Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
AWS FAQs:-
S3 faqs:-
1. S3 naming conversation?
2. What is the S3 bucket default limit?
3. How to mount the s3 bucket in your ec2 machine?
4. What is Bucket policies size limitation?
5. What is an IAM JSON policy element: Sid?
6. What is AWS Policy Generator?
URL: https://awspolicygen.s3.amazonaws.com/policygen.html
7. What are the types of policies AWS policy Generator support?
By default, you can create up to 100 buckets in each of your AWS accounts. If you need
additional buckets, you can increase your account bucket limit to a maximum of 1,000 buckets by submitting a service limit increase.
S3fs <bucket-name> <mount-ponit> -o iam_role=<role-name>
Bucket policies are limited to 20 KB in size.
The Sid (statement ID) is an optional identifier that you provide for the policy statement. You can assign
a Sid value to each statement in a statement array. In services that let you specify an IDelement, such as SQS and SNS, the Sid value is just a sub-ID of the policy document's ID. In IAM, theSid value must be unique within a JSON policy.
"Sid": "1"
The AWS Policy Generator is a tool that enables you to create policies that control access to Amazon
Web Services (AWS) products and resources.
Here are the types of policies:
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
8. How to add a bucket policy?
In its most basic sense, a policy contains the following elements:
For example, the s3:ListBucket permission allows the user permission to the Amazon S3 GET Bucket (List Objects) operation.
If you do not explicitly grant access to (allow) a resource, access is implicitly denied. You can also explicitly deny access to a resource, which you might do in order to make sure that a user
cannot access it, even if a different policy grants access.
The following example bucket policy shows the preceding common policy elements. The policy allows Dave, a user in account Account-ID, s3:GetObject, s3:GetBucketLocation, and s3:ListBucket Amazon S3 permissions on the examplebucket bucket.
{
"Version": "2012-10-17",
"Id": "ExamplePolicy01", "Statement": [
{
"Sid": "ExampleStatement01", "Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::Account-ID:user/Dave"
},
"Action": [ "s3:GetObject",
"s3:GetBucketLocation", "s3:ListBucket"
],
"Resource": [ "arn:aws:s3:::examplebucket/*",
"arn:aws:s3:::examplebucket"
]
}
]
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
}
https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingServerSideEncryption.html
To set up Amazon S3 inventory for an S3 bucket
You must create a bucket policy on the destination bucket to grant permissions to Amazon S3 to write objects to the bucket in the defined location. For an example policy, see Granting
Permissions for Amazon S3 Inventory and Amazon S3 Analytics.
When you configure an inventory list for a source bucket, you specify the destination bucket where you want the list to be stored, and whether you want to generate the list daily or weekly. You can also configure what object metadata to include and whether to list all object versions or
only current versions.
You can specify that the inventory list file be encrypted by using Amazon S3-managed keys (SSE- S3) or keys stored in AWS KMS (SSE-KMS). For more information about SSE-S3 and SSE-KMS,
see Protecting Data Using Server-Side Encryption. If you plan to use SSE-KMS encryption, see
Step 3
You can configure encryption for the inventory list file by using the AWS Management Console,
REST API, AWS CLI, or AWS SDKs. Whichever way you choose, you must grant Amazon S3
permission to use the AWS KMS customer master key (CMK) to encrypt the inventory file. You grant Amazon S3 permission by modifying the key policy for the AWS KMS CMK that is being used to encrypt the inventory file. For more information, see the next section, Grant Amazon S3 Permission to Encrypt Using Your AWS KMS Key.
11. How to grant permissions to encrypt using your AWS KMS key
Amazon S3 inventory helps you manage your storage by creating lists of the objects in an S3 bucket on a
defined schedule. You can configure multiple inventory lists for a bucket. The inventory lists are published to CSV, ORC, or Parquet files in a destination bucket.
The easiest way to set up an inventory is by using the AWS Management Console, but you can also use
the REST API, AWS CLI, or AWS SDKs. The console performs the first step of the following procedure for you: adding a bucket policy to the destination bucket.
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
navigation bar (upper-right corner).
{
"Sid": "Allow Amazon S3 use of the key", "Effect": "Allow",
"Principal": {
"Service": "s3.amazonaws.com"
},
"Action": [ "kms:GenerateDataKey*"
],
"Resource": "*"
}
You can also use the AWS KMS PUT key policy API PutKeyPolicy to copy the key policy to the CMK that is being used to encrypt the inventory file.
An inventory list file contains a list of the objects in the source bucket and metadata for each object. The inventory lists are stored in the destination bucket as a CSV file compressed with GZIP, as an Apache optimized row columnar (ORC) file compressed with ZLIB, or as an Apache Parquet (Parquet) file compressed with Snappy.
The inventory list contains a list of the objects in an S3 bucket and the following metadata for each listed object:
the list is only for the current version of objects.)
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
The manifest files manifest.json and symlink.txt describe where the inventory files are located. Whenever a new inventory list is delivered, it is accompanied by a new set of manifest files.
Each manifest contained in the manifest.json file provides metadata and other basic information about an inventory. This information includes the following:
Whenever a manifest.json file is written, it is accompanied by a manifest.checksum file that is the MD5 of the content of manifest.json file.
The following is an example of a manifest in a manifest.json file for a CSV-formatted inventory.
{
"sourceBucket": "example-source-bucket",
"destinationBucket": "arn:aws:s3:::example-inventory-destination-bucket", "version": "2016-11-30",
"creationTimestamp" : "1514944800000", "fileFormat": "CSV",
"fileSchema": "Bucket, Key, VersionId, IsLatest, IsDeleteMarker, Size, LastModifiedDate, ETag,
StorageClass, IsMultipartUploaded, ReplicationStatus, EncryptionStatus, ObjectLockRetainUntilDate, ObjectLockMode, ObjectLockLegalHoldStatus",
"files": [
{
"key": "Inventory/example-source-bucket/2016-11-06T21-32Z/files/939c6d46-85a9-4ba8-87bd- 9db705a579ce.csv.gz",
see Protecting Data Using Encryption.
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
When configuring event notifications for a bucket you must specify the type of events you want to be notified of and the destination where you want the notifications sent.
Amazon S3 can send notifications for the following types of events:
and CompleteMultiPartUpload.
select RRSObjectLost to be notified when Amazon S3 detects that an object of the RRS storage class has been lost.
"size": 2147483647,
"MD5checksum": "f11166069f1990abeb9c97ace9cdfabc"
}
]
}
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
Event notification messages can be sent to the following types of destinations:
Before you can enable event notifications for your bucket you must set up one of the following destination types:
An Amazon SNS topic
Amazon Simple Notification Service (Amazon SNS) is a web service that coordinates and manages the delivery or sending of messages to subscribing endpoints or clients. You can use the Amazon SNS console to create an Amazon SNS topic that your notifications can be sent to. The Amazon SNS topic must be in the same region as your Amazon S3 bucket. For information about creating an Amazon SNS topic, see Getting Started in the Amazon Simple Notification Service Developer Guide.
Before you can use the Amazon SNS topic that you create as an event notification destination, you need the following:
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
∙ | { | ||
| |||
∙ | ] | ||
| | } | |
"Version":"2012-10-17",
"Id": " example_policy_ID",
"Statement":[
∙
∙
∙
∙
{
"Sid": "example-statement-ID",
"Effect":"Allow",
"Principal": "*",
"Action": "SQS:*",
"Resource":"arn:aws:sqs:region:account-number:queue-name",
∙
∙
∙
∙
∙
∙
"Condition": {
An Amazon SQS queue
You can use the Amazon SQS console to create an Amazon SQS queue that your notifications can be sent to. The Amazon SQS queue must be in the same region as your Amazon S3 bucket. For information about creating an Amazon SQS queue, see Getting Started with Amazon SQS in the Amazon Simple Queue Service Developer Guide.
Before you can use the Amazon SQS queue as an event notification destination, you need the following:
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
∙ ∙ ∙ ∙ ∙ ∙ | "ArnEquals": { | | | ||||
"aws:SourceArn": "arn:aws:s3:::bucket-name" | |||||||
} | | ||||||
} | | ||||||
} | | ||||||
] | | ||||||
| } | ||||||
A Lambda function
You can use the AWS Lambda console to create a Lambda function. The Lambda function must be in the same region as your S3 bucket. For information about creating a Lambda function, see the AWS Lambda Developer Guide.
Before you can use the Lambda function as an event notification destination, you must have the name or the ARN of a Lambda function to set up the Lambda function as a event notification destination.
For information about using Lambda with Amazon S3, see Using AWS Lambda: with Amazon S3 in the AWS Lambda Developer Guide.
16. How Do I Enable and Configure Event Notifications for an S3 Bucket?
To enable and configure event notifications for an S3 bucket
3. Choose Properties.
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
4. Under Advanced settings, choose Events.
5. Choose Add notification.
6. In Name, type a descriptive name for your event configuration. If you do not enter a name, a GUID is autogenerated and used for the name.
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
7. Under Events, select one or more of the type of event occurrences that you want to receive notifications for. When the event occurs a notification is sent to a destination that you choose in Step 9. For a description of the event types,
For information about deleting versioned objects, see Deleting Object Versions. For information about object versioning, see Object Versioning and Using Versioning.
Note
When you delete the last object from a folder Amazon S3 can generate an object creation event. The Amazon S3 console displays a folder under the following
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
circumstances: 1) when a zero byte object has a trailing slash (/) in its name (in this case there is an actual Amazon S3 object of 0 bytes that represents a folder), and 2) if the object has a slash (/) within its name (in this case there isn't an actual object representing the folder). When there are multiple objects with the same prefix with a trailing slash (/) as part of their names, those objects are shown as being part of a folder. The name of the folder is formed from the characters preceding the trailing slash (/). When you delete all the objects listed under that folder, there is no actual object available to represent the empty folder. Under such circumstance the Amazon S3 console creates a zero byte object to represent that folder. If you enabled event notification for creation of objects, the zero byte object creation action that is taken by the console will trigger an object creation event.
8. Type an object name Prefix and/or a Suffix to filter the event notifications by the prefix and/or suffix. For example, you can set up a filter so that you are sent a notification only when files are added to an image folder (for example, objects with the name prefix images/). For more information, see Configuring Notifications with Object Key Name Filtering.
9. Select the type of destination to have the event notifications sent to. For a description of the destinations, see Amazon S3 Event Notification Types and Destinations.
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
ii. (Optional) You can also select Add SNS topic ARN from the menu and type the ARN of the SNS topic in SNS topic ARN.
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
iii.
(Optional) You can also choose Add Lambda function ARN from
the menu and type the ARN of the Lambda function in Lambda function ARN.
For information about using Lambda with Amazon S3, see Using AWS Lambda: with Amazon S3 in the AWS Lambda Developer Guide.
10. Choose Save. Amazon S3 will send a test message to the event notification destination.
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
The following are the available retrieval options when restoring an archived object:
within several hours. This is the default option for the GLACIER and DEEP_ARCHIVE retrieval requests that do not specify the retrieval option. Standard retrievals typically finish within 3–5 hours for objects stored in the GLACIER storage class. They typically finish within 12 hours for objects stored in the DEEP_ARCHIVE storage class.
18. How Do I Restore an S3 Object That Has Been Archived?
This topic explains how to use the Amazon S3 console to restore an object that has been archived to the GLACIER or DEEP_ARCHIVE storage classes. (The console uses the names Glacier and Glacier Deep Archive for these storage classes.)
To restore archived S3 objects
1. Sign in to the AWS Management Console and open the Amazon S3 console athttps://console.aws.amazon.com/s3/.
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
2. In the Bucket name list, choose the name of the bucket that contains the objects that you want to restore.
3. In the Name list, select the object or objects that you want to restore, choose Actions, and then choose Restore.
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
How Do I Create a Lifecycle Policy for an S3 Bucket?
You can use lifecycle policies to define actions you want Amazon S3 to take during an object's lifetime (for example, transition objects to another storage class, archive them, or delete them after a specified period of time).
You can define a lifecycle policy for all objects or a subset of objects in the bucket by using a shared prefix (that is, objects that have names that begin with a common string).
A versioning-enabled bucket can have many versions of the same object, one current version and zero or more noncurrent (previous) versions. Using a lifecycle policy, you can define actions specific to current and noncurrent object versions. For more information, see Object Lifecycle Management and Object Versioning and Using Versioning in the Amazon Simple Storage Service Developer Guide.
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
To create a lifecycle policy
3. Choose the Management tab, and then choose Add lifecycle rule.
For more information about object name prefixes, see Object Keys in the Amazon Simple Storage Service Developer Guide.
press Enter. Repeat the procedure to add another tag. You can combine
a prefix and tags. For more information about object tags, see Object Tagging in the Amazon Simple Storage Service Developer Guide.
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
5. You configure lifecycle rules by defining rules to transition objects to the Standard-IA, One Zone-IA, Glacier, and Deep Archive storage classes. For more information, see Storage Classes in the Amazon Simple Storage Service Developer Guide.
You can define transitions for current or previous object versions, or for both current and previous versions. Versioning enables you to keep multiple versions of an object in one bucket. For more information about versioning, see How Do I Enable or Suspend Versioning for an S3 Bucket?.
a. Select Current version to define transitions that are applied to the current version of the object.
Select Previous versions to define transitions that are applied to all previous versions of the object.
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
b.
Choose Add transitions and specify one of the following transitions:
Important
When you choose the Glacier or Glacier Deep Archive storage class, your objects remain in Amazon S3. You cannot access them directly through the separate Amazon S3 Glacier service. For more information, see Transitioning Objects Using Amazon S3 Lifecycle.
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
When you are done configuring transitions, choose Next.
For this example, select both Current version and Previous versions.
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
Select Expire current version of object, and then enter the number of days after object creation to delete the object (for example, 395 days). If you select this expire option, you cannot select the option to clean up expired delete markers.
Select Permanently delete previous versions, and then enter the number of days after an object becomes a previous version to permanently delete the object (for example, 465 days).
It is a recommended best practice to always select Clean up incomplete multipart uploads. For example, type 7 for the number of days after the multipart upload initiation
date that you want to end and clean up any multipart uploads that have not completed. For more information about multipart uploads, see Multipart Upload Overview in the Amazon Simple Storage Service Developer Guide.
Choose Next.
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
For Review, verify the settings for your rule. If you need to make changes, choose Previous. Otherwise, choose Save.
If the rule does not contain any errors, it is listed on the Lifecycle page and is enabled.
How Do I Undelete a Deleted S3 Object?
To be able to undelete a deleted object, you must have had versioning enabled on the bucket that contains the object before the object was deleted. For information about enabling versioning, see How Do I Enable or Suspend Versioning for an S3 Bucket?.
When you delete an object in a versioning-enabled bucket, all versions remain in the bucket and Amazon S3 creates a delete marker for the object. To undelete the object, you must delete this delete marker. For more information about versioning and delete markers, see Object Versioningin the Amazon Simple Storage Service Developer Guide.
To recover deleted objects from an S3 bucket
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
3. To see a list of the versions of the objects in the bucket, choose Show. You'll be able to see the delete markers for deleted objects.
4. To undelete an object, you must delete the delete marker. Select the check box next to the delete marker of the object to recover, and then choose delete from the More menu.
5. Choose Hide, you'll see the undeleted object listed.
How Do I See the Versions of an S3 Object?
This section explains how to use the Amazon S3 console to see the different versions of an object.
A versioning-enabled bucket can have many versions of the same object:, one current (latest) version and zero or more noncurrent (previous) versions. Amazon S3 assigns
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
each object a unique version ID. For information about enabling versioning, see How Do I Enable or Suspend Versioning for an S3 Bucket?.
If a bucket is versioning-enabled, Amazon S3 creates another version of an object under the following conditions:
For more information about versioning support in Amazon S3, see Object Versioning and Using Versioning in the Amazon Simple Storage Service Developer Guide.
To see multiple versions of an object
3. To see a list of the versions of the objects in the bucket, choose Show. For each object version, the console shows a unique version ID, the date and time the object version was created, and other properties. (Objects stored in your bucket before you set the versioning state have a version ID of null.)
To list the objects without the versions, choose Hide.
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
You also can view, download, and delete object versions in the object overview panel. For more information, see How Do I See an Overview of an Object?.
Important
You can undelete an object only if it was deleted as the latest (current) version. You can't undelete a previous version of an object that was deleted. For more information, see Object Versioning and Using Versioning in the Amazon Simple Storage Service Developer Guide.
How Do I Enable or Suspend Versioning for an S3 Bucket?
Versioning enables you to keep multiple versions of an object in one bucket. This section describes how to enable object versioning on a bucket. For more information about versioning support in Amazon S3, see Object Versioning and Using Versioning in the Amazon Simple Storage Service Developer Guide.
To enable or disable versioning on an S3 bucket
1. Sign in to the AWS Management Console and open the Amazon S3 console athttps://console.aws.amazon.com/s3/.
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
2. In the Bucket name list, choose the name of the bucket that you want to enable versioning for.
3. Choose Properties.
4. Choose Versioning.
5. Choose Enable versioning or Suspend versioning, and then choose Save.
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
Granting Permissions to Multiple Accounts with Added Conditions
The following example policy grants the s3:PutObject and s3:PutObjectAcl permissions to multiple AWS accounts and requires that any request for these operations include the public-read canned ACL. For more information, see Specifying Permissions in a Policy and Specifying Conditions in a Policy.
{ "Version":"2012-10-17", "Statement":[ { "Sid":"AddCannedAcl", "Effect":"Allow", "Principal": {"AWS": ["arn:aws:iam::111122223333:root","arn:aws:iam::444455556666:root"]}, |
"Action":["s3:PutObject","s3:PutObjectAcl"], "Resource":["arn:aws:s3:::examplebucket/*"], |
"Condition":{"StringEquals":{"s3:x-amz-acl":["public-read"]}} } ] } |
Granting Read-Only Permission to an Anonymous User
The following example policy grants the s3:GetObject permission to any public anonymous users. (For a list of permissions and the operations that they allow, see Specifying Permissions in a Policy.) This permission allows anyone to read the
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
object data, which is useful for when you configure your bucket as a website and want everyone to be able to read objects in the bucket.
{ "Version":"2012-10-17", "Statement":[ { "Sid":"AddPerm", |
"Effect":"Allow", "Principal": "*", |
"Action":["s3:GetObject"], "Resource":["arn:aws:s3:::examplebucket/*"] } ] } |
Warning
Use caution when granting anonymous access to your S3 bucket. When you grant anonymous access, anyone in the world can access your bucket. We highly recommend that you never grant any kind of anonymous write access to your S3 bucket.
Restricting Access to Specific IP Addresses
The following example grants permissions to any user to perform any Amazon S3 operations on objects in the specified bucket. However, the request must originate from the range of IP addresses specified in the condition.
The condition in this statement identifies the 54.240.143.* range of allowed Internet Protocol version 4 (IPv4) IP addresses, with one exception: 54.240.143.188.
The Condition block uses the IpAddress and NotIpAddress conditions and
the aws:SourceIpcondition key, which is an AWS-wide condition key. For more information about these condition keys, see Specifying Conditions in a Policy.
The aws:SourceIp IPv4 values use the standard CIDR notation. For more information, see IP Address Condition Operators in the IAM User Guide.
{ "Version": "2012-10-17", "Id": "S3PolicyId1", "Statement": [ { "Sid": "IPAllow", |
"Effect": "Allow", |
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
"Principal": "*", "Action": "s3:*", |
"Resource": "arn:aws:s3:::examplebucket/*", "Condition": { "IpAddress": {"aws:SourceIp": "54.240.143.0/24"}, "NotIpAddress": {"aws:SourceIp": "54.240.143.188/32"} } } ] } |
Allowing IPv4 and IPv6 Addresses
When you start using IPv6 addresses, we recommend that you update all of your organization's policies with your IPv6 address ranges in addition to your existing IPv4 ranges to ensure that the policies continue to work as you make the transition to IPv6.
The following example bucket policy shows how to mix IPv4 and IPv6 address ranges to cover all of your organization's valid IP addresses. The example policy would allow access to the example IP addresses 54.240.143.1 and 2001:DB8:1234:5678::1 and would deny access to the addresses54.240.143.129 and 2001:DB8:1234:5678:ABCD::1.
The IPv6 values for aws:SourceIp must be in standard CIDR format. For IPv6 we support using :: to represent a range of 0s, for example, 2032001:DB8:1234:5678::/64. For more information, seeIP Address Condition Operators in the IAM User Guide.
{
"Id":"PolicyId2",
"Version":"2012-10-17",
"Statement":[
{
"Sid":"AllowIPmix",
"Effect":"Allow",
"Resource":"arn:aws:s3:::examplebucket/*",
"Condition": {
"IpAddress": {
"aws:SourceIp": [
"54.240.143.0/24",
"2001:DB8:1234:5678::/64"
]
},
"NotIpAddress": {
"aws:SourceIp": [
"54.240.143.128/30",
"2001:DB8:1234:5678:ABCD::/80"
]
"Principal":"*",
"Action":"s3:*",
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
}
}
}
]
}
Restricting Access to a Specific HTTP Referrer
Suppose you have a website with domain name (www.example.com or example.com) with links to photos and videos stored in your S3 bucket, examplebucket. By default, all the S3 resources are private, so only the AWS account that created the resources can access them. To allow read access to these objects from your website, you can add a bucket policy that allows s3:GetObjectpermission with a condition, using the aws:Referer key, that the get request must originate from specific webpages. The following policy specifies the StringLike condition with the aws:Referercondition key.
{
"Version":"2012-10-17",
"Id":"http referer policy example",
"Statement":[
{
"Sid":"Allow get requests originating from www.example.com and example.com.",
"Effect":"Allow",
"Principal":"*",
"Action":"s3:GetObject",
"Resource":"arn:aws:s3:::examplebucket/*",
"Condition":{
"StringLike":{"aws:Referer":["http://www.example.com/*","http://example.com/*"]}
}
}
]
}
Make sure the browsers you use include the http referer header in the request.
You can further secure access to objects in the examplebucket bucket by adding explicit deny to the bucket policy as shown in the following example. Explicit deny supersedes any permission you might grant to objects in the examplebucket bucket using other means such as ACLs or user policies.
Important
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
Be aware that this example will prevent all users (including the root user) from performing all Amazon S3 actions, including managing bucket policies. Consider adding a third Sid that grants the root user s3:* actions.
Granting Permission to an Amazon CloudFront Origin Identity
The following example bucket policy grants a CloudFront Origin Identity permission to get (list) all objects in your Amazon S3 bucket. The CloudFront Origin Identity is used to enable the CloudFront private content feature. The policy uses the CanonicalUser prefix, instead of AWS, to specify a Canonical User ID. To learn more about CloudFront support for serving private content, go to the Serving Private Content topic in
the Amazon CloudFront Developer Guide. You must specify the canonical user ID for
your CloudFront distribution's origin access identity. For instructions about finding the canonical user ID, see Specifying a Principal in a Policy.
| { | |||
"Version":"2012-10-17", | | |||
"Id":"PolicyForCloudFrontPrivateContent", | | |||
"Statement":[ | | |||
{ "Version": "2012-10-17", "Id": "http referer policy example", "Statement": [ { "Sid": "Allow get requests referred by www.example.com and example.com.", "Effect": "Allow", "Principal": "*", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::examplebucket/*", "Condition": { "StringLike": {"aws:Referer": ["http://www.example.com/*","http://example.com/*"]} } |
}, { |
"Sid": "Explicit deny to ensure requests are allowed only from specific referer.", |
"Effect": "Deny", "Principal": "*", "Action": "s3:*", |
"Resource": "arn:aws:s3:::examplebucket/*", "Condition": { "StringNotLike": {"aws:Referer": ["http://www.example.com/*","http://example.com/*"]} } } ] } |
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
{
"Sid":" Grant a CloudFront Origin Identity access to support private content", "Effect":"Allow",
"Principal":{"CanonicalUser":"CloudFront Origin Identity Canonical User ID"},
"Action":"s3:GetObject", "Resource":"arn:aws:s3:::examplebucket/*"
}
]
}
Adding a Bucket Policy to Require MFA
Amazon S3 supports MFA-protected API access, a feature that can enforce multi-factor authentication (MFA) for access to your Amazon S3 resources. Multi-factor authentication provides an extra level of security you can apply to your AWS environment. It is a security feature that requires users to prove physical possession of an MFA device by providing a valid MFA code. For more information, go to AWS Multi- Factor Authentication. You can require MFA authentication for any requests to access your Amazon S3 resources.
You can enforce the MFA authentication requirement using
the aws:MultiFactorAuthAge key in a bucket policy. IAM users can access Amazon S3 resources by using temporary credentials issued by the AWS Security Token Service (STS). You provide the MFA code at the time of the STS request.
When Amazon S3 receives a request with MFA authentication,
the aws:MultiFactorAuthAge key provides a numeric value indicating how long ago (in
seconds) the temporary credential was created. If the temporary credential provided in the request was not created using an MFA device, this key value is null (absent). In a bucket policy, you can add a condition to check this value, as shown in the following example bucket policy. The policy denies any Amazon S3 operation on the/taxdocuments folder in the examplebucket bucket if the request is not MFA authenticated. To learn more about MFA authentication, see Using Multi-Factor Authentication (MFA) in AWS in the IAM User Guide.
{
"Version": "2012-10-17",
"Id": "123",
"Statement": [
{
"Sid": "",
"Effect": "Deny",
"Principal": "*",
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
"Action": "s3:*",
"Resource": "arn:aws:s3:::examplebucket/taxdocuments/*", "Condition": { "Null": { "aws:MultiFactorAuthAge": true }}
}
]
}
The Null condition in the Condition block evaluates to true if
the aws:MultiFactorAuthAge key value is null, indicating that the temporary security credentials in the request were created without the MFA key.
The following bucket policy is an extension of the preceding bucket policy. It includes two policy statements. One statement allows the s3:GetObject permission on a bucket (examplebucket) to everyone and another statement further restricts access to
the examplebucket/taxdocumentsfolder in the bucket by requiring MFA authentication.
{ "Version": "2012-10-17", "Id": "123", "Statement": [ { "Sid": "", |
"Effect": "Deny", "Principal": "*", "Action": "s3:*", |
"Resource": "arn:aws:s3:::examplebucket/taxdocuments/*", "Condition": { "Null": { "aws:MultiFactorAuthAge": true } } }, { "Sid": "", "Effect": "Allow", "Principal": "*", "Action": ["s3:GetObject"], "Resource": "arn:aws:s3:::examplebucket/*" } ] } |
You can optionally use a numeric condition to limit the duration for which theaws:MultiFactorAuthAge key is valid, independent of the lifetime of the temporary security credential used in authenticating the request. For example, the following bucket policy, in addition to requiring MFA authentication, also checks how long ago the temporary session was created. The policy denies any operation if
the aws:MultiFactorAuthAge key value indicates that the temporary session was created more than an hour ago (3,600 seconds).
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
{ "Version": "2012-10-17", "Id": "123", "Statement": [ { "Sid": "", |
"Effect": "Deny", "Principal": "*", "Action": "s3:*", |
"Resource": "arn:aws:s3:::examplebucket/taxdocuments/*", "Condition": {"Null": {"aws:MultiFactorAuthAge": true }} |
}, { "Sid": "", |
"Effect": "Deny", "Principal": "*", "Action": "s3:*", |
"Resource": "arn:aws:s3:::examplebucket/taxdocuments/*", "Condition": {"NumericGreaterThan": {"aws:MultiFactorAuthAge": 3600 }} }, { "Sid": "", "Effect": "Allow", "Principal": "*", "Action": ["s3:GetObject"], "Resource": "arn:aws:s3:::examplebucket/*" } ] } |
Granting Cross-Account Permissions to Upload Objects While Ensuring the Bucket Owner Has Full Control
You can allow another AWS account to upload objects to your bucket. However, you may decide that as a bucket owner you must have full control of the objects uploaded to your bucket. The following policy enforces that a specific AWS account (111111111111) be denied the ability to upload objects unless that account grants full-control access to the bucket owner identified by the email address (xyz@amazon.com).
The StringNotEquals condition in the policy specifies the s3:x-amz-grant-full- control condition key to express the requirement (see Specifying Conditions in a Policy).
{ "Version":"2012-10-17", "Statement":[ { "Sid":"111", "Effect":"Allow", |
"Principal":{"AWS":"1111111111"}, |
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
"Action":"s3:PutObject", |
"Resource":"arn:aws:s3:::examplebucket/*" }, { "Sid":"112", "Effect":"Deny", "Principal":{"AWS":"1111111111" }, "Action":"s3:PutObject", "Resource":"arn:aws:s3:::examplebucket/*", "Condition": { "StringNotEquals": {"s3:x-amz-grant-full- control":["emailAddress=xyz@amazon.com"]} } } ] } |
Granting Permissions for Amazon S3 Inventory and Amazon S3 Analytics
Amazon S3 inventory creates lists of the objects in an S3 bucket and Amazon S3 analytics export creates output files of the data used in the analysis. The bucket that the inventory lists the objects for is called the source bucket. The bucket where the inventory file is written and the bucket where the analytics export file is written is called a destination bucket. You must create a bucket policy for the destination bucket when setting up inventory for an S3 bucket and when setting up the analytics export. For more information, see Amazon S3 Inventory and Amazon S3 Analytics – Storage Class Analysis.
The following example bucket policy grants Amazon S3 permission to write objects (PUTs) from the account for the source bucket to the destination bucket. You use a bucket policy like this on the destination bucket when setting up Amazon S3 inventory and Amazon S3 analytics export.
{ "Version":"2012-10-17", "Statement":[ { "Sid":"InventoryAndAnalyticsExamplePolicy", "Effect":"Allow", "Principal": {"Service": "s3.amazonaws.com"}, "Action":["s3:PutObject"], "Resource":["arn:aws:s3:::destination-bucket/*"], "Condition": { "ArnLike": { "aws:SourceArn": "arn:aws:s3:::source-bucket" }, |
"StringEquals": { |
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
"aws:SourceAccount": "1234567890", |
"s3:x-amz-acl": "bucket-owner-full-control" } } } ] } |
Allowing an IAM User Access to One of Your Buckets
In this example, you want to grant an IAM user in your AWS account access to one of your buckets, examplebucket, and allow the user to add, update, and delete objects.
In addition to granting the s3:PutObject, s3:GetObject, and s3:DeleteObject permissions to the user, the policy also grants the s3:ListAllMyBuckets, s3:GetBucketLocation, ands3:ListBucket permissions. These are the additional permissions required by the console. Also, the s3:PutObjectAcl and the s3:GetObjectAcl actions are required to be able to copy, cut, and paste objects in the console. For an example walkthrough that grants permissions to users and tests them using the console, see Walkthrough: Controlling Access to a Bucket with User Policies.
{
"Version":"2012-10-17",
"Statement":[
{
"Effect":"Allow",
"Action":[
"s3:ListAllMyBuckets"
],
"Resource":"arn:aws:s3:::*"
},
{
"Effect":"Allow", "Action":[
"s3:ListBucket",
"s3:GetBucketLocation"
],
"Resource":"arn:aws:s3:::examplebucket"
},
{
"Effect":"Allow", "Action":[
"s3:PutObject", "s3:PutObjectAcl",
"s3:GetObject", "s3:GetObjectAcl", "s3:DeleteObject"
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
In this example, you want two IAM users, Alice and Bob, to have access to your bucket, examplebucket, so that they can add, update, and delete objects. However, you want to restrict each user’s access to a single folder in the bucket. You might create folders with names that match the user names.
To grant each user access only to his or her folder, you can write a policy for each user and attach it individually. For example, you can attach the following policy to user Alice to allow her specific Amazon S3 permissions on the examplebucket/Alice folder.
{ "Version":"2012-10-17", "Statement":[ { "Effect":"Allow", "Action":[ |
"s3:PutObject", "s3:GetObject", |
"s3:GetObjectVersion", "s3:DeleteObject", "s3:DeleteObjectVersion" ], "Resource":"arn:aws:s3:::examplebucket/Alice/*" } ] } |
You then attach a similar policy to user Bob, identifying folder Bob in the Resource value.
Instead of attaching policies to individual users, you can write a single policy that uses a policy variable and attach the policy to a group. First you must create a group and add both Alice and Bob to the group. The following example policy allows a set of Amazon S3 permissions in the examplebucket/${aws:username} folder. When the policy is evaluated, the policy variable ${aws:username} is replaced by the requester's user name.
}
Allowing Each IAM User Access to a Folder in a Bucket
]
}
],
"Resource":"arn:aws:s3:::examplebucket/*"
examplebucket | | ||
Alice/ | | ||
Bob/ | | ||
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
For example, if Alice sends a request to put an object, the operation is allowed only if Alice is uploading the object to theexamplebucket/Alice folder.
{ "Version":"2012-10-17", "Statement":[ { "Effect":"Allow", "Action":[ |
"s3:PutObject", "s3:GetObject", |
"s3:GetObjectVersion", "s3:DeleteObject", "s3:DeleteObjectVersion" ], "Resource":"arn:aws:s3:::examplebucket/${aws:username}/*" } ] } |
Note
When using policy variables, you must explicitly specify version 2012-10-17 in the policy. The default version of the access policy language, 2008-10-17, does not support policy variables.
If you want to test the preceding policy on the Amazon S3 console, the console requires permission for additional Amazon S3 permissions, as shown in the following policy. For information about how the console uses these permissions, see Walkthrough: Controlling Access to a Bucket with User Policies.
{ "Version":"2012-10-17", "Statement": [ { "Sid": "AllowGroupToSeeBucketListInTheConsole", "Action": [ "s3:ListAllMyBuckets", "s3:GetBucketLocation" ], "Effect": "Allow", "Resource": [ "arn:aws:s3:::*" ] }, { "Sid": "AllowRootLevelListingOfTheBucket", "Action": ["s3:ListBucket"], "Effect": "Allow", "Resource": ["arn:aws:s3:::examplebucket"], "Condition":{ "StringEquals":{ "s3:prefix":[""], "s3:delimiter":["/"] } |
} |
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
}, |
{ "Sid": "AllowListBucketOfASpecificUserPrefix", "Action": ["s3:ListBucket"], "Effect": "Allow", "Resource": ["arn:aws:s3:::examplebucket"], "Condition":{ "StringLike":{"s3:prefix":["${aws:username}/*"] } } }, { "Sid": "AllowUserSpecificActionsOnlyInTheSpecificUserPrefix", "Effect":"Allow", "Action":[ |
"s3:PutObject", "s3:GetObject", |
"s3:GetObjectVersion", "s3:DeleteObject", "s3:DeleteObjectVersion" ], "Resource":"arn:aws:s3:::examplebucket/${aws:username}/*" } ] } |
Note
In the 2012-10-17 version of the policy, policy variables start with $. This change in syntax can potentially create a conflict if your object key includes a $. For example, to include an object key my$file in a policy, you specify the $ character
with ${$}, my${$}file.
Although IAM user names are friendly, human-readable identifiers, they are not required to be globally unique. For example, if user Bob leaves the organization and another Bob joins, then new Bob could access old Bob's information. Instead of using user names, you could create folders based on user IDs. Each user ID is unique. In this case, you must modify the preceding policy to use the ${aws:userid} policy variable. For more information about user identifiers, see IAM Identifiers in the IAM User Guide.
{ "Version":"2012-10-17", "Statement":[ { "Effect":"Allow", "Action":[ |
"s3:PutObject", "s3:GetObject", |
"s3:GetObjectVersion", "s3:DeleteObject", |
"s3:DeleteObjectVersion" |
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
],
"Resource":"arn:aws:s3:::my_corporate_bucket/home/${aws:userid}/*"
}
]
}
Allowing Non-IAM Users (Mobile App Users) Access to Folders in a Bucket
Suppose that you want to develop a mobile app, a game that stores users' data in an S3 bucket. For each app user, you want to create a folder in your bucket. You also want to limit each user’s access to his or her own folder. But you cannot create folders before someone downloads your app and starts playing the game, because you don’t have a user ID.
In this case, you can require users to sign in to your app by using public identity providers such as Login with Amazon, Facebook, or Google. After users have signed in to your app through one of these providers, they have a user ID that you can use to create user-specific folders at runtime.
You can then use web identity federation in AWS Security Token Service to integrate information from the identity provider with your app and to get temporary security credentials for each user. You can then create IAM policies that allow the app to access your bucket and perform such operations as creating user-specific folders and uploading data. For more information about web identity federation, see About Web Identity Federation in the IAM User Guide.
Allowing a Group to Have a Shared Folder in Amazon S3
Attaching the following policy to the group grants everybody in the group access to the following folder in Amazon S3: my_corporate_bucket/share/marketing. Group members are allowed to access only the specific Amazon S3 permissions shown in the policy and only for objects in the specified folder.
{
"Version":"2012-10-17",
"Statement":[
{
"Effect":"Allow", "Action":[
"s3:PutObject",
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
"s3:GetObject", |
"s3:GetObjectVersion", "s3:DeleteObject", "s3:DeleteObjectVersion" ], "Resource":"arn:aws:s3:::my_corporate_bucket/share/marketing/*" } ] } |
Allowing All Your Users to Read Objects in a Portion of the Corporate Bucket
In this example, you create a group named AllUsers, which contains all the IAM users that are owned by the AWS account. You then attach a policy that gives the group access to GetObjectand GetObjectVersion, but only for objects in
the my_corporate_bucket/readonly folder.
{
"Version":"2012-10-17",
"Statement":[
{
"Effect":"Allow",
"Action":[
"s3:GetObject",
"s3:GetObjectVersion"
],
"Resource":"arn:aws:s3:::my_corporate_bucket/readonly/*"
}
]
}
Allowing a Partner to Drop Files into a Specific Portion of the Corporate Bucket
In this example, you create a group called WidgetCo that represents a partner company. You create an IAM user for the specific person or application at the partner company that needs access, and then you put the user in the group.
You then attach a policy that gives the group PutObject access to the following folder in the corporate bucket: my_corporate_bucket/uploads/widgetco.
You want to prevent the WidgetCo group from doing anything else with the bucket, so you add a statement that explicitly denies permission to any Amazon S3 permissions except PutObject on any Amazon S3 resource in the AWS account. This step is
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
necessary only if there's a broad policy in use elsewhere in your AWS account that gives users wide access to Amazon S3 resources.
{ "Version":"2012-10-17", "Statement":[ { "Effect":"Allow", "Action":"s3:PutObject", "Resource":"arn:aws:s3:::my_corporate_bucket/uploads/widgetco/*" }, { "Effect":"Deny", "NotAction":"s3:PutObject", "Resource":"arn:aws:s3:::my_corporate_bucket/uploads/widgetco/*" }, { |
"Effect":"Deny", "Action":"s3:*", |
"NotResource":"arn:aws:s3:::my_corporate_bucket/uploads/widgetco/*" } ] } |
Troubleshooting Amazon S3
Troubleshooting CORS Issues
If you encounter unexpected behavior while accessing buckets set with the CORS configuration, try the following steps to troubleshoot:
1. Verify that the CORS configuration is set on the bucket.
For instructions, see Editing Bucket Permissions in the Amazon Simple Storage Service Console User Guide. If the CORS configuration is set, the console displays an Edit CORS Configuration link in the Permissions section of
the Properties bucket.
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
If the header is missing, Amazon S3 doesn't treat the request as a cross- origin request, and doesn't send CORS response headers in the response.
The scheme, the host, and the port values in the Origin request header must match the AllowedOrigin elements in the CORSRule. For example, if you set the CORSRule to allow the origin http://www.example.com, then
both https://www.example.com and http://www.example.com:80 origins in your request don't match the allowed origin in your configuration.
EFS faqs:-
1. EFS naming conversation?
Route 53 faqs:-
2. What is AWS Route 53?
DNS name of your file system. You can construct this DNS name using the following generic form:
file-system-id.efs.aws-region.amazonaws.com
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
AWS Route 53 is a domain name system. Domain name system translates human-readable domain
name such as www.amazon.com to machine-readable IP address such as 192.0.2.44. Amazon Route 53 connects the request of users to the system running in AWS. This system includes Amazon
EC2instances, Elastic Load Balancing load balancers, or Amazon S3 buckets. Moreover, it can connect the user infrastructure outside of AWS. Amazon Route 53 is totally compatible with IPv6. It is designed to boost business in a reliable and cost-effective way. AWS Route 53 answers all the queries with the help of the global network of DNS servers.
Queries of the domain are sent to the nearest DNS Server and thus it answers with the best possible performance. With the help of AWS management console or easy-to-use API, one can create and
manage the public DNS. AWS Route 53 also helps us to register an available domain name. It helps in a way such that the person has to pay only for the management of domains, and the registered domains in AWS.
3. What types Hosted zones we have in Route 53?
There are 2 types of Hosted zones in Route 53.
4. Features of Amazon Route 53
AWS Route 53 offers a domain name registration service at a low cost. Here you can search and register
for the domains among the available ones. You can also transfer the existing domain to manage by Route 53.
Amazon Route 53 automatically sends the website visitors to other location to avoid site outages. It can
do by supporting a simple backup site hosted on Amazon S3. Read about What is AWS Direct Connect?
LBR works by routing your customers to the AWS endpoint that provides the fastest experience based on actual performance measurements of the different AWS regions where your application is running.
One can use the visual editor to quickly find resources that are needed to update and apply the updates
to one or more DNS names. The new configuration can change back if a user is not satisfied with the performance. It routes end users to the best endpoint for the application based on geo-proximity, latency, health, and other considerations.
AWS Management console provides web-based UI or a mobile app to monitor and view the resources on the go. In AWS route 53 he Web Base UI allows the user to manage Amazon Route 53 without writing
any code.
It helps the user to balance the load by sending requests to specific endpoints based on the geographic location from which the request originates.
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
5. Compatibility with other AWS Apps
6. Security in Amazon Route 53
7. What are routing policies we have in Route 53?
RDS faqs:-
8. What is Multi-AZ and what features we can get with this?
9. What is the default size of General purpose SSD for RDS instance?
10. What is RDS endpoint?
AWS Route 53 is compatible with almost all the apps of Amazon Web Services such as Amazon EC2
instances, Amazon S3 buckets, Amazon Cloud front distributions, and other AWS resources. One can also monitor the control on who can update the DNS data.
Amazon Route 53 along with AWs Identity and Access Management (IAM), one can permit unique
credentials and permit users within the AWS account and can limit the access by allowing the user you are in need of.
When you create a record, you choose a routing policy, which determines how Amazon Route 53
responds to queries:
with up to eight healthy records selected at random.
Multi-AZ deployment is a AWS managed offering where you get hot-standby replica of your RDS in a different Availability Zone which will substitute automatically your master/primary database in case of
its maintenance, failure or AZ failure.
20 GB
RDS endpoint is nothing but a DB instance name which can be used to access the DB from EC2 instance
on port 3306 (mysql)
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
11. What is command to access the DB from EC2 instance?
mysql –h <RDS endpoint name> -u <mysql DB user> -p
12. How to troubleshoot if we see the ELB/ALB instance state turn into OutofService state?
13. What is Cloudwatch?
14. Difference between scaling horizontally and vertically
15. What are the cloudwatch metrics that are available for EC2 instances?
16. What is the minimum and maximum size of individual objects that you can store in S3
17. What are the different storage classes in S3?
Answer: Following are the types of storage classes in S3,
We have to check below listed 3 items.
Answer: Cloudwatch is a monitoring tool that you can use to monitor your various AWS resources. Like
health check, network, Application, etc.
Horizontal scaling means that you scale by adding more machines into your pool of resources whereas
Vertical scaling means that you scale by adding more power (CPU, RAM) to an existing machine.
Diskreads, Diskwrites, CPU utilization, networkpacketsIn, networkpacketsOut, networkIn, networkOut,
CPUCreditUsage, CPUCreditBalance.
The minimum size of individual objects that you can store in S3 is 0 bytes and the maximum bytes that you can store for individual objects are 5TB.
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
VPC:
Amazon VPC lets you provision a logically isolated section of the Amazon Web Services (AWS) cloud where you can launch AWS resources in a virtual network that you define. You have complete control over your virtual networking environment, including selection of your own IP address range, creation of subnets, and configuration of route tables and network gateways.
You can also create a hardware Virtual Private Network (VPN) connection between your corporate datacenter and your VPC and leverage the AWS cloud as an extension of your corporate datacenter
You may connect your VPC to:
Amazon VPC supports the creation of an Internet gateway. This gateway enables Amazon EC2 instances in the VPC to directly access the Internet.
Amazon VPC comprises a variety of objects that will be familiar to customers with existing networks:
⦁ A Virtual Private Cloud (VPC): A logically isolated virtual network in the AWS cloud. You define a VPC’s IP address space from a range you select.
⦁ Subnet: A segment of a VPC’s IP address range where you can place groups of isolated resources.
⦁ Internet Gateway: The Amazon VPC side of a connection to the public Internet.
⦁ NAT Gateway: A highly available, managed Network Address Translation (NAT) service for your resources in a private subnet to access the Internet.
⦁ Hardware VPN Connection: A hardware-based VPN connection between your Amazon VPC and your datacenter, home network, or co-location facility.
⦁ Virtual Private Gateway: The Amazon VPC side of a VPN connection.
⦁ Customer Gateway: Your side of a VPN connection.
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
⦁ Router: Routers interconnect subnets and direct traffic between Internet gateways, virtual private gateways, NAT gateways, and subnets.
⦁ Peering Connection: A peering connection enables you to route traffic via private IP addresses between two peered VPCs.
⦁ VPC Endpoint for S3: Enables Amazon S3 access from within your VPC without using an Internet gateway or NAT, and allows you to control the access using VPC
endpoint polic
⦁ Egress-only Internet Gateway: A stateful gateway to provide egress only access for IPv6 traffic from the VPC to the Internet.
22. What are the steps to build a custom VPC?
Below are the steps of build a custome VPC:
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
12. Create an Elastic IP
Advantages of using AWS VPC are the following:
Intuitive and Easy-to-Use Friendly to the Pockets
High Functionality and Scalability
Dynamic and Flexible Operations Trustworthy
Safety
Yes. You can use the Amazon VPC Flow Logs feature to monitor the network traffic in your VPC.
25. Can a VPC span multiple Availability Zones?
Yes
26. Are there any bandwidth limitations for Internet gateways?
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
No. An Internet gateway is horizontally-scaled, redundant, and highly available. It imposes no bandwidth constraints.
Security groups in a VPC specify which traffic is allowed to or from an Amazon EC2 instance. Network ACLs operate at the subnet level and evaluate traffic entering and exiting a subnet. Network ACLs can be used to set both Allow and Deny rules. Network ACLs do not filter traffic between instances in the same subnet. In addition, network ACLs perform stateless filtering while security groups perform stateful filtering.
Yes
The default VPC CIDR is 172.31.0.0/16. Default subnets use /20 CIDRs within the default VPC CIDR.
You can have one default VPC in each AWS region where your Supported Platforms attribute is set to “EC2-VPC”.
One default subnet is created for each Availability Zone in your default VPC.
Yes. To launch an instance into non-default VPCs you must specify a subnet-ID during instance launch.
33. What is AWS?
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
Answer:AWS stands for Amazon Web Services. AWS is a platform that provides on-demand
resources for hosting web services, storage, networking, databases and other resources over the internet with a pay-as-you-go pricing.
Answer:EC2 – Elastic Compute Cloud, S3 – Simple Storage Service, Route53, EBS – Elastic Block Store, Cloudwatch, Key-Paris are few of the components of AWS.
Answer:Key-pairs are secure login information for your instances/virtual machines. To connect to the instances we use key-pairs that contain a public-key and private-key.
Answer:S3 stands for Simple Storage Service. It is a storage service that provides an interface that you can use to store any amount of data, at any time, from anywhere in the world. With S3 you pay only for what you use and the payment model is pay-as-you-go.
Answer:The different pricing model for EC2 instances are as below,
Q6) What are the types of volumes for EC2 instances?
Answer:
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
Q7) What are EBS volumes?
Answer:EBS stands for Elastic Block Stores. They are persistent volumes that you can attach to the instances. With EBS volumes, your data will be preserved even when you stop your instances, unlike your instance store volumes where the data is deleted when you stop the instances.
Q8) What are the types of volumes in EBS?
Answer:Following are the types of volumes in EBS,
Q9) What are the different types of instances?
Answer: Following are the types of instances,
Q10) What is an auto-scaling and what are the components?
Answer: Auto scaling allows you to automatically scale-up and scale-down the number of instances depending on the CPU utilization or memory utilization. There are 2 components in Auto scaling, they are Auto-scaling groups and Launch Configuration.
Q11) What are reserved instances?
Answer: Reserved instances are the instance that you can reserve a fixed capacity of EC2 instances. In reserved instances you will have to get into a contract of 1 year or 3 years.
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
Q12)What is an AMI?
Answer: AMI stands for Amazon Machine Image. AMI is a template that contains the software configurations, launch permission and a block device mapping that specifies the volume to attach to the instance when it is launched.
Q13) What is an EIP?
Answer: EIP stands for Elastic IP address. It is designed for dynamic cloud computing. When you want to have a static IP address for your instances when you stop and restart your instances, you will be using EIP address.
Q14) What is Cloudwatch?
Answer: Cloudwatch is a monitoring tool that you can use to monitor your various AWS resources. Like health check, network, Application, etc.
Q15) What are the types in cloudwatch?
Answer: There are 2 types in cloudwatch. Basic monitoring and detailed monitoring. Basic monitoring is free and detailed monitoring is chargeable.
Q16) What are the cloudwatch metrics that are available for EC2 instances?
Answer: Diskreads, Diskwrites, CPU utilization, networkpacketsIn, networkpacketsOut, networkIn, networkOut, CPUCreditUsage, CPUCreditBalance.
Q17) What is the minimum and maximum size of individual objects that you can store in S3
Answer: The minimum size of individual objects that you can store in S3 is 0 bytes and the maximum bytes that you can store for individual objects is 5TB.
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
Q18) What are the different storage classes in S3?
Answer: Following are the types of storage classes in S3,
Q19) What is the default storage class in S3?
Answer: The default storage class in S3 in Standard frequently accessed.
Q20) What is glacier?
Answer: Glacier is the back up or archival tool that you use to back up your data in S3.
Q21) How can you secure the access to your S3 bucket?
Answer: There are two ways that you can control the access to your S3 buckets,
Q22) How can you encrypt data in S3?
Answer: You can encrypt the data by using the below methods,
Q23) What are the parameters for S3 pricing?
Answer: The pricing model for S3 is as below,
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
What is the pre-requisite to work with Cross region replication in S3?
Answer: You need to enable versioning on both source bucket and destination to work with cross region replication. Also both the source and destination bucket should be in different region.
What are roles?
Answer: Roles are used to provide permissions to entities that you trust within your AWS account. Roles are users in another account. Roles are similar to users but with roles you do not need to create any username and password to work with the resources.
What are policies and what are the types of policies?
Answer: Policies are permissions that you can attach to the users that you create. These policies will contain that access that you have provided to the users that you have created. There are 2 types of policies.
Q27) What is cloudfront?
Answer: Cloudfront is an AWS web service that provided businesses and application developers an easy and efficient way to distribute their content with low latency and high data transfer speeds.
Cloudfront is content delivery network of AWS.
Q28) What are edge locations?
Answer: Edge location is the place where the contents will be cached. When a user tries to access some content, the content will be searched in the edge location. If it is not available then the content will be made available from the origin location and a copy will be stored in the edge location.
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
Q29) What is the maximum individual archive that you can store in glacier?
Answer: You can store a maximum individual archive of upto 40 TB.
Q30) What is VPC?
Answer: VPC stands for Virtual Private Cloud. VPC allows you to easily customize your networking configuration. VPC is a network that is logically isolated from other network in the cloud. It allows you to have your own IP address range, subnets, internet gateways, NAT gateways and security groups.
Q31) What is VPC peering connection?
Answer: VPC peering connection allows you to connect 1 VPC with another VPC. Instances in these VPC behave as if they are in the same network.
Q32) What are NAT gateways?
Answer: NAT stands for Network Address Translation. NAT gateways enables instances in a private subnet to connect to the internet but prevent the internet from initiating a connection with those instances.
Q33) How can you control the security to your VPC?
Answer: You can use security groups and NACL (Network Access Control List) to control the security to your
VPC.
Q34) What are the different types of storage gateway?
Answer: Following are the types of storage gateway.
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
Q35) What is a snowball?
Answer: Snowball is a data transport solution that used source appliances to transfer large amounts of data into and out of AWS. Using snowball, you can move huge amount of data from one place to another which reduces your network costs, long transfer times and also provides better security.
Q36) What are the database types in RDS?
Answer: Following are the types of databases in RDS,
Q37) What is a redshift?
Answer: Amazon redshift is a data warehouse product. It is a fast and powerful, fully managed, petabyte scale data warehouse service in the cloud.
Q38) What is SNS?
Answer: SNS stands for Simple Notification Service. SNS is a web service that makes it easy to
notifications from the cloud. You can set up SNS to receive email notification or message notification.
Q39) What are the types of routing polices in route53?
Answer: Following are the types of routing policies in route53,
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
Q40) What is the maximum size of messages in SQS?
Answer: The maximum size of messages in SQS is 256 KB.
Q41) What are the types of queues in SQS?
Answer: There are 2 types of queues in SQS.
Q42) What is multi-AZ RDS?
Answer: Multi-AZ (Availability Zone) RDS allows you to have a replica of your production database in another availability zone. Multi-AZ (Availability Zone) database is used for disaster recovery. You will have an exact copy of your database. So when your primary database goes down, your application will automatically failover to the standby database.
Q43) What are the types of backups in RDS database?
Answer: There are 2 types of backups in RDS database.
Q44) What is the difference between security groups and network access control list?
Answer:
Security Groups | Network access control list |
Can control the access at the instance level | Can control access at the subnet level |
Can add rules for “allow” only | Can add rules for both “allow” and “deny” |
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
Evaluates all rules before allowing the traffic | Rules are processed in order number when allowing traffic. |
Can assign unlimited number of security groups | Can assign upto 5 security groups. |
Statefull filtering | Stateless filtering |
Q45) What are the types of load balancers in EC2?
Answer: There are 3 types of load balancers,
Q46) What is and ELB?
Answer: ELB stands for Elastic Load balancing. ELB automatically distributes the incoming application traffic or network traffic across multiple targets like EC2, containers, IP addresses.
Q47) What are the two types of access that you can provide when you are creating users?
Answer: Following are the two types of access that you can create.
Q48) What are the benefits of auto scaling?
Answer: Following are the benefits of auto scaling
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
Q49) What are security groups?
Answer: Security groups acts as a firewall that contains the traffic for one or more instances. You can associate one or more security groups to your instances when you launch then. You can add rules to each security group that allow traffic to and from its associated instances. You can modify the rules of a security group at any time, the new rules are automatically and immediately applied to all the instances that are associated with the security group
Q50) What are shared AMI’s?
Answer: Shared AMI’s are the AMI that are created by other developed and made available for other developed to use.
Q51)What is the difference between the classic load balancer and application load balancer?
Answer: Dynamic port mapping, multiple port multiple listeners is used in Application Load Balancer, One port one listener is achieved via Classic Load Balancer
Q52) By default how many Ip address does aws reserve in a subnet?
Answer: 5
Q53) What is meant by subnet?
Answer: A large section of IP Address divided in to chunks are known as subnets
Q54) How can you convert a public subnet to private subnet?
Answer: Remove IGW & add NAT Gateway, Associate subnet in Private route table
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
Q55) Is it possible to reduce a ebs volume?
Answer: no it’s not possible, we can increase it but not reduce them
Q56) What is the use of elastic ip are they charged by AWS?
Answer: These are ipv4 address which are used to connect the instance from internet, they are charged if the instances are not attached to it
Q57) One of my s3 is bucket is deleted but i need to restore is there any possible way?
Answer: If versioning is enabled we can easily restore them
Q58) When I try to launch an ec2 instance i am getting Service limit exceed, how to fix the issue?
Answer: By default AWS offer service limit of 20 running instances per region, to fix the issue we need to contact AWS support to increase the limit based on the requirement
Q59) I need to modify the ebs volumes in Linux and windows is it possible
Answer: yes its possible from console use modify volumes in section give the size u need then for windows go to disk management for Linux mount it to achieve the modification
Q60) Is it possible to stop a RDS instance, how can I do that?
Answer: Yes it’s possible to stop rds. Instance which are non-production and non multi AZ’s
Q61) What is meant by parameter groups in rds. And what is the use of it?
Answer: Since RDS is a managed service AWS offers a wide set of parameter in RDS as parameter group which is modified as per requirement
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
Q62) What is the use of tags and how they are useful?
Answer: Tags are used for identification and grouping AWS Resources
Q63) I am viewing an AWS Console but unable to launch the instance, I receive an IAM Error how can I rectify it?
Answer: As AWS user I don’t have access to use it, I need to have permissions to use it further
Q64) I don’t want my AWS Account id to be exposed to users how can I avoid it?
Answer: In IAM console there is option as sign in url where I can rename my own account name with AWS account
Q65) By default how many Elastic Ip address does AWS Offer?
Answer: 5 elastic ip per region
Q66) You are enabled sticky session with ELB. What does it do with your instance?
Answer: Binds the user session with a specific instance
Q67) Which type of load balancer makes routing decisions at either the transport layer or the
Application layer and supports either EC2 or VPC.
Answer: Classic Load Balancer
Q68) Which is virtual network interface that you can attach to an instance in a VPC?
Answer: Elastic Network Interface
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
Q69) You have launched a Linux instance in AWS EC2. While configuring security group, you
Have selected SSH, HTTP, HTTPS protocol. Why do we need to select SSH?
Answer: To verify that there is a rule that allows traffic from EC2 Instance to your computer
Q70) You have chosen a windows instance with Classic and you want to make some change to the
Security group. How will these changes be effective?
Answer: Changes are automatically applied to windows instances
Q71) Load Balancer and DNS service comes under which type of cloud service?
Answer: IAAS-Storage
Q72) You have an EC2 instance that has an unencrypted volume. You want to create another
Encrypted volume from this unencrypted volume. Which of the following steps can achieve this?
Answer: Create a snapshot of the unencrypted volume (applying encryption parameters), copy the. Snapshot and create a volume from the copied snapshot
Q73) Where does the user specify the maximum number of instances with the auto scaling Commands?
Answer: Auto scaling Launch Config
Q74) Which are the types of AMI provided by AWS?
Answer: Instance Store backed, EBS Backed
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
Q75) After configuring ELB, you need to ensure that the user requests are always attached to a Single instance. What setting can you use?
Answer: Sticky session
Q76) When do I prefer to Provisioned IOPS over the Standard RDS storage?
Answer:If you have do batch-oriented is workloads.
Q77) If I am running on my DB Instance a Multi-AZ deployments, can I use to the stand by the DB Instance for read or write a operation along with to primary DB instance?
Answer: Primary db instance does not working.
Q78) Which the AWS services will you use to the collect and the process e-commerce data for the near by real-time analysis?
Answer: Good of Amazon DynamoDB.
Q79) A company is deploying the new two-tier an web application in AWS. The company has to limited on staff and the requires high availability, and the application requires to complex queries and table joins. Which configuration provides to the solution for company’s requirements?
Answer: An web application provide on Amazon DynamoDB solution.
Q80) Which the statement use to cases are suitable for Amazon DynamoDB?
Answer:The storing metadata for the Amazon S3 objects& The Running of relational joins and complex an updates.
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
Q81) Your application has to the retrieve on data from your user’s mobile take every 5 minutes and then data is stored in the DynamoDB, later every day at the particular time the data is an extracted into S3 on a per user basis and then your application is later on used to visualize the data to user. You are the asked to the optimize the architecture of the backend system can to lower cost, what would you recommend do?
Answer: Introduce Amazon Elasticache to the cache reads from the Amazon DynamoDB table and to reduce the provisioned read throughput.
Q82) You are running to website on EC2 instances can deployed across multiple Availability Zones with an Multi-AZ RDS MySQL Extra Large DB Instance etc. Then site performs a high number of the small reads and the write per second and the relies on the eventual consistency model. After the comprehensive tests you discover to that there is read contention on RDS MySQL. Which is the best approaches to the meet these requirements?
Answer:The Deploy Elasti Cache in-memory cache is running in each availability zone and Then Increase the RDS MySQL Instance size and the Implement provisioned IOPS.
Q83) An startup is running to a pilot deployment of around 100 sensors to the measure street noise and The air quality is urban areas for the 3 months. It was noted that every month to around the 4GB of sensor data are generated. The company uses to a load balanced take auto scaled layer of the EC2 instances and a RDS database with a 500 GB standard storage. The pilot was success and now they want to the deploy take atleast 100K sensors.let which to need the supported by backend. You need to the stored data for at least 2 years to an analyze it. Which setup of following would you be prefer?
Answer: The Replace the RDS instance with an 6 node Redshift cluster with take 96TB of storage.
Q84) Let to Suppose you have an application where do you have to render images and also do some of general computing. which service will be best fit your need?
Answer:Used on Application Load Balancer.
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
Q85) How will change the instance give type for the instances, which are the running in your applications tier and Then using Auto Scaling. Where will you change it from areas?
Answer: Changed to Auto Scaling launch configuration areas.
Q86) You have an content management system running on the Amazon EC2 instance that is the approaching 100% CPU of utilization. Which option will be reduce load on the Amazon EC2 instance?
Answer: Let Create a load balancer, and Give register the Amazon EC2 instance with it.
Q87) What does the Connection of draining do?
Answer: The re-routes traffic from the instances which are to be updated (or) failed an health to check.
Q88) When the instance is an unhealthy, it is do terminated and replaced with an new ones, which of the services does that?
Answer: The survice make a fault tolerance.
Q89) What are the life cycle to hooks used for the AutoScaling?
Answer: They are used to the put an additional taken wait time to the scale in or scale out events.
Q90) An user has to setup an Auto Scaling group. Due to some issue the group has to failed for launch a single instance for the more than 24 hours. What will be happen to the Auto Scaling in the condition?
Answer: The auto Scaling will be suspend to the scaling process.
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
Q91) You have an the EC2 Security Group with a several running to EC2 instances. You changed to the Security of Group rules to allow the inbound traffic on a new port and protocol, and then the launched a several new instances in the same of Security Group.Such the new rules apply?
Answer:The Immediately to all the instances in security groups.
Q92) To create an mirror make a image of your environment in another region for the disaster recoverys, which of the following AWS is resources do not need to be recreated in second region?
Answer: May be the selected on Route 53 Record Sets.
Q93) An customers wants to the captures all client connections to get information from his load balancers at an interval of 5 minutes only, which cal select option should he choose for his application?
Answer: The condition should be Enable to AWS CloudTrail for the loadbalancers.
Q94) Which of the services to you would not use to deploy an app?
Answer: Lambda app not used on deploy.
Q95) How do the Elastic Beanstalk can apply to updates?
Answer: By a duplicate ready with a updates prepare before swapping.
Q96) An created a key in the oregon region to encrypt of my data in North Virginia region for security purposes. I added to two users to the key and the external AWS accounts. I wanted to encrypt an the object in S3, so when I was tried, then key that I just created is not listed.What could be reason&solution?
Answer:The Key should be working in the same region.
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
Q97) As a company needs to monitor a read and write IOPS for the AWS MySQL RDS instances and then send real-time alerts to the operations of team. Which AWS services to can accomplish this?
Answer:The monitoring on Amazon CloudWatch
Q98) The organization that is currently using the consolidated billing has to recently acquired to another company that already has a number of the AWS accounts. How could an Administrator to ensure that all the AWS accounts, from the both existing company and then acquired company, is billed to the single account?
Answer: All Invites take acquired the company’s AWS account to join existing the company’s of organization by using AWS Organizations.
Q99) The user has created an the applications, which will be hosted on the EC2. The application makes calls to the Dynamo DB to fetch on certain data. The application using the DynamoDB SDK to connect with the EC2 instance. Which of respect to best practice for the security in this scenario?
Answer: The user should be attach an IAM roles with the DynamoDB access to EC2 instance.
Q100) You have an application are running on EC2 Instance, which will allow users to download the files from a private S3 bucket using the pre-assigned URL. Before generating to URL the Q101) application should be verify the existence of file in S3. How do the application use the AWS credentials to access S3 bucket securely?
Answer:An Create an IAM role for the EC2 that allows list access to objects in S3 buckets. Launch to instance with this role, and retrieve an role’s credentials from EC2 Instance make metadata.
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
Q101) You use the Amazon CloudWatch as your primary monitoring system
for web application. After a recent to software deployment, your users are to getting Intermittent the 500 Internal Server to the Errors, when you using web application.
You want to create the CloudWatch alarm, and notify the on-call engineer let when these occur. How can you accomplish the using the AWS services?
Answer: An Create a CloudWatch get Logs to group and A define metric filters that assure capture 500 Internal Servers should be Errors. Set a CloudWatch alarm on the metric and By Use of Amazon Simple to create a Notification Service to notify an the on-call engineers
when prepare CloudWatch alarm is triggered.
Q102) You are designing a multi-platform of web application for the AWS. The application will run on the EC2 instances and Till will be accessed from PCs, tablets and smart phones.Then Supported accessing a platforms are Windows, MACOS, IOS and Android. They Separate sticky sessions and SSL certificate took setups are required for the different platform types. Which do describes the most cost
effective and Like performance efficient the architecture setup?
Answer:Assign to multiple ELBs an EC2 instance or group of EC2 take instances running to common component of the web application, one ELB change for each platform type.Take Session will be stickiness and SSL termination are done for the ELBs.
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
Q103) You are migrating to legacy client-server application for AWS. The application responds to a specific DNS visible domain (e.g. www.example.com) and server 2-tier architecture, with multiple application for the servers and the database server.
Remote clients use to TCP to connect to the application of servers. The application servers need to know the IP address of clients in order to the function of properly and are currently taking of that information from TCP socket. A Multi-AZ RDS MySQL instance to will be used for database. During the migration you change the application code but you have file a change request. How do would you implement the architecture on the AWS in order to maximize scalability and high availability?
Answer: File a change request to get implement of Proxy Protocol support in the application. Use of ELB with TCP Listener and A Proxy Protocol enabled to distribute the load on two application servers in the different AZs.
Q104) Your application currently is leverages AWS Auto Scaling to the grow and shrink as a load Increases/decreases and has been performing as well. Your marketing a team expects and steady ramp up in traffic to follow an upcoming campaign that will result in 20x growth in the traffic over 4 weeks. Your forecast for approximate number of the Amazon EC2 instances necessary to meet
peak demand is 175. What should be you do avoid potential service disruptions during the ramp up traffic?
Answer: Check the service limits in the Trusted Advisors and adjust as necessary, so that forecasted count remains within the limits.
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
Q105) You have a web application running on the six Amazon EC2 instances, consuming about 45% of resources on the each instance. You are using the auto- scaling to make sure that a six instances are running at all times. The number of requests this application processes to consistent and does not experience to spikes. Then application are critical to your business and you want to high availability for at all times. You want to the load be distributed evenly has between all instances. You also want to between use same Amazon Machine Image (AMI) for all instances.
Which are architectural choices should you make?
Answer: Deploy to 3 EC2 instances in one of availability zone and 3 in another availability of zones and to use of Amazon Elastic is Load Balancer.
Q106) You are the designing an application that a contains protected health information. Security and Then compliance requirements for your application mandate that all protected to health information in application use to encryption at rest and in the transit module. The application to uses an three-tier architecture. where should data flows through the load balancers and is stored on the Amazon EBS volumes for the processing, and the results are stored in the Amazon S3 using a
AWS SDK. Which of the options satisfy the security requirements?
Answer: Use TCP load balancing on load balancer system, SSL termination on Amazon to create EC2 instances, OS-level disk take encryption on Amazon EBS volumes, and The amazon S3 with server-side to encryption and Use the SSL termination on load balancers, an SSL listener on the Amazon to create EC2 instances, Amazon EBS encryption on the EBS volumes containing the PHI, and Amazon S3 with a server-side of encryption.
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
Q107) An startup deploys its create photo-sharing site in a VPC. An elastic load balancer distributes to web traffic across two the subnets. Then the load balancer session to stickiness is configured to use of AWS-generated session cookie, with a session TTL of the 5 minutes. The web server to change Auto Scaling group is configured as like min-size=4, max-size=4. The startup is the preparing for a public launchs, by running the load-testing software installed on the single Amazon
Elastic Compute Cloud (EC2) instance to running in us-west-2a. After 60 minutes of
load-testing, the web server logs of show the following:WEBSERVER LOGS | # of HTTP requests to from load-tester system | # of HTTP requests to from private on beta users || webserver #1 (subnet an us-west-2a): | 19,210 | 434 | webserver #2 (subnet an us-west-2a): | 21,790 | 490 || webserver #3 (subnet an us-west-2b): | 0 | 410 || webserver #4 (subnet an us-west-2b): | 0 | 428 |Which as recommendations can be help of ensure that load-testing HTTP requests are will evenly distributed across to four web servers?
Answer:Result of cloud is re-configure the load-testing software to the re-resolve DNS for each web request.
Q108) To serve the Web traffic for a popular product to your chief financial officer and IT director have purchased 10 m1.large heavy utilization of Reserved Instances (RIs) evenly put spread across two availability zones: Route 53 are used to deliver the traffic to on Elastic Load Balancer (ELB). After the several months, the product grows to even more popular and you need to additional capacity As a result, your company that purchases two c3.2xlarge medium utilization RIs You take register the two c3.2xlarge instances on with your ELB and quickly find that the ml of large instances at 100% of capacity and the c3.2xlarge instances have significant to capacity that’s can unused Which option is the most of cost effective and uses EC2 capacity most of effectively?
Answer: To use a separate ELB for the each instance type and the distribute load to ELBs with a Route 53 weighted round of robin.
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
Q109) An AWS customer are deploying an web application that is the composed of a front-end running on the Amazon EC2 and confidential data that are stored on the Amazon S3. The customer security policy is that all accessing operations to this sensitive data must authenticated and authorized by centralized access
to management system that is operated by separate security team. In addition, the web application team that be owns and administers the EC2 web front-end instances are prohibited from having the any ability to access data that circumvents this centralized access to management system. Which are configurations will support these requirements?
Answer:The configure to the web application get authenticate end-users against the centralized access on the management system. Have a web application provision trusted to users STS tokens an entitling the download of the approved data directly from a Amazon S3.
Q110) A Enterprise customer is starting on their migration to the cloud, their main reason for the migrating is agility and they want to the make their internal Microsoft active directory available to the many applications running on AWS, this is so internal users for only have to remember one set of the credentials and as a central point of user take control for the leavers and joiners. How could they make their actions the directory secures and the highly available with minimal on-premises on infrastructure changes in the most cost and the time-efficient way?
Answer: By Using a VPC, they could be create an the extension to their data center and to make use of resilient hardware IPSEC on tunnels, they could then have two domain consider to
controller instances that are joined to the existing domain and reside within the different subnets in the different availability zones.
Q111)What is Cloud Computing?
Answer:Cloud computing means it provides services to access programs, application, storage, network, server over the internet through browser or client side application on your PC, Laptop, Mobile by the end user without installing, updating and maintaining them.
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
Q112)Why we go for Cloud Computing?
Answer:
Q113)What are the deployment models using in Cloud?
Answer:
Q114)Explain Cloud Service Models?
Answer: SAAS (Software as a Service): It is software distribution model in which application are hosted by a vendor over the internet for the end user freeing from complex software and hardware management. (Ex: Google drive, drop box)
PAAS (Platform as a Service): It provides platform and environment to allow developers to build applications. It frees developers without going into the complexity of building and maintaining the infrastructure. (Ex: AWS Elastic Beanstalk, Windows Azure)
IAAS (Infrastructure as a Service): It provides virtualized computing resources over the internet like cpu, memory, switches, routers, firewall, Dns, Load balancer (Ex: Azure, AWS)
Q115)What are the advantage of Cloud Computing?
Answer:
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
Q116)What is AWS?
Answer: Amazon web service is a secure cloud services platform offering compute, power, database, storage, content delivery and other functionality to help business scale and grow.
AWS is fully on-demand
AWS is Flexibility, availability and Scalability
AWS is Elasticity: scale up and scale down as needed.
Q117)What is mean by Region, Availability Zone and Edge Location?
Answer: Region: An independent collection of AWS resources in a defined geography. A collection of Data centers (Availability zones). All availability zones in a region connected by high bandwidth.
Availability Zones: An Availability zone is a simply a data center. Designed as independent failure zone. High speed connectivity, Low latency.
Edge Locations: Edge location are the important part of AWS Infrastructure. Edge locations are CDN endpoints for cloud front to deliver content to end user with low latency
Q118)How to access AWS Platform?
Answer:
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
Q119)What is EC2? What are the benefits in EC2?
Amazon Elastic compute cloud is a web service that provides resizable compute capacity in the cloud.AWS EC2 provides scalable computing capacity in the AWS Cloud. These are the virtual servers also called as an instances. We can use the instances pay per use basis.
Benefits:
Q120)What are the pricing models available in AWS EC2?
Answer:
Q121)What are the types using in AWS EC2?
Answer:
Q122)What is AMI? What are the types in AMI?
Answer:
Amazon machine image is a special type of virtual appliance that is used to create a virtual machine within the amazon Elastic compute cloud. AMI defines the initial software that will be in an instance when it is launched.
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
Types of AMI:
Q123)How to Addressing AWS EC2 instances?
Answer:
Q124)What is Security Group?
Answer: AWS allows you to control traffic in and out of your instance through virtual firewall called Security groups. Security groups allow you to control traffic based on port, protocol and source/Destination.
Q125)When your instance show retired state?
Answer:Retired state only available in Reserved instances. Once the reserved instance reserving time (1 yr/3 yr) ends it shows Retired state.
Q126)Scenario: My EC2 instance IP address change automatically while instance stop and start. What is the reason for that and explain solution?
Answer:AWS assigned Public IP automatically but it’s change dynamically while stop and start. In that case we need to assign Elastic IP for that instance, once assigned it doesn’t change automatically.
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
Q127)What is Elastic Beanstalk?
Answer:AWS Elastic Beanstalk is the fastest and simplest way to get an application up and running on AWS.Developers can simply upload their code and the service automatically handle all the details such as resource provisioning, load balancing, Auto scaling and Monitoring.
Q128)What is Amazon Lightsail?
Answer:Lightsail designed to be the easiest way to launch and manage a virtual private server with AWS.Lightsail plans include everything you need to jumpstart your project a virtual machine, ssd based storage, data transfer, DNS Management and a static ip.
Q129)What is EBS?
Answer:Amazon EBS Provides persistent block level storage volumes for use with Amazon EC2 instances. Amazon EBS volume is automatically replicated with its availability zone to protect component failure offering high availability and durability. Amazon EBS volumes are available in a variety of types that differ in performance characteristics and Price.
Q130)How to compare EBS Volumes?
Answer: Magnetic Volume: Magnetic volumes have the lowest performance characteristics of all Amazon EBS volume types.
EBS Volume size: 1 GB to 1 TB Average IOPS: 100 IOPS Maximum throughput: 40-90 MB
General-Purpose SSD: General purpose SSD volumes offers cost-effective storage that is ideal for a broad range of workloads. General purpose SSD volumes are billed based on the amount of data space provisioned regardless of how much of data you actually store on the volume.
EBS Volume size: 1 GB to 16 TB Maximum IOPS: upto 10000 IOPS Maximum throughput: 160 MB
Provisioned IOPS SSD: Provisioned IOPS SSD volumes are designed to meet the needs of I/O intensive workloads, particularly database workloads that are sensitive to storage performance and
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
consistency in random access I/O throughput. Provisioned IOPS SSD Volumes provide predictable,
High performance.
EBS Volume size: 4 GB to 16 TB Maximum IOPS: upto 20000 IOPS Maximum throughput: 320 MB
Q131)What is cold HDD and Throughput-optimized HDD?
Answer: Cold HDD: Cold HDD volumes are designed for less frequently accessed workloads. These volumes are significantly less expensive than throughput-optimized HDD volumes.
EBS Volume size: 500 GB to 16 TB Maximum IOPS: 200 IOPS Maximum throughput: 250 MB
Throughput-Optimized HDD: Throughput-optimized HDD volumes are low cost HDD volumes designed for frequent access, throughput-intensive workloads such as big data, data warehouse.
EBS Volume size: 500 GB to 16 TB Maximum IOPS: 500 IOPS Maximum throughput: 500 MB
Q132)What is Amazon EBS-Optimized instances?
Answer: Amazon EBS optimized instances to ensure that the Amazon EC2 instance is prepared to take advantage of the I/O of the Amazon EBS Volume. An amazon EBS-optimized instance uses an optimized configuration stack and provide additional dedicated capacity for Amazon EBS I/When you select Amazon EBS-optimized for an instance you pay an additional hourly charge for that instance.
Q133)What is EBS Snapshot?
Answer:
Q134)How to connect EBS volume to multiple instance?
Answer: We can’t able to connect EBS volume to multiple instance, but we can able to connect multiple EBS Volume to single instance.
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
Q135)What are the virtualization types available in AWS?
Answer: Hardware assisted Virtualization: HVM instances are presented with a fully virtualized set of hardware and they executing boot by executing master boot record of the root block device of the image. It is default Virtualization.
Para virtualization: This AMI boot with a special boot loader called PV-GRUB. The ability of the guest kernel to communicate directly with the hypervisor results in greater performance levels than other virtualization approaches but they cannot take advantage of hardware extensions such as networking, GPU etc. Its customized Virtualization image. Virtualization image can be used only for particular service.
Q136)Differentiate Block storage and File storage?
Answer:
Block Storage: Block storage operates at lower level, raw storage device level and manages data as a set of numbered, fixed size blocks.
File Storage: File storage operates at a higher level, the operating system level and manage data as a named hierarchy of files and folders.
Q137)What are the advantage and disadvantage of EFS? Advantages:
Answer:
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
Q138)what are the things we need to remember while creating s3 bucket?
Answer:
Q139)What are the storage class available in Amazon s3?
Answer:
Q140)Explain Amazon s3 lifecycle rules?
Answer: Amazon S3 lifecycle configuration rules, you can significantly reduce your storage costs by automatically transitioning data from one storage class to another or even automatically delete data after a period of time.
Q141)What is the relation between Amazon S3 and AWS KMS?
Answer: To encrypt Amazon S3 data at rest, you can use several variations of Server-Side Encryption. Amazon S3 encrypts your data at the object level as it writes it to disks in its data centers and decrypt it for you when you access it’ll SSE performed by Amazon S3 and AWS Key Management Service (AWS KMS) uses the 256-bit Advanced Encryption Standard (AES).
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
Q142)What is the function of cross region replication in Amazon S3?
Answer: Cross region replication is a feature allows you asynchronously replicate all new objects in the source bucket in one AWS region to a target bucket in another region. To enable cross-region replication, versioning must be turned on for both source and destination buckets. Cross region replication is commonly used to reduce the latency required to access objects in Amazon S3
Q143)How to create Encrypted EBS volume?
Answer: You need to select Encrypt this volume option in Volume creation page. While creation a new master key will be created unless you select a master key that you created separately in the service. Amazon uses the AWS key management service (KMS) to handle key management.
Q144)Explain stateful and Stateless firewall.
Answer:
Stateful Firewall: A Security group is a virtual stateful firewall that controls inbound and outbound network traffic to AWS resources and Amazon EC2 instances. Operates at the instance level. It supports allow rules only. Return traffic is automatically allowed, regardless of any rules.
Stateless Firewall: A Network access control List (ACL) is a virtual stateless firewall on a subnet level. Supports allow rules and deny rules. Return traffic must be explicitly allowed by rules.
Q145)What is NAT Instance and NAT Gateway?
Answer:
NAT instance: A network address translation (NAT) instance is an Amazon Linux machine Image (AMI) that is designed to accept traffic from instances within a private subnet, translate the source IP address to the Public IP address of the NAT instance and forward the traffic to IWG.
NAT Gateway: A NAT gateway is an Amazon managed resources that is designed to operate just like a NAT instance but it is simpler to manage and highly available within an availability Zone. To
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
allow instance within a private subnet to access internet resources through the IGW via a NAT
gateway.
Q146)What is VPC Peering?
Answer: Amazon VPC peering connection is a networking connection between two amazon vpc’s that enables instances in either Amazon VPC to communicate with each other as if they are within the same network. You can create amazon VPC peering connection between your own Amazon VPC’s or Amazon VPC in another AWS account within a single region.
Q147)What is MFA in AWS?
Answer: Multi factor Authentication can add an extra layer of security to your infrastructure by adding a second method of authentication beyond just password or access key.
Q148)What are the Authentication in AWS?
Answer:
Q149)What is Data warehouse in AWS?
Data ware house is a central repository for data that can come from one or more sources. Organization typically use data warehouse to compile reports and search the database using highly complex queries. Data warehouse also typically updated on a batch schedule multiple times per day or per hour compared to an OLTP (Online Transaction Processing) relational database that can be updated thousands of times per second.
Q150)What is mean by Multi-AZ in RDS?
Answer: Multi AZ allows you to place a secondary copy of your database in another availability zone for disaster recovery purpose. Multi AZ deployments are available for all types of Amazon RDS
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
Database engines. When you create s Multi-AZ DB instance a primary instance is created in one
Availability Zone and a secondary instance is created by another Availability zone.
Q151)What is Amazon Dynamo DB?
Answer: Amazon Dynamo DB is fully managed NoSQL database service that provides fast and predictable performance with seamless scalability. Dynamo DB makes it simple and Cost effective to store and retrieve any amount of data.
Q152)What is cloud formation?
Answer: Cloud formation is a service which creates the AWS infrastructure using code. It helps to reduce time to manage resources. We can able to create our resources Quickly and faster.
Q153)How to plan Auto scaling?
Answer:
Q154)What is Auto Scaling group?
Answer: Auto Scaling group is a collection of Amazon EC2 instances managed by the Auto scaling service. Each auto scaling group contains configuration options that control when auto scaling should launch new instance or terminate existing instance.
Q155)Differentiate Basic and Detailed monitoring in cloud watch?
Answer:
Basic Monitoring: Basic monitoring sends data points to Amazon cloud watch every five minutes for a limited number of preselected metrics at no charge.
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
Detailed Monitoring: Detailed monitoring sends data points to amazon CloudWatch every minute and
allows data aggregation for an additional charge.
Q156)What is the relationship between Route53 and Cloud front?
Answer: In Cloud front we will deliver content to edge location wise so here we can use Route 53 for Content Delivery Network. Additionally, if you are using Amazon CloudFront you can configure Route 53 to route Internet traffic to those resources.
Q157)What are the routing policies available in Amazon Route53?
Answer:
Q158)What is Amazon ElastiCache?
Answer: Amazon ElastiCache is a web services that simplifies the setup and management of distributed in memory caching environment.
Q159)What is SES, SQS and SNS?
Answer: SES (Simple Email Service): SES is SMTP server provided by Amazon which is designed to send bulk mails to customers in a quick and cost-effective manner.SES does not allows to configure mail server.
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
SQS (Simple Queue Service): SQS is a fast, reliable and scalable, fully managed message queuing
service. Amazon SQS makes it simple and cost Effective. It’s temporary repository for messages to waiting for processing and acts as a buffer between the component producer and the consumer.
SNS (Simple Notification Service): SNS is a web service that coordinates and manages the delivery or sending of messages to recipients.
Q160)How To Use Amazon Sqs? What Is Aws?
Answer:Amazon Web Services is a secure cloud services stage, offering compute power, database storage, content delivery and other functionality to help industries scale and grow.
Q161) What is the importance of buffer in AWS?
Answer:low price – Consume only the amount of calculating, storage and other IT devices needed. No long-term assignation, minimum spend or up-front expenditure is required.
Elastic and Scalable – Quickly Rise and decrease resources to applications to satisfy customer demand and control costs. Avoid provisioning maintenance up-front for plans with variable consumption speeds or low lifetimes.
Q162)What is the way to secure data for resounding in the cloud?
Answer:
Q163) Name The Several Layers Of Cloud Computing?
Answer:Cloud computing can be damaged up into three main services: Software-as-a-Service (SaaS), Infrastructure-as-a-Service (IaaS) and Platform-as-a-Service (PaaS). PaaS in the middle, and IaaS on the lowest
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
Q164) What Is Lambda edge In Aws?
Answer:Lambda Edge lets you run Lambda functions to modify satisfied that Cloud Front delivers, executing the functions in AWS locations closer to the viewer. The functions run in response to Cloud Front events, without provisioning or managing server.
Q165) Distinguish Between Scalability And Flexibility?
Answer:Cloud computing offers industries flexibility and scalability when it comes to computing needs:
Flexibility. Cloud computing agrees your workers to be more flexible – both in and out of the workplace. Workers can access files using web-enabled devices such as smartphones, laptops and notebooks. In this way, cloud computing empowers the use of mobile technology.
One of the key assistances of using cloud computing is its scalability. Cloud computing allows your business to easily expensive or downscale your IT requests as and when required. For example, most cloud service workers will allow you to increase your existing resources to accommodate increased business needs or changes. This will allow you to support your commercial growth without exclusive changes to your present IT systems.
Q166) What is IaaS?
Answer:IaaS is a cloud service that runs services on “pay-for-what-you-use” basis
IaaS workers include Amazon Web Services, Microsoft Azure and Google Compute Engine Users: IT Administrators
Q167) What is PaaS?
Answer:PaaS runs cloud platforms and runtime environments to develop, test and manage software Users: Software Developers
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
Q168) What is SaaS?
Answer:In SaaS, cloud workers host and manage the software application on a pay-as-you-go pricing model
Users: End Customers
Q169) Which Automation Gears Can Help With Spinup Services?
Answer:The API tools can be used for spin up services and also for the written scripts. Persons scripts could be coded in Perl, bash or other languages of your preference. There is one more option that is flowery management and stipulating tools such as a dummy or improved descendant. A tool called Scalar can also be used and finally we can go with a controlled explanation like a Right scale. Which automation gears can help with pinup service.
Q170) What Is an Ami? How Do I Build One?
Answer:An Amazon Machine Image (AMI) explains the programs and settings that will be applied when you launch an EC2 instance. Once you have finished organizing the data, services, and submissions on your ArcGIS Server instance, you can save your work as a custom AMI stored in Amazon EC2. You can scale out your site by using this institution AMI to launch added instances
Use the following process to create your own AMI using the AWS Administration Console:
*Configure an EC2 example and its attached EBS volumes in the exact way you want them created in the custom AMI.
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
Read the message box that appears. To view the AMI standing, go to the AMIs page. Here you can
see your AMI being created. It can take a though to create the AMI. Plan for at least 20 minutes, or slower if you’ve connected a lot of additional applications or data.
Q171)What Are The Main Features Of Amazon Cloud Front?
Answer:Amazon Cloud Front is a web service that speeds up delivery of your static and dynamic web content, such as .html, .css, .js, and image files, to your users.CloudFront delivers your content through a universal network of data centers called edge locations
Q172)What Are The Features Of The Amazon Ec2 Service?
Answer:Amazon Elastic Calculate Cloud (Amazon EC2) is a web service that provides secure, resizable compute capacity in the cloud. It is designed to make web-scale cloud calculating easier for designers. Amazon EC2’s simple web serviceinterface allows you to obtain and configure capacity with minimal friction.
Q173)Explain Storage For Amazon Ec2 Instance.?
Answer:An instance store is a provisional storing type located on disks that are physically attached to a host machine. … This article will present you to the AWS instance store storage type, compare it to AWS Elastic Block Storage (AWS EBS), and show you how to backup data stored on instance stores to AWS EBS
Amazon SQS is a message queue service used by scattered requests to exchange messages through a polling model, and can be used to decouple sending and receiving components
Q174)When attached to an Amazon VPC which two components provide connectivity with external networks?
Answer:
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
Q175)Which of the following are characteristics of Amazon VPC subnets?
Answer:
Q176)How can you send request to Amazon S3?
Answer:Every communication with Amazon S3 is either genuine or anonymous. Authentication is a process of validating the individuality of the requester trying to access an Amazon Web Services (AWS) product. Genuine requests must include a autograph value that authenticates the request sender. The autograph value is, in part, created from the requester’s AWS access keys (access key identification and secret access key).
Q177)What is the best approach to anchor information for conveying in the cloud ?
Answer:Backup Data Locally. A standout amongst the most vital interesting points while overseeing information is to guarantee that you have reinforcements for your information,
Q178)What is AWS Certificate Manager ?
Answer:AWS Certificate Manager is an administration that lets you effortlessly arrangement, oversee, and send open and private Secure Sockets Layer/Transport Layer Security (SSL/TLS) endorsements for use with AWS administrations and your inward associated assets. SSL/TLS declarations are utilized to anchor arrange interchanges and set up the character of sites over the Internet and additionally assets on private systems. AWS Certificate Manager expels the tedious manual procedure of obtaining, transferring, and reestablishing SSL/TLS endorsements.
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
Q179)What is the AWS Key Management Service
Answer:AWS Key Management Service (AWS KMS) is an overseen benefit that makes it simple for you to make and control the encryption keys used to scramble your information. … AWS KMS is additionally coordinated with AWS CloudTrail to give encryption key use logs to help meet your inspecting, administrative and consistence needs.
Q180)
What is Amazon EMR ?
Answer:Amazon Elastic MapReduce (EMR) is one such administration that gives completely oversaw facilitated Hadoop system over Amazon Elastic Compute Cloud (EC2).
Q181)What is Amazon Kinesis Firehose ?
Answer:Amazon Kinesis Data Firehose is the least demanding approach to dependably stack gushing information into information stores and examination devices. … It is a completely overseen benefit that consequently scales to coordinate the throughput of your information and requires no continuous organization
Q182)What Is Amazon CloudSearch and its highlights ?
Answer:Amazon CloudSearch is a versatile cloud-based hunt benefit that frames some portion of Amazon Web Services (AWS). CloudSearch is normally used to incorporate tweaked seek abilities into different applications. As indicated by Amazon, engineers can set a pursuit application up and send it completely in under 60 minutes.
Q183)Is it feasible for an EC2 exemplary occurrence to wind up an individual from a virtual private cloud?
Answer:Amazon Virtual Private Cloud (Amazon VPC) empowers you to characterize a virtual system in your very own consistently disengaged zone inside the AWS cloud, known as a virtual private
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
cloud (VPC). You can dispatch your Amazon EC2 assets, for example, occasions, into the subnets
of your VPC. Your VPC nearly looks like a conventional system that you may work in your very own server farm, with the advantages of utilizing adaptable foundation from AWS. You can design your VPC; you can choose its IP address extend, make subnets, and arrange course tables, organize portals, and security settings. You can interface occurrences in your VPC to the web or to your own server farm
Q184)Mention crafted by an Amazon VPC switch.
Answer:VPCs and Subnets. A virtual private cloud (VPC) is a virtual system committed to your AWS account. It is consistently segregated from other virtual systems in the AWS Cloud. You can dispatch your AWS assets, for example, Amazon EC2 cases, into your VPC.
Q185)How would one be able to associate a VPC to corporate server farm?
Answer:AWS Direct Connect empowers you to safely associate your AWS condition to your on- premises server farm or office area over a standard 1 gigabit or 10 gigabit Ethernet fiber-optic association. AWS Direct Connect offers committed fast, low dormancy association, which sidesteps web access suppliers in your system way. An AWS Direct Connect area gives access to Amazon Web Services in the locale it is related with, and also access to different US areas. AWS Direct Connect enables you to consistently parcel the fiber-optic associations into numerous intelligent associations called Virtual Local Area Networks (VLAN). You can exploit these intelligent associations with enhance security, separate traffic, and accomplish consistence necessities.
Q186)Is it conceivable to push off S3 with EC2 examples ?
Answer:Truly, it very well may be pushed off for examples with root approaches upheld by local event stockpiling. By utilizing Amazon S3, engineers approach the comparative to a great degree versatile, reliable, quick, low-valued information stockpiling substructure that Amazon uses to follow its own overall system of sites. So as to perform frameworks in the Amazon EC2 air, engineers utilize the instruments giving to stack their Amazon Machine Images (AMIs) into Amazon S3 and to
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
exchange them between Amazon S3 and Amazon EC2. Extra use case may be for sites facilitated
on EC2 to stack their stationary substance from S3.
Q187)What is the distinction between Amazon S3 and EBS ?
Answer:EBS is for mounting straightforwardly onto EC2 server examples. S3 is Object Oriented Storage that isn’t continually waiting be gotten to (and is subsequently less expensive). There is then much less expensive AWS Glacier which is for long haul stockpiling where you don’t generally hope to need to get to it, however wouldn’t have any desire to lose it.
There are then two principle kinds of EBS – HDD (Hard Disk Drives, i.e. attractive turning circles), which are genuinely ease back to access, and SSD, which are strong state drives which are excessively quick to get to, yet increasingly costly.
Q188)What do you comprehend by AWS?
Answer:This is one of the generally asked AWS engineer inquiries questions. This inquiry checks your essential AWS learning so the appropriate response ought to be clear. Amazon Web Services (AWS) is a cloud benefit stage which offers figuring power, investigation, content conveyance, database stockpiling, sending and some different administrations to help you in your business development. These administrations are profoundly versatile, solid, secure, and cheap distributed computing administrations which are plot to cooperate and, applications in this manner made are further developed and escalade.
Q189)Clarify the principle components of AWS?
Answer:The principle components of AWS are:
Highway 53: Route53 is an exceptionally versatile DNS web benefit.
Basic Storage Service (S3): S3 is most generally utilized AWS stockpiling web benefit.
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
Straightforward E-mail Service (SES): SES is a facilitated value-based email benefit and enables
one to smoothly send deliverable messages utilizing a RESTFUL API call or through an ordinary SMTP.
Personality and Access Management (IAM): IAM gives enhanced character and security the board for AWS account.
Versatile Compute Cloud (EC2): EC2 is an AWS biological community focal piece. It is in charge of giving on-request and adaptable processing assets with a “pay as you go” estimating model.
Flexible Block Store (EBS): EBS offers consistent capacity arrangement that can be found in occurrences as a customary hard drive.
CloudWatch: CloudWatch enables the controller to viewpoint and accumulate key measurements and furthermore set a progression of cautions to be advised if there is any inconvenience.
This is among habitually asked AWS engineer inquiries questions. Simply find the questioner psyche and solution appropriately either with parts name or with the portrayal alongside.
Q190)I’m not catching your meaning by AMI? What does it incorporate?
Answer:You may run over at least one AMI related AWS engineer inquiries amid your AWS designer meet. Along these lines, set yourself up with a decent learning of AMI.
AMI represents the term Amazon Machine Image. It’s an AWS format which gives the data (an application server, and working framework, and applications) required to play out the dispatch of an occasion. This AMI is the duplicate of the AMI that is running in the cloud as a virtual server. You can dispatch occurrences from the same number of various AMIs as you require. AMI comprises of the followings:
A pull volume format for a current example
Launch authorizations to figure out which AWS records will inspire the AMI so as to dispatch the occasions
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
Mapping for square gadget to compute the aggregate volume that will be appended to the example
at the season of dispatch
Q191) Is vertically scale is conceivable on Amazon occurrence?
Answer:Indeed, vertically scale is conceivable on Amazon example.
This is one of the normal AWS engineer inquiries questions. In the event that the questioner is hoping to find a definite solution from you, clarify the system for vertical scaling.
Q192)What is the association among AMI and Instance?
Answer:Various sorts of examples can be propelled from one AMI. The sort of an occasion for the most part manages the equipment segments of the host PC that is utilized for the case. Each kind of occurrence has unmistakable registering and memory adequacy.
When an example is propelled, it gives a role as host and the client cooperation with it is same likewise with some other PC however we have a totally controlled access to our occurrences. AWS engineer inquiries questions may contain at least one AMI based inquiries, so set yourself up for the AMI theme exceptionally well.
Q193)What is the distinction between Amazon S3 and EC2?
Answer:The contrast between Amazon S3 and EC2 is given beneath:
Amazon S3 Amazon EC2
The significance of S3 is Simple Storage Service. The importance of EC2 is Elastic Compute Cloud.
It is only an information stockpiling administration which is utilized to store huge paired files. It is a cloud web benefit which is utilized to have the application made.
It isn’t required to run a server. It is sufficient to run a server.
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
It has a REST interface and utilizations secure HMAC-SHA1 validation keys. It is much the same as
a tremendous PC machine which can deal with application like Python, PHP, Apache and some other database.
When you are going for an AWS designer meet, set yourself up with the ideas of Amazon S3 and EC2, and the distinction between them.
Q194)What number of capacity alternatives are there for EC2 Instance?
Answer:There are four stockpiling choices for Amazon EC2 Instance:
Amazon EC2 is the basic subject you may run over while experiencing AWS engineer inquiries questions. Get a careful learning of the EC2 occurrence and all the capacity alternatives for the EC2 case.
Q195)What are the security best practices for Amazon Ec2 examples?
Answer:There are various accepted procedures for anchoring Amazon EC2 occurrences that are pertinent whether occasions are running on-preface server farms or on virtual machines. How about we view some broad prescribed procedures:
Minimum Access: Make beyond any doubt that your EC2 example has controlled access to the case and in addition to the system. Offer access specialists just to the confided in substances.
Slightest Privilege: Follow the vital guideline of minimum benefit for cases and clients to play out the capacities. Produce jobs with confined access for the occurrences.
Setup Management: Consider each EC2 occasion a design thing and use AWS arrangement the executives administrations to have a pattern for the setup of the occurrences as these
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
administrations incorporate refreshed enemy of infection programming, security highlights and so
forth.
Whatever be the activity job, you may go over security based AWS inquiries questions. Along these lines, motivate arranged with this inquiry to break the AWS designer meet.
Q196)Clarify the highlights of Amazon EC2 administrations.
Answer:Amazon EC2 administrations have following highlights:
Q197)What is the system to send a demand to Amazon S3?
Answer: Reply: There are 2 different ways to send a demand to Amazon S3 –
Q198)What is the default number of basins made in AWS?
Answer:This is an extremely straightforward inquiry yet positions high among AWS engineer inquiries questions. Answer this inquiry straightforwardly as the default number of pails made in each AWS account is 100.
Q199)What is the motivation behind T2 examples?
Answer:T2 cases are intended for Providing moderate gauge execution
Higher execution as required by outstanding task at hand
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
Q200)What is the utilization of the cradle in AWS?
Answer:This is among habitually asked AWS designer inquiries questions. Give the appropriate response in straightforward terms, the cradle is primarily used to oversee stack with the synchronization of different parts i.e. to make framework blame tolerant. Without support, segments don’t utilize any reasonable technique to get and process demands. Be that as it may, the cushion makes segments to work in a decent way and at a similar speed, hence results in quicker administrations.
Q201)What happens when an Amazon EC2 occurrence is halted or ended?
Answer:At the season of ceasing an Amazon EC2 case, a shutdown is performed in a typical way. From that point onward, the changes to the ceased state happen. Amid this, the majority of the Amazon EBS volumes are stayed joined to the case and the case can be begun whenever. The occurrence hours are not included when the occasion is the ceased state.
At the season of ending an Amazon EC2 case, a shutdown is performed in an ordinary way. Amid this, the erasure of the majority of the Amazon EBS volumes is performed. To stay away from this, the estimation of credit deleteOnTermination is set to false. On end, the occurrence additionally experiences cancellation, so the case can’t be begun once more.
Q202)What are the mainstream DevOps devices?
Answer:In an AWS DevOps Engineer talk with, this is the most widely recognized AWS inquiries for DevOps. To answer this inquiry, notice the well known DevOps apparatuses with the kind of hardware –
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
Q203)What are IAM Roles and Policies, What is the difference between IAM Roles and Policies.
Answer:Roles are for AWS services, Where we can assign permission of some AWS service to other Service.
Example – Giving S3 permission to EC2 to access S3 Bucket Contents.
Policies are for users and groups, Where we can assign permission to user’s and groups. Example – Giving permission to user to access the S3 Buckets.
Q204)What are the Defaults services we get when we create custom AWS VPC?
Answer:
Q205)What is the Difference Between Public Subnet and Private Subnet ?
Answer:Public Subnet will have Internet Gateway Attached to its associated Route Table and Subnet, Private Subnet will not have the Internet Gateway Attached to its associated Route Table and Subnet
Public Subnet will have internet access and Private subnet will not have the internet access directly.
Q206) How do you access the Ec2 which has private IP which is in private Subnet ?
Answer: We can access using VPN if the VPN is configured into that Particular VPC where Ec2 is assigned to that VPC in the Subnet. We can access using other Ec2 which has the Public access.
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
Q207)We have a custom VPC Configured and MYSQL Database server which is in Private Subnet and we need to update the MYSQL Database Server, What are the Option to do so.
Answer:By using NAT Gateway in the VPC or Launch a NAT Instance ( Ec2) Configure or Attach the NAT Gateway in Public Subnet ( Which has Route Table attached to IGW) and attach it to the Route Table which is Already attached to the Private Subnet.
Q208) What are the Difference Between Security Groups and Network ACL
Answer:
Security Groups | Network ACL |
Attached to Ec2 instance | Attached to a subnet. |
Stateful – Changes made in incoming rules is automatically applied to the outgoing rule | Stateless – Changes made in incoming rules is not applied to the outgoing rule |
Blocking IP Address can’t be done | IP Address can be Blocked |
Allow rules only, by default all rules are denied | Allow and Deny can be Used. |
Q209)What are the Difference Between Route53 and ELB?
Answer:Amazon Route 53 will handle DNS servers. Route 53 give you web interface through which the DNS can be managed using Route 53, it is possible to direct and failover traffic. This can be achieved by using DNS Routing Policy.
One more routing policy is Failover Routing policy. we set up a health check to monitor your application endpoints. If one of the endpoints is not available, Route 53 will automatically forward the traffic to other endpoint.
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
Elastic Load Balancing
ELB automatically scales depends on the demand, so sizing of the load balancers to handle more traffic effectively when it is not required.
Q210)What are the DB engines which can be used in AWS RDS?
Answer:
Q211)What is Status Checks in AWS Ec2?
Answer: System Status Checks – System Status checks will look into problems with instance which needs AWS help to resolve the issue. When we see system status check failure, you can wait for AWS to resolve the issue, or do it by our self.
Q212)To establish a peering connections between two VPC’s What condition must be met?
Answer:
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
Q213) Troubleshooting with EC2 Instances:
Answer: Instance States
Workaround-Need to restart the instance, if still that is not working logs will help to fix the issue.
Q214) How EC2instances can be resized.
Answer: EC2 instances can be resizable(scale up or scale down) based on requirement
Q215) EBS: its block-level storage volume which we can use after mounting with EC2 instances.
Answer:For types please refer AWS Solution Architect book.
Q216) Difference between EBS,EFS and S3
Answer:
Q217) Maximum number of bucket which can be crated in AWS.
Answer:100 buckets can be created by default in AWS account.To get more buckets additionally you have to request Amazon for that.
Q218)Maximum number of EC2 which can be created in VPC.
Answer:Maximum 20 instances can be created in a VPC. we can create 20 reserve instances and request for spot instance as per demand.
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
Q219) How EBS can be accessed?
Answer:EBS provides high performance block-level storage which can be attached with running EC2 instance. Storage can be formatted and mounted with EC2 instance, then it can be accessed.
Q220)Process to mount EBS to EC2 instance
Answer:
Q221)How to add volume permanently with instance.
Answer:With each restart volume will get unmounted from instance, to keep this attached need to perform below step
Cd /etc/fstab
/dev/xvdf /data ext4 defaults 0
0 <edit the file system name accordingly>
Q222) What is the Difference between the Service Role and SAML Federated Role.
Answer: Service Role are meant for usage of AWS Services and based upon the policies attached to it,it will have the scope to do its task. Example : In case of automation we can create a service role and attached to it.
Federated Roles are meant for User Access and getting access to AWS as per designed role. Example : We can have a federated role created for our office employee and corresponding to that a Group will be created in the AD and user will be added to it.
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
Q223)How many Policies can be attached to a role.
Answer: 10 (Soft limit), We can have till 20.
Q224) What are the different ways to access AWS.
Answer:3 Different ways (CLI, Console, SDK)
Q225)How a Root AWS user is different from in IAM User.
Answer: Root User will have acces to entire AWS environment and it will not have any policy attached to it. While IAM User will be able to do its task on the basis of policies attached to it.
Q226)What do you mean by Principal of least privilege in term of IAM.
Answer: Principal of least privilege means to provide the same or equivalent permission to the user/role.
Q227)What is the meaning of non-explicit deny for an IAM User.
Answer: When an IAM user is created and it is not having any policy attached to it,in that case he will not be able to access any of the AWS Service until a policy has been attached to it.
Q228) What is the precedence level between explicit allow and explicit deny.
Answer: Explicit deny will always override Explicit Allow.
Q229) What is the benefit of creating a group in IAM.
Answer:Creation of Group makes the user management process much simpler and user with the same kind of permission can be added in a group and at last addition of a policy will be much simpler to the group in comparison to doing the same thing manually.
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
Q230)What is the difference between the Administrative Access and Power User Access in term of pre-build policy.
Answer: Administrative Access will have the Full access to AWS resources. While Power User Access will have the Admin access except the user/group management permission.
Q231)What is the purpose of Identity Provider.
Answer: Identity Provider helps in building the trust between the AWS and the Corporate AD environment while we create the Federated role.
Q232) What are the benefits of STS (Security Token Service).
Answer: It help in securing the AWS environment as we need not to embed or distributed the AWS Security credentials in the application. As the credentials are temporary we need not to rotate them and revoke them.
Q233)What is the benefit of creating the AWS Organization.
Answer: It helps in managing the IAM Policies, creating the AWS Accounts programmatically, helps in managing the payment methods and consolidated billing.
Q234)What is the maximum file length in S3?
Answer: utf-8 1024 bytes
Q235)which activity cannot be done using autoscaling?
Answer:Maintain fixed running of ec2
Q236)How will you secure data at rest in EBS?
Answer: EBS data is always secure
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
Q237)What is the maximum size of S3 Bucket?
Answer: 5TB
Q238)Can objects in Amazon s3 be delivered through amazon cloud front?
Answer:Yes
Q239)which service is used to distribute content to end user service using global network of edge location?
Answer: Virtual Private Cloud
Q240)What is ephemaral storage?
Answer: Temporary storage
Q241)What are shards in kinesis aws services?
Answer: Shards are used to store data in Kinesis.
Q242)Where can you find the ephemeral storage?
Answer: In Instance store service.
Q243)I have some private servers on my premises also i have distributed some of My workload on the public cloud,what is the architecture called?
Answer:Virtual private cloud
Q244)Route 53 can be used to route users to infrastructure outside of aws.True/false?
Answer: False
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
Q245)Is simple workflow service one of the valid Simple Notification Service subscribers?
Answer: No
Q246)which cloud model do Developers and organizations all around the world leverage extensively?
Answer: IAAS-Infrastructure as a service.
Q247)Can cloud front serve content from a non AWS origin server?
Answer: No
Q248)Is EFS a centralised storage service in AWS?
Answer: Yes
Q249)Which AWS service will you use to collect and process ecommerce data for near real time analysis?
Answer: Both Dynamo DB & Redshift
Q250)An high demand of IOPS performance is expected around 15000.Which EBS volume type would you recommend?
AWS Devops Interview Questions And Answers
Question # 1) What is Amazon Web Services in DevOps?
Answer # AWS provides services that help you practice DevOps at your company and that are built first for use with AWS. These tools automate manual tasks, help teams manage complex environments at scale, and keep engineers in control of the high velocity that is enabled by DevOps.
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
Question # 2) What is the role of a DevOps engineer?
Answer # There’s no formal career track for becoming a DevOps engineer. They are either developers who get interested in deployment and network operations, or sysadmins who have a passion for scripting and coding, and move into the development side where they can improve the planning of test and deployment.
Question # 3) What is Dev Ops with cloud computing?
Answer # Inseparable development and operations practices are universally relevant. Cloud computing, Agile development, and DevOps are interlocking parts of a strategy for transforming IT into a business adaptability enabler. If cloud is an instrument, then DevOps is the musician that plays it.
Question # 4) Why do we use AWS for DevOps?
Answer # There are many benefits of using AWS for devops, thery are:
configuration, and scaling.
gives you granular control over who can access your resources and how they access those resources.
to use them. AWS pricing has no upfront fees, termination penalties, or long term contracts. The AWS Free Tier helps you get started with AWS.
Question # 5) What is DevOps Tooling by AWS?
Answer # AWS provides services that help you practice DevOps at your company and that are built first for use with AWS. These tools automate manual tasks, help teams manage complex environments at scale, and keep engineers in control of the high velocity that is enabled by DevOps.
Related Article: Chef Interview Questions
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
Question # 6) How do you handle Continuous Integration and Continuous Delivery in AWS Devops?
Answer # The AWS Developer Tools help you securely store and version your application’s source code and automatically build, test, and deploy your application to AWS or your on-premises
environment.
Start with AWS CodePipeline to build a continuous integration or continuous delivery workflow that uses AWS CodeBuild, AWS CodeDeploy, and other tools, or use each service separately.
Question # 7) What is AWS CodePipeline in AWS Devops?
A) AWS CodePipeline is a continuous integration and continuous delivery service for fast and reliable application and infrastructure updates. CodePipeline builds, tests, and deploys your code every time there is a code change, based on the release process models you define. This enables you to rapidly and reliably deliver features and updates.
Question # 8) What is AWS CodeBuild in AWS Devops?
Answer # AWS CodeBuild is a fully managed build service that compiles source code, runs tests, and produces software packages that are ready to deploy. With CodeBuild, you don’t need to provision, manage, and scale your own build servers. CodeBuild scales continuously and processes multiple builds concurrently, so your builds are not left waiting in a queue.
Question # 9) What is AWS CodeDeploy in AWS Devops?
Answer # AWS CodeDeploy automates code deployments to any instance, including Amazon EC2 instancesand on-premises servers. AWS CodeDeploy makes it easier for you to rapidly release new features, helps you avoid downtime during application deployment, and handles the complexity of updating your applications.
Question # 10) What is AWS CodeStar in AWS Devops?
Answer # AWS CodeStar enables you to quickly develop, build, and deploy applications on AWS. AWS CodeStar provides a unified user interface, enabling you to easily manage your software development activities in one place. With AWS CodeStar, you can set up your entire continuous delivery toolchain in minutes, allowing you to start releasing code faster.
Top AWS Devops Interview Questions
AWS Devops Interview Questions # 11) How Instacart uses AWS Devops?
Answer # Instacart uses AWS CodeDeploy to automate deployments for all of its front-end and back- end services. Using AWS CodeDeploy has enabled Instacart’s developers to focus on their product and worry less about deployment operations.
Related Article: Puppet Interview Questions
AWS Devops Interview Questions # 12) How lululemon athletica uses AWS Devops?
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
Answer # lululemon athletica uses a variety of AWS services to engineer a fully automated, continuous integration and delivery system. lululemon deploys artifacts distributed via Amazon S3 using AWS CodePipeline. From this stage, the artifacts are deployed to AWS Elastic Beanstalk.
AWS Devops Interview Questions # 13) What is Amazon Elastic Container Service in AWS Devops?
Answer # Amazon Elastic Container Service (ECS) is a highly scalable, high performance container management service that supports Docker containers and allows you to easily run applications on a managed cluster of Amazon EC2 instances.
AWS Devops Interview Questions # 14) What is AWS Lambda in AWS Devops?
Answer # AWS Lambda lets you run code without provisioning or managing servers. With Lambda, you can run code for virtually any type of application or backend service – all with zero administration. Just upload your code and Lambda takes care of everything required to run and scale your code with high availability.
Related Article: Kubernetes Interview Questions
AWS Devops Interview Questions # 15) What are AWS Developer Tools?
Answer # The AWS Developer Tools is a set of services designed to enable developers and IT operations professionals practicing DevOps to rapidly and safely deliver software.
Together, these services help you securely store and version control your application’s source code and automatically build, test, and deploy your application to AWS or your on-premises environment. You can use AWS CodePipeline to orchestrate an end-to-end software release workflow using these services and third-party tools or integrate each service independently with your existing tools.
AWS Devops Interview Questions # 16) What is CodeCommit in AWS Devops?
Answer # AWS CodeCommit is a fully-managed source control service that makes it easy for companies to host secure and highly scalable private Git repositories. CodeCommit eliminates the need to operate your own source control system or worry about scaling its infrastructure. You can use CodeCommit to securely store anything from source code to binaries, and it works seamlessly with your existing Git tools.
AWS Devops Interview Questions # 17) What are the benefits of AWS CodeBuild in AWS Devops?
Answer # AWS CodeBuild is a fully managed build service that compiles source code, runs tests,
and produces software packages that are ready to deploy. With CodeBuild, you don’t need to provision, manage, and scale your own build servers.
CodeBuild scales continuously and processes multiple builds concurrently, so your builds are not left waiting in a queue. You can get started quickly by using prepackaged build environments, or you can
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
create custom build environments that use your own build tools. With CodeBuild, you are charged by the minute for the compute resources you use.
AWS CodeBuild Benefits:
not left waiting in a queue.
Related Article: Docker Interview Questions
AWS Devops Interview Questions # 18) What is Amazon EC2 in AWS Devops?
Answer # Amazon Elastic Compute Cloud (Amazon EC2) is a web service that provides secure, resizable compute capacity in the cloud. It is designed to make web-scale cloud computing easier for developers.
AWS Devops Interview Questions # 19) What is Amazon S3 in AWS Devops?
Answer # Amazon Simple Storage Service (Amazon S3) is object storage with a simple web service interface to store and retrieve any amount of data from anywhere on the web.
AWS Devops Interview Questions # 20) What is Amazon RDS in AWS Devops?
Answer # Amazon Relational Database Service (Amazon RDS) makes it easy to set up, operate, and scale a relational database in the cloud.
AWS Devops Interview Questions And Answers For Experienced
Question # 21) What is AWS Lambda in AWS Devops?
Answer # AWS Lambda lets you run code without provisioning or managing servers. You pay only for the compute time you consume – there is no charge when your code is not running.
Related Article: Kubernetes Interview Questions
Question # 22) What is Amazon QuickSight in AWS Devops?
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
Answer # Amazon QuickSight is a fast, cloud-powered business analytics service that makes it easy to build visualizations, perform ad-hoc analysis, and quickly get business insights from your data.
Question # 23) What is AWS IoT in AWS Devops?
Answer # AWS IoT is a managed cloud platform that lets connected devices easily and securely interact with cloud applications and other devices.
Question # 24) What are the benefits of AWS CodeDeploy in AWS Devops?
Answer # AWS CodeDeploy is a service that automates software deployments to a variety of compute services including Amazon EC2, AWS Lambda, and instances running on-premises.
AWS CodeDeploy makes it easier for you to rapidly release new features, helps you avoid downtime during application deployment, and handles the complexity of updating your applications.
AWS CodeDeploy Benefits:
Advanced AWS Devops Interview
Questions
Question # 25) How can you use CodeBuild to automate your release process?
Answer # Yes. CodeBuild is integrated with AWS CodePipeline. You can add a build action and set up a continuous integration and continuous delivery process that runs in the cloud.
Question # 26) What is a build project in AWS Devops?
Answer # A build project is used to define how CodeBuild will run a build. It includes information such as where to get the source code, which build environment to use, the build commands to run, and where to store the build output. A build environment is the combination of operating system, programming language runtime, and tools used by CodeBuild to run a build.
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
Related Article: Ansible Interview Questions
Question # 27) How do you configure a build project in AWS Devops?
Answer # A build project can be configured through the console or the AWS CLI. You specify the source repository location, the runtime environment, the build commands, the IAM role assumed by the container, and the compute class required to run the build. Optionally, you can specify build commands in a buildspec.yml file.
Question # 28) Which source repositories does CodeBuild support in AWS Devops? Answer # CodeBuild can connect to AWS CodeCommit, S3, and GitHub to pull source code for builds.
Question # 29) Which programming frameworks does CodeBuild support in AWS Devops? Answer # CodeBuild provides preconfigured environments for supported versions of Java, Ruby, Python, Go, Node.js, Android, and Docker. You can also customize your own environment by creating a Docker image and uploading it to the Amazon EC2 Container Registry or the Docker Hub registry. You can then reference this custom image in your build project.
Related Article: Nagios Interview Questions
Question # 30) What happens when a build is run in CodeBuild in AWS Devops?
Answer # CodeBuild will create a temporary compute container of the class defined in the build project, load it with the specified runtime environment, download the source code, execute the commands configured in the project, upload the generated artifact to an S3 bucket, and then destroy the compute container. During the build, CodeBuild will stream the build output to the service console and Amazon CloudWatch Logs.
Most Popular AWS Devops Interview Questions
AWS Devops Interview Questions # 31) How do you set up your first build in CodeBuild in AWS Devops?
Answer # Sign in to the AWS Management Console, create a build project, and then run a build.
AWS Devops Interview Questions # 32) How can you use CodeBuild with Jenkins in AWS Devops?
Answer # Yes. The CodeBuild Plugin for Jenkins can be used to integrate CodeBuild into Jenkins jobs. The build jobs are sent to CodeBuild, eliminating the need for provisioning and managing the Jenkins worker nodes.
AWS Devops Interview Questions # 33) How can you view past build results in AWS CodeBuild?
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
Answer # You can access your past build results through the console or the API. The results include outcome (success or failure), build duration, output artifact location, and log location.
AWS Devops Interview Questions # 34) How can you debug a past build failure in AWS CodeBuild?
Answer # You can debug a build by inspecting the detailed logs generated during the build run.
AWS Devops Interview Questions # 35) What types of applications can you build with AWS CodeStar?
Answer # CodeStar can be used for building web applications, web services and more. The
applications run on Amazon EC2, AWS Elastic Beanstalk or AWS Lambda. Project templates are available in several different programming languages including Java, Node.js (Javascript), PHP, Python and Ruby.
AWS Devops Interview Questions # 36) How do you add, remove or change users for my AWS CodeStar projects?
Answer # You can add, change or remove users for your CodeStar project through the “Team”
section of the CodeStar console. You can choose to grant the users Owner, Contributor or Viewer permissions. You can also remove users or change their roles at any time.
AWS Devops Interview Questions # 37) How do AWS CodeStar users relate to IAM users? Answer # CodeStar users are IAM users that are managed by CodeStar to provide pre-built, role- based access policies across your development environment; Because CodeStar users are built on IAM, you still get the administrative benefits of IAM. For example, if you add an existing IAM user to a CodeStar project, the existing global account policies in IAM are still enforced.
AWS Devops Interview Questions # 38) Can I work on my AWS CodeStar projects directly from an IDE?
Answer # Yes. By installing the AWS Toolkit for Eclipse or Visual Studio you gain the ability to
easily configure your local development environment to work with CodeStar Projects; Once installed, developers can then select from a list of available CodeStar projects and have their development tooling automatically configured to clone and checkout their project’s source code, all from within their IDE.
AWS Devops Interview Questions # 39) How do you configure my project dashboard?
Answer # Project dashboards can be configured to show the tiles you want, where you want them; To add or remove tiles, click on the “Tiles” drop-down on your project dashboard. To change the layout of your project dashboard, drag the tile to your desired position.
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
AWS Devops Interview Questions # 40) Are there any third party integrations that we can use with AWS CodeStar?
Answer # AWS CodeStar works with Atlassian JIRA to integrate issue management with your
projects.
Amazon Devops Engineer Interview Questions
Question # 41) Can we use AWS CodeStar to help manage my existing AWS applications? Answer # No. AWS CodeStar helps customers quickly start new software projects on AWS. Each CodeStar project includes development tools, including AWS CodePipeline, AWS CodeCommit, AWS CodeBuild and AWS CodeDeploy, that can be used on their own and with existing AWS applications.
Question # 42) Why AWS DevOps Matters?
Answer # Software and the Internet have transformed the world and its industries, from shopping to entertainment to banking. Software no longer merely supports a business; rather it becomes an integral component of every part of a business.
Companies interact with their customers through software delivered as online services or applications and on all sorts of devices. They also use software to increase operational efficiencies by transforming every part of the value chain, such as logistics, communications, and operations.
In a similar way that physical goods companies transformed how they design, build, and deliver products using industrial automation throughout the 20th century, companies in today’s world must transform how they build and deliver software.
Question # 43) How to Adopt a AWS DevOps Model?
Answer # Transitioning to DevOps requires a change in culture and mindset. At its simplest, DevOps is about removing the barriers between two traditionally siloed teams, development and operations.
In some organizations, there may not even be separate development and operations teams; engineers may do both. With DevOps, the two teams work together to optimize both the productivity of developers and the reliability of operations.
They strive to communicate frequently, increase efficiencies, and improve the quality of services they provide to customers. They take full ownership for their services, often beyond where their stated roles or titles have traditionally been scoped by thinking about the end customer’s needs and how they can contribute to solving those needs.
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
Quality assurance and security teams may also become tightly integrated with these teams. Organizations using a DevOps model, regardless of their organizational structure, have teams that view the entire development and infrastructure lifecycle as part of their responsibilities.
Question # 44) What are DevOps Practices?
Answer # There are a few key practices that help organizations innovate faster through automating and streamlining the software development and infrastructure management processes. Most of these practices are accomplished with proper tooling.
much more often than organizations using traditional software development practices.
paired with small, agile teams who take ownership of each service, organizations can move more quickly. However, the combination of microservices and increased release frequency leads to significantly more deployments which can present operational challenges.
Thus, DevOps practices like continuous integration and continuous delivery solve these issues and let organizations deliver rapidly in a safe and reliable manner.
Infrastructure automation practices, like infrastructure as code and configuration management, help to keep computing resources elastic and responsive to frequent changes.
In addition, the use of monitoring and logging helps engineers track the performance of applications and infrastructure so they can react quickly to problems.
Together, these practices help organizations deliver faster, more reliable updates to their customers. Here is an overview of important DevOps practices.
Best AWS Devops Interview Questions
Question # 45) What is Continuous Integration in AWS Devops?
Answer # Continuous integration is a software development practice where developers regularly merge their code changes into a central repository, after which automated builds and tests are run. The key goals of continuous integration are to find and address bugs quicker, improve software quality, and reduce the time it takes to validate and release new software updates.
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
Question # 46) What is Continuous Delivery in AWs Devops?
Answer # Continuous delivery is a software development practice where code changes are automatically built, tested, and prepared for a release to production.
It expands upon continuous integration by deploying all code changes to a testing environment and/or a production environment after the build stage. When continuous delivery is implemented properly, developers will always have a deployment-ready build artifact that has passed through a standardized test process.
Question # 47) What are Microservices in AWS Devops?
Answer # The microservices architecture is a design approach to build a single application as a set of small services. Each service runs in its own process and communicates with other services through a well-defined interface using a lightweight mechanism, typically an HTTP-based application programming interface (API).
Microservices are built around business capabilities; each service is scoped to a single purpose. You can use different frameworks or programming languages to write microservices and deploy them independently, as a single service, or as a group of services.
Question # 48) What is Infrastructure as Code in AWS Devops?
Answer # Infrastructure as code is a practice in which infrastructure is provisioned and managed using code and software development techniques, such as version control and continuous integration.
The cloud’s API-driven model enables developers and system administrators to interact with infrastructure programmatically, and at scale, instead of needing to manually set up and configure resources.
Thus, engineers can interface with infrastructure using code-based tools and treat infrastructure in a manner similar to how they treat application code. Because they are defined by code, infrastructure and servers can quickly be deployed using standardized patterns, updated with the latest patches and versions, or duplicated in repeatable ways.
Question # 49) What is AWS CloudFormation in AWS Devops?
Answer # AWS CloudFormation is a service that gives developers and businesses an easy way to create a collection of related AWS resources and provision them in an orderly and predictable fashion.
Question # 50) How is AWS CloudFormation different from AWS Elastic Beanstalk? These services are designed to complement each other. AWS Elastic Beanstalk provides an environment to easily deploy and run applications in the cloud.
Mahi Ratan Reddy Deva , mahiratan.blogger@gmail.com
It is integrated with developer tools and provides a one-stop experience for you to manage the lifecycle of your applications. AWS CloudFormation is a convenient provisioning mechanism for a broad range of AWS resources.
It supports the infrastructure needs of many different types of applications such as existing enterprise applications, legacy applications, applications built using a variety of AWS resources and container- based solutions (including those built using AWS Elastic Beanstalk).