Services - Management and Governance Flashcards
(30 cards)
1
Q
Auto Scaling - Characteristics
A
- Monitors applications and automatically adjusts capacity to maintain steady, predictable performance at the lowest possible cost
- There’s no charge for using this service
- From a single UI can configure automatic scaling policies for multiple resources like:
- EC2 instances and Spot Fleets
- ECS tasks
- DynamoDB tables and global secondary indexes
- Aurora Replicas
- Can also select to auto-scale an application defined in a CloudFormation stack or in Elastic Beanstalk
2
Q
Auto Scaling - Steps for CloudFormation application
A
- Select the CloudFormation stack used for your application
- Auto scaling will identify the supported resource types that can be scaled
- Create and review a scaling plan, which is a unit that consists of several resource items
- Select a scaling strategy: scale with availability, cost savings, or a balance of both
- Based on the scaling strategy, Auto scaling will create the target tracking scaling policies for each resource
3
Q
Auto Scaling - Scaling recommendations
A
- Based on the most popular scaling metrics and thresholds used for auto scaling
- Also calculate the minimum and maximum limits between which your resources will scale. At any time you can quickly gauge the minimum / maximum performance cost of your environment
4
Q
Auto Scaling - Scaling strategies
A
- Availability: a low resource utilization target is used to ensure capacity to absorb spikes on demand
- Balance strategy: a moderate resource utilization target is used to provide high availability and reduce costs
- Cost strategy: a high resource utilization target is used to optimize usage and reduce costs
- Custom strategy: can set your own target resource utilization with your own values
5
Q
Auto Scaling - Target tracking scaling policies
A
- Lets you select a metric and set a target value. So it creates and manage CloudWatch alarms that trigger the scaling policy and calculates the scaling adjustment based on the metric and the target value
- Adds / removes capacity as required to keep the metric at or close to the specified target value
- Also it self‑optimizes to adjust to changes in the metric due to a changing load pattern. Therefore, it reduces the fluctuations in the capacity of that target
6
Q
Auto Scaling - EC2 scaling options
A
- Maintain current instance levels at all times: a periodic health check is performed on running instances. When there’s an unhealthy instance, it’s terminated and a new one is created
- Scale manually: when you specify only the minimum, maximum, or desired capacity of your Auto Scaling group
- Scale based on a schedule: scaling actions are performed automatically as a function of time and date. Useful when you know when to increase or decrease the number of instances
- Scale based on demand: using dynamic scaling, lets you define a scaling policy that dynamically resizes your Auto Scaling group to meet changes in demand
- Predictive scaling: when you want to increase instances in advance of daily and weekly patterns in traffic flows
7
Q
Auto Scaling - EC2 auto scaling group characteristics
A
- Can schedule scaling to increase / decrease capacity at preset times
- Cooldown period, measured in seconds, is a setting that ensures that the Auto Scaling group doesn’t launch or terminate additional instances before the previous scaling activity takes effect
- Lifecycle hooks allow to put the instances to be terminated into a wait state. Can perform custom activities during the wait state. The default wait period is 1 hour
- Termination policy allows to specify which instances to terminate first during scale in
8
Q
Backup - Characteristics 1
A
- It’s a managed service that centralizes and automate data protection across AWS services, in the cloud, and on-premises
- Supports automatic backups, centralized backup monitoring, and backups retention as long as they are needed
- Supports cross-region backups, cross-account management and cross-account backups
- Pay only for the amount of backup storage used and the amount of backup restored per month
9
Q
Backup - Characteristics 2
A
- Integrates with CloudTrail to register activity logs, and SNS for notification delivery
- Uses backup vaults to offer encryption and resource-based access policies to define who has access to them
- Supports encryption of backup data, additional to the encryption of the resources being backed up
- Some AWS resources support incremental backups. A full backup is performed only the first time
10
Q
Backup - Policy-based backups
A
- Can create backup policies, known as backup plans to define backup requirements
- Can create separate backup plans to meet business and regulatory compliance requirements
11
Q
Backup - Supported resources
A
- FSx
- EFS, EBS
- RDS databases, Aurora clusters, DynamoDB tables
- EC2 instances
- Storage Gateway volumes
12
Q
Config - Characteristics
A
- It’s a managed service that enables you to assess, audit, and evaluate the configurations of your AWS resources
- Continuously monitors and records your resource configuration
- Payment is based on the number of configuration items recorded, number of active AWS Config rule evaluations, and number of conformance pack evaluations in your account
- Can also be used to discover existent resources
- Can help to troubleshoot operational issues by identifying recent configuration changes
13
Q
Config - How it works
A
- A configuration change occurs in any AWS resource
- Config records and normalizes changes in a consistent format
- Changes history and snapshot files are delivered to a S3 bucket, accessed through Config API, and alerts are optionally generated using SNS or EventBridge
- (Optional) Config automatically evaluates recorded configurations against desired configurations
- (Optional) Evaluations are displayed on a dashboard, accessed through Config API, and optionally sent via SNS
14
Q
Config - Rules
A
- Allow to check if a change to a resource configuration meet a desired configuration
- Rules types:
- AWS-managed config rules: defined by AWS
- Customer-managed config rules: authored by a client, or an AWS Partner using Lambda. Examples: INSTANCES_IN_VPC (Do all EC2 instances belong to a VPC?), ENCRYPTED_VOLUMES (Are all attached EBS volumes encrypted?)
15
Q
EventBridge - Characteristics 1
A
- A serverless event bus service that can connect your applications with data from a variety of sources. Formerly known as CloudWatch Events
- Delivers a stream of real-time data from applications, SaaS applications, and AWS services to targets such as Lambda, API destinations, or event buses in other AWS accounts
- Pay for events published on the event bus, events ingested for Schema Discovery, and for Event Replay
16
Q
EventBridge - Characteristics 2
A
- API destinations are HTTP endpoints that can be set as the target of a rule, in the same way that event data can be set to an AWS service or resource
- Events can be archived or saved. And then replayed, at a later time, from the archive
17
Q
EventBridge - How it works
A
- An events bus, events patterns, and rules must be defined first. An event bus is a pipeline that receives events. That bus applies a rule when an event arrives to route it to a specific target
- Event patterns have the same structure as the events they match
- Rules uses event patterns or a schedule to select events and send them to targets
- All events are associated with an event bus. Rules are tied to a single event bus
18
Q
EventBridge - Schema
A
- Defines the structure of events that are sent to EventBridge
- EventBridge provides schemas for all events that are generated by AWS services
- Also can be created, uploaded or inferred directly from events
- Schema registries collect and organize schemas
19
Q
Organizations - Characteristics
A
- It’s an account management service that enables you to consolidate multiple AWS accounts into an organization that you create and centrally manage
- Includes consolidated billing capabilities to better meet the budgetary, security, and compliance needs
- It’s offered at no additional charge
20
Q
Organizations - Terminology
A
- Root: parent container of all accounts
- Organizational Unit (OU): a container for accounts within a root. Can contain other OUs
- Account: a standard AWS account. It’s not the same as a “user account”. It typically contain many users and roles
- Invitation: process of asking an account to join the organization
- Policies: allow to apply additional types of management to the AWS accounts in your organization
21
Q
Organizations - Account types
A
- Management account:
- The account that creates the organization. Can’t be changed
- Manages invitations. Invites or remove accounts. It’s the payer account
- Applies policies to entities (roots, OUs, and accounts)
- Member account:
- The rest of the accounts
- Can be member of one organization at a time
22
Q
Organizations - Policy types
A
- Authorization policies or Service Control Policies (SCPs): help to centrally manage the security of AWS accounts
- An SCP is also needed to grant / deny permission to a resource in conjunction with an IAM policy
- Any account has only those permissions allowed / denied by every parent above it. Even if there are SCPs / IAM policies in the upper parents allowing / denying those permissions
- Management policies: help to centrally configure and manage AWS services and their features. There’s three subtypes:
- AI service opt-out policies: control data collection for AWS AI services
- Backup policies: centrally manage and apply backup plans to AWS resources
- Tag policies: standardize the tags attached to AWS resources
23
Q
Resource Access Manager - Characteristics
A
- It helps to securely share AWS resources across AWS accounts
- Can share within your organization or OUs
- There’s no additional pricing for this service
- Also can share with IAM roles and IAM users but for specific resource types
- Eliminates the need to provision duplicate resources in every account
24
Q
Resource Access Manager - Shareable resources
A
- Aurora clusters
- EC2 capacity reservations and dedicated hosts
- S3 on Outposts
- Resource groups
- Route 53 rules
- Prefix lists, subnets, transit gateways
- License Manager license configurations
25
Systems Manager - Characteristics 1
* It allows to view operational data from multiple AWS services and automate operational tasks across AWS resources (your infrastructure)
* Formerly Amazon Simple Systems Manager (SSM) and Amazon EC2 Systems Manager (SSM)
* Some capabilities charge fees based on the functionality they offer such as OpsCenter, AppConfig, Incident Manager, and others
* Systems Manager Parameter Store provides secure, hierarchical storage for configuration data management and secrets management. Can store passwords, database strings, AMI IDs, and license codes as parameter values
26
Systems Manager - Characteristics 2
* A managed instance is a machine configured for use with Systems Manager
* Helps you maintain security and compliance by scanning managed instances and reporting on (or taking corrective action on) any policy violations it detects
* Can associate AWS resources by applying the same identifying resource tag, or can view operational data of these resources as a resource group
27
Systems Manager - Supported machine types for managed instances
* EC2 instances
* On-premises servers
* VMs
28
Systems Manager - Capabilities 1
* Quick setup: to configure frequently used AWS services and features with recommended best practices
* Operations management: to manage AWS resources. Includes Incident Manager, Explorer, OpsCenter, and CloudWatch Dashboards capabilities
* Application management: to manage applications running in AWS. Includes Application Manager, Resource groups, and AppConfig capabilities
29
Systems Manager - Capabilities 2
* Change management: to provide management of taking action on, or changing your AWS resources. Includes Change Manager, Automation, and Change Calendar
* Node management: to help when managing EC2 instances, on-premises servers, VMs, and other types of AWS resources (nodes)
* Shared resources: includes Documents capability that defines the actions that Systems Manager performs
30
Systems Manager - SSM Agent
* It's an Amazon software that must be installed on each instance to be monitored by System Manager
* Allows Systems Manager to update, manage, and configure resources
* Processes requests from Systems Manager in the AWS cloud, then sends status and execution information back to Systems Manager
