DevOps Professional Flashcards
SQS: List of operations
AddPermission ChangeMessageVisibility ChangeMessageVisibilityBatch CreateQueue DeleteMessage DeleteMessageBatch DeleteQueue GetQueueAttributes GetQueueUrl ListDeadLetterSourceQueues ListQueues ListQueueTags PurgeQueue ReceiveMessage RemovePermission SendMessage SendMessageBatch SetQueueAttributes TagQueue UntagQueue
Can the cloudwatch agent monitor memory now?
Yes
RDS Cross Region Replication Requirements
PostgresSQL 9.5.2 and above
PostgreSQL 9.4.7 and above
Elasticache: Memcached Cluster configurations
Memcached clusters contain from 1 to 20 nodes across which you horizontally partition your data.
Elasticacahe: Redis Cluster configurations
Elasticache: Redis Cluster Configurations
- No Replication (Single Node)
- Cluster Mode Disabled (Replicated, no Sharding/Partioning)
- Cluster Mode Enabled (Replicated with Sharding/Partitioning).
RDS Single AZ IO Interruption
In a single AZ RDS Deployment there is an IO interruption on creating
* Read Replicas
* Snapshot Creation
& Automated Backups
In a multi AZ deployment these operations are performed against the secondary instead.
ELB: Sticky Sessions
Use an AWSALB Cookie.
Load Balancer Generated
Can’t be modified by applications.
Stickiness is configured at a target group level.
EC2: Metrics that need an agent
Swap Space
Disk Space
Memory Used
& Others
Cloudwatch: Alarm statuses
OK
ALARM
INSUFFICIENT_DATA
EC2: Status Check Types
System: Monitor the AWS systems on which your instance runs.
Instance: Monitor the software and network configuration of your individual instance.
VPC: AWS IP Reservations
. AWS reserves the first 4 IP & the last IP addresses.
. In a 10.0.0.0/24, the following IPs are reserved:
10.0.0.0: network address
10.0.0.1: Reserved by AWS for the AWS VPC router
10.0.0.2: Reserved by AWS. IP address of the DNS server
is always the base of the AWS VPC network range.
However, the base if each subnet range is also reserved
10.0.0.3: Reserved by AWS for future use
10.0.0.255: Network braodcast address.
AWS does NOT support any broadcase in an AWS VPC.
Therefore, they reserved the addess
AWS Personal Health Dashboard
https://phd.aws.amazon.come
. Provide Alerts & remedation guidance
when AWS is experiencing issues that
might impact customers
. Shows a personalized view of the
performance & availability of the
AWS services underlying your
provisioned AWS resources
EC2: Initialising Volumes
When restoring a volume from a snapshot, maximum volume performance is not achieved until all blocks on the device have been read.
Tools for this:
isblk
db
fio
sudo dd if=/dev/nvme2n1 of=/dev/null bs=1M
sudo yum install -y fio
sudo fio –filename=/dev/nvme2n1 –rw=read –bs=128k –iodepth=32 –ioengine=libaio –direct=1 –name=volume-initialize
AWS Inspector: Capabilities
- Security Best Practice
- Runtime behavior analysis
- Common vulnerability/exposure
- CIS Security Config Benchmark
Direct Connect: Requirements
. requires single-mode fiber
. 1GB: 1000Base-LX (1310nm)
. 10GB: 10GBase-LR (1310nm)
EBS: Ensuring Durability
. By default, instance store & EBS ROOT volumes are not backed up
. Will not persist upon termination
. cannot stop instance store volumes,
so termination is the only option
. This is why EBS volumes are recommended
. How do we save the data on a root volume?
1/ uncheck “Delete on Termination” in the console
. Also a CLI parameter with run-instances
2/ Create a snapshot before deletion
3/ Create a seperate volume & attach to the instance
. Attached volumes persist when the instance is terminated
EBS Metrics: Status Check
. Tests run every 5 minutes
. Returns: OK, warning, impaired, insufficient data
. User can change the result of the impaired response
ELB: SSL Offloading
. In a highly available web application, we use
load balancers to distribute traffic.
. Can also use load balancers’ elasticity & scalability
in HTTPS/SSL process
. Can improve the performace of the instances/applications by
off loading SLL process (encrytion/decryption) to load balancers
. Certifcate Manager also intergrates for certifiate generation & management. . AWS will create alias for certificate . point to target group . use web security group
NOTE:
IN ROUTE 53 (after create certificate for SSL, etc.)
. need to use “naked” domain name
(NO www in front of domain name)
. Then, point “alias” to the load balancer
SNS: Definition
Simple Notification Service
Push model (as supposed to SQS Pull model). Create topics, messages sent to the topic is pushed out to all subscribers to that topic.
SNS: Protocols
HTTP HTTPS Email Email-json Lambda SQS Application Platform SMS
Systems Manaager: Description
AWS Systems Manager is a management service that helps you automatically collect software inventory, apply operating system patches, create system images, and configure Windows and Linux operating systems. Systems Manager can be used for both EC2 instances, on-premises servers, and VMs. These capabilities help you define and track system configurations, prevent drift, and maintain software compliance of your EC2 and on-premises configurations.
Lambda vs EC2: Use Cases
Use Lambda when you want to run code
that is in response to events, such as
1/ changes to S3 buckets 2/ Messages in SQS queues 3/ Update to DynamoDB tables 4/ Cloudwatch Alarms 5/ Customed events generated by your applications or devices
Systems Manager: Patch Manager
.automate the process of patching managed instances with both security-related & other types of updates. You can use Patch Manager to apply patches for both OS & applications.
EC2: Hardware Virtualised Machines (hvm)
a/ Execute the master boot record of the root storage device b/ Virtual hardware set allows for running an OS as if it were run on bare metal. The OS doesn't know it's virtualized c/ No modification needed d/ Can use hardware extensions provide fast access to host hardware enhanced networking and CPU processing
EC2: ParaVirtualised Machines (pvm)
1/ runs a special boot loader & then loads the kernel
2/ can run on hardware that doesn’t support virtualization
3/ No hardware extension support
4/ PV historically performed faster than HVM,
but that is no longer the case
5/ PV has especial drivers for networking & storage
that used less overhead than an HVM instance
trying to emulate the hardware. These drivers can
now be run on HVM instances, making the performance of
both type the same
NOTE: AWS recommends using HVM instances because the performance
is the same as PV, and enhanced networking & GPU processing
can be utilized when neccessary.
CloudWatch Logs: Components
1/Log Events:
record of activities recorded by
the monitored resource
2/ Log Stream:
Sequence of log events from the same
source/application
3/ Log Group:
A collection of log streams with same
access control, monitoring, &
retention settings
4/ Metric Filters: .Assigned to log groups. .It extract data from the groups' log streams & convert that data into a metric data point
5/ Retention settings:
period of time logs are kept.
assigned to log groups, but applied
to ALL streams in the group.
VPC: Peering Limitations
. Can’t peer VPC with matching or overlapping CIDR blocks
. VPC peering connections are 1:1 between VPCs
. Transitive perring is NOT supported
However, there is a 3rd product might (Transit Gateway)
. One peering connection between the same 2 VPCs
. Tags applied to the peering connection are only applied
in the account & region in which you create them.
. Security groups can’t reference peer VPC security groups
across regions
. IPV6 across regions is NOT supported
. DNS resolution for private hostnames must be enabled manually
. If in different accounts, must be enabled in both accounts
RDS: Multi AZ Maintenance
Zero Downtime
. AWS will perform the following steps: . Perform maintenace on the standby . Promote the standby . Perform maintenace on the OLD primary DB which is the standby now.
EC2: Elastic IPs
. a public IP address that can be “moved”
. Enables instances without a public IP to become accessible
from the internet
. GOOD to know: . EIPs are region specific . NOT support IPV6 . 2 step process to implement: . allocation & Association . upon association, any previous public IP is released (DNS hostname changes as well) . Can be disassociated & reassociated with another instance . 2 step process to remove: . Disassociate & release
. Custmomers are charged for:
. Elastic IPs not associated
. More than one Elastic IP on an instance
CloudTrail: Description
CloudTrail is a service we can use to log all the API calls in our account.
API Calls include interaction from the console, AWS CLI, and SDKs.
We can also create trails that we can analyze with CloudWatch Logs or third-party tools.
Systems Manager: Run Command
automate tasks across resources
e.g. software package installs
CloudHSM: Description
1/ Dedicated hardware security modules under your exclusive control
2/ FIPS 140-2 LEVEL3 compliance
3/ Designed to integrate with VPC
4/ Integrates with PACS#11, Java JCE
5/ Can connect to CloudHSM from your on-premises datacenter
using VPN or AWS Direct Connect
RDS: Read Replica notes
. if the option for “Create Read Replica” is gray out
(disabled), i.e need to go to the DB & create backup
(default is 0 day –> aka disabled backup)
. Read Replica can be crossed Regions
. Also there is an option in the config of Read Replica to enable Multi AZs
. Can also promote Read Replica to StandAlone for disaster recovery (in case the Master becomes unvailable) –> choose “Promote” in the action menu
. can have multiple Read Replicas to improve performance
Redshift: Description
he Amazon Redshift service manages all of the work
of setting up, operating, and scaling a data warehouse.
These tasks include provisioning capacity, monitoring
and backing up the cluster, and applying patches and upgrades
to the Redshift engine.
CloudTrail: Notes
1/The last 90 days of event history
is in “View ALL events”
2/ When create a trail in ALL region,
it will create a trail in EACH region
3/ Always use the default to create a trail in ALL region so that if a new region lauches, Cloud Trail will automatically create a trail in that new region with the same setting as the original trail.
4/ "Enable log file validation" as YES --> make it impossible edit,change,modify,delete the log without detectin --> good for auditing/compliance
RDS: Multi AZ Failover Process
The process is automated by AWS
1/ AWS detects an issue & starts the failover process
2/ DNS records are modified to point to the standby instace
3/ The application re-establishes any existing DB connections
The application requires no changes since
DNS of DB endpoint is the same
Cloudfront: Components
ORIGIN:
. The original version of your content
. Can be an S3 bucket OR a web server
. DISTRIBUTION:
. Points edge locations & regional caches back to
the origin
. Configiration of logging, availbility, and limitations
. EDGE LOCATIONS:
. The location of your cached objects, located all over the globe
. Current total is 169 in 30 countries
. Regional Edge Caches:
. Location of cached objects that are NOT
frequently accessed
. Current total is 11 in 30 countries
IAM: Groups
Cannot be nested (group within a group).
User can be member of multiple groups
Should assign policies to groups, not individual
VPC: Flow Log record syntax
. version . account-id . interface-id . srcaddr . dstaddr . srcport . dstport . protocol . packets . bytes . start . end . action . log status
Config: Capabilities
1/ Evaluate resource configuration
for desire settings
2/ Get a snapshot of the current configurations
associated with your account
3/ Retrieve configuration resources in your
account
4/ Retrieve past configuration
5/ Retrieve notifications for creation,
deletions, and modifications
6/ View relationships between resources
(EX: members of security groups)
S3: Bucket Policy Elements
1/ Effect
Define whether to allow or deny the action
2/ Action
Actions we want to allow or deny (GET, POST,…)
An implicit DENY will overwrite an explicit ALLOW
3/ Resource
used to identity resources (like a bucket or object with Amazon
Resource Names (ARNs)
4/ Principal
An account or user that this policy applies to
Specific to S3 bucket policies, not user policies
5/ SID (optional)
6/ Condition (optional)
PutObject permission requiring objects to be stored using
server-side encryption
EC2: HDD Volumes
. Somewhat deprecated (Previous Generation volume)
. Low cost storage or small volume sizes
. Volume Size: 1 GiB to 1 TiB
. Burst capacity to hundreds of IOPS
ECS: Components
1/ Container:
. Virtualization method allowing you to run
applications in isolated processes
. Contains all the downloaded software, code,
runtime, system tools, & libraries
. packaged as readonly templates called
Docker images
2/ Docker file:
. Text file that specifies all the components
needed in the container:
. The intructions for what will be placed
inside a container
3/ Container Registry:
. A repository where container/Docker images
are stored & accessed
. A container registry can be:
. AWS Elastic Container Registry (ECR)
. A third-party repository liker Docker Hub
. self-hosted registry
4/ Task Definition:
. JSON-formatted text file that contains the
“blueprint” for your application:
. Container image
. Container Registry
. Ports that should be open on the instance
. Data Volume
5/ Service:
. Define how to run & maintain a specified number
of instances together
. Optional loading balancing
6/ Cluster:
. group of tasks or services on multiply EC2
or Fargate instance
7/ Fargate:
. A “serverless” launch type that eliminates
the need for explicit infrastructure.
Think AWS Lambda for containers.
RDS: MultiAZ vs Read Replica
. Cannot assign READ to a standby Multi AZs
(only a fail over mechanism)
. However, READ REPLICA helps with performance
(off load some computing capacity from
master/primary DB to Read Replica so that
it can focus on WRITE)
. READ REPLICA can also use in disaster/recovery
situation & migration
EBS: Snapshots
. Images or backups of EBS volunes
. Store in S3 (charge’s based on volume’s total size)
. Exact copy of the original volume
If the volume is encrypted, snapshot is also encrypted
. Incremental in nature, bit FULL volume can be restored
from any snapshot.
EX: if you have 5 snapshots & you delete the oldest one.
You can still restore the whole volume from any of
the 4 snapshots left.
AWS Service Health Dashboard
https://status.aws.amazon.com/
. Provide access to current state and historical data about ALL AWS services. If there is a problem with a service, you can expand the appropriate line in the details section to get more information.
. you can subscribe to RSS feed
for any service
. There is a “CONTACT-US” link
if you experience any real time
operational issue.
. “STATUS HISTORY” shows outage
issue details on a daily basis
SQS: Queue Attributes
1/ Default Visibility timeout
(30 seconds), but can be
anywhere from 0 second to
12 hours
2/ Message Retaintion Period (default 4 days), but it can be from 1 minute to 14 days The amount of time the message remains in the queue before it got deleted.
3/ MAX message size: 255 KB
4/ Delivery day from 0 seconds
to 15 minutes
5/ Receive message wait time (0 to 20 seconds) The amount of time that application will wait for the message before returning an empty respond
CloudWatch: Metrics Retention Periods
1/ 1 minute metrics (detailed monitoring)
available for 15 days
2/ 5 minute metrics (standard)
available for 63 days
3/ 1 hour metrics
available for 455 days
EFS: Deployment & Provisioning
. Highly available, scalable file system:
. span multiple AZs
. Throughput for parallel workloads:
Big Data, Analytics, Media Processing, Content Management,
Web Serving
. Share data store that can be mounted to multiple EC2 instances
or on-premise servers:
. For on-premises servers, use AWS Direct Connect or
AWS VPN
. Linux only, Windows is NOT supported
. TWO performance modes:
1/ General Purpose (Bursting mode?)
Most file system needs
2/ MAX I/O:cases where hundreds or more instances access
the file system
. Scales throughput & IOPS (slighly higher instances)
. Bursting:
. Burst to 100 MiB/s for any size file system
. Larger than 1TB = bursting 100 MiB/s per TB of data stored
. credit system: earns credits at 50 MB/s per TB of data stored
. Security groups should be used to control NFS traffic
. Use the EC2 security group as the source
. Supports encryption at rest & in transit
. Storage classes & lifecycle management:
. standard
. Infrequent Access (IA)
. Lifecycle management automatically moves files to IA
not access for 30 days
OpsWorks: Description
OpsWorks is a service that uses Chef cookbooks developed in the Ruby language.
It allows us to manage our application in layers.
We can use recipes to affect our layers at various lifecycle events in an application’s deployment.
EC2: Reserved Instances
. can be an effective method of saving money
if long-term compute capacity is needed.
(12 or 36 months)
. They can also reserve us capacity in case of
an Availability Zone or region shortage
of on-demand instances
. Standard reserved instances, OR
Scheduled reserved instances for batch files
offer discount
reserve capacity
EC2: HDD Volumes
. Not supported as a boot device . Ideal for frequesntly accessed & thoughput intensive workloads . Volume size 500GiB to 16 TiB . MAX throughput = 500 MB/s . Burst bucket . credits gained at 40 MB/s per TiB . credit capacity = 1 TiB . MAX burst = 500 MB/s (volume size 2TiB and larger)
Cold HHD volumes (sc1)
. Not supported as a boot device
IAM: Web Identity Federation
1/ Authenticate with ID provider (FB, google, Amazon,…)
2/ Obtain a temporary security credential with that provider
3/ call Assume a role with Web Identity to exchange that token
4/ for a temporary set of AWS credentials
Trusted Advisor: Description
can help you reduce costs,
increase performance,
and improve the security of your AWS environments.
It provides real-time guidance to help provision resources
following AWS best practices.
1/ Cost Optimization
2/ Performance
3/ Security
4/ Fault Tolerance
5/ Service limits
AWS Config: Description
AWS Config is a service we can use to evaluate the configurations of our resources.
It records all the details, including relationships between resources.
This can be very helpful in troubleshooting situations.
We can also create a set of rules for evaluating our resources.
When a resource is non-compliant with our set rules, AWS Config will let us know.
EBS: Cost Optimisation
- EBS volumes cost money
even when not in use. - Take a snap shot before
delete the volume if you
want to keep the data.
Snapshot storage is cheaper - Provisioned IOPS costs more
Make sure you not provision
more than needed - Downsize volumes that aren’t
anywhere near full capacity
SQS: Dead Letter Queue
SQS queue is configured to receive messages
from other queue (aka “source queue”)
. dead letter queue receives messages after
a number of attempts has been reached
. Provide the ability to isolate messages
that couldn’t be processed so that
they will not be lost
Glacier: Terminology
1/ Archive:
. a durably stored block of information . TAR & ZIP are common formats used to aggregate files . Total volume of data & number of archives are unlimited . Each archive can be up to 40 TB . Largest single upload is 4GB (use multipart upload > 100MB) . Archives can be uploaded and deleted, but not deleted or overwritten
2/ Vault:
. Way to group archives together
. Control access using vault level access policies using IAM
. SNS notifications are available for when retrieval requests
are ready for download
3/ Vault lock:
. Lockable policy to enforce compliance controls on vaults
. Vault locl policies are immutable
(once create, cannot change)
RDS: Aurora Serverless
. On-Demand auto scaling configuration for Aurora
. No instances to manage
. Charge on per-second basis
Storage Gateway: Description
For hybrid environments, ones that include some sort of on-premises infrastructure, AWS provides services to assist with data durability. Storage Gateway provides us a way to back up and even migrate to the cloud. It has three main types, and they all include some sort of on-premises component.
Glacier: Vault Lock Process
. have 24 hrs to validate the new created vault policy
& complete the lock process.
. have 24 hrs to test out the policy to make sure
everything works as expected before completing
the process. As once it’s locked, cannot change the policy.
. After which the lock ID will expire &
your in-progress policy will be deleted.
. copy the lock ID to a safe place
as you need the ID to complete the lock process
IAM Role: Use with AWS Services
1/ Role must be used because policy cannot be directly
attached to AWS services
2/ Services can only ONE role attached at a time
3/ Should never PASS or STORE credentials to an EC2 instance
instead using ROLE
EX: an EC2 needs to read data from an S3 bucket
The instance “assumes” a role with S3 read-only access from IAM
The instance can then read objects from the bucket
OpsWorks: Recipes
. Created using Ruby language & based on the CHEF deployment software . Custom recipes can customize different layers in an application . Recipes are run at certain predefined events within a stack a/ SETUP: occurs on a new instance after its first boot b/ CONFIGURE: occurs on ALL stack instances when they enter or leave the inline state c/ DEPLOY: occurs when deploy an app d/ UNDEPLOY: Happens when we delete an app from a set of application instances e/ SHUTDOWN: Happen when we shutdown an instance (but before it's actually stopped)
EBS: Changing Volume Size
The MANUAL Method:
1/ Modify the EBS volume
2/ Extend the partition to fill available space
3/ Expand the filesystem in the resized partition
NOTE:
commands for Nitro-based instances (e.g t3 micro)
are different than the ones for T2 instances
The AUTOMATED Method:
1/ Create new lauch configuration of an Auto Scaling grp
Make sure copy “user data” over to the new configuration
2/ Point the group to the new lauch configuration
3/ Terminate instance in the autoscaling group one at a time
so that the new configuration will replace the terminated
instance with a bigger EBS volume for a higher IOPS
RDS: MultiAZ Deployment
. Application can talk to only RDS Master
. Synchromous Replication to Multi-AZ for failover
. Help to shorten the down time in case the Master fails
. NOT to use to improve performance (just for fault tolerance only)
. Can turn on Multi AZs through AWS console or API
. AWS automatically handles replication
. Replication can cause higher write latency
. Use Provisioned IOPS is recommended
EBS: Burst Buckets
. Allows an EBS volume to “burst” above the baseline performance
a/ Volumes earn “credits”
b/ Credits are then spent whenever the volume needs more
performance
c/ There is a MAX number of credits
. Not available for Provisioned IOPS SSD (io1)
. Reported as a “BurstBalance” metric in Cloudwatch
join multiple gp2, io1, st1, or sc1 volumes together in a
RAID 0 configuration (strip set) to use the available bandwidth
improving throughput.
S3: Storage Classes
1/ Standard . Objects get replicated across at least 3 AZs . Most expensive storage class, . BUT no minimum object size . and no retrieval fee
2/ Inteligent-tiering
. Same characteristic performance as standard
. Observe the users’ pattern
& move objects across the tiers
3/ Standard IA
. Infrequent access for important objects
. BUT immediate retrieval is required
. replicate across at least 3 AZs
. 30 day minimum storage charge per object
. 128KB minimum storage charge
. Object Retrieval fee
4/ One Zone-IA
. for non-critical, reproducible objects (images for web application, or dynamically resize) . 99.5% availability . replicate within only ONE AZ . SAME minimum charges as Standard IA
5/ Glacier:
. Long term for archival objects . NOT for hot backup as restore can take from several minutes or hours. . 99.99 % availability . replicate across > 3 AZs . 90 days minimum charge per object . 40 KB minimum storage charge . object retrieval fee
EC2: Instance status check
This is something that you can control
Reasons for failure:
1/ Failed system status check 2/ Incorrect networking or setup configuration 3/ Exhausted memory 4/ Corrupted file system 5/ Incompatible kernel
Solutions:
1/ Make instace configuration changes
2/ Reboot the instance
S3: Bucket Policy gotchas
1/ when working at the object level permission (PUTobject,GETobject,Deleteobject) add /* at the end of bucket’s ARN to allow permission applies to ALL objects in the bucket
2/ Make sure to turn OFF “Block all public access” if you want to apply the policy to the bucket.
WAF: Rule Types
a/ IP addresses
b/ HTTP headers
c/ HTTP body
d/ Uniform Resource Identifier (URI) strings
(query strings from URL)
e/ SQL injection
d/ Cross-site scripting (XSS)WAF: Service Integrations
a/ Cloudfront
b/ API Gateway
c/ Application Load Balancer
ELB: Application Load Balancer
. Work at the application layer (7)
. Content-based routing
. Path-based routing: forwards based on the URL
in the request
./dev & /prod can route to different target groups
. Host-based routing: forwards based on the host field
of HTTP header
. dev.mysite.com & prod.mysite.com can route to
different target groups
. Routes to IP addresses.. including outside the VPC
(on-premises)
. Routes to microservices (allows dynamic port mapping)
MONITORING:
. Cloudwatch metrics . ActiveConnectionCount, . HealthyHostCount, . HTTP code totals, . etc....
. Access logs: sends detailed request information to S3
. Request tracing: A header is added that includes a trace identifier
for requests
. CloudTrail Logs: Records API activity
NOTE:
.dualstack (both IPV4 & IPV6)
. Target types:
. instance
. IP (can be on-premise IP addresses as well)
. Lambda function
. BEST PRACTICE:
use auto scaling group to create instances
(create ELB, then create auto-scaling,
then associate auto-scaling group with ELB)
S3: Cross Region Replication
. It’s bucket level configuration
. Enable automatic,
Asynchronus (a little delay depends on object’s size) copy to a bucket
in a different region
. Objects are replicated only once
(i.e this is NOT a sync process. It’s just a copy process)
. The following are retained by default: a/ Storage class b/ Object names c/ Owners d/ Permissions
RDS: Reserved Instances
. Reserved capacity is also available for AWS RDS
instances & ElasticCache nodes
. New generations of Reserved Cache Nodes only offer
Heavy Utilization nodes, while older generations offer
Heavy, Medium, and Light Utilization
Elasticache: Reserved Instances
. Reserved capacity is also available for AWS RDS
instances & ElasticCache nodes
. New generations of Reserved Cache Nodes only offer
Heavy Utilization nodes, while older generations offer
Heavy, Medium, and Light Utilization
Elastic Beanstalk: Deployment Options
1/ ALL at Once: Deploy the new version all instances simultaneouly. All instances in your environment are out of service for a short time while the deployment occurs
2/ BLUE/GREEN: Deploy the new version to a separate environment, then swap CNAMEs of the 2 environments to redirect traffic to the new version instantly.
3/ Rolling:
Beanstalk splits the environment EC2 instances
into batches & deploy the new version of the
application to one batch at a time
EC2: EIP & ENI
. When detach & re-attach an Elastic Network Interface from an instance,
the attributes (security groups & IP addresses) are travelded with ENI
. DIFFERENCE between EIP & ENI:
. EIP replace the whole public IP
. ENI does the same, BUT it replaces the WHOLE network interface
when move ENI around, not only EIP follows, but also security grp
and other attributes as well
VPC: Default VPC Configuration
. Size /16 CIDR block (172.31.0.0/16)
. Default subnet in each AZ using /20 subnet mask
. Internet Gateway
. Main route table sending all IPV4 traffic for 0.0.0.0/0 to the internet gateway
. Default security group allowing all trafic
. Default network ACL (NACL) alling all traffic
. Default DHCP option set
Cloudwatch Events: Event
. similar to alarms . instead of configuring thresholds & alarming on metrics, Cloudwatch Event are matching event patterns & use target to react.
. near real-time
CloudFormation: valid values for AWS::S3::Bucket::AccessControl
Private, PublicRead, PublicReadWrite, AuthenticatedRead, LogDeliveryWrite, BucketOwnerRead, BucketOwnerFullControl, or AwsExecRead
S3: Default Bucket Limits
100 Per Account
Can be increased by AWS Support.
Limit is not regional, its a global service.
Cloudwatch: Metrics default retention periods
Data points with a period of less than 60 seconds are available for 3 hours. These data points are high-resolution custom metrics.
Data points with a period of 60 seconds (1 minute) are available for 15 days
Data points with a period of 300 seconds (5 minute) are available for 63 days
Data points with a period of 3600 seconds (1 hour) are available for 455 days (15 months)
DynamoDB: Table Creation Limits
CANNOT create more than one table with a secondary index at a time.
Cloudwatch Logs: Default Retention Period
By default, logs are kept indefinitely and never expire.
You can adjust the retention policy for each log group, keeping the indefinite retention, or choosing a retention period between 10 years and one day.
APIGateway: Default DNS Name Format
https://api-id.execute-api.region.amazonaws.com/stage
S3: Static Website Name Format
[Bucketname].s3-website-[region]..amazonaws.com
CodeDeploy: Lambda deployment options
Canary: Traffic is shifted in two increments. You can choose from predefined canary options that specify the percentage of traffic shifted to your updated Lambda function version in the first increment and the interval, in minutes, before the remaining traffic is shifted in the second increment.
Linear: Traffic is shifted in equal increments with an equal number of minutes between each increment. You can choose from predefined linear options that specify the percentage of traffic shifted in each increment and the number of minutes between each increment.
All-at-once: All traffic is shifted from the original Lambda function to the updated Lambda function version all at once.
S3: Bucket Name Restrictions
Bucket names must be between 3 and 63 characters long.
Bucket names can consist only of lowercase letters, numbers, dots (.), and hyphens (-).
Bucket names must begin and end with a letter or number.
Bucket names must not be formatted as an IP address (for example, 192.168.5.4).
Bucket names can’t begin with xn– (for buckets created after February 2020).
Bucket names must be unique within a partition. A partition is a grouping of Regions. AWS currently has three partitions: aws (Standard Regions), aws-cn (China Regions), and aws-us-gov (AWS GovCloud [US] Regions).
Buckets used with Amazon S3 Transfer Acceleration can’t have dots (.) in their names. For more information about transfer acceleration, see Amazon S3 Transfer Acceleration.
SQS: Short Polling
Short Polling is when the WaitTimeSeconds is set to zero in either of these ways:
The ReceiveMessage call sets WaitTimeSeconds to 0.
The ReceiveMessage call doesn’t set WaitTimeSeconds, but the queue attribute ReceiveMessageWaitTimeSeconds is set to 0.
SQS: Maximum Long Poll Wait Time
20 Seconds
SQS: Default MessageRetentionPeriod
4 Days is default for all SQS Queues.
Range of values is 1 minute to 14 days.
SQS: Default VisibilityTimeout
30 seconds
DynamoDB: Table limits
256 DynamoDB Tables per Region
DynamoDB: Index limits per table
20 Global Secondary Indexes
5 Local Secondary Indexes
DynamoDB: 1 WCU
For items up to 1 KB in size, one WCU can perform one standard write request per second.
DynamoDB: 1 RCU
For items up to 4 KB in size, one RCU can perform one strongly consistent read request per second
For items up to 4 KB in size, one RCU can perform two eventually consistent read request per second.
Transactional read requests require two RCUs to perform one read per second for items up to 4 KB
