AWS UseCases Flashcards
EC2 needs access to sensitive data in S3. Cannot travers the internet must use private IPs. S3 can only allow access from services in the VPC
- Create a VPC Gateway endpoint for the S3 buck
- Enable a bucket policy to restrict S3 access
A company needs to migrate 50TB of data into AWS within a month. They also want a secure and reliable private connection
- Use a snowball device for the initial 50TBs
- Order a Direct Connect that could take over a month
Website developers needs a solution for a static website over https without managing server infrastructure and should be scalable as the company grows.
- Cloud Front with S3 as the origin
- since its https vs http
- can restrict with OAI - origin access identity
RDS postgres is configured in Multi-az. Need to scale read performance and the solution must be configured for high availablity.
- Create a read replica as a Multi-az DB
A shared services VPC is being created for use by several AWS accounts. An application needs to be security shared from the shared services vpc.
- Use AWS private link to expose the application as an endpoint
- Use a NLB to front the application.
- IP in the VPC
A Web application that runs on EC2 instance behind an ELB and all data in transit must be encrypted. How is this accomplished for both ALB and NLB?
- Using an ALB with HTTP Listener - Install Certs on ALB and EC2 Terminate on ALB and send to EC2
- Using an NLB with TCP listener - terminate on EC2 - pass through
Easiest way to block access to content from certain countries
Use Cloudfront to serve the application and block the content.
Restrict access to Dynamo DB to specific private source IPs from their VPC… what network resources?
Use a VPC Gateway endpoint.
EC2 instances need to make api calls to Dynamo DB from your VPC where it does not go over the internet.
- Create a VPC Gateway endpoint
- add a route to the endpoint
Can an ALB be used to redirect clients to another region if a health check fails?
No. It only identifies the health of targets.
What EBS storage should be used with a variable Disk I/O with peaks up to 3000 IOPS?
gp2… since it can burst to 3000 IOPS for an extended period of time
Aurora replica in Multi-AZ configuration. DB reads are high and causing performance issues. What can you do.
Update the app to read from the aurora replica.
How do you add encryption to a DirectConnect Connection?
Use a Virtual Private Gateway (VPG) A VPG is used to setup an AWS VPN which you can use in combination with DX to provide IPSEC-encrypted private comms.
You can’t just enable IPSec on the DX… that is not an option.
How can an ASG be used with an SQS queue to scale.
Use a custom cloud watch metric for the number of messages in the queue. Configure the ASG to scale based on the metric.
How can a security team limit access to specific services or actions in all of the teams AWS accounts that are part of a large org in AWS Organizatinos.
Use an SCP in the root org unit
Does CloudWatch Container Insights work with EKS?
Yes it does… with both ECS and EKS
Need to scale read ops within a region for an Aurura DB… what do you implement
Aurora Replicas - these offer standby and read scaling
How to block malicious traffic from the same CIDR range… Security Group or NACL/
Use the NACL Inbound rule to block that CIDR range.
What protocol does CloudFront support?
HTTP/HTTPS only
Can cloudfront expose static public IP addresses?
No
Mutiple consumer apps have total reads exceeding the per-shard limits of a Kinesis data stream…. how can this be resolved?
Increase the number of shards
How are custom EC2 metrics enabled?
Use CloudWatch Agent
Which AWS service is used to Accelerate the migration of on-prem data to S3
AWS DataSync… StorageGateway is used for hybrid scenarios where servers need local access to data
Steps to create a SSO solution for users signed into the organizations active directory
Call the AWS STS AssumeRole or GetFederationToken API to obtain temp access
Call the AWS federation endpoint and supply the temp access to get the token
