AWS

Question 1

What is SQS and where is effective?

Answer 1

• Simple Queue Service - Launched in 2006
• Offer Async Message Based Communication (as opposed to API calls)
• Scalable, Highly Available, Fully Managed and Cost Effective

It is effective:
- Data Processing
- Real-Time Event process (E-commerce)
- Ad-hoc job queue (database snapshot at midnight)

Question 2

Explain the Message Processing Workflow of SQS

Answer 2

1. First, a message is published in the queue
2. Then, a message is claimed by the viewer (consumer), and the “visibility countdown” start
3. Finally, we could have 2 options:
   a. Message is processed and deleted by consumer
   b. Visibility timeout expires and the message is returned to the queue (the whole thing can be retried later on)

Question 3

Why use SQS over API calls

Answer 3

• Decoupling: publisher has no insight into client processing, also services are decoupled*.
• Manage processing rate (do we want to process an event faster or slower)
• Very good for async/”no real time” apps

======
*Coupled dependencies between services WITHOUT SQS
If I have services A and B, and A makes a request to B every time something changes, if B is down, A is down too.

WITH SQS we have a middle man, so if service B goes down is not going to affect service A.

Question 4

In SQS: Standard vs FIFO queues / Pros and Cons

Answer 4

STANDARD QUEUE
PROs
- Unlimited messages amount to process
CONs
- At least one delivery (one message could be delivered multiple times)
- Best effort ordering (the order of processing the messages is not perfect)

FIFO QUEUE
PROs
- Messages processed in order
- Exactly Once processing per message
- Support multiple channels of Messages (execute messages for different customers, with different queues). Tight a message to a particular group. All the queues can be processed independently
CONs
- 300 TPS (Transaction Per Second) max or 3000 With Batching
- More expensive (25%). Not big deal.

Question 5

What are common patterns in SQS?

Answer 5

• Use SNS and set messages to different queues
• Use SQS with a Lambda function, so every time I have a new message, the lambda is triggered
• Use “Cloudwatch event” and set the event in SQS and then, if you have a long-running process job use EC2, and if you have a shorter running job, you can use a Lambda

Question 6

What is SNS?

Answer 6

• Message publishing and processing service
• Allows Fanout to millions of consumers (email, HTTP endpoints, SQS, Texting)
• Fully managed, durable, and auto-scaling:
  
  • Don’t need to worry about infrastructure (even with millions of transactions per second)
  • Messages are guaranteed to not be lost (not real-time)
• Consist of topics (for instance, an e-commerce checkout event) and subscriptions

Question 7

How can you set automatic notification every time your bill goes over X amount of dollars?

Answer 7

you go to Cloudwatch and you set a billing alarm. A billing alarm uses an SNS topic.

Question 8

what is EC2?

Answer 8

Amazon Elastic Computed Cloud is a web service that provides resizable compute capacity in the cloud.

Reduce the time to have a server to minutes.

Question 9

Types of EC2?

Answer 9

Dedicated Instances are billed by the number of instances, whereas Dedicated Hosts are billed by the host, irrespective of the number of instances you run on each host. With that in mind, we’re ready to move to the next important section, understanding the various pricing options for AWS instances.

REGULAR EC2 INSTANCE
These are the default AWS instances that most applications use. They are instances in the cloud that are shared between multiple AWS customers. AWS provides isolation between each user’s data. However, multi-tenancy normally comes with the “noisy neighbor” issue, where neighboring instances could affect the performance of your app if they hog up resources on the same host as you. To counter this problem, you have a couple of options.

SPOT INSTANCE
With a Spot instance, you can save money by purchasing the hourly compute power of someone else’s unused EC2 instance. The “Spot Price” is what you’ll pay. Spot instances are useful for running tasks that aren’t critical, and can also be interrupted without disruption (AWS calls these “fault-tolerant” workloads). Think batch jobs, compute-intensive analysis, temporary auto-scaling to meet a short-term spike or another similar usage.

OPTIMIZED EC2 INSTANCE
Compute, memory, and storage-optimized EC2 instances are also available. These instances are designed to deliver an optimized service level for a specific area (storage, memory, or compute). For example, optimized compute instances offer dedicated CPUs of specific varieties and speeds, along with standard network bandwidth and storage options. Storage optimized instances provide optimized access to local storage access (i.e. on the same host) – options include NVMe SSDs or HDDs combined with standard selections for vCPU and memory.

DEDICATED INSTANCE / RESERVED
These are virtual private cloud (VPC) instances that are blocked for use by a single customer. They are Isolated at the host level, so all instances running on the host would be reserved for a single customer. But there’s another option if you want even more isolation and control over your infrastructure.

DEDICATED HOST
Dedicated Hosts enable the same level of isolation as Dedicated Instances, but additionally, they give you visibility into the physical host. This is required if your applications use libraries and frameworks with licensing terms that restrict them to a single server. Or some applications may need to be hosted on a dedicated server for compliance purposes. In these cases, a Dedicated Instance is your only option.

PRICING
ON-DEMAND PRICING
With on-demand pricing, you pay by the hour for usage of an AWS instance.
- The benefit of on-demand pricing is that you don’t have to plan in advance how many instances you need. This gives you maximum flexibility.
- However, it comes at a cost. On-demand pricing is the highest of the lot.

SPOT INSTANCES
With Spot Instances, users bid for the price of spare EC2 Instances. There’s a market price for spare instances, and only if this market price meets your instance will you be allotted the instance. Similarly, when the market price reduces, you’ll automatically lose your instance so your charge doesn’t shoot up. This model is a bit more complex than on-demand pricing, but it could save 50-90% of your total costs.

RESERVED INSTANCES
Finally, if you can reliably predict approximately how much compute resources your applications need in advance, you should consider Reserved Instances (RIs).

Dedicated hosts

Question 10

Explain Security groups in EC2

Answer 10

• A security group acts as a virtual firewall for your EC2 instances to control incoming and outgoing traffic.
• Blocks all traffic EXCEPT the PORTS, PROTOCOLS, and SOURCES you specify.

For instance, access throw HTTP (if it is a web server), or SQL, the ports, etc.

All inbound traffic is blocked by default, but you can go and enable individual ports.
EC2 can be assigned to multiple security groups.
Every time you make a change in the security group, that change took effect immediately. (exam question)

All outbound is enabled by default.

The security Group is assigned to a VPC. When you create an instance of EC2, the security group that you can select are the ones that were created on the VPC selected

Question 11

What is IAM?

Answer 11

Identity Access Management:
- Core service in AWS that helps you control access to RESOURCES (S3, lambda, etc)
- The users perform ACTIONS to resources (create a bucket in S3)
- Authorizations to make ACTIONS depends on POLICIES

Question 12

What is a VPC

Answer 12

A Virtual Private CLoud is your isolated network in the cloud.

A VPC should be from ONE “region” but could have elements from different “Availability Zones” (data centers).

The subnets inside a VPC (subnetworks inside your VPC), each of them should be on one Availability Zone. So you can’t have a subnet that is in 2 Availability Zones.

Inside the VPC you have your own IP Range and every subnet has a subset of the VPC range.

https://www.youtube.com/watch?v=bGDMeD6kOz0&ab_channel=SamMeech-Ward

Question 13

What do you use to control the access to a VPC?

Answer 13

• You can have SECURITY GROUPS inside the VPC, and assign for each EC2 instance used inside the subnets, a security group, to control the input and output of data.

AWS Security Groups help you secure your cloud environment by controlling how traffic will be allowed into your EC2 machines. With Security Groups, you can ensure that all the traffic that flows at the instance level is only through your established ports and protocols.

• And for the connections to the VPC, we can use Network Access Control List (NACL).

A Network Access Control List (NACL) is an optional layer of security for your VPC that acts as a firewall for controlling traffic in and out of one or more subnets. You might set up network ACLs with rules similar to your security groups in order to add an additional layer of security to your VPC.

Question 14

What you can do to make a Subnet private?

Answer 14

You can
- BLOCK outgoing to internet
- set No Public IP

Sometimes you want your private subnet to connect to the internet to upgrade the packages for example. We can do that by redirecting outgoing access to the internet throw a NAT GATEWAY (NAT = Network Address Translation). So with that you can access internet INDIRECTLY

Question 15

what is EBS? Name the 5 different types

Answer 15

Amazon Elastic Block Storage is basically a virtual hard disk storage in the cloud.

It is automatically replicated between different Availability Zones to protect you from failure. But the volume will always be in the same availability zone as the instance of the EC2

The 5 different types are:
- General Purposse (SSD)
- Provisioned IOPS (SSD)
- Throughput optimised Hard disk drive (magnetic, not SSD)
- Cold Hard Disk Drive
- Magnetic

https://docs.google.com/document/d/1h7O_-Wyt2EnBkFQ54WM2t7mVVirwVlwDo50OLuNK–I/edit

Question 16

Where are the snapshots and what are they of EBS?

Answer 16

• Snapshots are like photograph of the EBS.
• They live in S3.
• They are incremental. Only the blocks that has changed are moved to S3, with the rest of the previous snapshot
• To do the snapshot for EBS volumes that serve as root device, you should stop the EC2 instance. However you can take a snapshot while the instance is running.
• You can create AMI (Amazon Machine Images) from snapshots.

Question 17

How do we move a EC2 Volume from one AZ to another?

Answer 17

We create a snapshot of the volume, then create an AMI (Amazon Machine Image) from the snapshot, and, after that, use the AMI to launch the EC2 instance in the new AZ

Question 18

SQS vs SNS vs EventBridge

Answer 18

SQS
1. queus
2. messages
3. polling
=> decouple services
=> temporarily message holding pool
=> optional order processing

SNS
1. Topics
2. Messages
3. Publish Subscriber
=> 1 to Many (FANOUTS)
=> Good for when you have many subscribers

 => you have one publisher and many subscriber (if I have one queue per every subscriber I introduce the problem of what happen if I publish in one queue and not in other)
 => it is not recommended to connect directly an API or lambda to SNS because if one of these services is down, they may loose some data. It doesn't have DLQ integrated by default. You could configure a redrive policy directly on your SNS topic to specify a DLQ. Alternatively, you could configure your SNS topic to publish messages to an SQS queue.

EVENT BRIDGE
1. message bus
2. Events
3. Rules
4. Targets

 => 1 to Many with limitations

=> Message bus (container for events), publish EVENTS to the Message Bus, you have some RULES for the EVENTS, and at the end you have TARGET that are the final receivers of the messages PROS
=> The most important Pro is the third party integration / service integration
=> Support DLQ (you can avoid setting an SQS between the client/target?) CONS
=> The most important Cons is that for a specific RULE you have a maximum of 5 TARGETS

https://www.youtube.com/watch?v=RoKAEzdcr7k&t=1s&ab_channel=BeABetterDev

Question 19

What is DLQ?

Answer 19

A Dead Letter Queue (DLQ) is a feature commonly used in messaging and event-driven systems to handle messages or events that cannot be successfully processed or delivered to their intended destination. DLQs provide a way to isolate and store problematic messages or events for further analysis, troubleshooting, or manual intervention, rather than simply discarding them or causing an infinite loop of retries.

In AWS It is a feature that enables you to set up an Amazon SQS queue to capture and store failed messages that could not be processed (for example) by your Lambda function. This can be useful for debugging and error handling.

If you enable DLQ for your Lambda function, failed events will be sent to the configured SQS queue instead of being discarded. This can help you identify and diagnose the root cause of the failure, and take appropriate action to resolve it.

For example, if your Lambda function is triggered by an S3 bucket and encounters an error while processing a file, the failed event will be sent to the configured DLQ. You can then examine the event to determine why it failed, and possibly correct the issue.

SQS and Event Bridge natively support DLQ

Question 20

How do you use DLS in SNS vs EventBridge?

Answer 20

• In SNS, you typically handle failed event deliveries using SQS or Lambda with custom error handling or DLQ configurations. Alternatively, You could configure a redrive policy directly on your SNS topic to specify a DLQ.
• In EventBridge, you can configure DLQs directly as part of its event routing and processing capabilities.