Flash Cards

Question

What is at-rest encryption?

Answer 1

● Means the data is stored in an encrypted state when it is being left alone on a hard disk or in storage of some kind. ● EBS (Elastic Block Store): enabled via a checkbox ● RDS (Relational Database Service): enabled via a checkbox ● DynamoDB (NoSQL Document Database): enabled via a checkbox

Answer 2

● Data is automatically encrypted as it leaves any AWS facility ● Data is automatically encrypted when it travels between Availability Zones ● Data sent between certain types of EC2s can be encrypted in transit as it travels through the network within a single availability zone ● Many services such as Lambda and DynamoDB already operate off HTTPS endpoints as it is so they are encrypted in transit too.

Answer 3

Cloud watch ● Logs generated on specific servers need to be collected via Cloudwatch Logs Agent ● Metrics ● Alarms

Answer 4

● OK: the metric is below the threshold ● ALARM: the metric is above the threshold ● INSUFFICIENT_DATA: the metric is not being reported (for instance, an AVG metric when there are no events)

Answer 5

● CloudTrail logs all configuration changes to AWS resources along with the IAM information of who took the operation. ● CloudTrail needs to be enabled, unlike CloudWatch, which collects logs by default ● CloudWatch would log what happens ON your server; CloudTrail would log what happens TO your server.

Answer 6

● AWS Config stores historical data about server configurations and can go back in time to see what a server looked like on a given day. ● It can also track compliance across server

Answer 7

● Change core account settings like account info ● Delegate the IAM permission to view Billing information ● Changing your root password ● To enable MFA on the root account ● Initially, to create a different IAM user you can use going forward ● Ask for access to restricted regions (GovCloud) ● Close your account

Answer 8

Deny takes precedence

Answer 9

● SUPERCEDE user and group policies ● You become acting “as” the role for as long as it’s assumed ● Preferred in complex setups and for Organizations ● Can be directly attached to servers and services ○ “This EC2 has the right to upload images to S3” ○ “This CodePipeline has the right to deploy CloudFormations”

Answer 10

● Global ● Regionally Based ● Availability Zone Based ● Edge Based

Answer 11

one that is effective worldwide, because it would not make sense for the “computing” to happen in a specific place. ● Route 53: the entire point of DNS is to be worldwide ● Cloudfront: it distributes content to edge locations across the globe ● IAM: saying a user does or doesn’t have these rights or can log into the console or is a member of groups is not a region-specific thing

Answer 12

● A region is a set of datacenters in one area of the globe comprised of several individual availability zones. ● Most abstract and serverless services are regional. ● Sample regions include us-east-1 (Virginia), us-east-2 (Ohio), ap-southeast-2 (Sydney), eu-west2 (London). ● There are two special regions you need to be granted special allowance to: China (which requires its own account and cannot coexist with a non-China account) and US GovCloud.

Answer 13

● One or more redundantly connected individual datacenters where things actually run. The specific locations are not disclosed. ● Most services that are serverful (think: devices that have IP addresses) are instantiated on the availability-zone level. ● As an example, us-east-2 (Ohio) has three availability zones: ○ us-east-2a ○ us-east-2b ○ us-east-2c

Answer 14

● Each subnet has an associated Route Table. A Route Table says where traffic routes to. ● For instance: ○ Route all traffic matching 10.10.1.0/16 locally ○ Route all traffic matching 0.0.0.0/0 to the NAT Gateway

Answer 15

● A two-way configuration that allows traffic in from the public internet and out from the VPC. ● Use with a route table to create publicly accessible resources.

Answer 16

● A one-way virtual appliance that allows traffic from inside the VPC out to the public internet but does not route traffic from the public internet back in. ● Is secretly an EC2 instance.

Answer 17

A free-standing public IP address that can be associated with different devices without needing to relinquish the IP address should the server change.

Answer 18

Abstract classifications of servers that can be used in conjunction with EC2s and RDSs to allow some kinds of connections and deny others

Answer 19

● A virtual machine is a hardware (real) server pretending to be another server. ● One real server can host hundreds of virtual servers. ● They have Virtual CPUs for processing instructions and Virtual RAM for memory. ● Virtual servers can also change which machines are currently servicing them. They could be running off of one piece of real hardware, then smoothly transfer to another, different real machine.

Answer 20

Most important AWS service. Creates virtual servers with Amazon Machine images and allocate them to computing resources You can do virtually anything with an EC2. By installing specific software on it, you can make it into any kind of server. ● Remember that if AWS offers “Thing As A Service”, it is more correct to use that specific service than to recreate the service by building from the ground up on an EC2.

Answer 21

● The pre-installed operating system as well as pre-installed software packages that the server will be “born with.” ● Amazon Linux ● Microsoft Windows (license fees included in server costs) ● Mac OS ● Other Linux distributions (Ubuntu, Red Hat, SUSE, more) ● Marketplace: vetted by Amazon ● Community: use at your own risk

Answer 22

For example, r5.large or t2.nano ● The first letter is the class: the family of servers it belongs to ● The number is the generation: how recent it is- higher numbers are newer ● The third word is the size: how much of it you’re getting- each size tends to be double the allocated resources of the previous size

Answer 23

M (stands for Medium): an even distribution of resources ● R (stands for RAM): allocates larger amounts of RAM with less focus on CPUs ● C (stands for CPU): allocates more virtual processors with less focus on RAM ● G (stands for Graphics Card): machines will have access to a real NVIDIA or AMD graphics processor ● I (stands for Input output focused) allocates strong disk performance ● T -doesnt stand for anything: saves up unused CPU cycles in a credit balance that can be borrowed against when server comes under heavier load - ideal for web servers

Answer 24

Relational Database Service ● SQL, relational databases as a service ● In the Shared Responsibility Model, you no longer need to administer the servers, let AWS do it, you still need to protect customer data and choose encryption responsibly ● MariaDB, MySQL, PostgresQL ● Microsoft SQL Server and Oracle (license feeds included in cost of server) ● Instantiates redundantly across multiple availability zones

Answer 25

● Redis or memached as a service ● Key-value store ● Often scales extremely well despite not technically being serverless

Answer 26

● Serverless document database-as-a-service ● Calls tables “Tables” and rows “Items” ● Rows are secretly JSON ● Do NOT just leap in without understanding indexing first

Answer 27

● Data Warehouse ● Offers serverless option ● Use any SQL client to query ● Built-in Machine Learning

Answer 28

● Auto Scaling creates “pools” of interchangeable servers based off of a template. ● Configure one server to behave as expected, save it as an AMI, and then new ones can be spun up. ● An Auto Scaling group has configuration parameters: ○ In each of several availability zones: ■ A minimum number of servers that can be running at any given time ■ A maximum number of servers that can be running at any given time ○ A “scaling policy” that tracks a metric (eg CPU usage over time) that determines when it is time to make more servers or remove servers

Answer 29

● Resilience/Redundancy/Fault Tolerance ○ If one AZ suffers failures other AZs can cover ○ Each server is individually unremarkable so there is no single point of failure ● Pay-as-you-go pricing at its finest ○ More servers when load demands that you need them, fewer servers when things are quiet

Answer 30

● A Load Balancer is a configuration with one IP address that can farm out traffic that reaches it to any number of individual instances. It’s how you make an Auto Scaling Group pool of 10 servers all effectively function behind one facade, e.g. MyApp.com. ● When a request arrives at a Load Balancer, it selects one of the devices in the target group and forwards the request to that server, receives a response, and forwards the response back to the original requester.

Answer 31

Classic: these are disfavored and only exist for Legacy reasons. Do not use Application: exists at layer 7 of the OSI model. Can inspect and route based on HTTPS traffic and its properties such as headers and content. Network: exists at layer 4 of the OSI model. Cannot inspect or route based on HTTP properties but can route low level traffic packets like UDP and other protocols.

Answer 32

● Elastic Beanstalk bundles together EC2’s, Auto Scaling Groups, and Load Balancers into one service that makes web application serving easy. ● It doesn’t do anything you couldn’t do manually by configuring all these services yourself, but it does so seamlessly and manages deploys of new versions of the app elegantly.

Answer 33

● Unlimited storage (usually of files) with 99.999999999% durability (the files are intact and their contents match what was originally written). ● Supports multiple tiers of availability (called Storage Classes). ● The basic unit is called a Bucket and the things in Buckets (usually files) are called Objects that have Keys (usually filenames). ● You PUT Objects into Buckets and then GET them later by their Key.

Answer 34

● As of the time of writing this presentation, about 2.4 cents per gigabyte per month ● 99.99% availability

Answer 35

● Half the price as Standard storage ● 99.9% availability ● Mildly slower

Answer 36

● As of the time of making this presentation, about .4 cents per gigabyte per month ● Files are not on-demand accessible ● First you have to put in a request to retrieve the key you want from deep storage ● Then within four hours you will receive a notification that the files are ready to be accessed ● Ideal for “forever storage”, log files, legacy files

Answer 37

● Lifecycles change an Object’s storage class N days into its life ● Replication automatically copies Objects from one bucket into another

Answer 38

● Disk space-as-a-service ● Can be attached to EC2 Instances ● SDD or HDD based ● 99.999% Availability ● Can’t be easily scaled later (I had a 100 GB hard drive and now need 200 GB)

Answer 39

● Instead of just abstract disk space it’s specifically file storage ● Attach to EC2s or Lambdas or ECS (containers) ● 99.99% availability, 11 9’s of durability ● Pay-as-you-go for storage space consumed

Answer 40

● For one-time massive data uploads as part of a transformation from on-prem to cloud ● Order one to your datacenter and it arrives in 4-6 days ● Upload all your on-premises data onto the Snowball’s disks ● Holds petabytes of data ● Ship it back to AWS ● They transform its contents into an S3 bucket and give you access

Answer 41

● An armored truck full of Snowballs ● Exabytes of data ● For truly massive one-time on-prem-tocloud transformations

Answer 42

● A bridge between an on-prem data center and cloud storage ● Still run your application locally but keep your files in the cloud ● Supports on-prem caching ● Encryption in transit, it’s like your on-prem network extends to the cloud

Answer 43

Lambda ● Code execution as a service. ● Upload code and it runs, and you’re billed by the amount of RAM and computation time it consumed. ● Serverless and endlessly scalable.

Answer 44

Run secure and scalable containers, for container-based applications

Answer 45

Same as ECS but specifically uses the popular Kubernetes framework to orchestrate the containers

Answer 46

Containers, completely serverless, no need to orchestrate

Answer 47

Analyze unstructured data that is stored in S3 with SQL

Answer 48

Pipelines that process streaming data. Also Kinesis Firehose which is scalable and serverless. Good way to load data into data warehouses.

Answer 49

● PUSH notification management as a service. ● You create Topics that any number of Publishers can publish Messages to and any number of Subscribers are immediately notified/triggered of the contents of the Message. ● Sample subscribers: ○ Email addresses ○ SMS numbers ○ Mobile push notifications ○ An HTTP endpoint ○ A Lambda

Answer 50

● PULL/POLLING based notifications as a service. ● You create a Queue and any number of Publishers publish Messages to that Queue, then those messages sit there in single-file line while some sort of consumer or worker periodically asks for the item at the front of the line. ● Supports Visibility Timeouts and Long Polling.

Answer 51

● EC2s in a greatly specific and simplified interface. ● Just choose how big of a server you want and you’re done. ● Commonly used for wordpress servers.

Answer 52

Virtual desktops as a service. They’re VMs just like EC2s are but the purpose is not to serve an application, but to be remoted into for performing work on.

Answer 53

A special RDS that exposes the same interface as Postgres or MySQL but optimized to run at Amazon well. Available in a serverless flavor.

Answer 54

Hosted Git source code version control. Very much like a less-featureful GitHub.

Answer 55

Watches a Git repository for commits and then runs an automated script (called buildspec.yml) on a short-lived EC2 instance to compile, test, or otherwise build the code.

Answer 56

An agent that deploys the results of a CodeBuild to servers or containers or Lambdas. Supports advanced deploy scripts and manages rollbacks.

Answer 57

Marries a CodeCommit, CodeBuild, and CodeDeploy under one roof to create a complete CI/CD pipeline (Continuous Integration Continuous Deployment).

Answer 58

Marries CodeCommit, CodeDeploy, and CodePipeline together with Cloud9, an in-browser code editor, to create a truly cloud-based application development platform.

Answer 59

Customer support as a service. Combine phone numbers or online chatbots with business logic.

Answer 60

An API “facade” that provides a unified RESTful interface that can use Lambdas or EC2s or proxies to serve the requests behind the scene.

Answer 61

a highly available and scalable Domain Name System (DNS) web service that allows users to register domain names, manage DNS records, and route traffic to their applications, with features like health checks and flexible routing policies.

Answer 62

Consumer identity as a service. Manages usernames, passwords, and social logins so you don’t have to. Like Auth0.

Answer 63

A global firewall that can be imposed on Cloudfront, Application Load Balancer, and API Gateway

Answer 64

Two-sided marketplace for complete third-party data sets of health, retail, finance, government, and more information

Answer 65

A pipeline that helps prepare many data sources for transformation and ingestion into a data lake

Answer 66

Essentially a managed ElasticSearch - compare to elastic.co

Answer 67

A workflow system of Lambdas glued together. You can stitch little Lambdas together in distinct sequences and steps to create workflows, like Zapier, Fiorano, Mule, etc.

Answer 68

Transactional email service, for sending individual emails at scale. Absolutely comparable to Sendgrid or Mandrill. Don’t think of it as a substitute for MailChimp or ConstantContact, though一it’s not a marketing tool.

Answer 69

● Kind of a bridge between S3 Storage and ECS/EKS/Fargate/EC2 Spot Instances ● You can upload massive amounts of records to S3 and then introduce an individual “job” that uses one of the above compute services to “process” that record. ● Batch orchestrates the whole thing and makes sure every record gets its turn.

Answer 70

“Local Zones” are a new “mini region.” They are like tiny regions that are very specifically in one specific urban center. They don’t offer all services or all instance types in all locations, though! Furthermore, they haven’t been launched in the burgeoning urban metropolis of Buffalo, NY yet, so how serious can they really be? :)

Answer 71

An AWS Outpost is a server rack you order and install in your own datacenter, and it runs “AWS services,” except locally. Why? It’s a little odd, but maybe you want the interface or API that you are used to from AWS services, but for the CPU and Storage to literally happen inside your own building. In functioning they are indistinguishable from the cloud!

Answer 72

Tens of thousands of dollars in credits for your startup if you launch it on AWS! Can say firsthand: I use this at every single startup I launch. :)

Answer 73

Two sided marketplace for seeking and providing AWS help. Pretty straightforward. I haven’t used it, although maybe I should! ?

Answer 74

Install desktop software in the cloud, but end-users can interact with it in their browsers as though it was browser-native SaaS software. Including appropriate encryption and VPN. I ~think~ (?) this is similar to what some applications like Citrix do, but I haven’t used Citrix in a decade.

Answer 75

● Sort of an all-in-one for launching lean new startup codebases. ● Stitches together some automagical React, some automagical Cognito, some automagical DynamoDB, and some Lambdas and deployment scripts, all in an attempt to fulfill a promise: that you could run a command “amplify this that deploy” and boom, you have a working app. ● Very much an answer to Firebase. I have had EXTREMELY mixed results, across many attempts. Use at your own risk as far as I am concerned.

Answer 76

A GraphQL server that directly competes with Apollo, but is at present far, far inferior to Apollo.

Answer 77

Farms of thousands of distinct mobile devices, in real hardware, that you can rent screen time on, to test your mobile apps on actual varied hardware. Not simulated一these are actual IRL mobile phones in giant arrays that you are fractionally reserving! 2

Answer 78

Analyzes observability services and security logs to try to automatically triage and detect potential security violations.

Answer 79

This is straight up just Microsoft Active Directory, but as-a-service.

Answer 80

Very robust, IAM-integrated encrypted secret storage. You won’t need to put API keys and other such sensitive data in source code anymore!

Answer 81

Storage Gateway

Answer 82

CloudTrail

Answer 83

Software packages that contain all the files needed to run an application in the cloud. They are portable, lightweight, and can be scaled up or down to meet demand

Flash Cards

(112 cards)