devops-exercises/exercises/aws

AWS

AWS Exercises

Note: Provided solutions are using the AWS console. It's recommended you'll use IaC technologies to solve the exercises (e.g. Terraform).

AWS - IAM

Name	Topic	Objective & Instructions	Solution	Comments
Create a User	IAM	Exercise	Solution	Easy
Password Policy	IAM	Exercise	Solution	Easy
Create a role	IAM	Exercise	Solution	Easy
Credential Report	IAM	Exercise	Solution	Easy
Access Advisor	IAM	Exercise	Solution	Easy

AWS - EC2

Name	Topic	Objective & Instructions	Solution	Comments
Launch EC2 web instance	EC2	Exercise	Solution	Easy
Security Groups	EC2	Exercise	Solution	Easy
IAM Roles	EC2, IAM	Exercise	Solution	Easy
Spot Instances	EC2	Exercise	Solution	Easy
Elastic IP	EC2, Networking	Exercise	Solution	Easy
Placement Groups Creation	EC2, Placement Groups	Exercise	Solution	Easy
Elastic Network Interfaces	EC2, ENI	Exercise	Solution	Easy
Hibernate an Instance	EC2	Exercise	Solution	Easy
Volume Creation	EC2, EBS	Exercise	Solution	Easy
Snapshots	EC2, EBS	Exercise	Solution	Easy
Create an AMI	EC2, AMI	Exercise	Solution	Easy

AWS - Lambda

Name	Topic	Objective & Instructions	Solution	Comments
Hello Function	Lambda	Exercise	Solution	Easy
URL Function	Lambda	Exercise	Solution	Easy

AWS - Misc

Name	Topic	Objective & Instructions	Solution	Comments
Budget Setup	Budget	Exercise	Solution	Easy
No Application :'(	Troubleshooting	Exercise	Solution	Easy

AWS Self Assessment

AWS - Global Infrastructure

Explain the following

• Availability zone
• Region
• Edge location

AWS regions are data centers hosted across different geographical locations worldwide.

Within each region, there are multiple isolated locations known as Availability Zones. Each availability zone is one or more data-centers with redundant network and connectivity and power supply. Multiple availability zones ensure high availability in case one of them goes down.

Edge locations are basically content delivery network which caches data and insures lower latency and faster delivery to the users in any location. They are located in major cities in the world.

True or False? Each AWS region is designed to be completely isolated from the other AWS regions

True.

True or False? Each region has a minimum number of 1 availability zones and the maximum is 4

False. The minimum is 2 while the maximum is 6.

What considerations to take when choosing an AWS region for running a new application?

• Services Availability: not all service (and all their features) are available in every region
• Reduced latency: deploy application in a region that is close to customers
• Compliance: some countries have more strict rules and requirements such as making sure the data stays within the borders of the country or the region. In that case, only specific region can be used for running the application
• Pricing: the pricing might not be consistent across regions so, the price for the same service in different regions might be different.

AWS - IAM

What is IAM? What are some of its features?

In short, it's used for managing users, groups, access policies & roles Full explanation can be found here

True or False? IAM configuration is defined globally and not per region

True

True or False? When creating an AWS account, root account is created by default. This is the recommended account to use and share in your organization

False. Instead of using the root account, you should be creating users and use them.

True or False? Groups in AWS IAM, can contain only users and not other groups

True

True or False? Users in AWS IAM, can belong only to a single group

False. Users can belong to multiple groups.

What are some best practices regarding IAM in AWS?

• Delete root account access keys and don't use root account regularly
• Create IAM user for any physical user. Don't share users.
• Apply "least privilege principle": give users only the permissions they need, nothing more than that.
• Set up MFA and consider enforcing using it
• Make use of groups to assign permissions ( user -> group -> permissions )

What permissions does a new user have?

Only a login access.

True or False? If a user in AWS is using password for authenticating, he doesn't needs to enable MFA

False(!). MFA is a great additional security layer to use for authentication.

What ways are there to access AWS?

• AWS Management Console
• AWS CLI
• AWS SDK

What are Roles?

AWS docs: "An IAM role is an IAM identity that you can create in your account that has specific permissions...it is an AWS identity with permission policies that determine what the identity can and cannot do in AWS." For example, you can make use of a role which allows EC2 service to access s3 buckets (read and write).

What are Policies?

Policies documents used to give permissions as to what a user, group or role are able to do. Their format is JSON.

A user is unable to access an s3 bucket. What might be the problem?

There can be several reasons for that. One of them is lack of policy. To solve that, the admin has to attach the user with a policy what allows him to access the s3 bucket.

What should you use to:

• Grant access between two services/resources?
• Grant user access to resources/services?

• Role
• Policy

What statements AWS IAM policies are consist of?

• Sid: identifier of the statement (optional)
• Effect: allow or deny access
• Action: list of actions (to deny or allow)
• Resource: a list of resources to which the actions are applied
• Principal: role or account or user to which to apply the policy
• Condition: conditions to determine when the policy is applied (optional)

Explain the following policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect:": "Allow",
            "Action": "*",
            "Resources": "*"
        }
    ]
}

This policy permits to perform any action on any resource. It happens to be the "AdministratorAccess" policy.

What security tools AWS IAM provides?

• IAM Credentials Report: lists all the account users and the status of their credentials
• IAM Access Advisor: Shows service permissions granted to a user and information on when he accessed these services the last time

Which tool would you use to optimize user permissions by identifying which services he doesn't regularly (or at all) access?

IAM Access Advisor

AWS - EC2

What is EC2?

"a web service that provides secure, resizable compute capacity in the cloud". Read more here

True or False? EC2 is a regional service

True. As opposed to IAM for example, which is a global service, EC2 is a regional service.

What are some of the properties/configuration options of EC2 instances that can be set or modified?

• OS (Linux, Windows)
• RAM and CPU
• Networking - IP, Card properties like speed
• Storage Space - (EBS, EFS, EC2 Instance Store)
• EC2 User Data
• Security groups

What would you use for customizing EC2 instances? As in software installation, OS configuration, etc.

AMI. With AMI (Amazon Machine Image) you can customize EC2 instances by specifying which software to install, what OS changes should be applied, etc.

AWS EC2 - AMI

What is AMI?

Amazon Machine Images is "An Amazon Machine Image (AMI) provides the information required to launch an instance". Read more here

What are the different sources for AMIs?

• Personal AMIs - AMIs you create
• AWS Marketplace for AMIs - AMIs made by others, mostly sold for some price
• Public AMIs - Provided by AWS

True or False? AMI are built for specific region

True (but they can be copied from one region to another).

Describe in high-level the process of creating AMIs

1. Start an EC2 instance
2. Customized the EC2 instance (install packages, change OS configuration, etc.)
3. Stop the instance (for avoiding data integrity issues)
4. Create EBS snapshot and build an AMI
5. To verify and test the AMI, launch an instance from the AMI

What is an instance type?

"the instance type that you specify determines the hardware of the host computer used for your instance" Read more about instance types here

Explain the instance type naming convention

Let's take for example the following instance type: m5.large

m is the instance class 5 is the generation large is the size of the instance (affects the spec properties like vCPUs and RAM)

True or False? The following are instance types available for a user in AWS:

• Compute optimizied
• Network optimizied
• Web optimized

False. From the above list only compute optimized is available.

Explain each of the following instance types:

• "Compute Optimized"
• "Memory Optimized"
• "Storage Optimized"

Compute Optimized:

• Used for compute-intensive tasks
• It has high performance processors
• Use cases vary: gaming serves, machine learning, batch processing, etc.

Memory Optimized:

• Used for processing large data sets in memory
• Other use cases: high performance, databases, distributed cache stores

Storage Optimized:

• Used for storage intensive tasks - high read and write access to large data sets
• Use cases: databases, OLTP system, distributing file systems

What can you attach to an EC2 instance in order to store data?

EBS

AWS EC2 - Storage

Explain what is Amazon EBS

AWS Docs: "provides block level storage volumes for use with EC2 instances. EBS volumes behave like raw, unformatted block devices."

What happens to EBS volumes when the instance is terminated?

By deafult, the root volume is marked for deletion, while other volumes will still remain.
You can control what will happen to every volume upon termination.

What happens to the EC2 disk (EBS) when the instance is stopped?

Disk is intact and can be used when the instance starts.

True or False? EBS volumes are locked to a specific availability zone

True

Explain EBS Snapshots

EBS snapshots used for making a backup of the EBS volume at point of time.

What are the use cases for using EBS snapshots?

• Backups of the data
• Moving the data between AZs

Is it possible to attach the same EBS volume to multiple EC2 instances?

Yes, with multi-attach it's possible to attach a single EBS volume to multiple instances.

True or False? EBS is a network drive hence, it requires network connectivity

True

How to move EBS volumes between availability zones?

Using snapshots.

What EBS volume types are there?

• HDD (st 1, sc 1): Low cost HDD volumes
• SSD
  • io1, io2: Highest performance SSD
  • gp2, gp3: General purpose SSD

If you need an EBS volume for low latency workloads, which volume type would you use?

SSD - io1, io2

If you need an EBS volume for workloads that require good performance but the cost is also an important aspect for you, which volume type would you use?

SSD - gp2, gp3

If you need an EBS volume for high-throughput, which volume type would you use?

SSD - io1, io2

If you need an EBS volume for infrequently data access, which volume type would you use?

HDD - sc1

Which EBS volume types can be used as boot volumes for EC2 instances?

SSD: gp2, gp3, io1, io2

If you would like to have an hardware disk attached to your EC2 instead of a network one (EBS). What would you use?

EC2 Instance Store.

Explain EC2 Instance Store. Why would someone choose to use it over other options?

EC2 instance store provides better I/O performances when compared to EBS.
It is mostly used for cache and temporary data purposes.

Are there any disadvantages in using instance store over EBS?

Yes, the data on instance store is lost when they are stopped.

AWS Storage - EFS

What is Amazon EFS?

AWS Docs: "Amazon Elastic File System (Amazon EFS) provides a simple, scalable, fully managed elastic NFS file system for use with AWS Cloud services and on-premises resources."

In simpler words, it's a network file system you can mount on one or more EC2 instances.

True or False? EFS is locked into a single availability zone

False. EFS can be mounted across multiple availability zones.

What are some use cases for using EFS?

• Data sharing (e.g. developers working on the same source control)
• Web serving
• Content management

True or False? EFS only compatible with Linux based AMI

True

True or False? EFS requires the user to perform capacity planning as it doesn't scales automatically

False. EFS scales automatically and you pay-per-use.

Which EFS mode would you use if need maximum throughput?

Performance Mode (Max I/O): This provides high throughput and it's used for big data, media processing, etc.

What is the default EFS mode?

Performance Mode (General Purpose): Used for web servers, CMS, etc.

AWS EC2 - Pricing Models

What EC2 pricing models are there?

On Demand - pay a fixed rate by the hour/second with no commitment. You can provision and terminate it at any given time. Reserved - you get capacity reservation, basically purchase an instance for a fixed time of period. The longer, the cheaper. Spot - Enables you to bid whatever price you want for instances or pay the spot price. Dedicated Hosts - physical EC2 server dedicated for your use.

True or False? Reserved instance has to be used for a minimum of 1 year

True.

Explain the following types of reserved instances:

• Convertible Reserved Instances

• Scheduled Reserved Instances

Convertible Reserved Instances: used for long running workloads but used when instance type might change during the period of time it's resreved

Scheduled Reserved Instances: when you need to reserve an instance for a long period but you don't need it continuously (so for example you need it only in the morning)

True or False? In EC2 On Demand, you pay per hour when using Linux or Windows and per second (after first minute) when using any other operating system

False. You pay per second (after the first minute) when using Windows or Linux and per hour for any other OS.

You need an instance for short-term and the workload running on instance must not be interrupted. Which pricing model would you use?

On Demand is good for short-term non-interrupted workloads (but it also has the highest cost).

You need an instance for running an application for a period of 2 years continuously, without changing instance type. Which pricing model would you use?

Reserved instances: they are cheaper than on-demand and the instance is yours for the chosen period of time.

Which pricing model has potentially the biggest discount and what its advantage

Spot instances provide the biggest discount but has the disadvantage of risking losing them due bigger bid price.

You need an instance for two years, but only between 10:00-15:00 every day. Which pricing model would you use?

Reserved instances from the "Scheduled Reserved Instances" type which allows you to reserve for specific time window (like 10:00-15:00 every day).

You need an instance for running workloads. You don't care if they fail for a given moment as long as they run eventually. Which pricing model would you use?

Spot instances. The discount potential is the highest compared to all other pricing models. The disadvantage is that you can lose the instance at any point so, you must run only workloads that you are fine with them failing suddenly.

You need a physical server only for your use. Which pricing model are you going to use?

EC2 Dedicated Host

What are some of the differences between dedicated hosts and dedicated instances?

In dedicated hosts you have per host billing, you have more visibility (sockets, cores, ...) and you can control where instance will be placed.
In dedicated instances the billing is per instance but you can't control placement and you don't have visibility of sockets, cores, ...

For what use cases, EC2 dedicated hosts are useful for?

• Compliance needs
• When the software license is complex (Bring Your Own License) and doesn't support cloud or multi-tenants
• Regulatory requirements

What are Security Groups?

"A security group acts as a virtual firewall that controls the traffic for one or more instances" More on this subject here

True or False? Security groups only contain deny rules

False. Security groups only contain allow rules.

True or False? One security group can be attached to multiple instances

True

True or False? Security groups are not locked down to a region and VPC (meaning you don't have to create a new one when switching regions)

False. They are locked down to regions and VPC.

True or False? By default, when using security groups, all inbound traffic to an EC2 instance is blocked and all outbound traffic is allowed

True

What is the advantage of referencing security groups from a given security group?

Imagine you have an instance referencing two security groups, allowing to get inbound traffic from them.
Now imagine you have two instances, each using one of the security groups referenced in the instance we've just mentioned. This means you can get traffic from these two instances because they use security groups which referenced in the instance mentioned at the beginning. No need to use IPs.

How to migrate an instance to another availability zone?

What can you attach to an EC2 instance in order to store data?

EBS

What EC2 reserved instance types are there?

Standard RI - most significant discount + suited for steady-state usage Convertible RI - discount + change attribute of RI + suited for steady-state usage Scheduled RI - launch within time windows you reserve

Learn more about EC2 RI here

For how long can reserved instances be reserved?

1 or 3 years.

What allows you to control inbound and outbound instance traffic?

Security Groups

What bootstrapping means and how to use it in AWS EC2?

Bootstrapping is about launching commands when a machine starts for the first time. In AWS EC2 this is done using the EC2 user data script.

You get time out when trying reach your application which runs on an EC2 instance. Specify one reason why it would possibly happen

Security group isn't configured properly.

What is the AWS Instance Connect?

AWS: "Amazon EC2 Instance Connect provides a simple and secure way to connect to your Linux instances using Secure Shell (SSH)."

You try to run EC2 commands in an EC2 instance you've just created but it fails due to missing credentials. What would you do?

DO NOT configure AWS credentials on the instance (this means anyone else in your account would be able to use and see your credentials).
The best practice is to attach an IAM role with sufficient permissions (like IAMReadOnlyAccess)

True or False? Cancelling a Spot instance request terminates the instance

False. When you cancel a Spot instance request, you are not terminating the instances created by it.
To terminate such instances, you must cancel the Spot instance request first.

What are Spot Fleets?

Set of Spot instances and if you would like, also on-demand instances.

What strategies are there to allocate Spot instances?

• lowestPrice: launch instances from the pool that has the lowest price
• diversified: distributed across all pools
• capacityOptimized: optimized based on the number of instances

From networking perspective, what do you get by default when running an EC2 instance?

A private IP and a public IP.

Explain EC2 hibernate

[AWS Docs](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/Hibernate.html: "Hibernation saves the contents from the instance memory (RAM) to your Amazon Elastic Block Store (Amazon EBS) root volume."

True or False? Using EC2 hibernate option results in having faster instance boot

True. This is because the operating system isn't restarted or stopped.

What are some use cases for using EC2 hibernate option?

• Save RAM state
• Service with long time initialization
• Keep long-running processes

What are some limitations of EC2 hibernate option?

• Instance RAM size is limited
• Root volume must be encrypted EBS
• Hibernation time is limited
• Doesn't supports all instances types
• No support for bare metal. Only On-Demand and Reserved instances
• Doesn't supports all AMIs

Explain what is EC2 Nitro

• Next generation EC2 instances using new virtualization technology
• Better EBS: 64,000 EBS IOPS
• Better networking: HPC, IPv6
• Better security

What CPU customization is available with EC2?

• Modifying number of CPU cores (useful for high RAM and low CPU applications)
• Modifying number of threads per cure (useful for HPC workloads)

Explain EC2 Capacity Reservations

• Allows you to ensure you have EC2 capacity when you need it
• Usually combined with Reserved Instances and Saving Plans to achieve cost saving

AWS - Lambda

Explain what is AWS Lambda

AWS definition: "AWS Lambda lets you run code without provisioning or managing servers. You pay only for the compute time you consume."

Read more on it here

True or False? In AWS Lambda, you are charged as long as a function exists, regardless of whether it's running or not

False. Charges are being made when the code is executed.

Which of the following set of languages Lambda supports?

• R, Swift, Rust, Kotlin
• Python, Ruby, Go
• Python, Ruby, PHP

• Python, Ruby, Go

True or False? Basic lambda permissions allow you only to upload logs to Amazon CloudWatch Logs

True

AWS Containers

What is Amazon ECS?

Amazon definition: "Amazon Elastic Container Service (Amazon ECS) is a fully managed container orchestration service. Customers such as Duolingo, Samsung, GE, and Cook Pad use ECS to run their most sensitive and mission critical applications because of its security, reliability, and scalability."

Learn more here

What is Amazon ECR?

Amazon definition: "Amazon Elastic Container Registry (ECR) is a fully-managed Docker container registry that makes it easy for developers to store, manage, and deploy Docker container images."

Learn more here

What is AWS Fargate?

Amazon definition: "AWS Fargate is a serverless compute engine for containers that works with both Amazon Elastic Container Service (ECS) and Amazon Elastic Kubernetes Service (EKS)."

Learn more here

AWS Storage

Explain what is AWS S3?

S3 stands for 3 S, Simple Storage Service. S3 is a object storage service which is fast, scalable and durable. S3 enables customers to upload, download or store any file or object that is up to 5 TB in size.

More on S3 here

What is a bucket?

An S3 bucket is a resource which is similar to folders in a file system and allows storing objects, which consist of data.

True or False? A bucket name must be globally unique

True

Explain folders and objects in regards to buckets

• Folder - any sub folder in an s3 bucket
• Object - The files which are stored in a bucket

Explain the following:

• Object Lifecycles
• Object Sharing
• Object Versioning

• Object Lifecycles - Transfer objects between storage classes based on defined rules of time periods
• Object Sharing - Share objects via a URL link
• Object Versioning - Manage multiple versions of an object

Explain Object Durability and Object Availability

Object Durability: The percent over a one-year time period that a file will not be lost Object Availability: The percent over a one-year time period that a file will be accessible

What is a storage class? What storage classes are there?

Each object has a storage class assigned to, affecting its availability and durability. This also has effect on costs. Storage classes offered today:

• Standard:

  • Used for general, all-purpose storage (mostly storage that needs to be accessed frequently)
  • The most expensive storage class
  • 11x9% durability
  • 2x9% availability
  • Default storage class

• Standard-IA (Infrequent Access)

  • Long lived, infrequently accessed data but must be available the moment it's being accessed
  • 11x9% durability
  • 99.90% availability

• One Zone-IA (Infrequent Access):

  • Long-lived, infrequently accessed, non-critical data
  • Less expensive than Standard and Standard-IA storage classes
  • 2x9% durability
  • 99.50% availability

• Intelligent-Tiering:

  • Long-lived data with changing or unknown access patterns. Basically, In this class the data automatically moves to the class most suitable for you based on usage patterns
  • Price depends on the used class
  • 11x9% durability
  • 99.90% availability

• Glacier: Archive data with retrieval time ranging from minutes to hours

• Glacier Deep Archive: Archive data that rarely, if ever, needs to be accessed with retrieval times in hours

• Both Glacier and Glacier Deep Archive are:

  • The most cheap storage classes
  • have 9x9% durability

More on storage classes here

A customer would like to move data which is rarely accessed from standard storage class to the most cheapest class there is. Which storage class should be used?

• One Zone-IA
• Glacier Deep Archive
• Intelligent-Tiering

Glacier Deep Archive

What Glacier retrieval options are available for the user?

Expedited, Standard and Bulk

True or False? Each AWS account can store up to 500 PetaByte of data. Any additional storage will cost double

False. Unlimited capacity.

Explain what is Storage Gateway

"AWS Storage Gateway is a hybrid cloud storage service that gives you on-premises access to virtually unlimited cloud storage". More on Storage Gateway here

Explain the following Storage Gateway deployments types

• File Gateway
• Volume Gateway
• Tape Gateway

Explained in detail here

What is the difference between stored volumes and cached volumes?

Stored Volumes - Data is located at customer's data center and periodically backed up to AWS Cached Volumes - Data is stored in AWS cloud and cached at customer's data center for quick access

What is "Amazon S3 Transfer Acceleration"?

AWS definition: "Amazon S3 Transfer Acceleration enables fast, easy, and secure transfers of files over long distances between your client and an S3 bucket"

Learn more here

Explain data consistency

S3 Data Consistency provides strong read-after-write consistency for PUT and DELETE requests of objects in the S3 bucket in all AWS Regions. S3 always return latest file version.

Can you host dynamic websites on S3? What about static websites?

No. S3 support only statis hosts. On a static website, individual webpages include static content. They might also contain client-side scripts. By contrast, a dynamic website relies on server-side processing, including server-side scripts such as PHP, JSP, or ASP.NET. Amazon S3 does not support server-side scripting.

What security measures have you taken in context of S3?

* Enable versioning. * Don't make bucket public. * Enable encryption if it's disabled.

What storage options are there for EC2 Instances?

What is AWS Snowmobile?

"AWS Snowmobile is an Exabyte-scale data transfer service used to move extremely large amounts of data to AWS."

Learn more here

AWS Disaster Recovery

In regards to disaster recovery, what is RTO and RPO?

RTO - The maximum acceptable length of time that your application can be offline.

RPO - The maximum acceptable length of time during which data might be lost from your application due to an incident.

What types of disaster recovery techniques AWS supports?

• The Cold Method - Periodically backups and sending the backups off-site
  
• Pilot Light - Data is mirrored to an environment which is always running
• Warm Standby - Running scaled down version of production environment
• Multi-site - Duplicated environment that is always running

Which disaster recovery option has the highest downtime and which has the lowest?

Lowest - Multi-site Highest - The cold method

AWS CloudFront

Explain what is CloudFront

AWS definition: "Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds, all within a developer-friendly environment."

More on CloudFront here

Explain the following

• Origin
• Edge location
• Distribution

What delivery methods available for the user with CDN?

True or False?. Objects are cached for the life of TTL

True

What is AWS Snowball?

A transport solution which was designed for transferring large amounts of data (petabyte-scale) into and out the AWS cloud.

AWS ELB

What is ELB (Elastic Load Balancing)?

AWS definition: "Elastic Load Balancing automatically distributes incoming application traffic across multiple targets, such as Amazon EC2 instances, containers, IP addresses, and Lambda functions."

More on ELB here

What types of load balancers are supported in EC2 and what are they used for?

• Application LB - layer 7 traffic
• Network LB - ultra-high performances or static IP address (layer 4)
• Classic LB - low costs, good for test or dev environments (retired by August 15, 2022)
• Gateway LB - transparent network gateway and and distributes traffic such as firewalls, intrusion detection and prevention systems, and deep packet inspection systems. (layer 3)

AWS Security

What is the shared responsibility model? What AWS is responsible for and what the user is responsible for based on the shared responsibility model?

The shared responsibility model defines what the customer is responsible for and what AWS is responsible for.

More on the shared responsibility model here

True or False? Based on the shared responsibility model, Amazon is responsible for physical CPUs and security groups on instances

False. It is responsible for Hardware in its sites but not for security groups which created and managed by the users.

Explain "Shared Controls" in regards to the shared responsibility model

AWS definition: "apply to both the infrastructure layer and customer layers, but in completely separate contexts or perspectives. In a shared control, AWS provides the requirements for the infrastructure and the customer must provide their own control implementation within their use of AWS services"

Learn more about it here

What is the AWS compliance program?

How to secure instances in AWS?

• Instance IAM roles should have minimal permissions needed. You don't want an instance-level incident to become an account-level incident
• Use "AWS System Manager Session Manager" for SSH
• Using latest OS images with your instances

What is AWS Artifact?

AWS definition: "AWS Artifact is your go-to, central resource for compliance-related information that matters to you. It provides on-demand access to AWS’ security and compliance reports and select online agreements."

Read more about it here

What is AWS Inspector?

AWS definition: "Amazon Inspector is an automated security assessment service that helps improve the security and compliance of applications deployed on AWS. Amazon Inspector automatically assesses applications for exposure, vulnerabilities, and deviations from best practices.""

Learn more here

What is AWS Guarduty?

AWS definition: "Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior to protect your Amazon Web Services accounts, workloads, and data stored in Amazon S3"
Monitor VPC Flow lows, DNS logs, CloudTrail S3 events and CloudTrail Mgmt events.

What is AWS Shield?

AWS definition: "AWS Shield is a managed Distributed Denial of Service (DDoS) protection service that safeguards applications running on AWS."

What is AWS WAF? Give an example of how it can used and describe what resources or services you can use it with

What AWS VPN is used for?

What is the difference between Site-to-Site VPN and Client VPN?

What is AWS CloudHSM?

Amazon definition: "AWS CloudHSM is a cloud-based hardware security module (HSM) that enables you to easily generate and use your own encryption keys on the AWS Cloud."

Learn more here

True or False? AWS Inspector can perform both network and host assessments

True

What is AWS Key Management Service (KMS)?

AWS definition: "KMS makes it easy for you to create and manage cryptographic keys and control their use across a wide range of AWS services and in your applications." More on KMS here

What is AWS Acceptable Use Policy?

It describes prohibited uses of the web services offered by AWS. More on AWS Acceptable Use Policy here

True or False? A user is not allowed to perform penetration testing on any of the AWS services

False. On some services, like EC2, CloudFront and RDS, penetration testing is allowed.

True or False? DDoS attack is an example of allowed penetration testing activity

False.

True or False? AWS Access Key is a type of MFA device used for AWS resources protection

False. Security key is an example of an MFA device.

What is Amazon Cognito?

Amazon definition: "Amazon Cognito handles user authentication and authorization for your web and mobile apps."

Learn more here

What is AWS ACM?

Amazon definition: "AWS Certificate Manager is a service that lets you easily provision, manage, and deploy public and private Secure Sockets Layer/Transport Layer Security (SSL/TLS) certificates for use with AWS services and your internal connected resources."

Learn more here

AWS Databases

What is AWS RDS?

What is AWS DynamoDB?

Explain "Point-in-Time Recovery" feature in DynamoDB

Amazon definition: "You can create on-demand backups of your Amazon DynamoDB tables, or you can enable continuous backups using point-in-time recovery. For more information about on-demand backups, see On-Demand Backup and Restore for DynamoDB."

Learn more here

Explain "Global Tables" in DynamoDB

Amazon definition: "A global table is a collection of one or more replica tables, all owned by a single AWS account."

Learn more here

What is DynamoDB Accelerator?

Amazon definition: "Amazon DynamoDB Accelerator (DAX) is a fully managed, highly available, in-memory cache for DynamoDB that delivers up to a 10x performance improvement – from milliseconds to microseconds..."

Learn more here

What is AWS Redshift and how is it different than RDS?

cloud data warehouse

What do you if you suspect AWS Redshift performs slowly?

• You can confirm your suspicion by going to AWS Redshift console and see running queries graph. This should tell you if there are any long-running queries.
• If confirmed, you can query for running queries and cancel the irrelevant queries
• Check for connection leaks (query for running connections and include their IP)
• Check for table locks and kill irrelevant locking sessions

What is AWS ElastiCache? For what cases is it used?

Amazon Elasticache is a fully managed Redis or Memcached in-memory data store. It's great for use cases like two-tier web applications where the most frequently accesses data is stored in ElastiCache so response time is optimal.

What is Amazon Aurora

A MySQL & Postgresql based relational database. Also, the default database proposed for the user when using RDS for creating a database. Great for use cases like two-tier web applications that has a MySQL or Postgresql database layer and you need automated backups for your application.

What is Amazon DocumentDB?

Amazon definition: "Amazon DocumentDB (with MongoDB compatibility) is a fast, scalable, highly available, and fully managed document database service that supports MongoDB workloads. As a document database, Amazon DocumentDB makes it easy to store, query, and index JSON data."

Learn more here

What "AWS Database Migration Service" is used for?

What type of storage is used by Amazon RDS?

EBS

Explain Amazon RDS Read Replicas

AWS definition: "Amazon RDS Read Replicas provide enhanced performance and durability for RDS database (DB) instances. They make it easy to elastically scale out beyond the capacity constraints of a single DB instance for read-heavy database workloads." Read more about here

AWS Networking

What is VPC?

"A logically isolated section of the AWS cloud where you can launch AWS resources in a virtual network that you define" Read more about it here.

True or False? VPC spans multiple regions

False

True or False? Subnets belong to the same VPC, can be in different availability zones

True. Just to clarify, a single subnet resides entirely in one AZ.

What is an Internet Gateway?

"component that allows communication between instances in your VPC and the internet" (AWS docs). Read more about it here

True or False? NACL allow or deny traffic on the subnet level

True

What is VPC peering?

docs.aws: "A VPC peering connection is a networking connection between two VPCs that enables you to route traffic between them using private IPv4 addresses or IPv6 addresses."

True or False? Multiple Internet Gateways can be attached to one VPC

False. Only one internet gateway can be attached to a single VPC.

You've restarted your EC2 instance and the public IP has changed. How would you deal with it so it won't happen?

Use Elastic IP which provides you a fixed IP address.

What is an Elastic IP address?

AWS Docs: "An Elastic IP address is a static IPv4 address designed for dynamic cloud computing. An Elastic IP address is allocated to your AWS account, and is yours until you release it. By using an Elastic IP address, you can mask the failure of an instance or software by rapidly remapping the address to another instance in your account."

True or False? When stopping and starting an EC2 instance, its public IP changes

True

What are the best practices around Elastic IP?

The best practice is actually not using them in the first place. It's more common to use a load balancer without a public IP or use a random public IP and register a DNS record to it

True or False? An Elastic IP is free, as long it's not associated with an EC2 instance

False. An Elastic IP is free of charge as long as **it is ** associated with an EC2 instance. This instance should be running and should have only one Elastic IP.

True or False? Route Tables used to allow or deny traffic from the internet to AWS instances

False.

Explain Security Groups and Network ACLs

• NACL - security layer on the subnet level.
• Security Group - security layer on the instance level.

Read more about it here and here

What is AWS Direct Connect?

Allows you to connect your corporate network to AWS network.

What would you use if you need a fixed public IP for your EC2 instance?

Elastic IP

AWS EC2 - ENI

Explain Elastic Network Interfaces (ENI)

AWS Docs: "An elastic network interface is a logical networking component in a VPC that represents a virtual network card."

Name at least three attributes the Elastic Network Interfaces (ENI) can include

1. One public IPv4 address
2. Mac Address
3. A primary private IPv4 address (from the address range of your VPC)

True or False? ENI are not bound to a specific availability zone

False. ENI are bound to specific availability zone.

True or False? ENI can be created independently of EC2 instances

True. They can be attached later on and on the fly (for failover purposes).

AWS EC2 - Placement Groups

What are "Placement Groups"?

AWS Docs: "When you launch a new EC2 instance, the EC2 service attempts to place the instance in such a way that all of your instances are spread out across underlying hardware to minimize correlated failures. You can use placement groups to influence the placement of a group of interdependent instances to meet the needs of your workload."

What Placement Groups strategies are there?

• Cluster: places instance close together in an AZ.
• Spread: spreads the instance across the hardware
• Partition: spreads the instances across different partitions (= different sets of hardware/racks) within an AZ

For each of the following scenarios choose a placement group strategy:

• High availability is top priority

• Low latency between instances

• Instances must be isolated from each other

• Big Data applications that are partition aware

• Big Data process that needs to end quickly

High availability is top priority - Spread

Low latency between instances - Cluster

Instances must be isolated from each other - Spread

Big Data applications that are partition aware - Partition

Big Data process that needs to end quickly - Cluster

What are the cons and pros of the "Cluster" placement group strategy?

Cons: if the hardware fails, all instances fail Pros: Low latency & high throughput network

What are the cons and pros of the "Spread" placement group strategy?

Cons:

• Current limitation is 7 instances per AZ (per replacement group) Pros:
• Maximized high availability (instances on different hardware, span across AZs)

AWS - Identify the service or tool

What would you use for automating code/software deployments?

AWS CodeDeploy

You would like to invoke a function every time you enter a URL in the browser. Which service would you use for that?

AWS Lambda

What would you use for easily creating similar AWS environments/resources for different customers?

CloudFormation

Using which service, can you add user sign-up, sign-in and access control to mobile and web apps?

Cognito

Which service would you use for building a website or web application?

Lightsail

Which tool would you use for choosing between Reserved instances or On-Demand instances?

Cost Explorer

What would you use to check how many unassociated Elastic IP address you have?

Trusted Advisor

Which service allows you to transfer large amounts (Petabytes) of data in and out of the AWS cloud?

AWS Snowball

Which service would you use if you need a data warehouse?

AWS RedShift

Which service provides a virtual network dedicated to your AWS account?

VPC

What you would use for having automated backups for an application that has MySQL database layer?

Amazon Aurora

What would you use to migrate on-premise database to AWS?

AWS Database Migration Service (DMS)

What would you use to check why certain EC2 instances were terminated?

AWS CloudTrail

What would you use for SQL database?

AWS RDS

What would you use for NoSQL database?

AWS DynamoDB

What would you use for adding image and video analysis to your application?

AWS Rekognition

Which service would you use for debugging and improving performances issues with your applications?

AWS X-Ray

Which service is used for sending notifications?

SNS

What would you use for running SQL queries interactively on S3?

AWS Athena

What would you use for preparing and combining data for analytics or ML?

AWS Glue

Which service would you use for monitoring malicious activity and unauthorized behavior in regards to AWS accounts and workloads?

Amazon GuardDuty

Which service would you use for centrally manage billing, control access, compliance, and security across multiple AWS accounts?

AWS Organizations

Which service would you use for web application protection?

AWS WAF

You would like to monitor some of your resources in the different services. Which service would you use for that?

CloudWatch

Which service would you use for performing security assessment?

AWS Inspector

Which service would you use for creating DNS record?

Route 53

What would you use if you need a fully managed document database?

Amazon DocumentDB

Which service would you use to add access control (or sign-up, sign-in forms) to your web/mobile apps?

AWS Cognito

Which service would you use if you need messaging queue?

Simple Queue Service (SQS)

Which service would you use if you need managed DDOS protection?

AWS Shield

Which service would you use if you need store frequently used data for low latency access?

ElastiCache

What would you use to transfer files over long distances between a client and an S3 bucket?

Amazon S3 Transfer Acceleration

Which service would you use for distributing incoming requests across multiple?

Route 53

Which services are involved in getting a custom string (based on the input) when inserting a URL in the browser?

Lambda - to define a function that gets an input and returns a certain string
API Gateway - to define the URL trigger (= when you insert the URL, the function is invoked).

Which service would you use for data or events streaming?

Kinesis

AWS DNS

What is Route 53?

"Amazon Route 53 is a highly available and scalable cloud Domain Name System (DNS) web service..." Some of Route 53 features:

• Register domain
• DNS service - domain name translations
• Health checks - verify your app is available

More on Route 53 here

AWS Monitoring & Logging

What is AWS CloudWatch?

AWS definition: "Amazon CloudWatch is a monitoring and observability service..."

More on CloudWatch here

What is AWS CloudTrail?

AWS definition: "AWS CloudTrail is a service that enables governance, compliance, operational auditing, and risk auditing of your AWS account."

Read more on CloudTrail here

What is Simply Notification Service?

AWS definition: "a highly available, durable, secure, fully managed pub/sub messaging service that enables you to decouple microservices, distributed systems, and serverless applications."

Read more about it here

Explain the following in regards to SNS:

• Topics
• Subscribers
• Publishers

• Topics - used for grouping multiple endpoints
• Subscribers - the endpoints where topics send messages to
• Publishers - the provider of the message (event, person, ...)

AWS Billing & Support

What is "AWS Organizations"?

AWS definition: "AWS Organizations helps you centrally govern your environment as you grow and scale your workloads on AWS." More on Organizations here

What are Service Control Policies and to what service they belong?

AWS organizations service and the definition by Amazon: "SCPs offer central control over the maximum available permissions for all accounts in your organization, allowing you to ensure your accounts stay within your organization’s access control guidelines."

Learn more here

Explain AWS pricing model

It mainly works on "pay-as-you-go" meaning you pay only for what are using and when you are using it. In s3 you pay for 1. How much data you are storing 2. Making requests (PUT, POST, ...) In EC2 it's based on the purchasing option (on-demand, spot, ...), instance type, AMI type and the region used.

More on AWS pricing model here

How do you estimate AWS costs?

• TCO calculator
• AWS simple calculator
• Cost Explorer
• AWS Budgets
• Cost Allocation Tags

What basic support in AWS includes?

• 24x7 customer service
• Trusted Advisor
• AWS personal Health Dashoard

How are EC2 instances billed?

What AWS Pricing Calculator is used for?

What is Amazon Connect?

Amazon definition: "Amazon Connect is an easy to use omnichannel cloud contact center that helps companies provide superior customer service at a lower cost."

Learn more here

What are "APN Consulting Partners"?

Amazon definition: "APN Consulting Partners are professional services firms that help customers of all types and sizes design, architect, build, migrate, and manage their workloads and applications on AWS, accelerating their journey to the cloud."

Learn more here

Which of the following are AWS accounts types (and are sorted by order)?

• Basic, Developer, Business, Enterprise
• Newbie, Intermediate, Pro, Enterprise
• Developer, Basic, Business, Enterprise
• Beginner, Pro, Intermediate Enterprise

• Basic, Developer, Business, Enterprise

True or False? Region is a factor when it comes to EC2 costs/pricing

True. You pay differently based on the chosen region.

What is "AWS Infrastructure Event Management"?

AWS Definition: "AWS Infrastructure Event Management is a structured program available to Enterprise Support customers (and Business Support customers for an additional fee) that helps you plan for large-scale events such as product or application launches, infrastructure migrations, and marketing events."

AWS Automation

What is AWS CodeDeploy?

Amazon definition: "AWS CodeDeploy is a fully managed deployment service that automates software deployments to a variety of compute services such as Amazon EC2, AWS Fargate, AWS Lambda, and your on-premises servers."

Learn more here

Explain what is CloudFormation

AWS - Misc

Which AWS service you have experience with that you think is not very common?

What is AWS CloudSearch?

What is AWS Lightsail?

AWS definition: "Lightsail is an easy-to-use cloud platform that offers you everything needed to build an application or website, plus a cost-effective, monthly plan."

What is AWS Rekognition?

AWS definition: "Amazon Rekognition makes it easy to add image and video analysis to your applications using proven, highly scalable, deep learning technology that requires no machine learning expertise to use."

Learn more here

What AWS Resource Groups used for?

Amazon definition: "You can use resource groups to organize your AWS resources. Resource groups make it easier to manage and automate tasks on large numbers of resources at one time. "

Learn more here

What is AWS Global Accelerator?

Amazon definition: "AWS Global Accelerator is a service that improves the availability and performance of your applications with local or global users..."

Learn more here

What is AWS Config?

Amazon definition: "AWS Config is a service that enables you to assess, audit, and evaluate the configurations of your AWS resources."

Learn more here

What is AWS X-Ray?

AWS definition: "AWS X-Ray helps developers analyze and debug production, distributed applications, such as those built using a microservices architecture." Learn more here

What is AWS OpsWorks?

Amazon definition: "AWS OpsWorks is a configuration management service that provides managed instances of Chef and Puppet."

Learn more about it here

What is AWS Athena?

"Amazon Athena is an interactive query service that makes it easy to analyze data in Amazon S3 using standard SQL."

Learn more about AWS Athena here

What is Amazon Cloud Directory?

Amazon definition: "Amazon Cloud Directory is a highly available multi-tenant directory-based store in AWS. These directories scale automatically to hundreds of millions of objects as needed for applications."

Learn more here

What is AWS Elastic Beanstalk?

AWS definition: "AWS Elastic Beanstalk is an easy-to-use service for deploying and scaling web applications and services...You can simply upload your code and Elastic Beanstalk automatically handles the deployment"

Learn more about it here

What is AWS SWF?

Amazon definition: "Amazon SWF helps developers build, run, and scale background jobs that have parallel or sequential steps. You can think of Amazon SWF as a fully-managed state tracker and task coordinator in the Cloud."

Learn more on Amazon Simple Workflow Service here

What is AWS EMR?

AWS definition: "big data platform for processing vast amounts of data using open source tools such as Apache Spark, Apache Hive, Apache HBase, Apache Flink, Apache Hudi, and Presto."

Learn more here

What is AWS Quick Starts?

AWS definition: "Quick Starts are built by AWS solutions architects and partners to help you deploy popular technologies on AWS, based on AWS best practices for security and high availability."

Read more here

What is the Trusted Advisor?

What is AWS Service Catalog?

Amazon definition: "AWS Service Catalog allows organizations to create and manage catalogs of IT services that are approved for use on AWS."

Learn more here

What is AWS CAF?

Amazon definition: "AWS Professional Services created the AWS Cloud Adoption Framework (AWS CAF) to help organizations design and travel an accelerated path to successful cloud adoption. "

Learn more here

What is AWS Cloud9?

AWS: "AWS Cloud9 is a cloud-based integrated development environment (IDE) that lets you write, run, and debug your code with just a browser"

What is AWS CloudShell?

AWS: "AWS CloudShell is a browser-based shell that makes it easy to securely manage, explore, and interact with your AWS resources."

What is AWS Application Discovery Service?

Amazon definition: "AWS Application Discovery Service helps enterprise customers plan migration projects by gathering information about their on-premises data centers."

Learn more here

What is the AWS well-architected framework and what pillars it's based on?

AWS definition: "The Well-Architected Framework has been developed to help cloud architects build secure, high-performing, resilient, and efficient infrastructure for their applications. Based on five pillars — operational excellence, security, reliability, performance efficiency, and cost optimization"

Learn more here

What AWS services are serverless (or have the option to be serverless)?

AWS Lambda AWS Athena

What is Simple Queue Service (SQS)?

AWS definition: "Amazon Simple Queue Service (SQS) is a fully managed message queuing service that enables you to decouple and scale microservices, distributed systems, and serverless applications".

Learn more about it here

AWS - Production

Describe in high-level how to upgrade a system on AWS with (near) zero downtime

One way is through launching a new instance. In more detail:

1. Launch a new instance
2. Install all the updates and applications
3. Test the instance
4. If all tests passed successfully, you can start using the new instance and perform the switch with the old one, in one of various ways:
5. Go to route53 and update the record with the IP of the new instance
6. If you are using an Elastic IP then move it to the new instance ...

When you launch EC2 instances, it takes them time to boot due to commands you run with user data. How to improve instances boot time?

Consider creating customized AMI with the commands from user data already executed there. This will allow you launch instance instantly.