Sem título

Página 1

Only users and roles can be used in resource policy

AWS by default logs only management events

Management events are nothing but contral pane events like creating an ec2 instance etc where as data events are events like access to an s3 bucket et

Cloud trail events are logged on the region where the event occurs.in case of global services like IAM, cliudfront, STS the events are always logged to us-east-1 region

Deleting an object will only mark the object for deletion(it just hides the object). If u delete the object by mentioning the “id”, the object will be permanently deleted

Data upload to an S3 bucket in a far off region happens thru edge location. Data gets uploaded to the near by edge location using public internet and from there it uses AWS global network to the bucket. Needs to be enabled at the bucket level. Bucket name should not contain periods and it should be domain name compatible

In KMS, CMK doesn’t leave the KMS service and only the encrypted version of the CMK is stored persistently in the disk. During encrypt or decrypt operation, CMK gets decrypted runtime

When DEKs are used, KMS service doesnot carry out the encryption, it just generates and encrypts the DEK. Encryption needs to be done the service using the KMS

You cannot instantly delete the KMS key. U can schedule it for deletion and you can set the waiting time for deletion between 7 to 30 days

You need to create and manage the keys. Once the object is encrypted, a HASH of the key is stored with the object. During decryption, u need to provide the keys again and S3 validates the key with the HASH. You cannot generate the key using the HASH. Generally this method is used where strict regulations are there. It also helps to offload CPU intensive encryption process to S3

No control over the keys as they are fully managed by AWS. No role separation is possible

AWS managed KMS key(aws/s3) gets automatically created first time when it is used. It trusts the account and s3 service and the resource policy cannot be modified

Both standard and standard-IA has a 99.9 % SLA for availability.

Expedited retrieval can be done within 1-5 mins but its very costly

No expedited retirevals possible

Retrieval options for glacier archive

Retrieval options for glacier deep archive

If u enable replication time control, AWS provides a 15 mins SLA for the replication. Otherwise replication is carried out on the best effort basis

Objects encrypted with SSE-C cannot be replicated

How to generate presign url for PUT operation. CLI has no option to set the API method but SDKs seems to have it.

https://docs.aws.amazon.com/AmazonS3/latest/dev/PresignedUrlUploadObject.html

VPC

If u select dedicated tenancy for a VPC, any resources that needs to be attached to this VPC should also be running on a dedicated hardware

EnableDnsHostnames – generates a public dns host name for instances with public IP

Local target takes precedence and has more priority that the destination CIDR range

NAT instances can be used if u need to control the cost associated with data usage. Also NAT instance can be used as a bastion host or for port forwarding. NAT gateways cannot do port forwarding or act as abastion host

Io1 volumes can be attached to multiple instances. This is a new feature introduced

You can send a SNS notification or carry out auto recovery of the instance in case of the failures in status checks

“recover this instance” option works only for EBS backed instances not for instance store

Even if there a proble in executing the user-data, the instance will still be in running state

Cloud-init.log and cloud-init-output.log under /var/log contains the logsfor the user-data execution

SSM is a public service. Changes to the values stored in parameters can be configured to trigger events. When using hierarchical parameters, u can access the individual parameters(/wordpress/DBUser) or the entire set of parameters under a root(/wortpress)

aws ssm get-parameters --names /my-dog-app/dbstring --profile iamadmin-general – to get individual parameters

aws ssm get-parameters-by-path --path /my-cat-app/ --profile iamadmin-general – to get the parameters by path

Use --with-decryption to decrypt the data encrypted by KMS

We need to configure log group for each individual logs that u send to cloudwatch and under that you will have a log stream for each EC2 instance

When u enable the metric collection using cloudwatch agent, the metrics will be available under cloudwatch agent namespace

With dedicated hosts, u have to decide the instance size to be used for the host and you cannot have mix and match. Ex. 2 medium, 2 large etc. with some of the new Nitro based instance types, we can have mix and match of the sizes within a host

Enhanced networking is enabled by default with no additional cost for most modern instance types. ideally suitable for cluster placement grousp

In weighted routing, if one of the record fails the health check, that record is skipped. In that way, its similar to failover routing but it has an activie-active routing

Similar to single record but u can configure multiple records and when queries, R53 returns all the healthy records

Dynamo DB is an example for wide column store

Any data transfer within the AZ is free. But data transfer across AZs are charged but charges are very minimal

Transation logs also gets retained based on the retention days set

If there is a significant reduction in the size of your database, u need to provision a new database and migrate your data to the new one to get the cost benefit

When any write is performed, apart from updating the shared storage, the writer endpoint also updates the in-memory caches of other writer endpoints

\

Launch templates can be used to launch instances where as Launch configuration can’t be used to launch instances

Standard workflow is the default with one year max duration whereas express has a max duration of 5 mins

If u r using query string, each query string is treated as a separate object. U can choose not to forward the query string to origin or select few query string to be forwarded to the origin

ACM certitifactes needs to be created in the same region as the product that is going to use the cert. for ex if u r creating a cert to be used for load balancer, u should create the cert in the same region of ur load balancer. In case of CDN, evn though it’s a global service, it is assumed to be in us-east-1. So any certs that needs to be used for CDN should be created in us-east-1

When u create a gateway endpoint, u attach them to route tables rather than attaching to subnets directly

For direct connect, AWS allocates a port in the DX location. This port needs to be connected to the customer router and from them there to the physical location of the data center. Customer router can be a partner router

When u create the VPC attachments, u need to select the AZs and a subnet within that AZ, which will be used to access the transit gateway.it basically creates an interface on that subnet for those AZs.

FSx can directly integrate with on-premises AD without the need for directory service

FSx enables the users to restore the previous versions of the files

Reads using DAX are eventually consistent

Página 2