PP ET NEW Flashcards
(52 cards)
How would you securely store and retrieve different types of variables across different environments in Amazon ECS?
AWS Systems Manager Parameter Store (stores environment path)
AWS Secrets Manager (stores credentials)
What is an S3 Object Lambda access point?
a way to use a Lambda function to modify the content of s3 objects on the fly
For example, return an object with the header / without depending on who makes the get request
How would you use SNS to notify a team if a threshold goes above 5%
Publish data on failure to Cloud Watch and configure an alarm to notify the existing SNS topic when error rate exceeds the specified rate.
How would you avoid accidental database deletion in the future when using AWS CloudFormation?
Add a CloudFormation Deletion Policy attribute with the Retain value to the database resource
Update the CloudFormation stack policy to prevent updates to the database
How would you enforce encryption in transit for requests to retrieve data from the S3 bucket?
Define a resource-based policy on the S3 bucket
Deny access when a request meets the condition “aws:SecureTransport”: “false”:
What is the cheapest way to securely manage one-time fixed license keys that need to be accessed by automation scripts running in Amazon EC2 instances and AWS CloudFormation stack
AWS Systems Manager Parameter Store SecureString parameters
How would you troubleshoot issues with API Gateway timeouts using Cloud Watch?
IntegrationLatency (if high, api taking a long time to interact with lambda)
Latency (time for API to process request)
How would you store and retrieve an access token that needs to be encrypted at rest and in transit, and accessible from other AWS accounts with the least management overhead?
Use Secrets Manager with AWS KMS with customer managed key
Resource-based policy (allows cross account access)
IAM role of the EC2 instances (permission to get the token from secrets manager)
How would you collect all the lifecycle events of EC2 instances from multiple AWS accounts and storing them in a single Amazon SQS queue in the main AWS account?
An Event Bridge rule to send all EC2 lifecycle events to the main event bus to the SQS queue (which is set as the target)
How would you increase the resiliency of the application when the batch response includes values in UnprocessedKeys?
- Retry the batch operation with exponential backoff and randomized delay to stop overwhelming DynamoDB with repeated requests
- Update the application to use an AWS SDK to make request because it has built in functionality for handling error and retries
What is Secrets Manager for?
Storing sensitive information
How would you return a document from s3 with/without header, if you only store one copy of the document?
Create an S3 Object Lambda access point from the S3 console.
Call a function that removes the header
Use S3 Access Points to access the object without the header
What are you defining access to in Effect Action Resource permissions?
Objects in buckets
How would you extend an app to run in the destination region and make sure the AMIs are encrypted in all regions?
- Create AMIs with encryption parameters
- Copy the AMIs to the destination regions.
- Delete the unencrypted AMIs.
How would you configure the custom domain for a API Gateway REST API that uses Cloud Front and a custom domain name with an SSL/TLS certificate from a 3rd party provider?
import the SSL/TLS certificate into ACM (in the same Region as the API)
Create a DNS CNAME record for the custom domain (that points to API Gateway Cloud Front distribution)
How would you avoid accidental deletion of a database when deploying an app using a Cloud Formation template?
Add a Cloud Formation Deletion policy attribute (Retain = database) and update the Cloud Formation Stack Policy (prevent updates to db)
How would you ensure an app on an EC2 instance can list objects from S3?
Update the IAM instance profile that is attached to the EC2 instance to include the S3:ListBucket permission for the S3 bucket
How would you:
- Create a Lambda function that will retrieve data from an Aurora database that is in a private subnet in the company’s VPC called VPC1.
How would the Lambda function access the data securely?
Create the Lambda function
Configure VPC1 access for the function.
Assign a security group (SG1) to the Lambda function and assign a security group (SG2) to the database.
Add an inbound rule to SG1 to allow TCP traffic from Port 3306.
How would you log key events with a unique identifier associated with a specific Lambda function invocation?
get the AWS request ID from the context object
Configure the application to write logs to standard output.
How would a developer reduce the time before an EC2 instance becomes available, while making sure to deploy the most recent version of an app on an EC2 instance, all updates are installed and minimise the number of images created
- Use EC2 Image Builder to create an AMI.
- Install the latest version of the app and all the patches and agents needed to manage and run the application.
- Update the Auto Scaling group launch configuration to use the AMI.
Set up AWS CodeDeploy to deploy the most recent version of the application at runtime.
For an API Gateway app how would you simulate different backend responses without invoking the actual backend service and with the least operational overhead?
Use a request mapping template to select the mock integration response.
Mock integration means you can define responses in API gateway, without calling the backend
How would you analyse an image before pushing it to an EKS cluster?
- Add Deployment action to pipeline
- Configure ECR image scanning on push
- Lambda function to check results and fail the pipeline if issues are found.
How would you add end-to-end testing to amplify?
Add a test phase to amplify.yml build settings for the app
How would you implement a web app that receives customer requests, generates reports that can be greater than 1B in 1 hour, makes them available for 8 hours and deletes reports older than 2 days old.
S3 bucket (to handle messages greater than 1B)
Generate a presigned URL that contains an expiration date
Provide the URL to customers through the web application.
Add S3 Lifecycle configuration rules to the S3 bucket to delete old reports
