DevOps Amazon AWS Flashcards

24 sample cards from the Amazon AWS deck

Sampled from the end of the deck, so these are different cards from the ones shown on the syllabus page.

1. What is the difference between AWS-managed keys, customer-managed keys, and AWS-owned keys in KMS?

   AWS-owned keys are used by AWS across accounts (not visible to you); AWS-managed keys are created automatically by services in your account (you can't manage rotation/policy); customer-managed keys (CMKs) are created and fully controlled by you, including rotation and key policies.

2. What is envelope encryption in AWS KMS?

   Envelope encryption is encrypting data with a data key, then encrypting that data key with a KMS key (CMK). The encrypted data key is stored alongside the data; KMS decrypts the data key when needed, so the master key never leaves KMS.

3. What is AWS CloudTrail?

   CloudTrail is a governance and auditing service that records API calls and account activity across AWS. It logs who did what, when, and from where, delivering event history to the console, S3, and CloudWatch for compliance and security analysis.

4. What are the main event types CloudTrail records?

   Management events (control-plane operations like creating resources), Data events (high-volume data-plane operations such as S3 object-level or Lambda invoke activity), and Insights events (detection of unusual API activity patterns).

5. What is the difference between AWS CloudTrail and Amazon CloudWatch?

   CloudTrail records API/account activity for auditing and governance (the 'who did what'). CloudWatch monitors operational performance and resource metrics/logs (the 'how is it performing'). CloudTrail answers security questions; CloudWatch answers performance questions.

6. What is AWS Shield, and what are its two tiers?

   AWS Shield is a managed DDoS protection service. Shield Standard is free and automatically protects against common layer 3/4 attacks; Shield Advanced is a paid tier adding enhanced protection, 24/7 DDoS Response Team (DRT) access, and cost-protection for scaling during attacks.

7. What is AWS WAF, and at which layer does it operate?

   AWS WAF (Web Application Firewall) protects web applications at layer 7 (application layer) by filtering HTTP/HTTPS requests. It uses rules and rule groups to block common exploits like SQL injection and cross-site scripting (XSS).

8. How do AWS WAF and AWS Shield differ in the protection they provide?

   AWS Shield protects against DDoS attacks (volumetric, layers 3/4 and some 7). AWS WAF protects at layer 7 against application exploits (SQLi, XSS, bad bots) by inspecting request content. They are complementary and often used together.

9. What is AWS CloudFormation?

   CloudFormation is an Infrastructure-as-Code (IaC) service that lets you model and provision AWS resources using declarative templates (JSON or YAML). It creates and manages a collection of related resources as a single unit called a stack.

10. In AWS CloudFormation, what is a stack and what is a template?

    A template is a JSON/YAML text file describing the AWS resources and their configuration. A stack is the running collection of resources created from a template, managed as a single unit so they can be created, updated, or deleted together.

11. What is a CloudFormation change set?

    A change set is a preview of how proposed modifications to a stack's template will affect running resources before you apply them, letting you review additions, modifications, and deletions to avoid unintended changes.

12. What is Amazon CloudWatch?

    CloudWatch is a monitoring and observability service that collects metrics, logs, and events from AWS resources and applications. It supports dashboards, alarms, and automated actions to track performance and operational health in real time.

13. What is the difference between a CloudWatch metric, alarm, and log?

    A metric is a time-ordered set of data points (e.g., CPUUtilization). An alarm watches a metric against a threshold and triggers actions (e.g., notify or auto scale). CloudWatch Logs collect and store log files for analysis and monitoring.

14. What is AWS Systems Manager (SSM)?

    AWS Systems Manager is a unified management service that provides operational control and automation of AWS and on-premises resources. Features include Run Command, Patch Manager, Parameter Store, Session Manager, and Automation documents.

15. What is AWS Systems Manager Parameter Store used for?

    Parameter Store provides secure, hierarchical storage for configuration data and secrets such as passwords, database strings, and license codes. Values can be stored as plain text or encrypted with KMS (SecureString) and referenced by applications.

16. What is AWS Config, and what does it track?

    AWS Config continuously records and evaluates the configuration of your AWS resources over time. It tracks configuration changes, maintains a history, and uses Config Rules to assess compliance against desired settings.

17. What is the difference between AWS Config and AWS CloudTrail?

    AWS Config tracks the configuration state and changes of resources over time (the 'what does it look like / is it compliant'). CloudTrail records the API calls/actions taken (the 'who did it and when'). Config focuses on configuration; CloudTrail on activity.

18. What is AWS CodeCommit?

    CodeCommit is a fully managed, secure source-control service that hosts private Git repositories in AWS. It scales automatically, encrypts repositories, and integrates with IAM for access control and with other AWS developer tools in the CI/CD pipeline.

19. What is AWS CodeBuild?

    CodeBuild is a fully managed continuous integration service that compiles source code, runs tests, and produces deployment-ready artifacts. It scales automatically, runs builds in parallel, and is billed per build minute with no servers to manage.

20. How do CodeCommit, CodeBuild, and CodeDeploy fit together in the AWS CI/CD pipeline?

    CodeCommit stores the source code (version control), CodeBuild compiles and tests it (continuous integration), and CodeDeploy releases the built artifacts to compute targets (continuous deployment). AWS CodePipeline orchestrates these stages end to end.

21. What does the buildspec.yml file define in AWS CodeBuild?

    The buildspec.yml is a YAML file that tells CodeBuild how to run a build. It defines phases (install, pre_build, build, post_build), environment variables, and the artifacts to output.

22. What is the AWS Shared Responsibility Model?

    It divides security duties: AWS is responsible for security 'of' the cloud (hardware, global infrastructure, managed service software); the customer is responsible for security 'in' the cloud (data, IAM configuration, OS/network/firewall settings, encryption).

23. What is the difference between vertical scaling and horizontal scaling in AWS?

    Vertical scaling (scaling up) increases the size/power of a single instance (e.g., larger EC2 type). Horizontal scaling (scaling out) adds more instances to distribute load, typically via Auto Scaling Groups and a load balancer for elasticity and fault tolerance.

24. What is the purpose of an AWS IAM policy's JSON structure (key elements)?

    An IAM policy JSON specifies Effect (Allow/Deny), Action (API operations), Resource (ARNs the actions apply to), and optionally Condition (constraints like IP or MFA) and Principal (who, in resource-based policies).

What this deck covers

Amazon AWS flashcards FAQ