to 5 replicas
- Asynchronous replication
- Primary node is used for read/write
- Other nodes are read-only
- Multi-AZ enabled by default for failover
- Helpful to scale read performance
What is ElastiCache replication: Cluster Mode Enabled?
- Data is partitioned across shards
- Each shard has a primary and up to 5 replica nodes
- Multi-AZ capability
- Up to 500 nodes per cluster
- Helpful to scale writes
What is DNS?
Domain Name System, it translates the human friendly hostnames into the machine IP addresses
What is a Zone File?
Contains DNS records
What is a Name Server?
Resolves DNS queries
What is Route 53?
- A highly available, scalable, fully managed and Authoritative DNS
- Also a Domain Registrar
- Has the ability to check the health of your resources
What is the ‘A’ record type?
Maps a hostname to IPv4
What is the ‘AAAA’ record type?
Maps a hostname to IPv6
What is a CNAME record?
It maps a hostname to another hostname
What are the requirements for a CNAME record?
- The target is a domain which must have an A or AAAA record
- Can’t create a CNAME record for the top node of a DNS namespace (Zone Apex), eg, example.com
What are NS records?
Name Servers for the Hosted Zone - control how traffic is routed for a domain
What is a Hosted Zone?
A container for records that define how to route traffic to a domain and its subdomains
True or False; in Route 53, TTL is mandatory for each DNS record
True, except for Alias records
Route 53; what is the difference between a CNAME and Alias?
CNAME:
- Point a hostname to any other hostname (app.mydomain.com => blabla.anything.com)
- ONLY FOR NON ROOT DOMAIN (aka. something.mydomain.com)
Alias:
- Points a hostname to an AWS Resource (app.mydomain.com => blabla.amazonaws.com)
- WORKS for ROOT DOMAIN and NON ROOT DOMAIN (aka mydomain.com)
- Free of charge
- Native health check
What do Route 53 Alias Records do?
- Maps a hostname to an AWS resource
- Always of type A/AAAA for AWS resource
What is the default TTL for Route 53 Alias records?
Alias records have no TTL
8 Route 53 Alias Records targets?
- ELBs
- CloudFront Distributions
- API Gateway
- Elastic Beanstalk environments
- S3 Websites
- VPC Interface Endpoints
- Global Accelerator
- Route 53 record in the same hosted zone
True or False; you can set an ALIAS record for an EC2 DNS name?
False
What are Route 53 Routing Policies?
- Define how Route 53 responds to DNS queries
- DNS does not route traffic, it only responds to the DNS queries
7 Route 53 routing policies?
- Simple
- Weighted
- Failover
- Latency based
- Geolocation
- Geoproximity
- Multi-Value answer
What is Route 53 simple routing?
- Typically routes traffic to a single resource
- Can specify multiple values in the same record, in which case a random one is chosen by the client
True or False; Route 53 simple routing can be associated with health checks?
False
True or False; Route 53 weighted routing can be associated with health checks?
True
True or False; Route 53 latency-based routing can be associated with health checks?
True, has a failover capability
True or False; Route 53 HTTP health checks are for public and private resources?
False; for public resources only
True or False; Route 53 Health Checks enable automated DNS failover?
True
3 type of Route 53 Health checks?
- Health checks that monitor an endpoint
- Health checks that monitor other health checks
- Health checks that monitor CloudWatch Alarms
How do Route 53 Health checks work?
- About 15 global health checkers will checker the endpoint health
- Healthy / unhealthy threshold is 3 (default)
- If > 18% of health checkers report the endpoint is healthy, Route 53 considers it Healthy, otherwise, it’s unhealthy
2 ways in which Route 53 health checks can pass?
- Only when the endpoint responds with the 2xx and 3xx status codes
- Health Checks can be setup to pass / fail based on the text in the first 5,120 bytes of the response
What are Route 53 calculated health checks?
- Combine the results of multiple health checks (children) into a single Health Check (parent)
- You can use OR, AND, or NOT
- Can monitor up to 256 Child Health Checks
- Specify how many of the child health checks needed to pass to make the parent pass
True or False; Route 53 health checks can’t access private endpoints (private VPC or on-premises resources)?
True, Route 53 health checkers are outside the VPC.
You can create a CloudWatchMetric and associate a CloudWatch Alarm, then create a Health Check that checks the alarm itself
What is Route 53 Geolocation Routing Policy?
- Routing based on user location
- Specify location by continent, country or by US state
- Should create a “Default” record in case of no match
What is Route 53 Geolocation Routing Policy?
- Route traffic to your resources based on the geographic location of users resources
- You have the ability to shift more traffic to resource based on the defined bias
What must be used with Route 53 Geoproximity routing policy?
Route 53 Traffic Flow
What is Route 53 Traffic Flow?
- It simplifies the process of creating and maintaining records in large and complex configurations
- Configurations can be saved as Traffic Flow Policy
True or False; Traffic Flow supports versioning?
True
What is Route 53 Multi-Value Routing Policy?
- Use when routing traffic to multiple resources
- Route 53 returns multiple values/resources
- Can be associated with Health Checks
True or False; Route 53 Multi-Value Routing Policy can be used as a substitute for having an ELB?
False
How do you use a 3rd Party Domain Registrar with Route 53?
1, Create a Hosted Zone in Route 53
2, Update NS Records on 3rd party website to use Route 53 Name Servers
What is a VPC?
a private network to deploy your resources (regional resource)
What are subnets?
Allow you to partition your network inside your VPC (availability zone resource)
What is a public subnet?
a subnet that is accessible from the internet
What is a private subnet?
a subnet that is not accessible from the internet
How do you define access to the internet and between subnets?
Use route tables
What do NAT Gateways / NAT instances do?
Allow your instances in your Private Subnets to access the internet while remaining private
What are NACLs?
- A firewall which controls traffic from and to subnets
- Can have ALLOW and DENY rules
- Are attached at subnet level
- Rule only include IP addresses
What are Security Groups?
- A firewall that controls traffic to and from an ENI / an EC2 Instance
- Can have only ONLY rules
- Rules include IP addresses and other security groups
NACL are stateless or stateful?
Stateless
Security Groups are stateless or stateful
Stateful
For Security Groups, how are rules evaluated for allowing / denying traffic?
All rules are evaluated before deciding whether to allow traffic
For NACLs, how are rules evaluated for allowing / denying traffic?
Rules are processed in number order when deciding whether to allow traffic
What are VPC flow logs?
- Capture information about IP traffic going into your interfaces (VPC Flow Logs, Subnet Flow Logs and ENI Flow Logs)
- Helps to monitor & troubleshoot connectivity issues
Where can VPC Flow Log data be stored?
S3 and CloudWatch Logs
What is VPC Peering?
- Connects two VPCs, privately using AWS’ network
- Makes them behave as if they were in the same network
What rule if there regarding VPC Peering and CIDR?
Peered VPCs must not have overlapping CIDR (IP address range)
What are VPC Endpoints
- VPC Endpoints allow you to connect to AWS Services using a private network instead of the public www network
- This gives you enhanced security and lower latency to access AWS services
What AWS services can be used with VPC Endpoint Gateway?
S3 & DynamoDB
What AWS services can be used by VPC Endpoint Interface?
Others services (S3 and DynamoDB are used with VPC Endpoint Gateway)
What is Site-to-Site VPN?
- Connect an on-premises VPN to AWS
- Connection is automatically encrypted
- Goes over the public internet
What is Direct Connect (DX)?
- Establishes a physical connection between on-premises and AWS
- The connection is private, secure and fast
- Goes over a private network
- Take at least a month to establish
True or False; Site-to-Site VPN and Direct Connect can access VPC Endpoints?
False
At what level are S3 buckets defined?
Region level
7 S3 Bucket naming rules
- Globally unique
- No uppercase, no underscore
- 3-63 characters long
- not an IP
- Must start with lowercase letter or number
- Must NOT start with the prefix xn–
- Must NOT end with the suffix -s3alias
S3 max object size?
5TB
When to use S3 multi-part upload?
If uploading more than 5GB
In an S3 Bucket Policy, what are resources?
Buckets and objects
In an S3 Bucket Policy, what is Effect?
Allow / Deny
In an S3 Bucket Policy, what are Actions?
Set of API to Allow or Deny
In an S3 Bucket Policy, what are Principal?
The account or use to apply the policy to
At what level is S3 versioning enabled?
Bucket level
What are the requirements of using S3 Replication (CRR & SRR)?
Versioning must be enabled in source and destination buckets
Is S3 replication synchronous or asynchronous?
asynchronous
In S3, what can you use to replicate existing objects (not just new objects)?
S3 Batch Replication
Does S3 Replication replicate delete markers?
Yes (optional setting)
True or False; S3 deletions with a version ID are replicated?
False (to avoid malicious deletes)
True or False; in S3 there is no “chaining” of replication?
True
7 S3 Storage classes?
- S3 Standard
- S3 Standard Infrequent Access (IA)
- S3 One zone Infrequent Access
- S3 Glacier Instant Retrieval
- S3 Glacier Flexible Retrieval
- S3 Glacier Deep Archive
- S3 Intelligent Tiering
What is S3 Glacier Instant Retrieval?
- Millisecond retrieval, great for data accessed once a quarter
- Minimum storage duration of 90 days
What is S3 Glacier Flexible Retrieval?
- Has different retrieval options
- Expedited (1 to 5 minutes)
- Standard (3 - 5 hours)
- Bulk (5 - 12 hours)
- Minimum storage duration 90 days
What is S3 Glacier Deep Archive?
- For term storage
- Standard retrieval (12 hours)
- Bulk retrieval (48 hours)
- Minimum storage duration of 180 days
What is S3 Intelligent Tiering?
- Move objects automatically between Access Tiers based on usage
- Small monthly monitoring and auto-tiering fee
- There are no retrieval charges
How do you decode AWS CLI STS errors?
sts decode-authorization-message
What is the URL for EC2 instance metadata?
169.254.169.254/latest/meta-data
True or False; using EC2 instance metadata you can retrieve the IAM Role name and IAM Policy?
False;
- IAM Role name: YES
- IAM Policy: NO
How do you use MFA with the CLI?
- You must create a temporary session by running the STS GetSessionToken API call:
aws sts get-session-token –serial-number arn-of-the-mfa-device –token-code code-from-token –duration-seconds 3600
What 8 programming languages are the official SDK in?
- Java
.NET
Node.js
PHP - Python
- Go
- Ruby
- C++
What is the API rate limit for DescribeInstances API for EC2?
100 calls per second
What is the API rate limit for GetObject API for S3?
5500 GET per second per prefix
How should you deal with intermittent API rate limit errors?
Implement Exponential Backoff
How should you deal with ConsistentAPI rate limit errors?
Request an API throttling limit increase
What is the service quota for running On-Demand Standard Instances?
1152 vCPU
What type of errors are 5xx errors?
Server errors
What type of errors are 4xx errors?
client errors
True or False; the exponential backoff retry mechanism is already included in the AWS SKD API calls?
True
For the AWS CLI Credentials Provider Chain, the CLI will look for credentials in what order?
1, Command Line options: –region, –output, and –profile
2, Environment Variables - AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and AWS_SESSION_TOKEN
3, CLI credentials file - aws configure
4, CLI configuration file - aws configure
5, Container credentials - for ECS tak
sks
6, Instance profile credentials - for EC2 Instance Profiles
For the AWS SDK Default Credentials Provider Chain, the Java SDK (example) will look for credential in what order?
1, Java system properties - aws.accessKeyId and aws.secretKey
2, Environment variables - AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY
3, The default credentials profile file - ex at: ~/.aws/credentials, shared by many SDKs
4, Amazon ECS container credentials - for ECS containers
5, Instance profile credentials - used on EC2 instances
What should you use to sign AWS HTTP requests?
Signature v4 (SigV4). If you use the SDK or CLI, the HTTP requests are signed for you
What are the 2 types of S3 Lifecycle rules?
- Transition Actions (configure objects to transition to another storage class)
- Expiration Actions (configure objects to expire (delete) after some time
True or False; S3 Lifecycle rules can be created for a certain prefix (eg: s3://mybucket/mp3/*)?
True
True or False; S3 Lifecycle rules can be created for certain object tags (eg, Department: Finance)?
True
True or False; with S3 Event Notifications, object name filtering is possible?
True (*.jpg)
How quick are S3 event notifications typically delivered?
Typically in seconds, but can sometimes take a minute or longer
4 S3 Event notification destinations?
- SQS
- SNS
- Lambda
- EventBridge
Benefits of using EventBridge with S3 Event Notifications?
- Advanced Filtering options with JSON rules (metadata, object size, name)
- Multiple Destinations (Step Functions, Kinesis Streams / Firehose)
- EventBridge Capabilities (Archive, Replay Events, Reliable delivery)
True or False; S3 automatically scales to high request rate, latency 100-200ms?
True
What API limits does S3 have?
Requests per second per prefix:
- 3,500 PUT/COPY/POST/DELETE
- 5,000 GET/HEAD
How to increase the S3 API limits?
Spread requests across multiple prefixes
What is S3 Transfer Accleration?
Increase object upload speed by transferring file to an AWS edge location which will forward the data to the S3 bucket in the target region
True or False; S3 Transfer Acceleration is compatible with multi-part upload?
True
What is S3 Byte-Range Fetches?
Parallelise GETs by requesting specific byte ranges
3 benefits of using S3 Byte-Range Fetches?
- Better resilience in case of failures
- Can be used to speed up downloads
- Can be used to retrieve only partial data (eg, the head of a file)
What is S3 Select and Glacier Select?
- Retrieve less data using SQL by performing server-side filtering
- Can filter by row & columns (simple SQL statements)
- Less network transfer, less CPU cost client side)
Four methods of encrypting objects in S3 buckets?
- Server-Side encryption with Amazon S3-Managed Keys (SSE-S3)
- Server-Side encryption with KMS Keys stored in AWS KMS (SSE-KMS)
- Server-Side encryption with Customer-Provided Keys (SSE-C)
- Client-Side Encryption
For S3 encryption SSE-S3, what header must you set?
“x-amz-server-side-encryption”:”AES256”
2 benefits of using SSE-KMS for S3 encryption?
- User control
- Audit key usage using CloudTrail
For S3 encryption SSE-KMS, what header must you set?
“x-amz-server-side-encryption”:”aws:kms”
True or False; you won’t be impacted by KMS limits when using SSE-KMS?
False; you might be
2 ways to “force encryption” in S3?
- Use a bucket policy and refuse any API call to PUT an S3 object without encryption headers
- Use the “default encryption” option in S3
What is CORS?
- Cross-Origin Resource Sharing
- Same origin: http://example.com/app1 & http://example.com/app2
- Different origins: http://www.example.com & http://other.example.com
- The request won’t be fulfilled unless the other origin allows for the requests, using CORS Headers
What must be enabled to use MFA Delete in S3?
Versioning must be enabled on the bucket
Who can enable/disable MFA delete?
Only the bucket owner (root account)
What are S3 access logs?
- For audit purposes, you may want to log all access to S3 buckets
- Any request made to S3, from any account, authorised or denied, will be logged into another S3 bucket
True or False; for S3 Access Logs, the target logging bucket can be in another region?
False
3 ways you can generate S3 pre-signed URLs?
- S3 console
- AWS CLI
- AWS SDK
What permissions are users given with a pre-signed URL?
They inherit the permissions of the user that generated the URL
Pre-signed URL expiration for URL generated through the S3 console?
1 min - 12 hours
Pre-signed URL expiration for URL generated through the AWS CLI?
- Max 168 hours
- Default 1 hour
What are S3 Access Points?
- Access Points can used used access S3 buckets.
- They can be granted read and / or write access to different buckets
- Making it easier to manage than complex buckete policies
What is S3 Object Lambda?
- Use AWS Lambda Functions to change the object before it is retrieved by the caller application
- Only one S3 bucket is needed on top of which we create an S3 Access Point and S3 Object Lambda Access Points
What CloudFront Origins can you have?
S3 Bucket
Custom Origin (HTTP):
- Application Load Balancer
- EC2 Instance
- S3 Website
- Any HTTP backend you want
What 3 things are CloudFront Caching cache based on?
- Headers
- Session Cookies
- Query String Parameters
How do you invalidate part of a CloudFront Cache?
By using the CreateInvalidation API
True or False; you can maximise CloudFront cache hits by separating static and dynamic content distributions?
True
How can you create Geo Restrictions in CloudFront?
By using an Allowlist or Blocklist
What can you use to distribute paid shared content to premium users over the world?
CloudFront Signed URL / Signed Cookies
True or False; the cost of data out is the same per edge location?
False; it varies per location
What are the 3 CloudFront price classes?
1, Price Class All: all regions - best performance
2, Price Class 200: most regions, but excludes the most expensive regions
3, Price Class 100: only the least expensive regions
What is CloudFront multiple origin?
Used to route to different kinds of origins based on the content type, using path patterns
What are CloudFront Origin Groups?
- Has one primary and one secondary origin, if the primary origin fails, the second one is used
What is CloudFront Field LEvel Encryption?
- Sensitive information is encrypted at the edge, close to the user
- Protects user sensitive information through application stack
- Adds an additional layer of security along with HTTPS
What are the basic steps of creating a docker container?
- Create Dockerfile
- Use Dockerfile to build Docker image
- Use Docker image to run docker container
True or False; on ECS with EC2 Launch Type; you must provision & maintain the infrastructure (the EC2 instances)?
True
On ECS, EC2 Launch Type, what must you run to register the ECS Cluster?
The ECS Agent
True or False; on ECS with Fargate Launch Type; you must provision & maintain the infrastructure (the EC2 instances)?
False, you just create task definitions
How does Fargate work?
- It is serverless
- You just create task definitions
- AWS just runs ECS Tasks for you based on the CPU / RAM you need
- To scale, just increase the number of tasks.
What are ECS Task roles
- Allows each task to have a specific role
- Use different roles for the different ECS services you run
- Task Role is defined in the task definition
Does ECS support load balancer integrations?
Yes, ALB and NLB
True or False; you can mount EFS file systems onto ECS tasks for both EC2 and Fargate launch types?
True
True or False; you can use S3 as a file system for ECS tasks for both EC2 and Fargate launch types?
False; S3 cannot be used as a file system
What is ECS Service Auto Scaling?
Automatically increase / decrease the desired number of ECS tasks
3 types are ECS Service Auto Scaling?
- Target Tracking (scale based on target value for a specific CloudWatch metric)
- Step Scaling (scale based on a specific CloudWatch Alarm
- Scheduled Scaling (scale based on a specified date/time (predictable changes))
What are EC2 Rolling Updates?
When updating from v1 to v2, we can control how many tasks can be started and stopped, and in which order
What are ECS Task Definitions?
Task definitions are metadata in JSON form to tell ECS how to run a Docker container
8 details contained with an ECS Task Definition?
- Image Name
- Port Binding for Container and Host
- Memory and CPU required
- Environmental variables
- Networking information
- IAM Role
- Logging configuration (eg CloudWatch)
How many containers can you define in a task definition?
Up to 10
How does Load Balancing work with ECS - EC2 Launch Type?
- We get a Dynamic Host Port Mapping if you define only the container port in the task definition
- The ALB finds the right port on your EC2 instances
- You must allow on the EC2 instance’s Security Group any port from the ALB’s Security Group
How does Load Balancing work on Fargate?
- Each task has a unique private IP
- Only define the container port (host port is not applicable)
True or False; it is best practice for each ECS Task Definition to have it’s own IAM Role?
True
What are ECS Data Volumes?
- Aloow you to share data between multiple containers in the same Task Definition
- Works for both EC2 and Fargate Tasks
When ECS places task, what process does it use to select container instances?
1, Identify the instances that satisfy the CPU, memory, and port requirements in the task definition
2, Identify the instances that satisfy the task placement constraints
3, Identify the instances that satisfy the task placement strategies
4, Select the instances for task placement
3 ECS Task PLacement Strategies
1, Binpack:
- Place tasks based on the least available amount of CPU or memory
- this minimises the number of instances in use (cost saving)
2, Random:
- Place the task randomly
3, Spread:
- Place the task evenly based on the specified value
True or False; you can mix ECS Task Placement Strategies?
True
What are 2 ECS Task Placement Constraints?
- distinctInstance (place each task on a different container instance)
- memberOf (places task on instances that satisfy an expression, eg, type t2.*. Usese the Cluster Query Language)
What is ECR?
- Elastic Container Registry
- Store and mange Docker images on AWS
- Private and public repository
- Fully integrated with ECS, backed by S3
- Access controlled through IAM
- Supports image vulnerability scanning, versioning, image tags, image lifecycle, …
What is Kubernetes?
Kubernetes is an open-source system for automatic deployment, scaling and management of containerised (usually Docker) application
Kubernetes is cloud-agnostic (can be used in any cloud)
What is EKS?
- Elastic Kubernetes Service
- It is a way to launch managed Kubernetes clusters on AWS
- It’s an alternative to ECS, similar goal but different API
- EKS supports EC2 if you want to deploy worker nodes or Fargate to deploy serverless containers
3 EKS Node Types
1, Managed Node Groups:
- Creates and manages Nodes (EC2 instances) for you
- Nodes are part of an ASG managed by EKS
- Supports On-Demand or Spot Instances
2, Self-Managed Nodes:
- Nodes created by you and registered to the EKS cluster and managed by an ASG
- You can use prebuilt AMI - Amazon EKS Optimised AMI
- Supports On-Demand or Spot Instances
3, AWS Fargate:
- No maintenance required; no nodes managed
What driver do EKS Data Volumes use?
a Container Storage Interface (CSI) compliant driver
What data volume can be used with EKS?
- EBS
- EFS (works with Fargate)
- FSx for Lustre
- FSx for NetApp ONTAP
What is Elastic Beanstalk?
- A managed service for deploying an application on AWS
- Automatically handles capacity provisioning, load balancing, scaling, application health monitoring, instance configuration…
- Just the application code is the responsibility of the developer
- We still have full control over the configuration
What are the Elastic Beanstalk components?
- Application: collection of Elastic Beanstalk component (environments, versions, configurations, …)
- Application Version: an iteration of your application code
- Environment:
– Collection of AWS resources running an pplication version (only one application version at a time)
– Tiers: web server environment tier & worker environment tier
– You can create multiple enviornments (dev, test, prod, …)
9 Elastic Beanstalk supported platforms?
- Go
- Java
- .NET
- Node.js
- PHP
- Python
- Ruby
- Packer Builder
- Docker (single container | Multi-container | Preconfigured)
If not supported, you can write your custom platform (advanced)
6 Options for Elastic Beanstalk Deployment Updates
- All at once (deploy all in one go)
- Rolling
- Rolling with additional batches
-Immutable - Blue / Green
- Traffic Splitting
What is Elastic Beanstalk Deployment - All at once?
- Turn off old, turn on new
- Fastest deployment
- Application has downtime
- Great for quick iteration in development environment
What is Elastic Bean Stalk Deployment - Rolling
- Turn off a few old, replace with new
- Application is running below capacity
- Can set the bucket size
- Application is running both version of the app simultaneously
- No additional cost
- Long deployment
What is the Elastic Beanstalk deployment - Rolling with additional batches
- Rolling, but new versions are added, before old are removed
- Application is running at capacity
- Can set the bucket size
- Application is running both versions simultaneously
- Small additional cost
- Additional batch is removed at the end of the deployment
- Longer deployment
- Good for production environment
What is Elastic Beanstalk Immutable Deployment?
- New app versions are deployed to new instances in a temporary ASG
- If ok, they are merged with the current (original) ASG
- Then the original instances are terminated
- Zero downtime
- High cost, double capacity
- Longest deployment
- Quick rollback in case of failures (just terminate new ASG)
- Great for production
What is Elastic Beanstalk Blue / Green Deployment?
- Not a ‘direct feature’ of Elastic Beanstalk
- Create a new “stage” environment and deploy v2 there
- Use Route 53 to setup weighted policies to redirect a little bit of traffic to the stage environment
- The new environment can be validated independently and roll back if issues
- Zero downtime and release facility
- Use Beanstalk, “swap URLs” when done with the environment test
True or False; Elastic Beanstalk has it’s own CLI?
True: EB CLI
What is the Elastic Beanstalk Deployment Process?
- Describe dependencies (requirements.txt for python)
- Package code
- Console: upload zip file (create new app version), and the deploy
- CLI: create new app version using CLI (uploads zip), and then deploy
- Elastic Beanstalk will deploy the zip on each EC2 instance, resolve dependencies and start the application
What is the Elastic Beanstalk Lifecycle Policy?
- Elastic Beanstalk can store at most 1,000 application versions
- If you don’t remove old versions, you won’t be able to deploy any more
- To phase out old application versions, use a lifecycle policy (based on time or space)
- Versions that are currently used won’t be deleted
- Option not to delete the source bundle in S3 to prevent data loss
What are Elastic Beanstalk Extensions?
- All the parameters set in the UI can be configured with code using files
Requirements:
- must be in the .ebextensions/ directory in the root of source code
- YAML / JSON format
- .config extensions (eg, logging.config)
- Able to modify some default settings using: option_settings
- Ability to add resources such as RDS, ElastiCache, DynamoDB, etc…
Resources managed by .ebextensions get deleted if the environment goes away
What service does Elastic Bean stalk use under the hood?
Elastic Beanstalk relies on CloudFromation
You can define CloudFormation resources in your .ebextensions to provision ElastiCache, an S3 Bcuket, anything you want!
True or False; it is possible to clone an Elastic Beanstalk environment?
True.
- You can clone an environment with the exact same configuration
- Useful for deploying a “test” version of your app
- All resources and configuration are preserved
True or False; after creating an Elastic Beanstalk environment, you can change the ELB type?
False; you have to migrate it
How do you migrate an Elastic Beanstalk app to have a different Elastic Load Balancer type?
1, Create a new environment with the same configuration except LB
2, deploy your application into the new environment
3, perform a CNAME swap or Route53 update
What is best practice for using RDS with Elastic Beanstalk?
- RDS can be provisioned with Beanstalk, which is great for dev / test
- This is not great for prod as the database lifecycle is tied to the Beanstalk environment lifecycle
- The best for prod is to separately create an RDS database and provide our EB app with the connection string
What do you provide to run your application in Elastic Beanstalk as a single Docker container?
Either provide:
- Dockerfile: Beanstalk will build and run the Docker container
- Dockerrun.aws.json(v1): describe where already built Docker image is (Image, Ports, Volumes, Logging etc)
True or FAlse; Beanstalk in Single Docker Container uses ECS?
False
What is Elastic Beanstalk Multi Docker Container?
Multi Docker container helps run multiple containers per EC2 instance in Elastic Beanstalk
What will Elastic Beanstalk Multi Docker Container create for you?
- ECS cluster
- EC2 instances, configured to use the ECS Cluster
- Load Balancer (in high availability mode)
- Task definitions and execution
What is required to create an Elastic Beanstalk Multi Docker container?
- Requires a config Dockerrun.aws.json (v2) file at the root of source code
- Dockerrun.aws.json is used to generate the ECS task definition
- Your Docker images must be pre-built and stored in ECR for example
How do you create your own Elastic Beanstalk Custom PLatform?
- Define an AMI using Platform.yaml file
- Build that platform using the Packer software (open source tool to create AMIs)
In Elastic Beanstalk, what is the difference between Custom Image vs Custom Platform?
- Custom Image is to tweak an existing Beanstalk Platform
- Custom Platform is to create an entirely new Beanstalk Platform
What is CodeCommit
Used for stoing our code
What is CodePipeline?
Used for automating our pipeline from code to Elastic Beanstalk
What CodeBuild?
Used for building and testing our code
What is CodeDeploy?
Used for deploying the code to EC2 instances (not Elastic Beanstalk)
What is CodeStar?
Used to manage software development activities in one place
What is CodeArtifact?
Used to store, publish, and share software packages
What is CodeGuru?
Used to automate code reviews using Machine Learning
What is Continuous Integration (CI)?
- Devlopers push the code to a code repo often (Github, CodeCommit)
- A testing / build server checks the code as soon as it’s pushed (CodeBuild, Jenkins CI)
- The developer gets feedback about the tests and checks that have passed / failed
_ Find bugs early, then fix bugs - Deliver faster as the code is tested
- Deploy often
What is Continuous Delivery (CD)?
- Ensures that the software can be released reliably whenever needed
- Ensure deployments happen often and are quick
- Shift way from “one release every 3 months” to “5 releases a day”
- that usually means automated deployment (eg, CodeDeploy, Jenkins CD)
Features on CodeCommit?
- Private git repositories
- No size limit on repositories
- Fully managed, highly available
- Code only in AWS Cloud account => increased security and compliance
- Security (encrypted, access control)
- Integrated with Jenkins, AWS CodeBuild, and other CI tools
What authorisation does CodeCommit use?
It uses IAM policies to manage users / roles permissions to repositories
What is AWS CodePipeline?
- Visual Workflow to orchestrate your CICD
- Source - CodeCommit, ECR, S3, Bitbucket, Github
- Build - CodeBuild, Jenkins
- Test: CodeBuild, 3rd party tools
- Deploy - CodeDeploy, Elastic Beanstalk, CloudFormation, ECS
- Consists of stages
– Each stage can have sequential actions and / or parallel actions, eg, build -> Test -> Deploy -> Load Testing -> …
– Manual approval can be defined at any stage
Where are CodePipeline artifacts stored?
In S3 buckets
How do pass build instructions to CodeBuild?
Code file buildspec.yml or insert manually in Console
Where can CodeBuild output logs be stored?
S3 or CloudWatchLogs
How can you monitor CodeBuild build statistics?
CloudWatch metrics
How can you detect failed builds and trigger notifications in CodeBuild?
Use CloudWatch Events
What can you use to notify you if you need “threshold” for failures in CodeBuild?
CloudWatch Alarms
9 supported environments for CodeBuild
- Java
- Ruby
- Python
- Go
- Node.js
- Android
- .NET Core
- PHP
- Docker (extend any environment you like)
When using CodeBuild, where must the buildspec.yml file be located?
At the root of your code
True or False; you can run CodeBuild locally on your desktop?
True ( after installing Docker)
- Useful for deep troubleshooting
- Leverage the CodeBuild Agent
By default, your CodeBuild containers are launched inside or outside your VPC?
OUtside - it cannot access resources in a VPC
In CodeBuild can you specify a VPC configuration?
Yes, you can specify:
- VPC ID
- Subnet IDs
- Security Group IDs
Then your build can access resources in your VPC
Which AWS service can be used to automatically deploy our application to many EC2 instances?
CodeDeploy
How does CodeDeploy work?
- Each EC2 Instance / on-premises server must be running the CodeDeploy agent
- The agent is continuously polling AWS CodeDeploy for work to do
- Application + appspec.yml is pulled from Github or S3
- EC2 instance will run the deployment instructions in appspec.yml
- CodeDeploy Agent will report of success/failure of the deployment
In the CodeDeploy appsepc.yml, what are files?
How to source and copy from S3 / Github to filesystem
- source
- destination
In the CodeDeploy appsepc.yml, what are hooks?
Hooks are a set of instructions to deploy the new version (hooks can have timeouts)
In the CodeDeploy appsepc.yml, what is the hooks order?
- ApplicationStop
- DownloadBundle
- BeforeInstall
- Install
- AfterInstall
- ApplicationStart
- ValidateService (important)
4 CodeDeploy configurations:
- One At A Time
- Half At A Time
- All At Once
- Custom
In CodeDeploy, what happens to failures?
- EC2 Instances stay in “Failed” state
- New deployments will first be deployed to failed instances
In CodeDeploy, how to do rollbacks?
To rollback, redeploy old deployment or enable automated rollback for failures
In CodeDeploy, how does a Blue/Green deployment work?
- A new Auto-Scaling Group is created (settings are copied)
- Choose how long to keep the old EC2 instances (old ASG)
- Must be using an ELB
In CodeDeploy, what happens for a rollback?
CodeDeploy redeploys the last known good revision as a new deployment (not a restored version)
What is CodeStar?
-Quickly create “CICD-ready” projects for EC2, LAmbda, Elastic Beanstalk
-An integrated solution that groups: Github, CodeCommit, CodeBuild, CodeDeploy, CloudFormation, CodePipeline, CloudWatch…
What is CodeArtifact?
- Software packages depend on each other to be built (also called code dependencies), and new ones are created
- Storing and retrieving these dependencies is called artifact management
- CodeArtifact is a secure, scalable, and cost-effective artifact management for software development
What is CodeGuru?
An ML-powered service for automated code reviews and application performance recommendations
What two functionalities does CodeGuru provide:
- CodeGuru reviewer: automated code reviews for static code analysis (development)
- CodeGuru Profiler: visibility/recommendations about application performance during runtime (production)
What programming languages does CodeGuru reviewer support?
What programming languages does CodeGuru reviewer support?
- Java
- Python
What is CloudFromation?
- CloudFormation is a declarative way of outlines your AWS Infrastructure, for any resources (most of them are supported)
- Within a CloudFormation template you define what resources you want
- Then CloudFormation creates those for you, in the right order, with the exact configuration that you specify
Benefits of using CloudFormation?
Infrastructure as code:
- No resources are manually created, which is excellent for control
- The code can be version controlled
- Changes to the infrastructure are reviewed through code
Cost:
- Each resource with the stack is tagged with an identifier so you can easily see how much as stack costs you
- You can estimate the costs of your resources using CloudFormation template
-Savings strategy: In Dev, you could automate deletion of templates at 5PM and recreate at 8AM, safely
Productivity:
-Ability to destroy and re-create an infrastructure in the cloud on the fly
- Automated generation of Diagram for your templates
Declarative programming (no need to figure out ordering and orchestration)
Separation of concern: create many stacks for many apps, and many layers, eg:
- VPC stacks
- Network stacks
- App stacks
Don’ re-invent the wheel:
- Leverage existing templates on the web
- Leverage the documentation
How odes CloudFormation work?
- Templates have to be uploaded in S3 and then referenced in CloudFormation
- To update a template, we can’t edit previous ones. We have to re-upload a new version of the template to AWS
- Stacks are identified by a name
- Deleting a stack deletes every single artifact that was created by CloudFormation
How can you deploy CloudFormation templates?
Manually:
- Editing templates in the CloudFormation Designer
- Using the console to input parameters etc
Automated:
- Editing templates in a YAML file
- Using the AWS CLI to deploy the templates
- Recommended way when you fully want to automate your flow
What are 6 CloudFormation Templates?
1, Resources: your AWS resources declared in the templated (MANDATORY)
2, Parameters: the dytnamic inputs for your template
3, Mappings: the static variables for your template
4, Outputs: References to what has been created
5, Conditionals: List of conditions to performa resource creation
6 Metadata
What are CloudFormation resources?
- Resources are the core of your CloudFormation Template (MANDATORY)
- They represent the different AWS Components that will be created and configured
- Resources are declared and can reference each other
- AWS figures out create, updates and deletes of resource for us
What is the form of CloudFormation resource type identifiers?
AWS::aws-product-name::data-type-name
In CloudFormation templates, what are parameters?
- Parameters are a way to provide inputs to your AWS CloudFormation template
- They important if you want to reuse your templates across the company or some inputs can’t be determined ahead of time
How to reference a parameter in a CloudFormation template?
- Parameters can be used anywhere in a template
- The shorthand for this in YAML is !Ref
- The function can also reference other elements within the template
What are Pseudo parameters in CloudFormation templates and give some examples?
- AWS offers us pseudo parameters in any CloudFormation template
- These can be used at any time and are enabled by default
Egs:
- AWS::AccountId
- AWS::NotificationARNs
- AWS::NoValue
- AWS::Region
- AWS::StackId
- AWS::StackName
What are mappings in a CloudFormation template?
- Mappings are fixed variables within your CloudFormation template
- They’re handy to differentiate between different environments (dev vs prod), regions, AMI types etc
What are mappings in a CloudFormation template?
- Mappings are fixed variables within your CloudFormation template
- They’re handy to differentiate between different environments (dev vs prod), regions, AMI types etc
- All the values are hardcoded within the template
When to use mappings vs paramets in a CloudFormation template?
Mappings are great when you know in advance all the values that can be taken and that they can be deducted from variables such as:
- Region
- Availability Zone
- AWS Account
- Environment
- Etc
How do you access mapping values in a CloudFormation template?
- We use Fn::FindInMap to return a named value from a specific key
- !FindInMap [ MapName, TopLevelKey, SecondLevelKey ]
What are outputs in CloudFormation templates?
- The outputs sections declares optional output values that we can import into other stacks
- You can also view the outputs in the AWS Console or using the AWS CLI
- It’s the best way to perform some collaboration cross stack, as you let experts handle their own part of the stack
- You can’t delete a CloudFormation Stack if its outputs are being referenced by another CloudFormation stack
What are conditions in CloundFormation templates used for?
- Conditions are used to control the creation of resources or outputs based on a condition
What are 7 must know CloundFormation template intrinsic functions?
- Ref
- Fn::GetAtt
- Fn::FindInMap
- Fn::ImportValue
- Fn::Join
- Fn::Sub
- Condition Functions (Fn::If, Fn::Not, Fn::Equals, etc)
What happens on CloundFormation rollbacks?
Stack Creation Fails:
- Default: everything rolls back (gets deleted). We can look at the log
- Option to disable rollback and troubleshoot what happened
Stack update fails:
- The stack automatically rolls back to the previous known working state
- Ability to see in the log what happened and error messages
In CloundFormation what are ChangeSets?
- When you update a stack, you need to know what changes before it happens for greater confidence
- ChangeSets won’t say if the update will be successful
In CloudFormation what are Nested stacks?
- Nested stacks are stacks as part of other stacks
- They allow you to isolate repeated patterns / common components in separate stacks and call them from other stacks
- Examples: load balancer configuration that is re-used or security group that is re-used
- Nested stacks are considered best practice
- To update a nested stack, always update the parent (root stack)
CloundFormation, when to use Cross stacks vs Nested stacks?
Cross stacks:
- Helpful when stacks have different lifecycles
-Use Output Export and Fn::ImportValue
- When you need to pass export values to many stacks (VPC Id, etc…)
Nested Stacks:
- Helpful when components must be re-used
- Eg: how to properly configure an ALB
- The nested stack only is important to the higher level stack (it’s not shared)
What are CloundFormation StackSets?
- Create, update, or delete stacks across multiple accounts and regions with a single operation
- Administrator account to create StackSets
- Trusted accounts to create, update, delete stack instances from StackSets
- When you update a stack seyt, all associated stack instances are updated throughout all accounts and regions
What is CloundFormation drift?
- Helps protect you against manual configuration changes
- It allows you to see if your resources have changed since they where created
3 ways of monitoring in AWS?
AWS CloudWatch:
- Metrics: Collect and track key metrics
- Logs: Collect, monitor , analyse and store log files
- Events: send notifications when certain events happen in yout AWS
- Alarms: React in real-time to metrics /events
AWS X-Ray:
- Troubleshoot application performance and errors
- Distributed tracing of microservices
AWS CloudTrail:
- Internal monitoring of API calls being made
- Audit changes to AWS REsources by your users
What is CloudWatch Metrics:
- CloudWatch provides metrics for every service in AWS
- Metric is a variable t monitor
- Metrics belong to namespaces
- Dimension is an attribute of a metric
What are CloudWatch custom metrics?
- Possibility to define and send your own custom metrics to CloudWatch
What API call do you use to create CloudWatch custom metrics?
PutMetricData
5 AWS resources where CloudWatch Logs can send logs to?
- S3
- Kinesis Data Streams
- Kinesis Data Firehose
- AWS LAmbda
- ElasticSearch
What are CloudWatchLogs Metric Filter & Insights?
- CloudWatch Logs can use filter expressions
- They can be used to trigger CloudWatch alarms
- CloudWatch Logs Insights can be used to query logs and add queries to CloudWatch DashBoards
How long does Log data take to be available to export to S3?
- Up to 12 hours
- Not near real time or real- time … use Log Subscriptions instead
How do CloudWatch Logs works for Ec2?
- By default, no logs from your EC2 machine will go to CloudWatch
- You need to run a CloudWatch agent on EC2 to push the log files you want
- Make sure IAM permissions are correct
What is the CloudWatch Logs Agent & Unified Agent?
- For virtual servers (EC2, on-premises servers…)
CloudWatch Logs Agent:
- Old version of the agent
- Can only send to CloudWatch Logs
CloudWatch Unified Agent:
- Collect additional system-level metrics such as RAM, processes, etc
- Collect logs to send to CloudWatch Logs
- Centralised configuration using SSM Parameter Store
What metrics are collected by the CloudWatch Unified Agent?
- CPU (active, guest, idle, system, user, steal)
- Disk metrics (free, used, total), Disk IO (writes, reads, byres, IOPS)
- RAM (free, inactive, used, total, cached)
- Netstat (number of TCP and UDP connections, net packets, bytes)
- Processes (Total, dead, blocked, idle, running, sleep)
- Swap Space (free, used, used %)
Do CloudWatch Logs Metric Filter work on past data or new data?
CloudWatch Logs Metric Filter do not retroactively filter data, Filters only publish the metric data points for event that happen after the filter was created
What are the 3 CloudWatch Alarms alarm states?
- OK
- INSUFFICIENT_DATA
- ALARM
What is the CloudWatch Alarm period?
The length of time in seconds to evaluate the metric
What are 3 CloudWatch Alarm targets?
- Stop, Terminate, Reboot or Recover an EC2 instance
- Trigger Auto Scaling Action
- Send notification to SNS (from which you can do pretty much anything)
What are CloudWatch Alarms - Composite Alarms?
- CloudWatch Alarms are on a single meteric
Composite Alarms are monitoring the states of multiple other alarms - AND and OR conditions
- Helpful to reduce “alarm noise” by creating complex composite alarms
What are CloudWatch Alarms - Composite Alarms?
- CloudWatch Alarms are on a single meteric
Composite Alarms are monitoring the states of multiple other alarms - AND and OR conditions
- Helpful to reduce “alarm noise” by creating complex composite alarms
3 types of Event Buses for EventBridge?
- Default Event Us: generated by AWS services (CloudWAtch EVents)
- Partner Event Bus: received events from Saas service or applications
- Custom Event Bus - for your own applications
True or False; EventBridge gives you the ability to replay archived events?
True
What is EventBridge schema registry?
- EventBridge can analyse the events in your bus and infer the schema
- The Schema Registry allows you to generate code for your application, that will know in advance how data is structured in the event bus
- Schema can be versioned
What is the difference between Amazon EventBridge and CloudWAtch Events?
- Amazon EventBridge builds upon and extends CloudWAtch Events
- It uses the same service API and endpoint, and the same underlying service infrastructure
- EVentBridge allows extension to add event buseses for your custom applications and your third party SaaS apps
- EventBridge has the Schema Registry capability
- EventBridge has a different - Over time, the CloudWAtch Events name will be replaced with EventBridge
Which AWS services is X-Ray compatible with (6)?
- LAmbda
- Elastic Beanstalk
- ECS
- ELB
- API Gateway
- EC2 instances or any application server (even on-premies)
In AWS X-Ray, what is Tracing?
- Tracing is an end to end way to follow a “request”
- Each component dealing with the request adds its own “trace”
- Tracing is made of segments (+ sub segments)
- Annotations can be added to traces to provide extra-information
How do you enable AWS X-RAy?
2 ways:
1, Your code must import the AWS X-Ray SDK:
- Very little code required
2, Install the X-Ray daemon or enable X-Ray AWS Integration
What can you do to troubleshoot, if X-Ray is not working on EC2?
- Ensure the EC2 IAM Role has the proper permissions
- Ensure the EC2 instance is running the X-Ray Daemon
How to enable X-Ray on AWS Lambda?
- Ensure it has an IAM execution role with proper policy (AWSX-RayWriteOnlyAccess)
- Ensure that X-Ray is imported in the code
What is instrumentation?
Instrumentation means the measure of product’s performance, diagnose errors, and to write trace information
In AWS X-Ray, what are segments and subsegments?
- Segments: each application / service will send them
- Subsegments: if need more details in your segments
In AWS X-Ray, what is a trace?
A trace are segments collected together to form an end-to-end trace
In AWS X-Ray, what are annotations?
Annotation are key value pairs used to index traces and use with filters
Using the X-Ray SDK, what is recorded by default?
By default the X-Ray SDK records the first request each second, and five percent of any additional requests
True or False; Elastic Beanstalk includes the X-Ray daemon?
True
How can you run the X-Ray daemon with Elastic Beanstalk?
You can run the daemon by setting an option in the Elastic Beanstalk console or with a configuration file (in ebextensions/xray-daemon.config)
What is CloudTrail?
- Provides governance, compliance and audit for your AWS Account
- Get a history of events / API calls made within your AWS Account by: Console / SDK / CLI / AWS Services
True or False; CloudTrail is enabled by default?
True
Where can you put CloudTrail logs?
CloudWatch Logs or S3
CloudTrail trails can be applied to All Regions or a single Region?
Both; all regions is default
If a resource is deleted in AWS, where is the first place to investigate?
CloudTrail
What are the two types of CloudTrail events?
- Management events
- Data events
What are CloudTrail Management events?
- Operations that are performed on resources in your AWS account
- By default trails are configured to log management events
- Can separate Read events from write events
What are CloudTrail Insights?
CloudTrail Insights analyses normal management events to create a baseline, and then continuously analyses write events to detect unusual patterns or activity in your account:
- inaccurate resource provisioning
- hitting service limits
- Bursts of AWS IAM actions
Gaps in periodic maintenance activity
How long are events sytored for in CloudTrail?
- EVents are stored for 90 days in CloudTrail
- To keep events beyond this period, log them to S3 and use Athena
What is the difference between CloudTrail vs CloudWatch vs X-Ray?
CloudTrail:
- Audit API calls made by users / services / AWS Console
- Useful to detect unauthorised calls or root causes of changes
CloudWatch:
- CloudWatch Metrics over time for monitoring
- CloudWatch Logs for storing application logs
- CloudWatch Alarms to send notifications in case of unexpected metrics
X-Ray:
- Automated Trace Analysis & Central Service Map Visualisation
- Latency, Errors and Fault analysis
- Request tracking across distributed systems
What is the difference between synchronous and asynchronous communications?
- Synchronous communication is direct: application to application
- Asynchronous is not direct: app to queue to app
How can you decouple your applications in AWS?
- SQS: queue model
- SNS: pub/sub model
- Kinesis: real-time streaming model
How do SQS queues work?
-Producers send messages to the SQWS queue
- Consumers poll for messages in the queue
What attributes does SQS - Standard queue have?
- Unlimited throughput, unlimited number of messages in queue
- Default retention of messages: 4 days, maximum 14 days
- Low latency (10 ms on publish and receive)
- Limitation of 256KB per message sent
Can you have duplicate messages in SQS Standard Queue?
Yes, you can have duplicate messages (at least once delivery, occasionally)
In SQS standard queue, are messages in order?
Can have out of order messages (best effort ordering)
How are SQS messages consumed?
Consumers:
- Poll SQS for messages (receive up to 10 messages at a time)
- Process the messages
- Delete the messages using the DeleteMessage API
What is the CloudWAtch Metric to get an SQS Queue length?
ApproximateNumberOfMessages
How is security managed for SQS?
Encryption:
- Insliflight encryption using HTTPS API
- At-rest encryption using KMS keys
- Client-side encryption if the client wants to perfrom encryption/decryption themselves
Access Controls:
- IAM policies to regulate access to the SQS API
SQS Access Policies (similiar to S3 bucket policies):
- Useful for cross-account access to SQS queues
- Useful for allowing other services to write to an SQS queue
What is the default message visibility timeout for an SQS queue?
30 seconds
How can a consumer get more time to process a message in SQS?
Call the ChangeMessageVisibility API to get more time (increase Visibility timeout)
What are Dead Letter Queues for SQS?
- If a consumer fails to process a message within the Visibility Timeout - the message goes back to the queue
- We can set a threshold of how many times a message can go back to the queue
- After the MaximumReceives threshold is exceeded, the message goes into a dead letter queue
- Dead Letter Queues are a type of SQS queue
- A deadletter Queue of a FIFO queue must also be a FIFO queue
- A Dead Letter Queue of a standard queue must also be a Standard Queue
How do you send messages from the Dead Letter Queue back to the source queue (or any other queue)?
Redrive to source
What is SQS Delay Queue?
- Delay a message (consumers don’t see it immediately) up to 15 minutes
- Default is 0 seconds
Is it possible to override the default SQS Delay Queue?
Yes, using the DelaySeconds parameter
What is the message size limit in SQS?
256KB
How do you send messages larger than 256KB in SQS?
By using the SQS Extended Client (Java Library)
What is the maximum throughput when using SQS FIFO queues?
300 msg/s with batching, 3000 msg/s with batching
How many times are SQS FIFO queue messages sent?
Exactly-once (no duplicates)
What is the SQS FIFO Deduplication interval
5 minutes
What are two SQS FIFO Deduplication methods?
- Content-based deduplication: will do a SHA-256 hash of the message body
- Explicitly providing a Message Duplication ID
How does SQS FIFO Message Grouping work?
- If you specify the same value of MessageGroupID in an SQS FIFO queue, you can only have one consumer, all the messages are in order
- To get ordering at the level of a subset of messages, specify different values of MessageGroupID
- Messages that share a common Message Group ID will be in order within a group
- Each Group ID can have a different consumer (parallel processing)
- Ordering across groups is not guaranteed
What is SNS?
- The “event producer” only sends message to one SNS topic
- As many “event receivers” (subscriptions) as we want to listen to the SNS topic notifications
- Each subscriber to the topic will get all the messages
How to do publish in SNS?
Topic Publish:
- Create a topic
- Create a subscription (or many)
- Publish to the topic
Direct Publish (for mobile app SDK):
- Create a platform application
- Create a platform endpoint
- Publish to the platform endpoint
- Work with Google GCM, Apple APNS, Amaazon ADM…
What is SNS + SQS fan out?
- Push once in SNS, receive in all SQS queues that are subscribers
- Fully decoupled, no data loss
- Cross-REgion Delivery, works with SQS queues in other regions
What is SNS FIFO Topic?
- First-in-First-out (ordering of messages in the topic)
- Similar features as SQS FIFI (ordering by MEssage Group ID and Deduplication)
- CAn only have SQS FIFO queues as subscribers
- Limited throughput (same throughput as SQS FIFO)
True or False; you can filter messages sent to SNS topic’s subscriptions?
True
What is Kinesis?
- Makes it easy to collect, process and analyse streaming data in real-time
- Ingest real-time data such as: Application logs, metrics, Website clickstreams, IoT telemtry data
What is Kinesis Data Streams?
capture, process and store data streams
- ability to reprocess (replay) data
- Once data is inserted in Kinesis, it can’t be deleted (immutability)
- Data that shares the same partition goes to the same shard (ordering)
What is Kinesis Data Firehose?
load data streams into AWS data stores
What is Kinesis Data Analytics?
analyse data streams with SQL or Apache Flink
What is Kinesis Video Streams?
capture, process and store video streams
What are the two Kinesis Data Streams capacity modes?
- Provisioned mode
- On-demand mode
What is the Kinesis Data Streams provisioned capacity mode?
- You choose the number of shared provisioned, scale manually or using API
- Each shard get 1MB/s in (or 1000 records per second)
- Each shared get 2MB/s out (classic or enhanced fan-out consumer)
- You pay per shard provisioned per hour
What is the Kinesis Data Streams On-demand mode?
- No need to provision or manage the capacity
- Default capacity provisioned (4 MB/s in or 4000 records)
- Scales automatically based on observed throughput peak during the last 30 days
- Pay per stream per hour & data in/out per GB
What do Kinesis Data Streams data record consist of (3)?
- Sequence number (unique per partition-key within shard)
- Partition key (must specify while put records into stream
- Data blob (up to 1mb)
What is the write throughput for Kinesis Data Streams?
1 MB/sec or 10,000 records/sec per shard
How do you reduce costs & increase throughput in Kinesis Data Streams?
Use batching with PutRecords API
In Kinesis Data Streams how do you avoid a “hot partition”?
Use highly distributed partition key
3 solutions to ProvisionedThroughputExceeded errors in Kinesis Data Streams?
- Use highly distributed partition key
- Retries with exponential backoff
- Increase shards (scaling)
2 types of Kinesis Data Streams consumer types?
- Shared (Classic) Fan-out Consumer - pull
- Enhanced Fan-out consumer - push
For the Kinesis Shared (Classic) Fan-out Consumer, how many consuming applications can you have?
Low number
For the Kinesis Shared (Classic) Fan-out Consumer what is the read throughput?
2 MB/sec per shared across all consumer
For the Kinesis Shared (Classic) Fan-out Consumer what is the max. GetRecords API calls/sec?
5
For the Kinesis Shared (Classic) Fan-out Consumer what is the latency?
~200ms
For the Kinesis Shared (Classic) Fan-out Consumer how do consumers poll data?
Using the GetRecords API call
For the Kinesis Shared (Classic) Fan-out Consumer how much data is returned?
Returns up to 10 MB (then throttle for 5 seconds) or up to 10,000 records
For the Kinesis Enhanced Fan-out Consumer how many application can connect?
Multiple applications for the same stream
For the Kinesis Enhanced Fan-out Consumer what is the read throughput?
2 MB/sec per consumer per shard
For the Kinesis Enhanced Fan-out Consumer what is the latency?
~70ms
For the Kinesis Enhanced Fan-out Consumer how is data pushed to consumers?
over HTTP/2 (SubscribeToShard API)
For the Kinesis Enhanced Fan-out Consumer what is the limit of consumer applications (KCL) per data stream (default)
soft limit of 5
When lambda is a consumer on Kinesis Data Streams, how many batches can be processed?
Can process up to 10 batches per shard simultaneously
What is the Kinesis Client Library(KCL)?
- A Java library that helps read record from a Kinesis Data Stream with distributed aplications sharing the read workload
- Each is to be read by only one KCL instance
- Progress is checkpointed into DynamoDB
- Track other workers and share the work amongst shards using DynamoDB
- KCL can run on EC2, Elastic Beanstalk and on-premises
- Records are read in order at the shard level
In Kinesis Data Streams, what is Shared Splitting?
- Used to increase the Stream capacity
- Use to divide a “hot shard”
- The old shard is closed and will be deleted once the data is expired
- Can’t split into more than two shards in a single operation
In Kinesis Data Streams what is Merging Shards?
- Cecrease the Steam capacity asnd save costs
- Can be used to group two shards with low traffic (cold shards)
- Old shards are closed and will be deleted once the data is expired
- Can’t merge more than two shards in a single operation
What is Kinesis Fire Hose?
- loads data streams into AWS data stores
- Fully managed service
- Pay for data going through Firehose
- Near Real Time
- Supports many data formats, conversions, transformations, compression
- Supports custom data transformations using AWS Lambda
Kinesis Fire Hose is real-time?
No, it is NEAR real-time
Where can Kinesis Firehose send data to?
AWS:
- Redshift
- S3
- ElasticSearch
3rd PArty partner:
- Splunk
- MongoDB
- DataDog
Cusom:
- To any HTTP endpoint
What is Kinesis Data Analytics?
- Real-time analytics on Kinesis Data Streams & Firehose using SQL
- Add reference data from S3 to enrich streaming data
- Fully managed
- Automatic scaling
- Pay for actual consumption rate
What sources and destinations are available for Kinesis Data Analytics?
Kinesis Data Streams and Kinesis Fire Hose for both Sources and Destinations
How are you charged for using AWS Lambda?
- Pay per request and compute time
- Free tier of 1,000,000 Lambda requests and 400,000 GBs of computer time
How do you expose a Lambda function as a HTTP(S) endpoint?
- You can use the Application Load Balancer or an API Gateway
- The Lambda function must be registered in a target group
How are ALB Multi-Header Values shown within the AWS Lambda event and response objects?
HTTP headers and query string parameters that are sent with multiple values are shown as arrays
True or False; you can use Lambda@edge to change CloudFront requests and responses?
True
What are Lambda asynchronous invocations?
- Lambda reads events from an Event queue
- Lambda attempts to retry on errors, using exponential backoff
3 examples of Lambda asynchronous invocations using AWS services?
- S3
- SNS
- CloudWatch Events / EventBridge
What is Lambda Event Source Mapping?
- Kinesis Data Streams, SQS queues and DynamoDB Streams need to be polled
- The results of the polling go into the event source mapping, which is a queue
- When there are items in the event source mapping queue, your lambda function is invoked synchronously with the event batch
With Streams and Lambda, how are errors handled?
- By default, if your function returns an error, the entire batch is reprocessed until the function succeeds, or the items in the batch expire
- To ensure in-order processing, processing for the affected shard is paused until the error is resolved
- You can configure the event source mapping to discard old events, restrict the number of retries and split the batch on error
For Lambda event source mapping with SQS queues, what the the recommended length of the queue visibility timeout?
6x the timeout of your lambda function
How doe scaling work with Lambda Event Mapper foreach different input service?
Kinesis Data Streams & DynamoDB Streams:
- One lambda inovation per stream shard
- If you use parallelization, to to 10 batches processed per shard simultaneously
SQS Standard:
- Lambda adds 60 more instances per minute to scale up
- Up to 1000 batches of messages processed simultaneously
SQS FIFO:
- Messages with the same GroupID will be processed in order
- The Lambda function scales to the number of active message groups
What is the Lambda Execution Role?
An IAM Role that grants the lambda function permissions to AWS services / resources
When you use an event source mapping to invoke your function, Lambda uses the execution role to read event data
Best practice is to create one Lambda Execution Role per function
What are Lambda resource based policies?
- Use resource-based policies to give other accounts and AWS services permissions to use your Lambda resources
- Similar to S3 bucket policies for S3 buckets
What are Lambda environment variables?
- Environment variables are key / value pairs in “String” form
- Environment variables are available to your code
-Helpful to store secrets (encrypted by KMS) - Secrets can be encrypted by trhe Lambda service key, or your own CMK
Where are Lambda execution logs stored?
CloudWatch logs.
Make sure your AWS Lambda function has an execution role with an IAM policy that authorises writes to CloudWatch Logs
How to enable Lambda tracing with X-Ray?
- Enable in Lambda configuration (Active Tracing)
- Runs the X-Ray daemon for you
- use AWS X-Ray SDK in code
- Ensure Lambda function has a correct IAM execution role - the managed policy is called AWSXRayDaemonWriteAccess
By default, is your Lambda function is launched inside or outside of your own VPC?
- Outside
- Therefore it cannot access resources in your VPC
How do you allow a Lambda function to access your VPC?
- You must define the VPC ID, the Subnets and the Security Groups
- Lambda will create an ENI (Elastic Network Interface) in your subnets
- AWSLambdaVPCAccessExecutionRole
How can you give a Lambda function in a VPC internet access?
- A LAmbda function in your VPC does not have internet access
- Deploying a Lambda function in a public subnet does not give it internet access or a public IP
- Deploying a Lambda function in a private subnet gives it internet access if you have a NAT Gateway / Instance
- You can use VPC endpoints to privately access AWS services without a NAT
What should you do if your lambda is CPU-bound (computation heavy)?
Increase RAM
Can you increase RAM in Lambda?
Yes
- From 128MB to 10GB in 1MB increments
- The more RAM you add, the more vCPU credits you get
- At 1,792 MB, a function has the equivalent of one full vCPU
- After 1,792 MB, you get more than one CPU, and need to use multi-threading in your code to benefit from it
What is the default and max. timeout for Lambda executions?
- Default = 3 seconds
- Max. is 900 seconds (15 mins)
What is the Lambda Execution Context?
- Basically it is the code outside the handler
- It is a temporary runtime environment that initialses asny exteneral dependencies of your lambda code
- Great for database connections, HTTP clients, SDK clients…
- The execution context is maintained for some time in anticipation of another LAmbda function invocation
- The next functioninvocation can “re-use” the context to execution time and save time in initialising connection objects
- The execution context includes the /tmp directory
What is the Lambda Execution Context?
- Basically it is the code outside the handler
- It is a temporary runtime environment that initialses asny exteneral dependencies of your lambda code
- Great for database connections, HTTP clients, SDK clients…
- The execution context is maintained for some time in anticipation of another LAmbda function invocation
- The next functioninvocation can “re-use” the context to execution time and save time in initialising connection objects
- The execution context includes the /tmp directory
What can you use if your lambda function needs to download a big file or needs disk space to p[erform operations?
-You can use the /tmp directory
- MAx size is 10GB
- The directory content remains when the execution context is frozen, providing transient cache that can be used for multiple invocations
- For permanent persistence of object , use S3
How many concurrent lambda invocations can you have?
-Up to 1000
- You can set a “reserved concurrency” limit for each lambda function
- Each invocation over the concurrency limit will trigger a “throttle”
What happens with lambda concurrency and asynchronous invocations?
- If the function doesn’t have enough concurrency available to process all event, additional requests are throttled
- For throttling errors (429) and system errors (5xx), Lambda returns the event to the queue and attempts to run the function again for up to 6 hours
- The retry interval increases exponentially from 1 second up to a max. of 5 mins
How do you manage your lambda function if it has dependencies?
- You need to install the packages alongside your code and zip it together
- Upload the zip straight to lambda if less than 50MB, else to S3
- AWS SDK comes by default with every lambda function
2 ways in which we can use CloudFormation to upload a Lambda function?
Inline:
- inline functions ar every simple
- Use the Code.ZipFile property
- You cannot include function dependencies withi inline functions
Through S3:
- You must store the Lambda zip in S3
- You must refer the S3 zip location in the CloudFormation template
What are 2 use-cases for Lambda layers?
- Creating custom runtimes, eg, c++ or Rust
- Externalizing dependencies to re-use them
What are Lambda container images?
- Deploy Lambda functions as container images of up to 10GB from ECR
- Pack complex dependencies, large dependencies in a container
- Can create your own image as long as it implement the Lambda Runtime API
How do Lambda versions work?
- When you work on a Lambda function, we work on $LATEST
- When we’re ready to publish a Lambda function, we create a version
- Versions are immutable
- Versions have increasing version numbers
- Versions get their own ARN
- Version = code + configuration
- Each version of the lambda function can be accessed
How do Lambda aliases work?
- Aliases are “pointers” to Lambda function versions
- We can define a “dev”, “test”, “prod” aliases and have them point at different lambda versions
- Aliases are mutable
- Aliases enable blue / green deployments
- Aliases have their own ARNs
- Aliases cannot reference aliases
How can you automate traffic shift for Lambda aliasses?
- Use CodeDeploy
- Feature is integrated within the SAM framework
- Can create Pre & Post Traffic hooks to check the health of the Lambda function
What are the Lambda limits (per region) for: memory allocation?
128 - 10GB (1MB increments)
What are the Lambda limits (per region) for: max. execution time?
900 seconds (15 mins)
What are the Lambda limits (per region) for: environment variable size?
4KB
What are the Lambda limits (per region) for: Disk capacity in the “function container” (in/tmp)?
512MB to 10GB
What are the Lambda limits (per region) for: concurrency executions?
1000 (can be increased)
What are the Lambda limits (per region) for: KAmbda function deployment size (compressed zip)?
50MB
What are the Lambda limits (per region) for: size of uncompressed deployment (code + dependencies)?
250MB
How do NoSQL databases scale?
horizontally
How big can DynamoDB scale to?
- Millions of requests per second
- Trillions of rows
- 100s of TB of storage
Two types of table class for DynamoDB?
- Standard
- Infrequent Access (IA)
Do DynamoDB tables have primary key?
Yes, must be decided at creation time
Max. item size in DynamoDB?
400KB
What data types are supported in DynamoDB?
- Scalar tpyes: string, number, binary, boolean, null
- Document types: list, map
- Set types: string set, number set, binary set
What options do you have for primary keys in DynamoDB?
Option 1: Partition Key (HASH):
- Partition key must be unique for each item
- Partition key must be “diverse” so that the data is distributed
- Eg, “User_ID” for a users table
Option 2: Partition Key + Sort Key (HASH + RANGE):
- The combination must be unique for each item
- Data is grouped by partition key
- Eg: users-games table, “User_ID” for PArtition Key and “Game_ID” for sort key
What are the two Read/Write capacity modes?
- Provisioned Mode (Default)
- On-demand mode
You can switch between different modes once every 24 hours
What is the DynamoDB provisioned mode?
- You specify the number of reads/write per second
- You need to plan capacity beforehand
- Pay for provisioned read & write capacity units
- Option to setup auto-scaling of throughput to meet demand
- throughput can be exceeded temporarily using “Burst capcity”
- If burst capcity has been consumed, you’ll get a “ProvisionedThroughputExceededException”
- Then its advised to do an exponential backoff
What is the DynamoDB On-Demand mode?
- Read/writes automatically scale up/down with your workloads
- No capacity planning needed
- Pay for what you use, more expensive
How do dynamoDB Write Capacity Units (WCU) work?
- 1 WCU represents 1 write per second for an item up to 1KB in size
- If the items are larger than 1KB, more WCUs are consumed
For DynamoDB, how many WCUs do we need in this example:
We write 10 items per second, with item size 2KB
10 x (2KB / 1KB) = 20WCUs
For DynamoDb, how many WCUs do we need in this example:
we write 6 items per second, with item size 4.5KB
6 x (5kb / 1KB) = 30 WCUs
For DynamoDb, how many WCUs do we need in this example:
we write 120 items per minute, with item size 2KB
(120 / 60) * (2KB / 1KB) = 4 WCUs
In DynamoDB, what are eventually consistent reads and strongly consistent reads?
Eventually Consistent Reads (default):
- If we read just after a write, it’s possible we’ll get some stale data because of replication
Strongly Consistent Read:
- If we read just after a write, we will get the correct data
- Set “ConsistentRead” parameter to True, in API calls (GetITem, BatchGetITem, Query, Scan)
- Consumes twice the RCU
In DynamoDB, how do Read Capacity Units (RCU) work?
- One RCU represents one Strongly Consistent Read per second, or two Eventually Consistent Reads per second, for an item up to 4KB in size
- If the items are larger than 4KB, more RCU is are consumed
For DynamoDB, how many RCUs do we need in this example:
10 Strongly Consistent reads per second, with item size 4KB
10 x (4KB / $KB) = 10 RCUs
For DynamoDB, how many RCUs do we need in this example:
16 Eventually Consistent reads per second, with item size 12KB
(16 / 2) x (12KB / 4KB) = 24 RUCs
For DynamoDB, how many RCUs do we need in this example:
10 Strongly Consistent reads per second, with item size 6KB
10 x (8KB / 4 KB) = 20 RCUs - we must round up from 6KB to 8KB)
What are the reasons and solutions to trottling in DynamoDB?
If we exceed provisioned RCUs or WCUs, we get “ProvisionedThroughputExceededException”
Reasons:
- Hot keys: one partition key is being read too many times (eg popular item)
- Hot partitions
- Very large item,: remember RCU and WCU depends on the size of items
Solutions:
- Exponential back-off
- Distributed partition keys as much as possible
- If RCU issue, we can use DynamoDB Accelerator (DAX)
What DynamoDB API calls can be used to write data?
PutITem
- Create a new item or fully replaces an old item (same primary key)
- Consumes WCUs
UpdateItem
- Edits an existing item’s attributes or adds a new item if it doesn’t exist
- CAn be used to implement Atomic Counters- a numberic attribute that’s unconditionally incremented
ConditionalWrites:
- Accept a write/update/delete only if conditions are met, otherwise returns an error
- Helps with concurrent access to items
What DynamoDB API calls can be used to read data?
GetITem:
- Read based on Primary Key
- Eventually Consistent Read ((default)
- ProjectionExpression can be specified to retrieve only certain attributes
How do you query data in DynamoDB?
Query reyruns items based on:
KeyConditionExpression:
- Partition key value (must be - operator) - required
- Sort key value (=,<,<=<>,>=,Between,Begins with) - optional
FilterExpression:
- Additional filtering after the query operation (before data is returned to you)
- Use only with non-key attributes (does not allow HASH or RANGE attributes)
Return the number of items specified in Limit, or up to 1MB of data
Can query table, a Local Secondary Index, or a Global Secondary Index
How does Reading Data (Scan) for DynamoDB work?
- Scan the entire table and then filter out data (inefficient)
- Returns up to 1MB of data - use pagination to keep on reading
- Consumes a lot of RCU
- Limit impact using Limit or reduce the size of the result and pause
- For faster performance, use Parallel Scan
What DynamoDB API calls can be used to delete data?
DeleteItem:
- Delete an individual item
- Ability to perform a conditional delete
DeleteTable:
- Delete a whole table and its items
- Much quicker deletion than calling DeleteItem on all items
What are batch operations in DynamoDB?
- Allows you to save in latency by reducing the number of API calls
-Operations are done in parallel for better efficiency - Part of a batch can fail; in which case we need to try again for the failed items
What are the two DynamoDB batch operation API calls?
BatchWriteItem:
- Up to 25 PutItem and/or DeleteITem in one call
- Up to 16MB of data written, up to 400KB of data per item
- CAn’t update items (use UpdateITem)
BatchGetItem:
- Return items from one or more tables
- Up to 100 items, up to 16MB of data
- Items are retrieved in parallel to minimise latency
In DynamoDB, what is a Local Secondary Index (LSI)?
- Alternative Sort Key for your table (same partition key as that of the base table)
- The Sort key consists of one scalar attribute (string, number, or binary)
- Up to 5 local Secondary Indexes per table
- Must be defined at table creation time
- Attribute Projections - can contain some or all the attributes of the base table (KEYS_ONLY, INCLUDE, ALL)
In DynamoDB, what is a Global Secondary Index (GSI)?
- Alternative Primary Key from the base table
- Speed up queries on non-key attributes
- The index key consists of scalar attributes (string, number or binary)
- Attribute projections - some or all the attributes of the base table (KEYS_ONLY, INCLUDE, ALL)
- Must provision RCUs and WCUs for the index
- Can be added/modified after table creation
In DynamoDB, how does throttling work with Global Secondary Indexes and Local Secondary Indexes?
Global Secondary Index:
- If the writes are throttled on the GSI, then the main table will be throttled
- Even if the WCU on the main tables are fine
- Choose your GSI partition key carefully
- Assign your WCU capacity carefully!
Local Secondary Index:
- Uses the WCUs anr eRCUs of the main table
- No special throttling considerations
What is DynamoDB - PartiQL?
- Use a SQL-like syntax to manipulate DynamoDB tables
- Support some (but not all) statements (INSERT, UPDATE, SELECT, DELETE)
- SUpports Batch operations
In DynamoDB, what is Optimiistic Locking?
- DynamoDB has a feature called “Conditional Writes”
- Astrategy to ensure an item hasn’t changed before you update/delete it
- Each item has an attribute that acts as a version nuimmber
What is DynamoDB Accelerator (DAX)?
- Fully-managed, highly available, seamless in-memory cache for DynamoDB
- Microseconds latency for cached reads and queries
- Doesn’t require application logic modification (compatible with existing DynamoDB APIs)
- Solves the “Hot Key” problem (too many reads)
- 5 minutes TTL for cache (default)
- Up to 10 nodes in the cluster
- Multi-AZ (3 nodes minimum recommended for production)
- Secure (Encryption at rest with KMS, VPC, IAM, CloudTrail, …)
What are DynamoDB streams?
- Ordered stream of item-level modifications (create/update/delete) in a table
- Stream records can be (sent to Kinesis Data Streams | Read by Lambda | Read by Kinesis Client Library applications)
- Data retention for up to 24 hours
In DynamoDB streams, what information can be written to the stream?
- KEYS_ONLY: only the key attributes of the modified item
- NEW_IMAGE: the entire item, as it appears after it was modified
- OLD_IMAGE: the entire item, as it appears before it was modified
- NEW_AND_OLD_IMAGES: both the new and the old images of the item
What are DynamoDB streams made of?
Shards, just like Kinesis Data Streams
You don’t provision shards though, it is automated by AWS
How does DynamoDB streams work with LAmbda?
- You need to define an Event Source Mapping to read from a DynamoDB stream
- You need to ensure the Lambda function has the appropriate permissions
- Your Lambda function is invoked synchronously
What is Time to Live (TTL) in DynamoDB?
- Automatically delete items after an expiry timestamp
- Doesn’t consume any WCUs (ie, no extra cost)
- The TTL attribute must be a n”Number” data type with “Unix Epoch timestamp” value
- Expired items deleted within 48 hours of expiration
- Expired items are deleted from both LSIs and GSIs
In DynamoDB CLI, what is –projection-expression?
one or more attributes to retrieve
In DynamoDB CLI, what is –filter-expression?
filter items before returned to you
What are DynamoDB Transactions?
- Coordinated, all-or-nothing operations (add/update/delete) to multiple items across one or more tables
- Provides Atomicity, Consistency, Isolation and Durability (ACID)
- Consumes 2x WCUs and RCUs - DynamoDB performs 2 operations for every item (prepare & commit)
Calculate the WCUs required:
3 transactional writes per second, with item size 5KB
3 x (5KB / 1KB) x 2 (transactional costs) = 30 WCUs
Calculate the RCUs required:
5 transaction reads per second, with item size 5KB
5 x (8KB / 4KB) x 2 (transactional cost) = 20 RCUs
%KB gets rounded to the upper 4KB = 8KB
What is a DynamoDB partitioning strategy?
- Imagine we have a voting application with 2 candidates. If partition key is “Candidate_ID”, this results into two partitions, which will generate issues (eg, Hot Partition)
- A strategy that allows better distribution of items evenly across partitions
- Add a suffix to Partition Key value
- Two methods - sharding using random suffix, sharding using calculated suffix
How do you do a table cleanup in DynamoDB?
Option 1 - Scan + DeleteItem:
- Very slow, consumes RCU and WCU, expensive
Option 2 - Drop Table + Recreate Table:
- Fast efficient, cheap
How do you copy a DynamoDB table?
Option1 - Using AWS Data Pipeline:
Option 2: Backup and restore into a new table:
- Takes some time
Option 3:- scan + PutItem or BatchWriteItem:
- Write your own code
What backup and restore feature is available for DynamoDB?
Point-in-time Recovery (PITR) like RDS
- No performance impact
What is DynamoDB Global Tables?
Multi-region, multi-active, fully replicated, high performance
What is DynamoDB local?
Develop and test apps locally without accessing the DynamoDB web service (without Internet)
True or False; API Gateway supports the WebSocket Protocol?
True
True or False; API Gateway can handle different environemnts (dev,text,prod)etc?
True
In API Gateway, what can you import to quickly define APIs?
Swagger / Open API
True or False; API Gateway can handle security (Authentication and Authorization)?
True
True or False; API Gateway can cache API responses?
True
True or False; API Gateway can handle request throttling?
True
What are the main API Gateway integrations?
Lambda Function
- Invoke lambda as a function
- Easy way to expose REST API backend by LAmbda
HTTP:
- Expose HTTP endpoints in the backend
– Why? Add rate limiting, caching, user authentications, API keys, etc…
AWS Service:
- Expose any AWS API through the API Gateway
- Why? Add authentication, deploy publicly, rate control…
3 Types of API Gateway endpoints?
Edge-Optimised (default):
- For global clients
- Requests are routed through the CloudFront Edge locations (improves latency)
- The API Gateway still lives in only one region
Regional:
- For clients within the same region
- Could manually combine with CloudFront (more control over the caching strategies and the distribution)
Private:
- Can only be accessed from your VPC using an interface VPC endpoint (ENI)
- Use a resource policy to define access
How does API Gateway do user authentication?
- IAM Roles (useful for internal applications)
- Cognito (Identity for external users - example mobile users)
- Custom Authoriser (your own logic)
For API Gateway, how do you get Custom Domain Name HTTPS security?
Through integration with AWS Certificate Manager (ACM):
- If using Edge-Optimised endpoint, then the certificate must be in us-east-1
- If using Regional endpoint, the certificate must be in the API Gateway region
- Must setup CNAME or A-alias record in Route 53
How do API Gateway deployment stages work?
- Making changes in the API Gateway does not mean they’re effective
- You need to make a “deployment” for them to be in effect
- Changes are deployed to “stages” (as many as you want)
- Use the naming you like for stages (dev,text,prod)
- Each stage has its own configuration parameters
- Stages can be rolled back as a history of deployments is kept
In API Gateway, what are stage variables?
- Stage variables are like environment variables for API Gateway
- Use them to change often changing configuration values
- They can be used in Lambda function ARN, HTTP endpoint, parameter mapping templates
- Stage variables are passed to the “context” object in AWS Lambda
For API Gateway, what are Canary Deployments?
- Choose the % of traffic the canary channel receives
- Metrics & Logs are separate (for better monitoring)
- Possibility to override stage variables for canary
4 API Gateway Integration Types?
-MOCK
- HTTP / AWS (Lambda & AWS Services)
- AWS_PROXY (Lambda Proxy)
- HTTP_PROXY
What is the API Gateway MOCK Integration Type?
API Gateway returns a response without sending the request to the backend
What is the API Gateway HTTP / AWS (Lambda & AWS Services) Integration Type?
- you must configure both the integration request and integration response
- Setup data mapping using mapping templates for the request & response
What is the API Gateway AWS_PROXY (Lambda Proxy) Integration Type?
- incoming request from the client is the input to Lambda
- The function is responsible for the logic of request / response
- No mapping template, headers, query string parameters… are passed as arguments
What is the API Gateway HTTP_PROXY Integration Type?
- No mapping template
- The HTTP request is passed to the backend
- The HTTP response from the backend is forwarded by API Gateway
For API Gateway, what are mapping templates?
- Used for LAmbda and HTTP integration
- Mapping templates can be used to modify request / responses
- Rename / modify query string parameters
- Modify body content
- Add headers
- Uses Velocity Template Language (VTL): for loop, if etc…
- Filter output results (remove unnecessary data)
What is Swagger and Open API?
Common ways of defining REST APIs, using API definition as code
True or False; you can import existing Swagger / OpeAPI 3.0 spec into API Gateway?
True
What can Swagger be written in?
YAML or JSON
What is the API Gateway default, min and max. TTL?
- Default 300 seconds
- Min: 0 s
- Max. 3600 s
Where are caches defined in API Gateway?
Caches are defined per stage
What is the min and max cache size in API Gateway?
0.5GB to 237GB
How do you invalidate an API Gateway cache?
Clients can invalidate the cache with header: Cache-Control: max-age=0
In API Gateway, what if you don’t impose an InvalidateCache policy?
If you don’t impose an InvalidateCache policy (or choose the Require authorisation check box in the console), any client can invalidate the API Cache
How do you configure a usage plan for API Gateway?
1, Create one or more APIs, configure the methods to require an API key, and deploy the API to stages
2, Generate or import API keys to distribute to application developers (your customers) who will be using your API
3, Create the usage plan with the desired throttle and quota limits
4, Associate API stages and API keys with the usage plan
Callers of the API must supply an assigned API key in the x-api-key header in requests to the API
How many API Gateway requests can be made before throttling?
10,000 requests per second across all APIs
Soft limit can be increased upon request
What response do you get if an API in API Gateway is throttled?
429 - too many requests
What response do you get if an API in API Gateway is throttled?
429 - Quota exceeded, Throttle
True or False; in API Gateway if one API is overloaded, if not limited, can cause the other APIs to be throttled
True
In API Gateway, what does this error mean: 400
Bad Request
In API Gateway, what does this error mean: 403
Access Denied, WAF filtered
In API Gateway, what does this error mean: 502
Bad Gateway Exception: usually for an incomptible output returned from a Lambda proxy integration backend and occasionally for out-of-order invocations due to heavy workloads
In API Gateway, what does this error mean: 503
Service unable exception
In API Gateway, what does this error mean: 504
Integration FAilure - eg, Endpoint REquest Tomed-Out Exception (API Gateway requests time out after 29 seconds max.)
For API Gateway, CORS must be enabled when you receive API calls from another domain?
True
Regarding API Gateway and CORS, the OPTIONS pre-flight request must contain what headers?
-Access-Control-Allow-Methods
-Access-Control-Allow-Headers
-Access-Control-Allow-Origin
True or False; you can create resource policies for API Gateway?
True
True or FAlse; API Gateway resource policies can allow for Cross Account Access?
True
3 ways security is implemented in API Gateway?
- IAM
- Customer Authorisaer
- Cognito User pools
What are WebSoeckets?
- Two-way interactive communication between a user’s browser and a server
- Server can push information to the client
- This enables stateful application use cases
- Often used in real-time applications
True or False; API Gateway supports WebSocket API?
True
For client-to-server messaging in API Gateway WebSockets, what is re-used?
ConnectID
How do you set-up routing in API Gateway?
Using a Route Key Table
What is AWS SAM?
- SAM = Serverless Application Model
- Framework for developing and deploying serverless applications
- All the configuration is YAML code
- Generate complex CloudFormation from simple SAM YAML file
- Supports anything from CloudFormation (Outputs, Mappings, Parameters, Resources)
- SAM can use CodeDeploy to deploy Lambda functions
- SAM can help you to run Lambda, API Gateway, DynamoDB locally
What is the SAM transform header?
Transform: ‘AWS::Serverless-2016-10-31
What are the SAM template commands for package and deploy?
- aws cloudfromation packages / sam package
- aws cloudfromation deploy / sam deploy
What are SAM policy templates?
List of templates to apply permissions to your Lambda functions
How does SAM update Lambda functions?
SAM framework natively uses CodeDeploy to update Lambda functions
What is SAM built on?
CloudFormation
What sections are required by SAM?
Transform and Resources
SAM commands to know for the exam?
- sam build: fetch dependencies and create local deployment artifacts
- sam package: package and upload to S3, generate CF template
- sam deploy: deploy to CloudFormation
What is the Serverless Application Repository (SAR)?
- Managed repository for serverless applications
- The applications are packaged using SAM
- Build and publish applications that cabe re-used by organisation
- Application settings and behaviour can be customised using Environment variable
What AWS Cloud DEvelopemnt Kit (CDK)?
- Define your cloud infrastructure using a familiar language (Javascript, python, java, .net)
- Leverages CloudFormation
How does the CDK work?
- Contains high level compnents called constructs
- The code is “compiled” into a CloudFromation template
- You can therefore deploy infrastructure and application runtime code together (Grreat for Lambda functions and Docker containers)
What is Amazon Cognito used for?
We want to give our users an identity so that they can interact with our application
3 parts of Cognito?
- Cognito user pools
- Cognito Identity Pools (Federated Identity)
- Cognito Sync
What are Cognito User Pools?
- Sign in functionality for app users
- Integrate with API Gateway & Application Load Balancer
- Database of users for your web and mobile application
What is Cognito Identity pool (Federated Identity)?
- Provide temporary AWS credentials to users so they can access AWS resources directly
- Integrate with Cognito User Pools as an identity provider
- Users are mapped to IAM roles & policies,, can leverage policy variables
What is Cognito Sync?
- Synchronise data from device to Cognito
- Is depreciated and replaced by AppSync
- Store preferences, configuration ,state of app
- ross device synchronisation
- Offline capability
Cognito USer Pools can invoke a Lambda function synchronously on which triggers?
Authentication events:
- Pre authentication Lambda trigger
- Post authentication lambda trigger
- Pre token Generation Lambda trigger
Sign-up:
- Pre sign-up Lambda trigger
- Post confirmation Lambda trigger
- Migrate User lambda trigger
Messages:
- Custom message Lambda trigger
Token Creation:
- Pre token generation Lambda trigger
True or False; Cognito has a hosted authentication UI that you can add to your app to handle sign-up and sign-in workflows?
True
Which identity sources can be used for Cognito Identity Pools?
- Public providers (Loginwith Amazon, Facebook, Google, Apple)
- Users in an Amazon Cognito user pool
-OpenID Connect Providers & SAML Identity Providers - Developer Authenticated Identities (custom login erver)
- Cognito Identity pools allow for unauthenticated (guest) access
How do Cognito Identity Pools obtain IAM credentials?
Through STS
In Cognito Identity Pools - What IAM roles are given for authenticated and guest users?
- Default IAM roles for authenticated and guest users
- Define rules to choose the role for each user based on the user’s ID
What is Cognito Sync - Cognito stream?
Steam data from Cognito into Kinesis
What is Cognito Sync - Cognito events?
Execute lambda functions in response to events
What are AWS Step Functions?
- Model your workflow as state machines (one per workflow)
- Written in JSON
- Visualsisation of the workflow and the execution of the workflow, as well as the history
- Start workflow with SDK call, API Gateway, Event Bridge
6 AWS Step Function states?
- Choice state: test for a condition to send to a branch (or default branch)
- Fail or succeed state - stop execution with failure or success
- Pass state - simply pass ints input to its output or inject some fixed data, without performaing work
- Wait state: provide a delay for a certain amount of time or until a specified time/date
- Map state : dynamically iterate steps
- Parallel state: begin parallel branches of execution
How to handle erros in AWS Step Functions?
Use RETRY (to retry failed state) and CATCH (transition to failure path) in the state machine to handle the error instead of inside the application code
- Evaluated from top to bottom
What are the two types of Step Function worflows?
Standard and Express
For Step Function Standard Workflows, what is the max. duration?
1 year
For Step Function Standard Workflows, what is the supported execution start rate?
Over 2,000 per second
For Step Function Standard Workflows, what is the support state transition rate?
Over 4,000 per second per account
For Step Function Standard Workflows, what is the pricing?
Priced per state transition. A state transition is counted each time a step in your execution is completed
For Step Function Standard Workflows, what is the pricing?
Priced per state transition. A state transition is counted each time a step in your execution is completed
For Step Function Standard Workflows, how is execution history viewed?
Executions can be listed and descried with Step Functions APIs, and visually debugged through the console. They can also be insepected in CloudWatch Logs by enabling logging on your state machine
For Step Function Standard Workflows, what are the execution semantics?
exactly-once workflow execution
For Step Function Express Workflows, what is the maximum duration?
5 mins
For Step Function Express Workflows, what is the supported execution start rate?
over 100,000 per second
For Step Function Express Workflows, what is the supported state transition rate?
Nearly unlimited
For Step Function Express Workflows, what is the pricing?
Priced by the number of executions your run, their duration, and memory consumption
For Step Function Express Workflows, how is execution history viewed?
Executions can be inspected in CloudWatch Logs by enabling logging on your state machine
For Step Function Express Workflows, what are the execution semantics
At least once workflow execution
What is AWS AppSync?
- AppSync is a manged service that uses GraphQL
- GraphQL makes it easy for applications to get exactly the data they need
- This includes combining data from one or more sources
- Retrieve data in real-time with WebSocket or MQTT on WebSocket
-For mobile apps: local data access & data synchronisation - It all starts with uploading one GraphQL schema
What are the four ways in wehich you can authorisae applications to interact with your AWS AppSync GraphQL API?
- API_KEY
- AWS_IAM: IAM users / roles / cross-account access
- OPENID_CONNECT: OpenID Connect provider / JSON Web Token
- AMZON_COGNITO_USER_POOLS
What is Amplify studio?
Visually build a full-stak app, both front-end UI and a back-end
What is Amplify libraries?
Connect your app to existing AWS Services (Cognito, S3 and more)
What is Amplify CLI?
Configure an Amplify backend. With a guided CLI workflow
What is AWS Amplify?
- Set of tools to get started with creating mobile and web applications
- “Elastic Beanstalk for mobile and web applications”
- Must-have features such as data storage, authentication, storage and machine-learning, all powered by AWS services
How is authentication done in AWS Amplify?
- Leverages Amazon Cognito
- User registration, authentication, account recovery & other operations
- Supports MFA, Social Sign-in, etc
- Pre-built UI components
- Fine-grained authorisation
How is data stored using AWS Amplify?
- Leverages AppSync and DynamDB
- Work with local data and have automatic synchronisation to the cloud without complex code
- Powered by graphQL
- Offline and real-time capabilities
What is AWS STS?
- Secure Token Service (STS)
- Allows to grant limited and temporary access to AWS resources
What is the max time temporary access is granted to AWS resrouces from STS?
up to 1 hour
7 STYS API calls?
- AssumeRole: Assume roles within your account or cross account
- AssumeRoleWithSAML: reteurn credentials for users logged with SAML
- AssumeRoleWithWebIdentity: return creds for user logged with an IdP. AWS recommends against using this, and using Cognito Identity Pools instead
- GetSessionToken: for MFA, from a user or AWS account root user
- GetFederationToken: obtain temporary creds for a federated user
- GetCAllerIdentity: return details about the IAM user or role used in the API call
- DecodeAuthorisationMessage: decode error message when an AWS API is denied
How can you use STS to Assume an IAM Role?
- Define an IAM Role within your account or corss-account
- Define which principals can access this IAM Role
- Use AWS STS to retrieve credentials and impersonate the IAM Role you have have access to (AssumeRoleAPI)
- Temporary credentials can be valid between 15 minutes to 1 hour
How can you use STS to Assume an IAM Role?
- Define an IAM Role within your account or cross-account
- Define which principals can access this IAM Role
- Use AWS STS to retrieve credentials and impersonate the IAM Role you have access to (AssumeRoleAPI)
- Temporary credentials can be valid between 15 minutes to 1 hour
How are IAM Policies authorisation evaluated?
1, If there’s an explicit DENY, end decision with DENY
2, If there’s an ALOLOW, end decision with ALLOW
3, Else DENY
What can IAM Policies be attached to?
- Users
- Roles
- Groups
True or False; you can create dynamic IAM polcies?
True
What is the special policy variable for creating dynamica policies with IAM?
${aws:username}
How do you grant a USer permissions to pass a role to an AWS Service?
- To configure many AWS services, you must pass an IAM role to the service (this happens only once during setup)
- The service will later assume the role and perform actions
- For this, you need to IAM permission iam:PAssRole
- It often comes with iam:GetRole to view the role being passed
What is Microsoft Active Directory (AD)?
- Found on any Windows Server with AD Domain Services
- Database of objects: User Accounts, Computers, Printers, File Shares, Security Groups
- Centralised security management, create account, assign permissions
- Objects are organised in trees
- A group of trees is a forest
3 types of AWS Directory Services?
- AWS Managed Microsft AD
- AD Connector
- Simple AD
What is AWS MAnaged Microsoft AD?
- Create your own AD in AWS, manage users locally, supports MFA
- Establish “trust” connections with your on-premises AD
What is AD Connector?
- Directory Gateway (proxy) to redirect to on-premises AD, supports MFA
- Users are managed on the on-premises AD
What is Simple AD?
- AD-compatible managed directory on AWS
- CAnnot be joined with on-premises AD
In the exam, anytime you hear “encryption” for an AWS service, what should you think?
KMS
What is KMS?
- AWS manages encryption keys fo rus
- Fully integrated with IAM for authorisation
- Easy way to control access to your data
- Able to audit KMS key usage using CloudTrail
- Seamlessly integrated into most AWS
What are the 2 KMS key types?
- Symmetric (AES-256 keys)
- Asymmetric (RSA & ECC key pairs)
What are KMS symmetric keys?
- Single encryption key that is used to encrypt and decrypt
- AWS services that are integrated with KMS use Symmetric CMKs
- You never get access to the KMS Key unencrypted (must call KMS API to use)
What are KMS Asymmetric keys?
- Public (encrypt) and private key (Decrypt) pair
- Used for encrypt / decrypt, or sign/verify operations
- The public key is downloadable, but you can’t access the Private Key unencrypted
3 Types of KMS keys?
- AWS Managed key: free
- Customer Managed Keys (CMK): created in KMS $1 / month
- Customer Managed Keys: imported $1 / month
True or False; KMS API calls are free?
False; $0.03 / 10,000 cals
Do KMS keys have automatic rotation?
- AWS managed KMS keys: automatic every 1 year
- Customer-managed KMS keys: (must be enabled) automatic every 1 year
- Imported KMS key: only manual rotation possible using alias
What are KMS key policies?
- Control access to KMS keys, “similar” to S3 bucket policies
- Difference: you cannot control access without them
What is the default KMS key policy?
- Created if you don’t provide a specific KMS Key Policy
- Complete access to the key to the root user = entire AWS account
What are custom KMS key policies?
- Define users, roles that can access the KMS key
- Define who can administer the key
- Useful for cross-account access of your KMS keys
What is the KMS Encrypt API call limit size?
4 KB, if you want to encrypt >4KB, we need to use eenvelope encryption
What is the main API for envelope encryption?
GenerateDataKey API
What is the Encryption SDK?
- The AWS Encryption SDK impemented Envelop Encryption for us
- The Encryption SDK also exists as a CLI tool we can install
What is an important feature of tthe Encryption SDK?
Data Key Caching:
- re-use keys instead of creating new ones for each encryption
- Helps with reducing the number of calls to KMS with a security trade-off
- Use LocalCryptoMaterialsCache
5 KMS symmetric API calls?
Encrypt: encrypt up to 4KB of data through KMS
GenerateDataKey: generates a unique symmetric data key (DEK)
GerateDataKeyWithoutPlaintext: Generate a DEK to use at some point
Decrypt: decrypt up to 4KB of data (including Data Encryption Keys)
GenerateRandom: returns a random byte string
What happens when you exceed a request quota?
You get a ThrottlingException.
To respond, use exponential backoff
What is the S3 Bucket Key for SSE-KMS encrpytion?
- New setting to decrease number of API calls made to KMS from S£ by 99%
- This leverages data keys. A S3 bucket key is generated and that key is used to encrypt KMS objects with new data keys
- You will see less KMS CloudTail events in CloudTail
What is SSM Parameter Store?
- Secure storage for configuration and secrets
- Optional seamless encryption using KMS
- Version tracking of configuration / secrets
- Hierarchical storage
- Simple API
- No secret rotation
- Optional KMS encryption
What are Parameter store - parameter policies?
- Allow to assign a TTL to a parameter (expiration date) to force updating or deleting sensitive data such as passwords
What is AWS Sectrets MAnager?
- Newer service, meant for storing secrets
- Mostly meant for RDS integration
- Capability to force rotation of secrets every X days
- Automate generation of secrets on rotation
- Integration with RDS
- Secrets are encrypted using KMS (madatory)
Can CloudWatch Logs be encrypted?
- You can encrypt CloudWatch logs with KMS keys
- Encryption is enabled at the log group level, by associating a CMK with a log group, either when you create the log group or after it exists
- You must use the CloudWatch Logs API - associate-kms-key & create-log-group
What is AWS Redshift?
- OLAP - analytic processing
- Datawarehousing / Data Lakes
- Analytics queries
What is AWS Neptune?
Graph Database
What is DocumentDB?
Managed MongoDB for AWS
What is AWS CErtificate MAnager (ACM)?
- Lets you easily provision, manage and deploy SSL/TLS certificates
- USed to provide in-flight encryption for wwebsites (HTTPS)
- Supports both public and private TLS certificates
- Automatic TLS certificate renewal
- Integrates with ELBs, CloudFront Distributions, APIs on API Gateway
What is AWS Cloud Map?
- A fully managed resource discovery service
- Creates a map of the backend services / resources that your applications depend on
- You register your application components, their location, attributes, and health status with the AWS Cloud Map
- Integrated health checking
Whata is AWS FAult Injection Simulator (FIS)?
- A fully managed service for runing fault injection experiements on AWS workloads
- Based on chaos engineering - stressing an application by creating disruptive events, observing how the system responds and implementing improvement
- Helps you uncover hidden bugs and performance bottlenecks
- Use pre-built templates that generate the desired disruptions
What is AWS DataSync?
Move large amounts of data to and from:
- On-premises / other cloud to AWS - needs agent
- AWS to AWS - no agent needed
- Replication tasks can be scheduled hourly, daily, weekly
- File permissions and metadata are preserved
- One agent task can use 10 Gbps, can setup a bandwidth limit
What can AWS DataSync synchronise to?
- S3
- EFS
- FSx
Which section of a CloudFormation template does not allow for conditions?
Parameters
True or False; CloudWatch integrates with S3?
True
True or False; ECS supports dynamic port mapping?
True,you can use dynamic port maping to support multiple tasks from a single service on the same container instance
CloudFront or Application Load Balancer can be used to securely authenticate users for accessing your applications?
ALB
You are a DynamoDB developer for an aerospace company that requires you to write 6 objects per second of 4.5KB in size each.
What write capacity unit is needed for your project?
30
What can you use to ensure that a lambda function can always reach a certain level of concurrency?
Reserved concurrency
What is reserved concurrency for lambda functions?
- To ensure that a function can always reach a certain level of concurrency, you can configure the function with reserved concurrency.
- When a function has reserved concurrency, no other function can use that concurrency.
- More importantly, reserved concurrency also limits the maximum concurrency for the function, and applies to the function as a whole, including versions and aliases.
True or False; provisioned concurrency can be used to limit the maximum concurrency for a given Lambda function?
False
What is provisioned concurrency used for in lambda functions?
You should use provisioned concurrency to enable your function to scale without fluctuations in latency.
In ECS, if you want two containers to use shared memory, should they go into separate task definitions, or a single task definition?
Single task definition
True or False; You can configure a Lambda function to connect to private subnets in a virtual private cloud (VPC) in your account?
True
True or False; you can configure a Lambda function to connect to private subnets in a virtual private cloud (VPC) in your account?
True
True or FAlse; With Application Load Balancers, cross-zone load balancing is always enabled?
True
True or False; if you terminate a container instance while it is in the STOPPED state, that container instance isn’t automatically removed from the cluster?
True; You will need to deregister your container instance in the STOPPED state by using the Amazon ECS console or AWS Command Line Interface. Once deregistered, the container instance will no longer appear as a resource in your Amazon ECS cluster.
True or False; if you terminate a container instance while it is in the RUNNING state, that container instance isn’t automatically removed from the cluster?
False; if you terminate a container instance in the RUNNING state, that container instance is automatically removed, or deregistered, from the cluster.
True or False; auto scaling groups span across availability zones and AWS regions?
False; they span across availability zones, but not regions
What does a ProjectionExpression do in DynamoDB?
A projection expression is a string that identifies the attributes you want.
To retrieve a single attribute, specify it’s name. For multiple attribute, the names must be comma-separated
In DynamoDB, what is the FilterExpression used for?
If you need to further refine the Query results, you can optionally provide a filter expression
In DynamoDB, what does the –query parameter do?
–query finds items based on primary key values
In DynamoDB, what does the Scan operation do?
Reads every item in a table or a secondary index
By default, what type, is the health check configuration of your Auto Scaling Group set to?
EC2 typew. To automate te replacement of unhealthy EC2 instances, you must change the health check type of your instane’s auto scaling group from EC2 to ELB by using a configuration file
What is an organisation tail?
In AWS Organisations you can create a trail that will log all events for all AWS accounts in that organsation
True or False; member accounts will be able to see the organisation trail, but cannot modify or delete it?
True
True or False; IAM roles and resource-based policies can delegate access across accounts only within different partitions?
False; IAM roles and resource-based policies delegate access across accounts only within a single partition
In ECS, how do you register a container instance with a cluster?
Update the cluster name parameter in the /etc/ecs/ecs.config file
In CloudFormation, which intrinsic function returns the value of an output exported by another stac?
!ImportValue
In CloudFormation what does this intrinsic function do !Ref?
Returns the value of the specified parameter or resource
In CloudFormation what does this intrinsic function do !GetAtt?
Returns the value of an attribute from a resource in the template.
True or False; EBS volumes do not support in-flight encryption but do support encryption at rest using KMS?
False; EBS volumes support both in-flight encryption and encryption at rest using KMS
True or False; in S3, if two writes are made to a single non-versioned object at the same time, it is possible that only a single event notification will be sent?
True
In CloudFormation, how do you create a cross-stack reference?
Use the Export output field to flag the value of a resource output for export. Then, use the Fn::ImportValue instrinsic function to import the value
Simple Work Flow (SWF) is synchronous or Asynchronous?
Asynchronous
True or False; EC2 Auto Scaling ensures that the new capacity never goes outside of the min. and max. size limits?
True
During a rollback which instances does CodeDeploy deploy first to?
The failed instances
True or False; you can update the cache and the backend at the same time?
False; The cache and the backend cannot be updated at the same time via a single atomic operation as these are two separate systems.
True or False; Lambda aliases can point to other aliases?
False; lambda aliases can only point to a lambda function version
True or False; by default, scripts entered as user data do not have root user privileges for executing?
False; they do have root user privileges
What does Parameter Store use to encrypt and decrypt the parameter values of SecureString parameters?
AWS KMS
True or False; applications running outside of an AWS environment will need access keys for programmatic access to AWS resources?
True
True or False; An IAM user’s username and password can only be used to interact with AWS via its Management Console?
True
In X-Ray, what are annotations ?
Annotations are simple key-value pairs that are indexed for use with filter expressions. Use annotations to record data that you want to use to group traces in the console, or when calling the GetTraceSummaries API. X-Ray indexes up to 50 annotations per trace.
True or False; you can use a self-signed certificate for HTTPS communication between CloudFront and your origin?
False
For API Gateway to pass the Lambda output as the API response to the client, the Lambda function must return the result in which format?
JSON
What are Elastic Beanstalk worker environments?
It helps process task asynchronously by managing the SQS queue and worker instances by running a daoemon process
What does the ‘require authorisation’ checkbox do in the settings tabs on API Gateway?
Ticking the Require authorization checkbox ensures that not every client can invalidate the API cache
In the Lambda Invoke API, you have 3 options to choose from for the InvocationType, what are they?
RequestResponse (default) – Invoke the function synchronously. Keep the connection open until the function returns a response or times out. The API response includes the function response and additional data.
Event – Invoke the function asynchronously. Send events that fail multiple times to the function’s dead-letter queue (if it’s configured). The API response only includes a status code.
DryRun – Validate parameter values and verify that the user or role has permission to invoke the function.
In CodeDeploy, how do Canary deployments work?
- Traffic is shifted in two increments.
- You can choose from predefined canary options. The options specify:
1, the percentage of traffic that’s shifted to your updated Lambda function version in the first increment
2, the interval, in minutes, before the remaining traffic is shifted in the second increment.
What does this mean: CodeDeployDefault.LambdaCanary10Percent5Minutes?
It’s a CodeDeploy lambda canary deployment where:
- 10 percent of your customer traffic is immediately shifted to your new version.
- After 5 minutes, all traffic is shifted to the new version.
This means that the entire deployment time will only take 5 minutes
In DynamoDB what is a secondary index?
A secondary index is a data structure that contains a subset of attributes from a table, along with an alternate key to support Query operations.
In DynamoDB, what is the difference between a “Global secondary index” and a “local secondary index”?
Global secondary index — an index with a partition key and a sort key that can be different from those on the base table.
Local secondary index — an index that has the same partition key as the base table, but a different sort key. Local secondary indexes are created when the main table is created
4 types of RDS MySQL export logs?
- Audit
- Error
- General
- Slow query
In CloudWatch metrics, what are the 2 resolutions and what is their granularity?
– Standard resolution, with data having a one-minute granularity
– High resolution, with data at a granularity of one second
True or False; IAM DB authentication rotates credentials by default?
False; it can’t rotate credentials
True or False; Cognito Identity pools supports unauthenticated identities?
True
In DynamoDB, what is a projection expression?
If you don’t what to retrieve all attributes from a query, use a projection expression to specify the attributes you want
How can a client of your API Gateway invalidate an existing cache entry?
Have the client send a request with the Cache-Control: max-age=0 header.
When to choose memcached over redis for ElastiCache?
You can choose Memcached over Redis if you have the following requirements:
– You need the simplest model possible.
– You need to run large nodes with multiple cores or threads.
– You need the ability to scale out and in, adding and removing nodes as demand on your system increases and decreases.
– You need to cache objects, such as a database.
What is the integration type ‘AWS’ used for in API Gateway?
only used for Lambda custom integration
In a SAM template, how do you define a nested application resource type?
AWS::Serverless::Application
True or False; the name of the bucket used for Transfer Acceleration must be DNS-compliant and must not contain periods (“.”)?
True
True or False; for DynamoDB, creating a local secondary index is more effecient than scanning a whole table and discarding irrelevant items?
True
What is the is the recommended way to consume streams from DynamoDB for real-time processing?
Kinesis Adapter
What are CodeDeploy in-place deployments?
The application on each instance in the deployment group is stopped, the latest application revision is installed, and the new version of the application is started and validated
True or False; In CodeDeploy, Lambda compute platform deployments can use an in-place deployment type?
False
Where can CodeDeploy deploy to?
- EC2 instances
- On-premises instances
- Lambda
- ECS services
What protocol does CodeDeploy use to communicate?
HTTPS on port 443
What protocol and port does X-Ray listen for traffic?
UDP on port 2000
What is Optimistic locking ?
Optimistic locking is a strategy to ensure that the client-side item that you are updating (or deleting) is the same as the item in DynamoDB. If you use this strategy, then your database writes are protected from being overwritten by the writes of others — and vice-versa.
What is a CloudWatch namespace?
A namespace is a container for CloudWatch metrics. Metrics in different namespaces are isolated from each other
What is envelope encryption?
Envelope encryption is the practice of encrypting plaintext data with a data key and then encrypting the data key under another key.
What is a top-level plaintext master key?
The envelope encryption master key that is plaintext (unencrypted)
In S3 server-side encryption with customer key, what headers are required when uploading an item?
- x-amz-server-side-encryption-customer-algorithm
- x-amz-server-side-encryption-customer-key
- x-amz-server-side-encryption-customer-key-MD5
For X-Ray what does the GetTraceSummaries API do?
Gets a list of trace IDs of the application
For X-ray what does the BatchGetTraces API call do?
Returns the the traces for all the trace IDs specified in the call
What is the API call to deploy the new version to Elastic Beanstalk via the CLI?
eb deploy
What is an EC2 Spot Fleet?
A Spot Fleet is a set of Spot Instances and optionally On-Demand Instances that is launched based on criteria that you specify
After you attach an EBS volume to an EC2 instance, what is the next step?
Create a file system on the volume
What is the unreserved concurrency pool for Lambda functions?
AWS Lambda will keep the unreserved concurrency pool at a minimum of 100 concurrent executions, so that functions that do not have specific limits set can still process requests. So, in practice, if your total account limit is 1000, you are limited to allocating 900 to individual functions.
When is an atomic counter not useful?
An atomic counter would not be appropriate where overcounting or undercounting cannot be tolerated (For example, in a banking application). In this case, it is safer to use a conditional update instead of an atomic counter.
What is the IAM policy simulator?
The IAM policy simulator evaluates the policies that you choose and determines the effective permissions for each of the actions that you specify.
In X-Ray, what are annotations used for?
annotations object with key-value pairs that you want X-Ray to index for search.
In X-Ray, what do you use metadata for?
metadata object with any additional data that you want to store in the segment.
What is the environment configuration file that should added in the source bundle of an elastic beanstalk app
env.yml
C++ is supported in lambda?
Yes, but through a custom runtime
In an S3 bucket CORS header file, what is the MaxAgeSeconds field?
Specifies the amount of time in seconds that the browser caches an Amazon S3 response to a preflight OPTIONS request for the specified resource.
What are cluster queries?
Cluster queries are expressions that enable you to group objects.
For Lambda functions that process Kinesis or DynamoDB streams, what is the important factor for calculating concurrency?
For Lambda functions that process Kinesis or DynamoDB streams, the number of shards is the unit of concurrency. If your stream has 100 active shards, there will be at most 100 Lambda function invocations running concurrently. This is because these streams are pull based, not push based, such as API Gateway for example
For Lambda functions that process Kinesis or DynamoDB streams, what is the important factor for calculating concurrency?
For Lambda functions that process Kinesis or DynamoDB streams, the number of shards is the unit of concurrency. If your stream has 100 active shards, there will be at most 100 Lambda function invocations running concurrently. This is because these streams are pull based, not push based, such as API Gateway for example
What is detailed monitoring in CloudWatch?
Sending EC2 instance data every 1-minute
What is In-Place Deployment?
The application on each instance in the deployment group is stopped, the latest application revision is installed, and the new version of the application is started and validated.
What deployments can CodeDeploy do?
In-Place:
- EC2/On-Premises
Blue/Green
- EC2
- Lambda
- ECS
True or False; Local Secondary Indexes can can added to existing DynamoDB tables?
False; they must be set-up when the table is created
How do you increase CPU in Lambda?
You cannot manually configure the CPU settings of your function. You have to increase the memory configuration of your function instead.
What is the DyanamoDB Transactions feature?
DynamoDB Transactions feature simply provides developers atomicity, consistency, isolation, and durability (ACID)
What is Systems Manager State Manager?
Automates the process of keeping your EC2 and hybrid infrastructure in a state that you define
True or FAlse; canary deployment is available in Elastic Beanstalk?
FAlse
What are AWS CloudFormation StackSets?
AWS CloudFormation StackSets extends the functionality of stacks by enabling you to create, update, or delete stacks across multiple accounts and regions with a single operation.
When should you use a Global Secondary Index (GSI)?
global secondary index (GSI) is primarily used if you want to query over the entire table, across all partitions.
Do Local and Global Secondary indexes support eventual and strongly consistent reads?
Local secondary index support both, global secondary indexes only support eventual
With RDS, what is transparent data encryption?
Use to automatically encrypt data before it is written to storage, and automatically decrypts data when is read from storage
Which AWS service should be used service to coordinate multiple AWS services into serverless workflows?
AWS Step Functions
What is a Blue/Green deployment?
True or FAlse; API Gateway exposes HTTP and HTTPS endpoints?
False; only HTTPS
True or False; it is best practice to separate the Lambda handler (entry point) from your core logic?
True
How do you properly instrument an EC2 instance to use the X-Ray daemon?
Use a user data script to install the X-Ray daemon.
In SWF, what are markers?
You can use markers to record events in the workflow execution history for application specific purposes. Markers are useful when you want to record custom information
Trueor False; automatic key rotation is available in KMS for keys in custom key stores?
False
True or False; Cognito Identity Pool can be used as an authorizer for API Gateway?
False, use Cognito user pool instead
What are Trust Policies?
Trust policies define which principal entities (accounts, users, roles, and federated users) can assume the role.
What programming languages does lambda natively support?
- python
- Go
- Ruby
- C#
-Powerscript - Node.js
- Java
What does Cognito pass to the user to provide a set of temporary, limited-privilege AWS credentials?
Cognito ID
