AWS Pricing, Limits & other misc Flashcards
(114 cards)
1
Q
S3 Standard Pricing model
A
GB / month fee for data stored.
$ per GB for data transfer (outbound)
price per 1000 requests.
Used for frequently accessed data.
2
Q
S3 Upload Object size limit
A
5 GB per object in a single operation (AWS SDKs, REST API, or AWS CLI).
160 GB per object using the Amazon S3 Console.
Files greater than 5 GB must be uploaded using multi-part uploads.
Max size limit in S3 is 5 TB files per object.
3
Q
S3 Multi-Part Upload min data size
A
100 MB file
5 MB min part size
4
Q
S3 Multi-Part Upload max parts
A
10K max parts
5
Q
S3 Multi-Part Upload part limits
A
min 5 MB
max 5 GB
the last part can be smaller than 5 MB
Max size limit in S3 is 5 TB files per object.
6
Q
KMS Security standard
A
FIPS 140-2 (L2)
Federal Information Processing Standard
Some features of KMS are compliant with Level 3, but overall it achieved 140-2 Level 2
7
Q
CMK
A
Customer Master Key
• Is logical
○ ID
○ Date
○ Policy
○ Desc & state
8
Q
CMK data encryption limit
A
4 KB
9
Q
DEK
A
Data Encryption Key
10
Q
KMS rotation interval for AWS managed CMKs
A
every 3 years.
enabled by default and cannot be disabled.
11
Q
KMS rotation interval for CMK
A
every 1 year after the enable date.
Disabled CMKs are not rotated.
When the CMK is re-enabled, if the key material is more than 365 days old, AWS KMS rotates it immediately.
12
Q
S3 number of allowed buckets per account
A
100 buckets soft limit.
can be increased up to 1000 (hard limit) by submitting a service limit increase.
13
Q
KMS scheduled key deletion waiting period
A
between 7 and 30 days.
14
Q
SSE-S3
A
Server-Side Encryption with Amazon S3-Managed Keys
15
Q
SSE-KMS
A
Server-Side Encryption with Customer Master Keys (CMKs) Stored in AWS Key Management Service (SSE-KMS)
16
Q
SSE-C
A
Server-Side Encryption with Customer-Provided Keys (SSE-C)
The customer manages the encryption keys.
Amazon S3 manages the encryption, as it writes to disks, and decryption, when you access your objects.
Inputs are data and key.
Output are encrypted object and one-way hash of the key.
17
Q
SSE-S3 x-amz-server-side-encryption header
A
AWS256
18
Q
SSE-KMS x-amz-server-side-encryption header
A
aws:kms
19
Q
S3 200 Put
A
data was stored durably.
20
Q
S3 Standard-IA Pricing model
A
Retrieval fee for every GB of data retrieved.
GB / month fee for data stored - (less than standard).
$ per GB for data transfer (outbound) - (same as standard)
price per 1000 requests (more than standard).
21
Q
S3 Standard-IA/One Zone-IA Minimum capacity charge
A
128 KB per object
22
Q
S3 Standard-IA use cases
A
Used for long-lived infrequently accessed data.
Don’t use for small files, frequently accessed, frequently changed or temp data (due to 30 days charge).
Don’t use for data which isn’t inportant or which can be easily replaced (use S3 One Zone-IA)
23
Q
S3 Standard-IA/One Zone-IA minimum duration charge
A
30 days
24
Q
S3 Standard-IA use cases
A
Used for long-lived infrequently accessed data where resilience is not required. NON-CRITICAL or data which is REPLACEABLE.
Objects have same durability but, cannot be accessed if the AZ fails.
Don’t use for critical data.
Don’t use for small files, frequently accessed, frequently changed or temp data (due to 30 days charge).
25
S3 One Zone-IA Pricing model
Retrieval fee for every GB of data retrieved.
GB / month fee for data stored - (less than Standard-IA).
$ per GB for data transfer (outbound) - (same as standard)
price per 1000 requests (more than standard).
26
S3 Glacier Pricing model
Pay for retrieval process:
- Expedited (1-5 minutes) - $10.00 per 1K retrievals
- Standard (3-5 hours) - $0.05 per 1K
- Bulk (5-12 hours) - $0.025 per 1K
Retrieval fee for every GB of data retrieved.
GB / month fee for data stored - (80% less storage costs than Standard).
$ per GB for data transfer (outbound) - (same as standard)
price per 1000 requests.
27
S3 Glacier first byte latency
Minutes or hours
- Expedited (1-5 minutes)
- Standard (3-5 hours)
- Bulk (5-12 hours)
28
S3 Glacier minimum duration charge
90 days minimum duration
29
S3 Glacier minimum capacity charge
40 KB per object
30
S3 Glacier Deep Archive pricing model
GB / month fee for data stored - (80% less storage costs than Glacier).
Retrieval fee for every GB of data retrieved.
$ per GB for data transfer (outbound).
price per 1000 requests (more than Glacier).
31
S3 Glacier Deep Archive first byte latency
Hours or days
- Standard (12 hours)
- Bulk (48 hours)
32
S3 Glacier Deep Archive use cases
Used for archival data which rarely if ever needs to be accessed. Data that needs to be retained due to legal or regulatory requirements.
Hours-days retrieval.
Not suited for system backups.
33
S3 Glacier use cases
Used for archival data where frequent or realtime acces isn't needed with Minutes-hours retrieval.
34
S3 Glacier Deep Archive minimum duration charge
180 day minimum duration
35
S3 Glacier Deep Archive minimum capacity charge
40 KB per object
36
S3 Intelligent-Tiering pricing model
Management fee per 1K objects.
No retrieval fees.
Min duration of 30 days.
37
S3 Intelligent-Tiering use cases
Long lived data (due to 30 days minimum duration).
Usage of objects is changing or unknown. Low admin overhead.
Other prices are comparable to static tiers (Glacier etc).
38
S3 Glacier Deep Archive minimum duration charge
30 days minimum duration
39
S3 Intelligent-Tiering migration thresholds
after 30 days - move to Infrequent Access
after 90 days - Archive
after 180 days - Deep Archive
40
S3 Lifecycle Configuration min duration before transition from S3 Standard is possible
30 days
Objects must be in S3 Standard for 30 days before they can be transitioned automatically.
41
S3 Lifecycle Configuration min duration before transition to S3 Glacier type in a single rule
30 days
A single rule cannot transition to Standard-IA, Intelligent-tiering or One Zone-IA and THEN to either Glacier type within 30 days.
Have to wait 30 days before the second transition.
This only applies for multi-stage transition performed with a single rule.
42
S3 Replication default storage class on destination bucket
```
use the same class as the source for objects.
Glacier or Glacier Deep Archive will not be replicated.
```
43
S3 Replication ownership account default
default is the source account.
44
S3 Replication Time Control (RTC) window
replicates 99.99% of objects within 15 minutes
45
S3 Replication encryption methods
Unencrypted
SSE-S3
SSE-KMS
SSE-C is not supported.
46
S3 Ojbect Size limit
5 TB
47
S3 Select supported data formats
CSV, JSON, Parquet.
BZIP2 compression for CSV and JSON.
48
CIDR
Classless inter-domain routing
49
All IPv6 addresses shorthand
::/0
same as
0000:0000:0000:0000:0000:0000:0000:0000/0
equivalient to 0.0.0.0/0 IPv4
50
VPC default ip CIDR
172.31.0.0/16
51
VPC min and max IPs
min: /28 (16 IPs)
max: /16 (65456 IPs)
52
VPC and subnets quotas
VPCs per Region 5 (adjustable)
Subnets per VPC 200 (adjustable)
IPv4 CIDR blocks per VPC 5 (adjustable)
IPv6 CIDR blocks per VPC 1 (fixed)
53
How to enable DNS hostnames
enableDnsHostnames setting on VPC.
54
How to enable DNS resolution
enableDnsSupport setting on VPC.
55
Reserved IP Addresses in a subnet
5 IPs
Network x.x.x.0 - Network address
Network+1 x.x.x.1 - VPC Router
Network+2 x.x.x.2 - DNS (via Route53)
Network+3 x.x.x.3 - Reserved for future use
Broadcast x.x.x.255
56
Where is the public IP address of an EC2 instance maintained?
in the internet gateway of the VPC.
the IGW links the private IP of the instance to the allocated public IP.
inside the instance OS only the private IP is available.
57
Min number of routes in a route table
all route tables have at least 1 route.
the local route.
if the vpc is IPv6 enabled it will have another route matching the IPv6 CIDR.
58
NACL
Network Access Control List
59
Network ACL Implicit rule
Rule \* DENY all traffic.
Last one to process. Is matched when no other rule is matched.
Cannot be removed or edited.
60
Network ACL limit per subnet
1
When associating a custom NACL, the default one is unassociated.
When unassociating the custom NACL, the default one is activated again.
61
NAT
Network Address Translation
Adjust IP packets by changing their source or destination IPs.
62
NAT Gateway resilience level
AZ resilient service.
A NAT gateway is provisioned in a specific AZ.
To achieve region resilience, a NAT Gateway must be provisioned in each AZ.
63
Internet Gateway resilience level
Region resilient.
64
NAT Gateway pricing model
```
Hourly charge (partial hours are billed as full hours).
Data processing charge per GB.
```
65
NAT Instance configuration
Disable Source/Destionation Checks.
66
Instance type decode
R5dn.8xlarge
R - family
5 - generation (should use latest)
db - additional capabilities (n - network optimized, a - amd cpu, e - extra capacity)
8xlarge - the size (determines the size of the ram and hte cpu)
67
EBS resilience level
AZ resilient service.
68
EBS pricing model
GB / month
IOPS/s
69
GP2 min and max volume size
min 1 GB
max 16 TB
70
EBS Volume types
Standard (magnetic)
GP2
GP3
IO1/2/BlockExpress (provisioned IOPS)
71
Provisioned IOPS min and max volume size
min 4 GB max 16 TB for io 1/2
min 4 GB max 64 TB for BlockExpress
72
Provisioned IOPS use cases
Consistent/high performance with low latency and jitter.
I/O intensive workloads such as NoSQL & relational databases.
Low volume size paired with high performance is only achievable with Provisioned IOPS as IOPS can be adjusted independently of volume size.
73
EBS Standard (HDD) use cases
st1 - throughtput optimized - use for big data, data warehouses, log processing. Frequent access. Sequential.
sc1 - cold HDD - less frequently accessed workloads. Colder data requiring fewer scans per day.
74
GP2/3 max IOPS
16,000 per volume
16KB I/O
75
GP2/3 use cases
Low-latency interactive apps
Development and test environments
76
Provisioned IOPS max IOPS
io1 / io2 - 64,000
io2 Block Express - 256,000
77
RAID0 + EBS max IOPS
260,000 (limited by the instance)
Available for io1/io2/io2-Block Express/GP2/GP3
78
FSR
Fast Snapshot Restore
79
EBS Snapshots pricing model
GB/month
80
EBS Encryption pricing model
does not cost anything.
accounts can be set to encrypt by default.
81
EBS Encryption algorithm
AES-256 algorithm.
The encrypted DEK is stored on the disk with the encrypted data.
The same data key is shared by snapshots of the volume and any subsequent volumes created from those snapshots.
82
EC2 ON-DEMAND pricing
Hourly rate billed in seconds (60s minimum) or hourly based on OS.
No long-term commitments or upfront payments.
83
EC2 SPOT instance pricing
up to 90% cost reduction.
uses spot price based on spare capacity. a maximum price can be specified.
Instance terminates if spot price goes above ours.
84
EC2 RESERVED instances pricing
up to 75% off.
1 or 3 years commitment
- all upfront
- partial upfront
- no upfront.
Reserverved in a region or AZ with capacity reservation.
85
EC2 RESERVED instances - use cases
Known steady state usage.
Lowest cost for apps which can't handle disruption.
When reserved capacity is needed for a business critical application.
86
EC2 ON-DEMAND - use-cases
New or undertain application requirements.
Short-term, spiky or undpredictable workloads which can't tolerate any distruption.
87
EC2 SPOT instance - use-cases
Use for applications that have flexible start and end times, apps which can tolerate failure and continue later.
88
Instance metadata url
http://169.254.169.254/latest/meta-data
89
Install docker command
sudo amazon-linux-extras install docker
90
User data security
not secure.
opaque to ec2 (just a block of data).
91
EC2 instance cloud init logs location
/var/log/cloud-init-output.log
92
Cluster placement groups - networking speed performance
10 Gbps single stream
93
Cluster placement groups - use cases
Performance
Faster transfer speeds (10Gbps)
Low latency
94
Spread placement groups - limit per AZ
7 instances per AZ (hard limit)
95
Spread placement groups - use case
small number of critical instances that need to be kept separated from each other.
96
Partition placement groups - use cases
more than 7 EC2 instances and it needs exposure to physical location for performance and availability reasons.
HDFS Hbase Cassandra - can use placement info to make intelligent data replication decisions.
97
R53 Simple routing - use case
Use when we want to route requests towards one service such as a web server.
98
Route 53 - health checkers threshold for healthy
18%+
99
R53 Failover routing - use case
Configure an active passive failover. Route traffic to a resource when it is healthy, or to a different resource when the first one is unhealthy.
Manage an "out of band" failure / maintenance page for a service (e.g. EC2 / S3).
100
Fast Snapshot Restore - limits
50 per region.
1 snapshot configured to restore on 4 AZs consumes 4 out of 50 slots.
They cost extra.
101
R53 Multi value routing - use cases
When we want route 53 to respond with multiple records (up to 8 records chosen randomly).
Improves availability, but is not a replacement for load balancing.
102
R53 Weighted routing - use cases
Simple load balancing or testing new software versions (A/B/N testing).
103
R53 Latency-Based routing - use cases
use when optimising for **performance and user experience** for global applications.
104
R53 Geolocation - use cases
used for regional restrictions, language specific content or load balancing across regional endpoints.
105
R53 Geolocation - how it works
Records are tagged with location:
1 US state
2 country
3 continent
4 default (optional)
R53 returns the most specific record or "NO ANSWER"
geo location doesn't return "closest" records, only relevant (location) records.
It's not about proximity.
106
R53 Geoproximity - use cases
Use when you want to route traffic based on the location of your resources and, optionally, shift traffic from resources in one location to resources in another.
if we have more resources/bigger instance size in a particular region we can route more requests by assigning a higher bias to that region / resource.
107
OLTP
OnLine Transaction Processing
108
ACID
* *Atomic** - ALL or NO components of a transaction SUCCEEDS or FAILS.
* *Consistent** - Transactions move the database from one valid state to another (nothing in-between is allowed)
* *Isolated** - transactions don't interfere with each other.
* *Durable** - once a transaction is committed it will persist even in the case of a system failure (stored on non-volatile memory).
Downside - limits scaling
109
BASE
* *Basically available** - READ and WRITE operations are available 'as much as possible', but without any consistency guarantees.
* *Soft State** - The database itseld doesn't enforce consistency.
* *Eventually consistent** - If we wait long enough, reads from the system will be consistent.
110
CAP Theorem
Consistency, Availablility, Partition Tolerant (resilience) - **choose 2**
111
BASE use cases
Highly scalable databases with high performance.
112
ACID and BASE AWS solutions
ACID - RDS
BASE - DynamoDB (or other noSQL)
BASE + ACID or noSQL + ACID = DynamoDB transactions
113
RDS Database engines
MySQL, MariaDB, PostgreSQL, Oracle, MS SQL Server
114
RDS MultiAZ failover
**60-120 seconds**.
Highly available, but not fault tolerant.
