Cloud Computing Serverless and Application Services Syllabus

Compare Standard and Express workflows in AWS Step Functions.

Standard: long-running (up to 1 year), exactly-once, full execution history, priced per state transition. Express: high-volume, short-running (up to 5 min), at-least-once, priced by number and duration of executions; cheaper for high throughput.

Contrast orchestration and choreography in workflow design.

Orchestration uses a central coordinator (e.g., Step Functions) that explicitly directs each step. Choreography has no central controller; services react to events independently via events/messages. Orchestration is easier to monitor; choreography is more loosely coupled.

List the main cost components of a FaaS platform like AWS Lambda.

1) Number of requests (invocations), and 2) Compute duration measured in GB-seconds (allocated memory times execution time). Additional costs may include provisioned concurrency and data transfer.

Give the formula for AWS Lambda compute cost in GB-seconds.

$$\text{GB\text{-}s} = \frac{\text{Memory}_{MB}}{1024} \times \text{Duration}_{s} \times \text{Invocations}$$ Total cost = (GB-s $\times$ price per GB-s) + (invocations $\times$ price per request).

When is serverless (FaaS) most cost-effective versus always-on servers?

Serverless wins for spiky, unpredictable, or low-average traffic because you pay nothing when idle. Steady, high-utilization, sustained workloads often become cheaper on reserved/always-on compute, since per-invocation pricing accumulates.

List key trade-offs (downsides) of serverless architectures.

Cold-start latency, execution time limits, vendor lock-in, harder local testing/debugging, statelessness constraints, per-invocation cost at scale, limited control over runtime, and distributed-system complexity.

Contrast REST and GraphQL APIs.

REST exposes multiple endpoints, each returning fixed resource representations, and can over-/under-fetch. GraphQL exposes a single endpoint where clients query exactly the fields they need in one request, reducing over-fetching but adding server-side complexity and harder HTTP caching.

What are the core REST architectural constraints?

Client-server separation, statelessness, cacheability, uniform interface, layered system, and (optionally) code-on-demand. Resources are identified by URIs and manipulated via standard HTTP methods.

Map common HTTP methods to CRUD operations in REST.

POST = Create, GET = Read (safe, idempotent), PUT = Replace/Update (idempotent), PATCH = Partial update, DELETE = Delete (idempotent). GET, PUT, DELETE are idempotent; POST is not.

What are the three GraphQL root operation types?

Query (read data), Mutation (write/modify data), and Subscription (real-time updates over a persistent connection, typically WebSockets).

What is the N+1 problem in GraphQL and how is it mitigated?

Resolving a list plus a related field triggers 1 query for the list and N queries for each item's relation. It is mitigated with batching/caching via a DataLoader that coalesces requests into a single batched fetch.

What is an API Gateway?

A managed service that sits in front of backend services as a single entry point, handling request routing, authentication/authorization, rate limiting/throttling, request/response transformation, caching, and protocol translation.

List key features provided by a managed API Gateway.

Routing, authN/authZ (API keys, JWT, IAM, OAuth), throttling/rate limiting, caching, request/response mapping/validation, usage plans, TLS termination, WAF integration, and monitoring/logging.

Compare REST APIs and HTTP APIs in Amazon API Gateway.

REST APIs offer richer features (API keys, usage plans, request validation, WAF, private endpoints) at higher cost. HTTP APIs are lower-latency, cheaper, and simpler, supporting JWT auth and Lambda/HTTP integrations but fewer advanced features.

What is throttling in an API Gateway and how is it typically configured?

Limiting the rate of requests to protect backends. Usually configured with a steady-state rate limit (requests per second) plus a burst limit (bucket capacity) using a token-bucket algorithm; excess requests receive HTTP 429.

Explain the token-bucket algorithm used for rate limiting.

A bucket holds up to $b$ tokens (burst capacity) and refills at rate $r$ tokens/sec. Each request consumes a token; if the bucket is empty the request is throttled. It allows short bursts up to $b$ while enforcing average rate $r$.

What are common API versioning strategies?

URI path versioning (/v1/users), query-parameter versioning (?version=1), custom header versioning (Api-Version: 1), and media-type/content-negotiation versioning (Accept: application/vnd.api.v1+json).

Why version an API, and what is a breaking change?

Versioning lets you evolve an API without breaking existing clients. A breaking change alters the contract in a backward-incompatible way (removing/renaming fields, changing types, altering required params, changing response structure).

What is OpenAPI (Swagger) and what is it used for?

A standard, language-agnostic specification (YAML/JSON) that describes REST APIs: endpoints, methods, parameters, request/response schemas, and auth. It enables auto-generated documentation, client SDKs, server stubs, and request validation.

What is a managed message queue and what pattern does it enable?

A fully managed service (e.g., Amazon SQS, Azure Service Bus) that stores messages between producers and consumers, enabling asynchronous, decoupled point-to-point communication where each message is processed by one consumer.

Compare Amazon SQS Standard and FIFO queues.

Standard: nearly unlimited throughput, best-effort ordering, at-least-once delivery (possible duplicates). FIFO: strict ordering within a message group, exactly-once processing (deduplication), but limited throughput (300 msg/s, up to 3000 with batching).

What is the SQS visibility timeout?

The period after a consumer receives a message during which the message is hidden from other consumers. If not deleted before the timeout expires, the message becomes visible again for reprocessing (default 30s).

What is a dead-letter queue (DLQ)?

A separate queue where messages are routed after failing to be processed successfully a configured number of times (max receive count). It isolates poison/problematic messages for later inspection without blocking the main queue.

Contrast message queues with pub/sub notification services.

A queue delivers each message to exactly one consumer (point-to-point, competing consumers). Pub/sub delivers each message to all subscribers of a topic (one-to-many broadcast/fan-out).

What is Amazon SNS and how does it work?

A managed pub/sub notification service. Publishers send messages to a topic; SNS pushes each message to all subscribers of that topic. Subscribers can be SQS queues, Lambda functions, HTTP(S) endpoints, email, or SMS.

What is Google Cloud Pub/Sub and how does its delivery model differ from plain SNS?

A managed messaging service combining pub/sub with durable message storage. Unlike push-only SNS, Pub/Sub decouples topics from subscriptions: each subscription retains messages and supports both pull and push delivery with at-least-once guarantees and acknowledgements.

What is an event bus, and what is Amazon EventBridge?

An event bus is a router that receives events and delivers them to targets based on rules. EventBridge is AWS's serverless event bus that ingests events from AWS services, SaaS partners, and custom apps, then routes them via content-based rule matching.

How does EventBridge route events, and how does this differ from SNS?

EventBridge uses rules with content-based filtering (event patterns matching JSON fields) to route to many targets, plus a schema registry and archive/replay. SNS routes by topic subscription with simpler attribute filtering and no built-in content routing or replay.

When would you choose SQS vs. SNS vs. EventBridge?

SQS: decouple with a durable queue and one consumer per message. SNS: high-throughput fan-out/broadcast to many subscribers. EventBridge: event-driven routing with rich content-based filtering, schema management, and many SaaS/AWS integrations.

What delivery guarantee levels exist in messaging, and what do they mean?

At-most-once (may lose messages, no duplicates), at-least-once (never lost but possible duplicates, requires idempotent consumers), and exactly-once (each message processed precisely once, hardest and costliest to guarantee).