AWS SAP-CO2 Study Guide 2 Flashcards
(102 cards)
What are the two main types of policies in AWS Identity and Access Management (IAM) and their purposes?
Two main types of IAM policies are User-Based and Resource-Based policies. User-Based policies govern user access to AWS resources, while Resource-Based policies are attached to resources like S3 buckets to control access from other AWS accounts.
What is the purpose of S3 Bucket Policies, and what can they govern?
S3 Bucket Policies are JSON-based statements that govern access and permissions for S3 buckets. They can control things like blocking public access, enforcing encryption at upload, enabling cross-account access, and specifying access permissions.
What is the difference between Object Access Control Lists (ACLs) and Bucket Access Control Lists (ACLs) in S3?
ACLs in S3 allow finer control of individual objects, while Bucket ACLs control access at the bucket level. ACLs can be used to block public access to objects, but it’s recommended to use Bucket Policies for such control.
How does versioning impact S3 objects, and what is the purpose of MFA Delete?
Versioning in S3 allows objects to have multiple versions, providing protection against accidental deletions or modifications. MFA Delete is an additional layer of security, required for deleting objects within versioned buckets to prevent accidental permanent deletions.
What is Origin Access Control (OAC) in S3, and what is its role in preventing public availability?
Origin Access Control (OAC) restricts access to S3 objects, ensuring they are accessed through intended CloudFront distributions. It prevents public access and enforces access through CloudFront, eliminating direct access to S3.
What is Cross-Region Replication (CRR) and Same-Region Replication (SRR) in S3, and how do they differ?
CRR and SRR are replication options in S3. CRR replicates objects across different AWS regions, while SRR replicates objects within the same AWS region. CRR is suitable for compliance and replication between accounts, while SRR is used for live replication within the same region.
What are the considerations for replicating unencrypted objects and objects encrypted with SSE-KMS in S3?
By default, unencrypted objects and objects encrypted with SSE-S3 are replicated. Objects encrypted with SSE-KMS need an option enabled in the replication configuration. It’s important to specify the KMS Key in the target bucket and adapt the KMS Key Policy.
What is the purpose of S3 Batch Replication, and how does it differ from live replication?
S3 Batch Replication allows the replication of objects that existed before a replication configuration was in place and objects that have previously been replicated. It differs from live replication as it’s used for bulk operations and can replicate existing objects.
What is the S3 Sync Command, and how does it work?
The S3 Sync Command is used to copy objects between S3 buckets efficiently. It lists source and target buckets, identifies objects found in the source but not in the target, and copies them. It only copies the current version of objects in versioned buckets.
What are the different storage classes available in Amazon S3, and what are their key characteristics?
The main S3 storage classes are Standard, Intelligent Tiering, Standard-IA, One Zone-IA, Glacier Instant Retrieval, Glacier Flexible Retrieval, and Glacier Deep Archive. They differ in durability, availability, minimum storage duration charge, minimum billable object size, retrieval fees, storage costs, retrieval costs, and retrieval time.
When would you use S3 Standard storage class, and what is it suitable for?
S3 Standard is suitable for frequently accessed data that requires high throughput and low latency. It’s used for mobile applications, gaming, big data analytics, and as a pseudo content delivery network (CDN).
What is S3 Intelligent-Tiering, and how does it work?
S3 Intelligent-Tiering is a storage class that automatically moves objects between tiers based on their usage patterns. It includes Frequent and Infrequent access tiers, Archive Instant for objects not accessed for 90 days, and optional Archive and Deep Archive tiers.
When is S3 One Zone-IA storage class a suitable choice?
S3 One Zone-IA is suitable for data that can be recreated and doesn’t require high durability. It’s cost-effective for secondary backups or less critical data.
What is the purpose of S3 Glacier storage classes, and when should they be used?
S3 Glacier is designed for long-term archival and backup storage. Glacier Instant Retrieval is suitable for accessing data once a quarter, while Glacier Flexible Retrieval and Deep Archive are for infrequently accessed objects that don’t require immediate access.
S3 Glacier is designed for long-term archival and backup storage. Glacier Instant Retrieval is suitable for accessing data once a quarter, while Glacier Flexible Retrieval and Deep Archive are for infrequently accessed objects that don’t require immediate access.
S3 Lifecycle Rules are used to transition objects between S3 storage classes automatically or delete objects after a specified time. They are helpful for managing data retention, cost optimization, and compliance.
What is S3 Analytics, and how can it aid in managing S3 storage classes?
S3 Analytics provides insights into object usage patterns, helping in making informed decisions for transitioning objects between storage classes using Lifecycle Rules.
How can S3 performance be optimized for PUT/COPY/POST/DELETE and GET/HEAD operations?
PUT/COPY/POST/DELETE operations offer a rate of 3500 requests per second per prefix, and GET/HEAD operations offer a rate of 5500 requests per second per prefix. To increase efficiency, place objects in different prefixes and utilize S3 Byte-Range Fetches in parallel.
What are S3 Event Notifications, and what types of operations can trigger them?
S3 Event Notifications are triggered by all CRUD (Create, Read, Update, Delete) operations on objects and can be consumed by various services like SNS, SQS, Lambda functions, etc.
What is S3 Requester Payments, and when is it useful?
S3 Requester Payments allow the requester of objects to pay for transfer and request costs instead of the bucket owner. It is useful for sharing large files or datasets where the requester should bear the costs.
What is S3 Object Lock, and what are its modes?
S3 Object Lock is used for data immutability and comes in two modes: Retention Governance mode (users can’t alter lock settings without special permissions) and Retention Compliance mode (object version can’t be deleted or altered by anyone, including the root user).
What is S3 Transfer Acceleration, and how does it improve data transfer performance?
S3 Transfer Acceleration improves data transfer performance by routing traffic through CloudFront Edge and AWS backbone networks, resulting in faster uploads and downloads.
What are some key features of AWS RDS (Relational Database Service)?
AWS RDS offers features such as autoscaling when running out of storage, support for multiple database engines (MySQL, MariaDB, Postgres, Oracle, Aurora), at-rest encryption via KMS, SSL for data in transit, and the ability to use IAM authentication and Secrets Manager integration.
What is the purpose of Multi-AZ deployment in Amazon RDS?
Multi-AZ (Availability Zone) deployment in Amazon RDS provides high availability and fault tolerance by replicating the primary database instance synchronously to a standby instance in a different Availability Zone within the same region.
What is RDS autoscaling, and under what conditions does it autoscale?
RDS autoscaling automatically adjusts the capacity of your database instance based on workload requirements. It autoscales when free space falls below 10% allocated space, after 6 hours of inactivity, and if low-storage lasts at least 5 minutes.
