DevOps Amazon AWS Syllabus

What is Amazon DynamoDB?

DynamoDB is a fully managed, serverless NoSQL key-value and document database offering single-digit millisecond latency at any scale, automatic scaling, and built-in high availability with replication across multiple AZs.

What is Amazon Aurora and how does it differ from standard RDS MySQL/PostgreSQL?

Aurora is AWS's cloud-native relational database compatible with MySQL and PostgreSQL, offering up to 5x MySQL and 3x PostgreSQL throughput, storage that auto-scales to 128 TB, and six-way replication across three AZs for higher performance and availability.

What is Amazon Redshift used for?

Amazon Redshift is a fully managed, petabyte-scale cloud data warehouse optimized for online analytical processing (OLAP) and complex analytical queries over large datasets, using columnar storage and massively parallel processing (MPP).

What is Amazon ElastiCache?

ElastiCache is a managed in-memory caching service supporting Redis and Memcached engines, used to improve application performance by caching frequently accessed data and reducing load on backend databases.

What is an Amazon VPC?

Amazon Virtual Private Cloud (VPC) is a logically isolated virtual network within AWS where you launch resources. You control IP address ranges (CIDR blocks), subnets, route tables, internet gateways, and security settings.

What is the difference between a Security Group and a Network ACL in a VPC?

A Security Group is a stateful firewall at the instance level (return traffic auto-allowed, allow rules only). A Network ACL (NACL) is a stateless firewall at the subnet level (allow and deny rules, return traffic must be explicitly allowed).

What is Amazon CloudFront?

CloudFront is AWS's global Content Delivery Network (CDN) that caches and delivers content (web pages, videos, APIs) from edge locations close to users for low latency and high transfer speeds, with built-in DDoS protection.

What is Amazon Route 53?

Route 53 is AWS's highly available and scalable Domain Name System (DNS) web service. It performs domain registration, DNS routing (latency-based, geolocation, weighted, failover), and health checks for resources.

What is the difference between an Internet Gateway and a NAT Gateway in a VPC?

An Internet Gateway allows resources in public subnets to send and receive traffic to/from the internet (inbound and outbound). A NAT Gateway lets instances in private subnets initiate outbound internet traffic while preventing inbound connections from the internet.

What is AWS Identity and Access Management (IAM)?

IAM is the service for securely managing access to AWS resources. It lets you create users, groups, and roles, and attach policies that define permissions, controlling authentication (who) and authorization (what they can do).

What are the core IAM identity entities, and how do they differ?

Users (individual identities with long-term credentials), Groups (collections of users sharing permissions), and Roles (temporary credentials assumed by users, services, or applications). Policies (JSON documents) define the permissions attached to these entities.

What is the difference between an IAM user and an IAM role?

An IAM user has permanent credentials tied to a specific person/application. An IAM role has no long-term credentials; it is assumed temporarily by a trusted entity (user, AWS service, or external account) which receives temporary security credentials.

What is the IAM principle of least privilege?

The least privilege principle means granting only the minimum permissions required to perform a task, and no more. It reduces the security blast radius if credentials are compromised and is a core IAM best practice.

In an IAM policy evaluation, what is the order of precedence between Allow and Deny?

By default all requests are implicitly denied. An explicit Allow grants access, but an explicit Deny always overrides any Allow. So: explicit Deny > explicit Allow > implicit (default) Deny.

What is AWS Key Management Service (KMS)?

AWS KMS is a managed service for creating and controlling cryptographic keys (KMS keys / CMKs) used to encrypt data across AWS services. It centralizes key management, enforces access policies, and integrates with CloudTrail for key-usage auditing.

What is the difference between AWS-managed keys, customer-managed keys, and AWS-owned keys in KMS?

AWS-owned keys are used by AWS across accounts (not visible to you); AWS-managed keys are created automatically by services in your account (you can't manage rotation/policy); customer-managed keys (CMKs) are created and fully controlled by you, including rotation and key policies.

What is envelope encryption in AWS KMS?

Envelope encryption is encrypting data with a data key, then encrypting that data key with a KMS key (CMK). The encrypted data key is stored alongside the data; KMS decrypts the data key when needed, so the master key never leaves KMS.

What is AWS CloudTrail?

CloudTrail is a governance and auditing service that records API calls and account activity across AWS. It logs who did what, when, and from where, delivering event history to the console, S3, and CloudWatch for compliance and security analysis.

What are the main event types CloudTrail records?

Management events (control-plane operations like creating resources), Data events (high-volume data-plane operations such as S3 object-level or Lambda invoke activity), and Insights events (detection of unusual API activity patterns).

What is the difference between AWS CloudTrail and Amazon CloudWatch?

CloudTrail records API/account activity for auditing and governance (the 'who did what'). CloudWatch monitors operational performance and resource metrics/logs (the 'how is it performing'). CloudTrail answers security questions; CloudWatch answers performance questions.

What is AWS Shield, and what are its two tiers?

AWS Shield is a managed DDoS protection service. Shield Standard is free and automatically protects against common layer 3/4 attacks; Shield Advanced is a paid tier adding enhanced protection, 24/7 DDoS Response Team (DRT) access, and cost-protection for scaling during attacks.

What is AWS WAF, and at which layer does it operate?

AWS WAF (Web Application Firewall) protects web applications at layer 7 (application layer) by filtering HTTP/HTTPS requests. It uses rules and rule groups to block common exploits like SQL injection and cross-site scripting (XSS).

How do AWS WAF and AWS Shield differ in the protection they provide?

AWS Shield protects against DDoS attacks (volumetric, layers 3/4 and some 7). AWS WAF protects at layer 7 against application exploits (SQLi, XSS, bad bots) by inspecting request content. They are complementary and often used together.

What is AWS CloudFormation?

CloudFormation is an Infrastructure-as-Code (IaC) service that lets you model and provision AWS resources using declarative templates (JSON or YAML). It creates and manages a collection of related resources as a single unit called a stack.

In AWS CloudFormation, what is a stack and what is a template?

A template is a JSON/YAML text file describing the AWS resources and their configuration. A stack is the running collection of resources created from a template, managed as a single unit so they can be created, updated, or deleted together.

What is a CloudFormation change set?

A change set is a preview of how proposed modifications to a stack's template will affect running resources before you apply them, letting you review additions, modifications, and deletions to avoid unintended changes.

What is Amazon CloudWatch?

CloudWatch is a monitoring and observability service that collects metrics, logs, and events from AWS resources and applications. It supports dashboards, alarms, and automated actions to track performance and operational health in real time.

What is the difference between a CloudWatch metric, alarm, and log?

A metric is a time-ordered set of data points (e.g., CPUUtilization). An alarm watches a metric against a threshold and triggers actions (e.g., notify or auto scale). CloudWatch Logs collect and store log files for analysis and monitoring.

What is AWS Systems Manager (SSM)?

AWS Systems Manager is a unified management service that provides operational control and automation of AWS and on-premises resources. Features include Run Command, Patch Manager, Parameter Store, Session Manager, and Automation documents.

What is AWS Systems Manager Parameter Store used for?

Parameter Store provides secure, hierarchical storage for configuration data and secrets such as passwords, database strings, and license codes. Values can be stored as plain text or encrypted with KMS (SecureString) and referenced by applications.

What is AWS Config, and what does it track?

AWS Config continuously records and evaluates the configuration of your AWS resources over time. It tracks configuration changes, maintains a history, and uses Config Rules to assess compliance against desired settings.

What is the difference between AWS Config and AWS CloudTrail?

AWS Config tracks the configuration state and changes of resources over time (the 'what does it look like / is it compliant'). CloudTrail records the API calls/actions taken (the 'who did it and when'). Config focuses on configuration; CloudTrail on activity.

What is AWS CodeCommit?

CodeCommit is a fully managed, secure source-control service that hosts private Git repositories in AWS. It scales automatically, encrypts repositories, and integrates with IAM for access control and with other AWS developer tools in the CI/CD pipeline.

What is AWS CodeBuild?

CodeBuild is a fully managed continuous integration service that compiles source code, runs tests, and produces deployment-ready artifacts. It scales automatically, runs builds in parallel, and is billed per build minute with no servers to manage.

How do CodeCommit, CodeBuild, and CodeDeploy fit together in the AWS CI/CD pipeline?

CodeCommit stores the source code (version control), CodeBuild compiles and tests it (continuous integration), and CodeDeploy releases the built artifacts to compute targets (continuous deployment). AWS CodePipeline orchestrates these stages end to end.

What does the buildspec.yml file define in AWS CodeBuild?

The buildspec.yml is a YAML file that tells CodeBuild how to run a build. It defines phases (install, pre_build, build, post_build), environment variables, and the artifacts to output.

What is the AWS Shared Responsibility Model?

It divides security duties: AWS is responsible for security 'of' the cloud (hardware, global infrastructure, managed service software); the customer is responsible for security 'in' the cloud (data, IAM configuration, OS/network/firewall settings, encryption).

What is the difference between vertical scaling and horizontal scaling in AWS?

Vertical scaling (scaling up) increases the size/power of a single instance (e.g., larger EC2 type). Horizontal scaling (scaling out) adds more instances to distribute load, typically via Auto Scaling Groups and a load balancer for elasticity and fault tolerance.

What is the purpose of an AWS IAM policy's JSON structure (key elements)?

An IAM policy JSON specifies Effect (Allow/Deny), Action (API operations), Resource (ARNs the actions apply to), and optionally Condition (constraints like IP or MFA) and Principal (who, in resource-based policies).