<?xml version="1.0" encoding="utf-8"?>
<feed xmlns="http://www.w3.org/2005/Atom">
  <title>Technical Tips to Revitalize Your Devices and Memory</title>
  <icon>https://www.gravatar.com/avatar/b6dadb269a35798c0a6db2cf38988125</icon>
  <subtitle>Pablo Magro&#39;s Blog (Developer)</subtitle>
  <link href="https://blog.pablo-magro-gaspar.site/atom.xml" rel="self"/>
  
  <link href="https://blog.pablo-magro-gaspar.site/"/>
  <updated>2026-04-14T20:03:04.026Z</updated>
  <id>https://blog.pablo-magro-gaspar.site/</id>
  
  <author>
    <name>Pablo Magro Gaspar</name>
    <email>pmagas@gmail.com</email>
  </author>
  
  <generator uri="https://hexo.io/">Hexo</generator>
  
  <entry>
    <title>Getting started with Hexo</title>
    <link href="https://blog.pablo-magro-gaspar.site/2026/04/14/Getting-Started-With-Hexo/"/>
    <id>https://blog.pablo-magro-gaspar.site/2026/04/14/Getting-Started-With-Hexo/</id>
    <published>2026-04-14T20:03:04.026Z</published>
    <updated>2026-04-14T20:03:04.026Z</updated>
    
    <content type="html"><![CDATA[<p>Welcome to <a href="https://hexo.io/">Hexo</a>! This is your very first post. Check <a href="https://hexo.io/docs/">documentation</a> for more info. If you get any problems when using Hexo, you can find the answer in <a href="https://hexo.io/docs/troubleshooting.html">troubleshooting</a> or you can ask me on <a href="https://github.com/hexojs/hexo/issues">GitHub</a>.</p><h2 id="Quick-Start"><a href="#Quick-Start" class="headerlink" title="Quick Start"></a>Quick Start</h2><h3 id="Create-a-new-post"><a href="#Create-a-new-post" class="headerlink" title="Create a new post"></a>Create a new post</h3><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">$ hexo new <span class="string">&quot;My New Post&quot;</span></span><br></pre></td></tr></table></figure><p>More info: <a href="https://hexo.io/docs/writing.html">Writing</a></p><h3 id="Run-server"><a href="#Run-server" class="headerlink" title="Run server"></a>Run server</h3><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">$ hexo server</span><br></pre></td></tr></table></figure><p>More info: <a href="https://hexo.io/docs/server.html">Server</a></p><h3 id="Setup-deployment-to-github"><a href="#Setup-deployment-to-github" class="headerlink" title="Setup deployment to github"></a>Setup deployment to github</h3><p>Install the hexo-deployer-git module using NPM and add the following bits of configuration to your <code>_config.yml</code> file to set it up:</p><h4 id="Installation"><a href="#Installation" class="headerlink" title="Installation"></a>Installation</h4><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">$ npm install hexo-deployer-git --save</span><br></pre></td></tr></table></figure><h4 id="Options"><a href="#Options" class="headerlink" title="Options"></a>Options</h4><figure class="highlight yml"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line"><span class="attr">deploy:</span></span><br><span class="line">  <span class="attr">type:</span> <span class="string">git</span></span><br><span class="line">  <span class="attr">repo:</span> <span class="string">https://github.com/yourusername/your-blog-url.github.io.git</span></span><br><span class="line">  <span class="attr">branch:</span> <span class="string">master</span></span><br><span class="line">  <span class="attr">message:</span> <span class="string">Default</span> <span class="string">to</span> <span class="string">Site</span> <span class="string">updated</span> &#123;&#123; <span class="string">now(&#x27;YYYY-MM-DD</span> <span class="string">HH:mm:ss&#x27;)</span> &#125;&#125;</span><br></pre></td></tr></table></figure><p>Replace the [username] bits with your username and save the configuration. <code>your-blog-url.github.io.git</code> has to be created previously into GitHub.Now you can run the following set of commands to generate and deploy your website:</p><h3 id="Generate-static-files"><a href="#Generate-static-files" class="headerlink" title="Generate static files"></a>Generate static files</h3><p>Generate Markdown to HTML.</p><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">$ hexo generate</span><br></pre></td></tr></table></figure><p>More info: <a href="https://hexo.io/docs/generating.html">Generating</a></p><h3 id="Deploy-to-remote-sites"><a href="#Deploy-to-remote-sites" class="headerlink" title="Deploy to remote sites"></a>Deploy to remote sites</h3><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">$ hexo deploy</span><br></pre></td></tr></table></figure><h3 id="Just-create-a-common-npm-script"><a href="#Just-create-a-common-npm-script" class="headerlink" title="Just create a common npm script."></a>Just create a common npm script.</h3><p>You can create a script in <code>package.json</code> file including above commands in one.</p><figure class="highlight json"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line"><span class="attr">&quot;scripts&quot;</span><span class="punctuation">:</span> <span class="punctuation">&#123;</span></span><br><span class="line">  <span class="attr">&quot;deploy&quot;</span><span class="punctuation">:</span> <span class="string">&quot;hexo generate &amp;&amp; hexo deploy&quot;</span><span class="punctuation">,</span></span><br><span class="line">  <span class="attr">&quot;watch&quot;</span><span class="punctuation">:</span> <span class="string">&quot;hexo server --draft --open&quot;</span></span><br><span class="line"><span class="punctuation">&#125;</span></span><br></pre></td></tr></table></figure><p>More info: <a href="https://hexo.io/docs/deployment.html">Deployment</a></p><h3 id="Using-a-custom-Domain-CNAME"><a href="#Using-a-custom-Domain-CNAME" class="headerlink" title="Using a custom Domain (CNAME)."></a>Using a custom Domain (CNAME).</h3><p>To use a custom domain for your Hexo website, e.g. blog.pablomagro.co.nz instead of pablomagro.github.io, then you need to create a file named <strong>CNAME</strong> to the hexo project source directory</p><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line"><span class="built_in">source</span>/CNAME</span><br><span class="line">blog.pablomagro.co.nz</span><br></pre></td></tr></table></figure><p>You will need to own this custom domain and set your domain to point to the actual web address.</p><p>For example:</p><p><img src="https://c1.staticflickr.com/9/8292/29032060104_be33416b81_o.png" alt="GoDaddy Hosting"></p><h2 id="Enabling-Disqus-Comments"><a href="#Enabling-Disqus-Comments" class="headerlink" title="Enabling Disqus Comments"></a>Enabling Disqus Comments</h2><h3 id="Register-for-a-Disqus-Account"><a href="#Register-for-a-Disqus-Account" class="headerlink" title="Register for a Disqus Account"></a>Register for a Disqus Account</h3><p>In order to setup Disqus on your Hexo site you must first create a Disqus account by registering at the following link: <a href="https://disqus.com/profile/signup/">https://disqus.com/profile/signup/</a>.</p><p>Reed more from the following <a href="http://dddotcom.github.io/2014/12/28/enabling-disqus-comments/">link</a>.</p><hr><h2 id="Install-additional-plugins"><a href="#Install-additional-plugins" class="headerlink" title="Install additional plugins"></a>Install additional plugins</h2><h3 id="hexo-renderer-marked"><a href="#hexo-renderer-marked" class="headerlink" title="hexo-renderer-marked"></a>hexo-renderer-marked</h3><p>The hexo marked renderer is a markdown rendering engine that enables you to configure how your markdown should be processed. The module follows commonmark specs as much as possible.</p><p>More info: <a href="https://github.com/hexojs/hexo-renderer-marked">Rendered Marked</a></p><h4 id="Installation-1"><a href="#Installation-1" class="headerlink" title="Installation"></a>Installation</h4><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">$ npm install hexo-renderer-marked --save</span><br></pre></td></tr></table></figure><h4 id="Options-1"><a href="#Options-1" class="headerlink" title="Options"></a>Options</h4><p>You can configure this plugin in <code>_config.yml</code>.</p><figure class="highlight yaml"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment"># Marked renderer</span></span><br><span class="line"><span class="attr">marked:</span></span><br><span class="line">  <span class="attr">gfm:</span> <span class="literal">true</span></span><br><span class="line">  <span class="attr">pedantic:</span> <span class="literal">false</span></span><br><span class="line">  <span class="attr">sanitize:</span> <span class="literal">false</span></span><br><span class="line">  <span class="attr">tables:</span> <span class="literal">true</span></span><br><span class="line">  <span class="attr">breaks:</span> <span class="literal">false</span></span><br><span class="line">  <span class="attr">smartLists:</span> <span class="literal">true</span></span><br><span class="line">  <span class="attr">smartypants:</span> <span class="literal">true</span></span><br></pre></td></tr></table></figure><h3 id="hexo-generator-category"><a href="#hexo-generator-category" class="headerlink" title="hexo-generator-category"></a>hexo-generator-category</h3><p>If you like, you can include a page for every category you use on your weblog. Add a property to your markdown files that specify in which category the post belongs and install this module to generate a page for that category.</p><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br></pre></td><td class="code"><pre><span class="line">---</span><br><span class="line">title: youtube-dl</span><br><span class="line">tags: youtube-dl</span><br><span class="line">categories: CLI</span><br><span class="line">date: 2016-09-13 16:13:19</span><br><span class="line">---</span><br></pre></td></tr></table></figure><h4 id="Installation-2"><a href="#Installation-2" class="headerlink" title="Installation"></a>Installation</h4><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">$ npm install hexo-generator-category --save</span><br></pre></td></tr></table></figure><h4 id="Options-2"><a href="#Options-2" class="headerlink" title="Options"></a>Options</h4><p>You can configure this plugin in <code>_config.yml</code>.</p><figure class="highlight yaml"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line"><span class="attr">category_generator:</span></span><br><span class="line">  <span class="attr">per_page:</span> <span class="number">10</span></span><br></pre></td></tr></table></figure><h3 id="hexo-generator-tag"><a href="#hexo-generator-tag" class="headerlink" title="hexo-generator-tag"></a>hexo-generator-tag</h3><p>You can select a tag and go to a page listing all the posts that are tagged with that particular tag. The hexo-generator-tag module is required for this functionality, so I suggest you install this if you like to enable people to browse your site by tag.</p><h4 id="Installation-3"><a href="#Installation-3" class="headerlink" title="Installation"></a>Installation</h4><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">$ npm install hexo-generator-tag --save</span><br></pre></td></tr></table></figure><h4 id="Options-3"><a href="#Options-3" class="headerlink" title="Options"></a>Options</h4><p>You can configure this plugin in <code>_config.yml</code>.</p><figure class="highlight yaml"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line"><span class="attr">tag_generator:</span></span><br><span class="line">  <span class="attr">per_page:</span> <span class="number">10</span></span><br></pre></td></tr></table></figure><!---### hexo-generator-cnameYou can use a custom domain name for your github pages website. All you need to do is add a CNAME file with your custom domainname in it and link the Github IP-Address in your DNS registration to your domainname.#### Installation<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">$ npm install hexo-generator-cname --save</span><br></pre></td></tr></table></figure><h4 id="Enable"><a href="#Enable" class="headerlink" title="Enable"></a>Enable</h4><p>Add hexo-generator-cname to plugins in <code>_config.yml</code>.</p><figure class="highlight yaml"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line"><span class="attr">plugins:</span></span><br><span class="line">  <span class="bullet">-</span> <span class="string">hexo-generator-cname</span></span><br></pre></td></tr></table></figure><p>–&gt;</p><h3 id="hexo-generator-feed"><a href="#hexo-generator-feed" class="headerlink" title="hexo-generator-feed"></a>hexo-generator-feed</h3><p>Feed generator for Hexo</p><h4 id="Installation-4"><a href="#Installation-4" class="headerlink" title="Installation"></a>Installation</h4><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">$ npm install hexo-generator-feed --save</span><br></pre></td></tr></table></figure><h4 id="Options-4"><a href="#Options-4" class="headerlink" title="Options"></a>Options</h4><p>You can configure this plugin in <code>_config.yml</code>.</p><figure class="highlight yaml"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line"><span class="attr">feed:</span></span><br><span class="line">  <span class="attr">type:</span> <span class="string">atom</span></span><br><span class="line">  <span class="attr">path:</span> <span class="string">atom.xml</span></span><br><span class="line">  <span class="attr">limit:</span> <span class="number">20</span></span><br><span class="line">  <span class="attr">hub:</span></span><br></pre></td></tr></table></figure><ul><li><strong>type</strong> - Feed type. (atom&#x2F;rss2)</li><li><strong>path</strong> - Feed path. (Default: atom.xml&#x2F;rss2.xml)</li><li><strong>limit</strong> - Maximum number of posts in the feed (Use <code>0</code> or <code>false</code> to show all posts)</li><li><strong>hub</strong> - URL of the PubSubHubbub hubs (Leave it empty if you don’t use it)</li></ul>]]></content>
    
    
      
      
    <summary type="html">&lt;p&gt;Welcome to &lt;a href=&quot;https://hexo.io/&quot;&gt;Hexo&lt;/a&gt;! This is your very first post. Check &lt;a href=&quot;https://hexo.io/docs/&quot;&gt;documentation&lt;/a&gt; for</summary>
      
    
    
    
    <category term="Hexo" scheme="https://blog.pablo-magro-gaspar.site/categories/Hexo/"/>
    
    
    <category term="Hexo" scheme="https://blog.pablo-magro-gaspar.site/tags/Hexo/"/>
    
  </entry>
  
  <entry>
    <title>Claude Code - Skills Setup</title>
    <link href="https://blog.pablo-magro-gaspar.site/2026/04/14/Claude-Code-Skills-Setup/"/>
    <id>https://blog.pablo-magro-gaspar.site/2026/04/14/Claude-Code-Skills-Setup/</id>
    <published>2026-04-14T12:00:00.000Z</published>
    <updated>2026-04-14T20:03:04.026Z</updated>
    
    <content type="html"><![CDATA[<p><a href="https://claude.ai/code">Claude Code</a> is Anthropic’s official CLI for Claude. It can be extended with <strong>skills</strong> — reusable slash commands that give Claude structured workflows for common tasks like debugging, testing, code review, and more.</p><h2 id="Installing-Skills"><a href="#Installing-Skills" class="headerlink" title="Installing Skills"></a>Installing Skills</h2><p>Skills are installed via <code>npx skills</code>. The <code>-g</code> flag installs them globally (available in all projects) and <code>-y</code> auto-confirms.</p><h3 id="Sequential-Thinking"><a href="#Sequential-Thinking" class="headerlink" title="Sequential Thinking"></a>Sequential Thinking</h3><p>Systematic step-by-step reasoning with the ability to revise and branch thoughts.</p><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">npx skills add mrgoonie/claudekit-skills@sequential-thinking -g -y</span><br></pre></td></tr></table></figure><p>Invoke with: <code>/sequential-thinking</code></p><h3 id="Superpowers-Bundle-14-skills"><a href="#Superpowers-Bundle-14-skills" class="headerlink" title="Superpowers Bundle (14 skills)"></a>Superpowers Bundle (14 skills)</h3><p>A curated bundle covering the most common development workflows.</p><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">npx skills add obra/superpowers -g -y</span><br></pre></td></tr></table></figure><h3 id="Context7-—-Live-Library-Documentation"><a href="#Context7-—-Live-Library-Documentation" class="headerlink" title="Context7 — Live Library Documentation"></a>Context7 — Live Library Documentation</h3><p>Fetches up-to-date documentation for libraries and frameworks in real time.</p><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment"># Install the skill</span></span><br><span class="line">npx skills add upstash/context7@context7-mcp -g -y</span><br><span class="line">npx skills add intellectronica/agent-skills@context7 -g -y</span><br><span class="line"></span><br><span class="line"><span class="comment"># Activate the MCP server</span></span><br><span class="line">claude mcp add context7 -- npx -y @upstash/context7-mcp@latest</span><br></pre></td></tr></table></figure><p>Invoke with: <code>/context7</code></p><h2 id="Official-Claude-Plugin"><a href="#Official-Claude-Plugin" class="headerlink" title="Official Claude Plugin"></a>Official Claude Plugin</h2><h3 id="Code-Simplifier"><a href="#Code-Simplifier" class="headerlink" title="Code Simplifier"></a>Code Simplifier</h3><p>Reviews changed code for reuse, quality, and efficiency, then fixes issues found.</p><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">claude plugin install code-simplifier</span><br></pre></td></tr></table></figure><p>Invoke with: <code>/simplify</code></p><h2 id="Quick-Reference-—-All-Skills"><a href="#Quick-Reference-—-All-Skills" class="headerlink" title="Quick Reference — All Skills"></a>Quick Reference — All Skills</h2><table><thead><tr><th>Skill</th><th>Command</th></tr></thead><tbody><tr><td>Sequential Thinking</td><td><code>/sequential-thinking</code></td></tr><tr><td>Brainstorming</td><td><code>/brainstorming</code></td></tr><tr><td>Writing Plans</td><td><code>/writing-plans</code></td></tr><tr><td>Executing Plans</td><td><code>/executing-plans</code></td></tr><tr><td>Test-Driven Development</td><td><code>/test-driven-development</code></td></tr><tr><td>Systematic Debugging</td><td><code>/systematic-debugging</code></td></tr><tr><td>Subagent Development</td><td><code>/subagent-driven-development</code></td></tr><tr><td>Parallel Agents</td><td><code>/dispatching-parallel-agents</code></td></tr><tr><td>Git Worktrees</td><td><code>/using-git-worktrees</code></td></tr><tr><td>Verification</td><td><code>/verification-before-completion</code></td></tr><tr><td>Code Review (request)</td><td><code>/requesting-code-review</code></td></tr><tr><td>Code Review (receive)</td><td><code>/receiving-code-review</code></td></tr><tr><td>Finish Branch</td><td><code>/finishing-a-development-branch</code></td></tr><tr><td>Context7 Docs</td><td><code>/context7</code></td></tr><tr><td>Code Simplifier</td><td><code>/simplify</code></td></tr></tbody></table><h2 id="Extra-Tools"><a href="#Extra-Tools" class="headerlink" title="Extra Tools"></a>Extra Tools</h2><h3 id="markitdown-—-Document-Reader"><a href="#markitdown-—-Document-Reader" class="headerlink" title="markitdown — Document Reader"></a>markitdown — Document Reader</h3><p>Converts files (PDF, Word, PowerPoint, Excel, HTML, CSV, JSON, Images, Audio, YouTube URLs, EPubs, ZIP) to Markdown so Claude can read them.</p><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line">pipx install <span class="string">&#x27;markitdown[all]&#x27;</span></span><br><span class="line"></span><br><span class="line"><span class="comment"># For scanned PDFs (OCR support)</span></span><br><span class="line">sudo apt install tesseract-ocr</span><br></pre></td></tr></table></figure><p>Usage inside a Claude Code session:</p><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">markitdown path/to/file.pdf</span><br></pre></td></tr></table></figure>]]></content>
    
    
      
      
    <summary type="html">&lt;p&gt;&lt;a href=&quot;https://claude.ai/code&quot;&gt;Claude Code&lt;/a&gt; is Anthropic’s official CLI for Claude. It can be extended with &lt;strong&gt;skills&lt;/strong&gt; </summary>
      
    
    
    
    <category term="AI" scheme="https://blog.pablo-magro-gaspar.site/categories/AI/"/>
    
    
    <category term="Claude" scheme="https://blog.pablo-magro-gaspar.site/tags/Claude/"/>
    
    <category term="AI" scheme="https://blog.pablo-magro-gaspar.site/tags/AI/"/>
    
    <category term="CLI" scheme="https://blog.pablo-magro-gaspar.site/tags/CLI/"/>
    
  </entry>
  
  <entry>
    <title>SOLID Principles</title>
    <link href="https://blog.pablo-magro-gaspar.site/2023/07/13/SOLID-Principles/"/>
    <id>https://blog.pablo-magro-gaspar.site/2023/07/13/SOLID-Principles/</id>
    <published>2023-07-13T22:29:52.000Z</published>
    <updated>2026-04-14T20:03:04.027Z</updated>
    
    <content type="html"><![CDATA[<p>These 5 principles will guide you on how to <code>write better code</code>. Though they come from object-oriented programming.</p><p>It’s much easier to work on small Singly Responsible parts whose changes don’t affect any upstream or downstream part.</p><ol><li><code>S</code> - <code>Single responsibility principle</code>  A class should have only one reason to change. It means that a class should have only one responsibility or purpose</li><li><code>O</code> - <code>Open closed principle</code>  Software entities (classes, modules, functions, etc.) should be open for extension but closed for modification.</li><li><code>L</code> - <code>Liskov substitution principle</code>  Subtypes must be substitutable for their base types.</li><li><code>I</code> - <code>Interface segregation principle</code>  Clients should not be forced to depend on interfaces they do not use.</li><li><code>D</code> - <code>Dependency Inversion principle</code>  High-level modules should not depend on low-level modules; both should depend on abstractions.</li></ol><p>Helping the code to:</p><ul><li>Tolerate change.</li><li>Ease code understanding.</li><li>Write components that can be used in many software systems.</li></ul><h2 id="NOTE"><a href="#NOTE" class="headerlink" title="NOTE"></a>NOTE</h2><p><code>SOLID is a must know skill in OO development</code> but I think we should be willing to modernize it and make it fit in 2022 when industry is moving towards functional coding. I’m a 20 year c# vet and do full solid on most projects but it’s hard to justify the abstractions for smaller projects.  You end up with too many single method classes which can be functions instead.</p><h2 id="S-—-Single-responsibility-principle-SRP"><a href="#S-—-Single-responsibility-principle-SRP" class="headerlink" title="S — Single responsibility principle  (SRP)"></a>S — Single responsibility principle  (SRP)</h2><p>“There should never be more than one reason for a class to change.” same idea different words: “a class should have only one job and do one thing”</p><figure class="highlight typescript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment">// Bad</span></span><br><span class="line"><span class="keyword">class</span> <span class="title class_">Book</span> &#123;</span><br><span class="line">  <span class="keyword">public</span> <span class="attr">title</span>: <span class="built_in">string</span>;</span><br><span class="line">  <span class="keyword">public</span> <span class="attr">author</span>: <span class="built_in">string</span>;</span><br><span class="line">  <span class="keyword">public</span> <span class="attr">description</span>: <span class="built_in">string</span>;</span><br><span class="line">  <span class="keyword">public</span> <span class="attr">pages</span>: <span class="built_in">number</span>;</span><br><span class="line"></span><br><span class="line">  <span class="comment">// constructor and other methods</span></span><br><span class="line"></span><br><span class="line">  <span class="keyword">public</span> <span class="title function_">saveToFile</span>(): <span class="built_in">void</span> &#123;</span><br><span class="line">    <span class="comment">// some fs.write method to save book to file</span></span><br><span class="line">  &#125;</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line"><span class="comment">// Good</span></span><br><span class="line"><span class="keyword">class</span> <span class="title class_">Book</span> &#123;</span><br><span class="line">  <span class="keyword">public</span> <span class="attr">title</span>: <span class="built_in">string</span>;</span><br><span class="line">  <span class="keyword">public</span> <span class="attr">author</span>: <span class="built_in">string</span>;</span><br><span class="line">  <span class="keyword">public</span> <span class="attr">description</span>: <span class="built_in">string</span>;</span><br><span class="line">  <span class="keyword">public</span> <span class="attr">pages</span>: <span class="built_in">number</span>;</span><br><span class="line"></span><br><span class="line">  <span class="comment">// constructor and other methods</span></span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line"><span class="keyword">class</span> <span class="title class_">BookPersistence</span> &#123;</span><br><span class="line">  <span class="keyword">public</span> <span class="title function_">saveToFile</span>(<span class="attr">book</span>: <span class="title class_">Book</span>): <span class="built_in">void</span> &#123;</span><br><span class="line">    <span class="comment">// some fs.write method to save book to file</span></span><br><span class="line">  &#125;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure><h2 id="O-—-Open-Close-Principle-OCP"><a href="#O-—-Open-Close-Principle-OCP" class="headerlink" title="O — Open-Close Principle (OCP)"></a>O — Open-Close Principle (OCP)</h2><p>“Software entities should be open for extension, but closed for modification.”</p><p>There are two primary attributes in the OCP:</p><ol><li>It is open for extension — This means you can extend what the module can do.</li><li>It is closed for modification — This means you cannot change the source code, even though you can extend the behavior of a module or entity.</li></ol><p>OCP means that a class, module, function, and other entities can extend their behavior without modifying their source code. In other words, an entity should be extendable without modifying the entity itself.</p><figure class="highlight typescript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br><span class="line">59</span><br><span class="line">60</span><br><span class="line">61</span><br><span class="line">62</span><br><span class="line">63</span><br><span class="line">64</span><br><span class="line">65</span><br><span class="line">66</span><br><span class="line">67</span><br><span class="line">68</span><br><span class="line">69</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment">// Bad</span></span><br><span class="line"><span class="comment">// If we add another shape later, which means we need to create a new class.</span></span><br><span class="line"><span class="comment">// In that case, we would also need to modify the AreaCalculator class to calculate the area of the new class. That’s against the Open-Close  Principle.</span></span><br><span class="line"></span><br><span class="line"><span class="keyword">class</span> <span class="title class_">Rectangle</span> &#123;</span><br><span class="line">  <span class="keyword">public</span> <span class="attr">width</span>: <span class="built_in">number</span>;</span><br><span class="line">  <span class="keyword">public</span> <span class="attr">height</span>: <span class="built_in">number</span>;</span><br><span class="line"></span><br><span class="line">  <span class="title function_">constructor</span>(<span class="params">width: <span class="built_in">number</span>, height: <span class="built_in">number</span></span>) &#123;</span><br><span class="line">    <span class="variable language_">this</span>.<span class="property">width</span> = width;</span><br><span class="line">    <span class="variable language_">this</span>.<span class="property">height</span> = height;</span><br><span class="line">  &#125;</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line"><span class="keyword">class</span> <span class="title class_">Circle</span> &#123;</span><br><span class="line">  <span class="keyword">public</span> <span class="attr">radius</span>: <span class="built_in">number</span>;</span><br><span class="line"></span><br><span class="line">  <span class="title function_">constructor</span>(<span class="params">radius: <span class="built_in">number</span></span>) &#123;</span><br><span class="line">    <span class="variable language_">this</span>.<span class="property">radius</span> = radius;</span><br><span class="line">  &#125;</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line"><span class="keyword">class</span> <span class="title class_">AreaCalculator</span> &#123;</span><br><span class="line">  <span class="keyword">public</span> <span class="title function_">calculateRectangleArea</span>(<span class="attr">rectangle</span>: <span class="title class_">Rectangle</span>): <span class="built_in">number</span> &#123;</span><br><span class="line">    <span class="keyword">return</span> rectangle.<span class="property">width</span> * rectangle.<span class="property">height</span>;</span><br><span class="line">  &#125;</span><br><span class="line"></span><br><span class="line">  <span class="keyword">public</span> <span class="title function_">calculateCircleArea</span>(<span class="attr">circle</span>: <span class="title class_">Circle</span>): <span class="built_in">number</span> &#123;</span><br><span class="line">    <span class="keyword">return</span> <span class="title class_">Math</span>.<span class="property">PI</span> * (circle.<span class="property">radius</span> * circle.<span class="property">radius</span>);</span><br><span class="line">  &#125;</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line"><span class="comment">// God</span></span><br><span class="line"><span class="keyword">interface</span> <span class="title class_">Shape</span> &#123;</span><br><span class="line">  <span class="title function_">calucatelateArea</span>(): <span class="built_in">number</span>;</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line"><span class="keyword">class</span> <span class="title class_">Rectangle</span> <span class="keyword">extends</span> <span class="title class_ inherited__">Shape</span> &#123;</span><br><span class="line">  <span class="keyword">public</span> <span class="attr">width</span>: <span class="built_in">number</span>;</span><br><span class="line">  <span class="keyword">public</span> <span class="attr">height</span>: <span class="built_in">number</span>;</span><br><span class="line"></span><br><span class="line">  <span class="title function_">constructor</span>(<span class="params">width: <span class="built_in">number</span>, height: <span class="built_in">number</span></span>) &#123;</span><br><span class="line">    <span class="variable language_">this</span>.<span class="property">width</span> = width;</span><br><span class="line">    <span class="variable language_">this</span>.<span class="property">height</span> = height;</span><br><span class="line">  &#125;</span><br><span class="line"></span><br><span class="line">  <span class="title function_">calculateArea</span>(<span class="params"></span>) &#123;</span><br><span class="line">    <span class="keyword">return</span> <span class="variable language_">this</span>.<span class="property">width</span> * <span class="variable language_">this</span>.<span class="property">height</span>;</span><br><span class="line">  &#125;</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line"><span class="keyword">class</span> <span class="title class_">Circle</span> <span class="keyword">extends</span> <span class="title class_ inherited__">Shape</span>  &#123;</span><br><span class="line">  <span class="keyword">public</span> <span class="attr">radius</span>: <span class="built_in">number</span>;</span><br><span class="line"></span><br><span class="line">  <span class="title function_">constructor</span>(<span class="params">radius: <span class="built_in">number</span></span>) &#123;</span><br><span class="line">    <span class="variable language_">this</span>.<span class="property">radius</span> = radius;</span><br><span class="line">  &#125;</span><br><span class="line"></span><br><span class="line">  <span class="title function_">calculateArea</span>(<span class="params"></span>) &#123;</span><br><span class="line">    <span class="keyword">return</span> <span class="title class_">Math</span>.<span class="property">PI</span> * (<span class="variable language_">this</span>.<span class="property">radius</span> * <span class="variable language_">this</span>.<span class="property">radius</span>);</span><br><span class="line">  &#125;</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line"><span class="title class_">Class</span> <span class="title class_">AreaCalculator</span> &#123;</span><br><span class="line">  <span class="title function_">calculateAreas</span>(<span class="attr">shapes</span>: <span class="title class_">Shape</span>[]): <span class="built_in">number</span> &#123;</span><br><span class="line">    <span class="keyword">return</span> shapes.<span class="title function_">reduce</span>(calculateArea, shape)</span><br><span class="line">      =&gt; calculateArea + shape.<span class="title function_">calculateArea</span>(), <span class="number">0</span>);</span><br><span class="line">  &#125;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure><h2 id="L-—-Liskov-substitution-principle-LSP"><a href="#L-—-Liskov-substitution-principle-LSP" class="headerlink" title="L — Liskov substitution principle (LSP)"></a>L — Liskov substitution principle (LSP)</h2><p>If you have a function that works for a base type, it should work for a derived type.</p><pre><code>In simple terms, if a program is written to work with a certain type (superclass), it should also work correctly with any of its derived types (subclasses) without requiring any modifications.</code></pre><figure class="highlight typescript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment">// A classic example of a violation of this principle is the Rectangle-Square problem.</span></span><br><span class="line"><span class="comment">// The Square class extends the Rectangle class and assumes that the width and height are equal. When calculating the area of a square, we’d get a wrong value.</span></span><br><span class="line"></span><br><span class="line"><span class="keyword">class</span> <span class="title class_">Rectangle</span> &#123;</span><br><span class="line">  <span class="title function_">constructor</span>(<span class="params"><span class="keyword">private</span> _width: <span class="built_in">number</span>, <span class="keyword">private</span> _height: <span class="built_in">number</span></span>) &#123;&#125;</span><br><span class="line"></span><br><span class="line">  <span class="keyword">public</span> <span class="title function_">area</span>() : <span class="built_in">number</span> &#123;</span><br><span class="line">    <span class="keyword">return</span> <span class="variable language_">this</span>.<span class="property">_height</span> * <span class="variable language_">this</span>.<span class="property">_width</span>;</span><br><span class="line">  &#125;</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line"><span class="keyword">class</span> <span class="title class_">Square</span> <span class="keyword">extends</span> <span class="title class_ inherited__">Rectangle</span> &#123;</span><br><span class="line"></span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line"><span class="comment">// Good</span></span><br><span class="line"></span><br><span class="line"><span class="keyword">interface</span> <span class="title class_">Shape</span> &#123;</span><br><span class="line">  <span class="keyword">public</span> <span class="title function_">area</span>(): <span class="built_in">number</span>;</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line"><span class="keyword">class</span> <span class="title class_">Rectangle</span> <span class="keyword">extends</span> <span class="title class_ inherited__">Shape</span> &#123;</span><br><span class="line">  <span class="title function_">constructor</span>(<span class="params"><span class="keyword">private</span> _width: <span class="built_in">number</span>, <span class="keyword">private</span> _height: <span class="built_in">number</span></span>) &#123;&#125;</span><br><span class="line"></span><br><span class="line">  <span class="keyword">public</span> <span class="title function_">area</span>() : <span class="built_in">number</span> &#123;</span><br><span class="line">    <span class="keyword">return</span> <span class="variable language_">this</span>.<span class="property">_height</span> * <span class="variable language_">this</span>.<span class="property">_width</span>;</span><br><span class="line">  &#125;</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line"><span class="keyword">class</span> <span class="title class_">Square</span> <span class="keyword">extends</span> <span class="title class_ inherited__">Rectangle</span> &#123;</span><br><span class="line">  <span class="title function_">constructor</span>(<span class="params"><span class="keyword">private</span> _height: <span class="built_in">number</span></span>) &#123;&#125;</span><br><span class="line"></span><br><span class="line">  <span class="keyword">public</span> <span class="title function_">area</span>() : <span class="built_in">number</span> &#123;</span><br><span class="line">    <span class="keyword">return</span> <span class="title class_">Math</span>.<span class="title function_">pow</span>(<span class="variable language_">this</span>.<span class="property">_height</span>, <span class="number">2</span>);</span><br><span class="line">  &#125;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure><h2 id="I-—-Interface-segregation-principle-ISP"><a href="#I-—-Interface-segregation-principle-ISP" class="headerlink" title="I — Interface segregation principle (ISP)"></a>I — Interface segregation principle (ISP)</h2><p>“Many client-specific interfaces are better than one general-purpose interface.”</p><p>The principle suggests that using client-specific interfaces instead of a general-purpose interface prevents the implementation of unnecessary methods in classes, ensuring better design.</p><figure class="highlight typescript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br><span class="line">59</span><br><span class="line">60</span><br><span class="line">61</span><br><span class="line">62</span><br><span class="line">63</span><br><span class="line">64</span><br><span class="line">65</span><br><span class="line">66</span><br><span class="line">67</span><br><span class="line">68</span><br><span class="line">69</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment">// Bad</span></span><br><span class="line"></span><br><span class="line"><span class="keyword">interface</span> <span class="title class_">VehicleInterface</span> &#123;</span><br><span class="line">  <span class="title function_">drive</span>(): <span class="built_in">string</span>;</span><br><span class="line">  <span class="title function_">fly</span>(): <span class="built_in">string</span>;</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line"><span class="keyword">class</span> <span class="title class_">FutureCar</span> <span class="keyword">implements</span> <span class="title class_">VehicleInterface</span> &#123;</span><br><span class="line">  <span class="keyword">public</span> <span class="title function_">drive</span>() : <span class="built_in">string</span> &#123;</span><br><span class="line">    <span class="keyword">return</span> <span class="string">&#x27;Driving Car.&#x27;</span>;</span><br><span class="line">  &#125;</span><br><span class="line"></span><br><span class="line">  <span class="keyword">public</span> <span class="title function_">fly</span>() : <span class="built_in">string</span> &#123;</span><br><span class="line">    <span class="keyword">return</span> <span class="string">&#x27;Flying Car.&#x27;</span>;</span><br><span class="line">  &#125;</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line"><span class="keyword">class</span> <span class="title class_">Car</span> <span class="keyword">implements</span> <span class="title class_">VehicleInterface</span> &#123;</span><br><span class="line">  <span class="keyword">public</span> <span class="title function_">drive</span>() : <span class="built_in">string</span> &#123;</span><br><span class="line">    <span class="keyword">return</span> <span class="string">&#x27;Driving Car.&#x27;</span>;</span><br><span class="line">  &#125;</span><br><span class="line"></span><br><span class="line">  <span class="keyword">public</span> <span class="title function_">fly</span>() : <span class="built_in">string</span> &#123; <span class="comment">// &lt;-- A car shouldn&#x27;t implement this method.</span></span><br><span class="line">    <span class="keyword">throw</span> <span class="keyword">new</span> <span class="title class_">Error</span>(<span class="string">&#x27;Not implemented method.&#x27;</span>);</span><br><span class="line">  &#125;</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line"><span class="keyword">class</span> <span class="title class_">Airplane</span> <span class="keyword">implements</span> <span class="title class_">VehicleInterface</span> &#123;</span><br><span class="line">  <span class="keyword">public</span> <span class="title function_">drive</span>() : <span class="built_in">string</span> &#123; <span class="comment">// &lt;-- A fly shouldn&#x27;t implement this method.</span></span><br><span class="line">    <span class="keyword">throw</span> <span class="keyword">new</span> <span class="title class_">Error</span>(<span class="string">&#x27;Not implemented method.&#x27;</span>);</span><br><span class="line">  &#125;</span><br><span class="line"></span><br><span class="line">  <span class="keyword">public</span> <span class="title function_">fly</span>() : <span class="built_in">string</span> &#123;</span><br><span class="line">    <span class="keyword">return</span> <span class="string">&#x27;Flying Airplane.&#x27;</span>;</span><br><span class="line">  &#125;</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line"><span class="comment">// Good. Splliting in interfaces</span></span><br><span class="line"></span><br><span class="line"><span class="keyword">interface</span> <span class="title class_">AirplaneInterface</span> &#123;</span><br><span class="line">  <span class="title function_">fly</span>(): <span class="built_in">string</span>;</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line"><span class="keyword">interface</span> <span class="title class_">CarInterface</span> &#123;</span><br><span class="line">  <span class="title function_">fly</span>(): <span class="built_in">string</span>;</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line"><span class="keyword">class</span> <span class="title class_">FutureCar</span> <span class="keyword">implements</span> <span class="title class_">CarInteface</span>, <span class="title class_">AirplaneInterface</span> &#123;</span><br><span class="line">  <span class="keyword">public</span> <span class="title function_">drive</span>() : <span class="built_in">string</span> &#123;</span><br><span class="line">    <span class="keyword">return</span> <span class="string">&#x27;Driving Car.&#x27;</span>;</span><br><span class="line">  &#125;</span><br><span class="line"></span><br><span class="line">  <span class="keyword">public</span> <span class="title function_">fly</span>() : <span class="built_in">string</span> &#123;</span><br><span class="line">    <span class="keyword">return</span> <span class="string">&#x27;Flying Car.&#x27;</span>;</span><br><span class="line">  &#125;</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line"><span class="keyword">class</span> <span class="title class_">Car</span> <span class="keyword">implements</span> <span class="title class_">CarInterface</span> &#123;</span><br><span class="line">  <span class="keyword">public</span> <span class="title function_">drive</span>() : <span class="built_in">string</span> &#123;</span><br><span class="line">    <span class="keyword">return</span> <span class="string">&#x27;Driving Car.&#x27;</span>;</span><br><span class="line">  &#125;</span><br><span class="line">  &#125;</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line"><span class="keyword">class</span> <span class="title class_">Airplane</span> <span class="keyword">implements</span> <span class="title class_">AirplaneInterface</span> &#123;</span><br><span class="line">  <span class="keyword">public</span> <span class="title function_">fly</span>() : <span class="built_in">string</span> &#123;</span><br><span class="line">    <span class="keyword">return</span> <span class="string">&#x27;Flying Airplane.&#x27;</span>;</span><br><span class="line">  &#125;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure><h2 id="D-—-Dependency-Inversion-principle-DIP"><a href="#D-—-Dependency-Inversion-principle-DIP" class="headerlink" title="D — Dependency Inversion principle (DIP)"></a>D — Dependency Inversion principle (DIP)</h2><p>“Entities must depend on abstractions not on concretions. It states that the high level module must not depend on the low level module, but they should depend on abstractions.”</p><p>This principle states that a class should not depend on another class, but instead on an abstraction of that class. It allows loose-coupling and more reusability.</p><p><code>It means that classes should depend on abstractions (interfaces or abstract classes) rather than concrete implementations.</code></p><ul><li><p>Design Principles and Design Patterns:</p><p>  “If the open-closed principle (OCP) states the goal of object oriented (OO) architecture, the DIP states the primary mechanism”.</p></li></ul><figure class="highlight typescript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment">// Bad</span></span><br><span class="line"><span class="comment">// Here, the Post class depends on the MemoryStorage class to save new posts.</span></span><br><span class="line"><span class="comment">// What happens if we need to change the storage used to save posts? We’ll have to modify the PostService class to change the type of the db property, thus violating the Open-Closed Principle .</span></span><br><span class="line"></span><br><span class="line"><span class="keyword">class</span> <span class="title class_">MemoryStorage</span> &#123;</span><br><span class="line">  <span class="keyword">private</span> <span class="attr">storage</span>: <span class="built_in">any</span>[];</span><br><span class="line"></span><br><span class="line">  <span class="title function_">constructor</span>(<span class="params"></span>) &#123;</span><br><span class="line">    <span class="variable language_">this</span>.<span class="property">storage</span> = [];</span><br><span class="line">  &#125;</span><br><span class="line"></span><br><span class="line">  <span class="keyword">public</span> <span class="title function_">insert</span>(<span class="attr">record</span>: <span class="built_in">any</span>): <span class="built_in">void</span> &#123;</span><br><span class="line">    <span class="variable language_">this</span>.<span class="property">storage</span>.<span class="title function_">push</span>(record);</span><br><span class="line">  &#125;</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line"><span class="keyword">class</span> <span class="title class_">PostService</span> &#123;</span><br><span class="line">  <span class="keyword">private</span> db = <span class="keyword">new</span> <span class="title class_">MemoryStorage</span>();</span><br><span class="line"></span><br><span class="line">  <span class="title function_">createPost</span>(<span class="params">title: <span class="built_in">string</span></span>) &#123;</span><br><span class="line">    <span class="variable language_">this</span>.<span class="property">db</span>.<span class="title function_">insert</span>(title);</span><br><span class="line">  &#125;</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line"><span class="comment">// Good</span></span><br><span class="line"></span><br><span class="line"><span class="keyword">interface</span> <span class="title class_">GenericStorage</span> &#123;</span><br><span class="line">  <span class="title function_">insert</span>(<span class="attr">record</span>: <span class="built_in">any</span>): <span class="built_in">void</span>;</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line"><span class="keyword">class</span> <span class="title class_">MemoryStorage</span> <span class="keyword">extends</span> <span class="title class_ inherited__">GenericStorage</span> &#123;</span><br><span class="line">  <span class="keyword">private</span> <span class="attr">storage</span>: <span class="built_in">any</span>[];</span><br><span class="line"></span><br><span class="line">  <span class="title function_">constructor</span>(<span class="params"></span>) &#123;</span><br><span class="line">    <span class="variable language_">this</span>.<span class="property">storage</span> = [];</span><br><span class="line">  &#125;</span><br><span class="line"></span><br><span class="line">  <span class="keyword">public</span> <span class="title function_">insert</span>(<span class="attr">record</span>: <span class="built_in">any</span>): <span class="built_in">void</span> &#123;</span><br><span class="line">    <span class="variable language_">this</span>.<span class="property">storage</span>.<span class="title function_">push</span>(record);</span><br><span class="line">  &#125;</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line"><span class="keyword">class</span> <span class="title class_">PostService</span> &#123;</span><br><span class="line">  <span class="keyword">private</span> db = <span class="keyword">new</span> <span class="title class_">GenericStorage</span>();</span><br><span class="line"></span><br><span class="line">  <span class="title function_">constructor</span>(<span class="params">db: GenericStorage</span>) &#123;</span><br><span class="line">    <span class="variable language_">this</span>.<span class="property">db</span> = db;</span><br><span class="line">  &#125;</span><br><span class="line"></span><br><span class="line">  <span class="title function_">createPost</span>(<span class="params">title: <span class="built_in">string</span></span>) &#123;</span><br><span class="line">    <span class="variable language_">this</span>.<span class="property">db</span>.<span class="title function_">insert</span>(title);</span><br><span class="line">  &#125;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>]]></content>
    
    
      
      
    <summary type="html">&lt;p&gt;These 5 principles will guide you on how to &lt;code&gt;write better code&lt;/code&gt;. Though they come from object-oriented programming.&lt;/p&gt;
&lt;p&gt;It’</summary>
      
    
    
    
    <category term="Design" scheme="https://blog.pablo-magro-gaspar.site/categories/Design/"/>
    
    <category term="TypeScript" scheme="https://blog.pablo-magro-gaspar.site/categories/Design/TypeScript/"/>
    
    
    <category term="SOLID Principles" scheme="https://blog.pablo-magro-gaspar.site/tags/SOLID-Principles/"/>
    
  </entry>
  
  <entry>
    <title>AWS Certified SysOps Administrator - Associate (SOA-C02)</title>
    <link href="https://blog.pablo-magro-gaspar.site/2023/05/15/AWS-Certified-SysOps-Administrator-Associate-SOA-C02/"/>
    <id>https://blog.pablo-magro-gaspar.site/2023/05/15/AWS-Certified-SysOps-Administrator-Associate-SOA-C02/</id>
    <published>2023-05-15T01:27:03.000Z</published>
    <updated>2026-04-14T20:03:04.026Z</updated>
    
    <content type="html"><![CDATA[<h1 id="Summary-of-concepts-for-AWS-SysOps-Administrator-Certification"><a href="#Summary-of-concepts-for-AWS-SysOps-Administrator-Certification" class="headerlink" title="Summary of concepts for AWS SysOps Administrator Certification."></a>Summary of concepts for AWS SysOps Administrator Certification.</h1><h2 id="CloudWatch"><a href="#CloudWatch" class="headerlink" title="CloudWatch"></a>CloudWatch</h2><h3 id="AWS-CloudWatch-Metrics"><a href="#AWS-CloudWatch-Metrics" class="headerlink" title="AWS CloudWatch Metrics"></a>AWS CloudWatch Metrics</h3><p>CloudWatch provides <code>metrics for every services in AWS</code></p><ul><li><code>Metric</code> is a variable to monitor (CPUUtilization, NetworkIn…)</li><li>Metrics belong to <code>namespaces</code></li><li>Dimension is an attribute of a metric (instance id, environment, etc…).</li><li>Up to 30 dimensions per metric</li><li>Metrics have <code>timestamps</code></li><li>Can create CloudWatch dashboards of metrics</li></ul><p>AWS Provided metrics (AWS pushes them):</p><ol><li><code>Basic</code> Monitoring (default): metrics are collected at a <code>5 minute</code> internal</li><li><code>Detailed</code> Monitoring (paid): metrics are collected at a <code>1 minute</code> interval</li><li>Includes <code>CPU, Network, Disk and Status Check Metrics</code></li></ol><p>Custom metric (<strong>yours to push</strong>):</p><ol><li>Basic Resolution: 1 minute resolution</li><li>High Resolution: all the way to 1 second resolution</li><li>Include <code>RAM</code>, application level metrics</li><li>Make sure the IAM permissions on the EC2 instance role are correct !</li></ol><p><u><strong>RAM is NOT included in the AWS EC2 metrics</strong></u></p><h4 id="CloudWatch-Custom-Metrics"><a href="#CloudWatch-Custom-Metrics" class="headerlink" title="CloudWatch Custom Metrics"></a>CloudWatch Custom Metrics</h4><p>You can retrieve custom metrics from your applications or services using the <code>StatsD</code> and <code>collectd</code> protocols. StatsD is supported on both Linux servers and servers running Windows Server. collectd is supported only on Linux</p><ul><li><p>Possibility to define and send your own custom metrics to CloudWatch</p></li><li><p>Example: memory (RAM) usage, disk space, number of logged in users …</p></li><li><p>Use API call <code>PutMetricData</code></p></li><li><p>Ability to use dimensions (attributes) to segment metrics</p><ul><li>Instance.id</li><li>Environment.name</li></ul></li><li><p>Metric resolution (<code>StorageResolution</code> API parameter - two possible value):</p><ul><li>Standard: 1 minute (60 seconds)</li><li>High Resolution: 1&#x2F;5&#x2F;10&#x2F;30 second(s) - Higher cost</li></ul></li><li><p>Important <code>👀 EXAM</code>: <strong><code>Accepts metric data points two weeks in the past and two hours in the future (make sure to configure your EC2 instance time correctly)</code></strong></p></li><li><p>You can <code>use AWS CLI or API</code> to <code>upload</code> the <code>data metrics</code> to CloudWatch.</p></li></ul><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">aws cloudwatch put-metric-data --metric-name PageViewCount --namespace MyService --value 2 --timestamp 2023-01-01-14T08:00:00.000Z</span><br></pre></td></tr></table></figure><ul><li><a href="https://aws.amazon.com/blogs/aws/new-high-resolution-custom-metrics-and-alarms-for-amazon-cloudwatch/">high-resolution</a>: high-resolution custom metric, your applications can publish metrics to CloudWatch with 1-second resolution.  High-Resolution Alarms allow you to react and take actions faster and support the same actions available today with standard 1-minute alarms.</li></ul><h3 id="CloudWatch-Dashboards"><a href="#CloudWatch-Dashboards" class="headerlink" title="CloudWatch Dashboards"></a>CloudWatch Dashboards</h3><ul><li>Great way to setup custom dashboards for quick access to key metrics and alarms</li><li><strong><code>Dashboards are global</code></strong></li><li><strong>&#96;&#96;Dashboards can include graphs from different AWS accounts and regions</strong>&#96;&#96;** - <code>👀 EXAM</code></li><li>You can change the time zone &amp; time range of the dashboards</li><li>You can setup automatic refresh (10s, 1m, 2m, 5m, 15m)</li><li>Dashboards can be shared with people who don’t have an AWS account (public, email address, 3rd party SSO provider through Amazon Cognito)</li></ul><p>CloudWatch Logs - Sources</p><ul><li>SDK, CloudWatch Logs Agent, CloudWatch Unified Agent</li><li>Elastic Beanstalk: collection of logs from application</li><li>ECS: collection from containers</li><li>AWS Lambda: collection from function logs</li><li>VPC Flow Logs: VPC specific logs</li><li>API Gateway</li><li>CloudTrail based on filter</li><li>Route53: Log DNS queries</li></ul><h3 id="CloudWatch-Logs-Subscriptions"><a href="#CloudWatch-Logs-Subscriptions" class="headerlink" title="CloudWatch Logs Subscriptions"></a>CloudWatch Logs Subscriptions</h3><ul><li><strong><code>Get a real-time log events from CloudWatch Logs for processing and analysis</code></strong></li><li>Send to Kinesis Data Streams, Kinesis Data Firehose, or Lambda</li><li><code>Subscription Filter </code>- filter which logs are events delivered to your destination</li><li><code>Cross-Account Subscription</code> - send log events to resources in a different AWS account (KDS, KDF)</li></ul><h3 id="Alarms"><a href="#Alarms" class="headerlink" title="Alarms"></a>Alarms</h3><p>CloudWatch alarms allow you to monitor metrics and trigger actions based on defined thresholds. In this case, you can create a CloudWatch alarm that monitors the CPU utilization metric of the EC2 instance. When the CPU utilization reaches 100%, the alarm will be triggered, and you can configure actions such as sending notifications or executing automated actions to address the unresponsiveness issue.</p><h3 id="Alarm-Targets-👀-EXAM"><a href="#Alarm-Targets-👀-EXAM" class="headerlink" title="Alarm Targets - 👀 EXAM"></a>Alarm Targets - 👀 EXAM</h3><ul><li><p><code>EC2</code> - Stop, Terminate, Reboot, or Recover an EC2 Instance</p></li><li><p><code>EC2 Auto Scaling</code> - Trigger Auto Scaling Action, scaling up or down.</p></li><li><p><code>SNS</code> - Send notification to SNS (from which you can do pretty much anything)</p></li><li><p>creating a <code>Systems Manager OpsItem</code>.</p></li><li><p><code>Composite Alarms are monitoring the states of multiple other alarms</code></p></li></ul><h3 id="EC2-Instance-Recovery"><a href="#EC2-Instance-Recovery" class="headerlink" title="EC2 Instance Recovery"></a>EC2 Instance Recovery</h3><p>StatusCheckFailed_System</p><ul><li><p>Status Check:</p><ul><li><code>Instance status = check the EC2 VM</code></li><li><code>System status = check the underlying hardware</code></li></ul></li><li><p><code>Recovery: Same Private, Public, Elastic IP, metadata, placement group</code></p><pre><code>👀 Alarms can be created based on CloudWatch Logs Metrics Filters</code></pre></li><li><p>Test an alarm using <code>aws set-alarm-state</code></p></li></ul><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">👀 aws cloudwatch set-alarm-state --alarm-name <span class="string">&quot;TerminateInHighCPU&quot;</span> --state-value ALARM --state-reason <span class="string">&quot;testing purposes&quot;</span></span><br></pre></td></tr></table></figure><h3 id="CloudWatch-Synthetics"><a href="#CloudWatch-Synthetics" class="headerlink" title="CloudWatch Synthetics"></a>CloudWatch Synthetics</h3><p>CloudWatch Synthetics canaries are <code>automated/configurable scripts</code> that <code>monitor</code> the <code>availability and performance of applications, endpoints, and APIs</code>. They are <code>designed to simulate user interactions with an application and provide insights into its behavior</code>.</p><p>Canaries are created using scripts written in Node.js or Python and are scheduled to run at regular intervals. These scripts perform tasks such as navigating through a website, clicking on specific elements, submitting forms, and validating responses. By executing these predefined actions, canaries can monitor the functionality, responsiveness, and performance of an application or API.</p><p>CloudWatch Synthetics canaries collect data on metrics like response time, latency, availability, and success rates. They can also be configured to generate alarms when certain conditions are met, allowing proactive identification and remediation of issues.</p><h4 id="Reference"><a href="#Reference" class="headerlink" title="Reference"></a>Reference</h4><p><a href="https://docs.aws.amazon.com/awssupport/latest/user/trusted-advisor-check-reference.html">https://docs.aws.amazon.com/awssupport/latest/user/trusted-advisor-check-reference.html</a></p><h3 id="Amazon-EventBridge-formerly-CloudWatch-Events"><a href="#Amazon-EventBridge-formerly-CloudWatch-Events" class="headerlink" title="Amazon EventBridge (formerly CloudWatch Events)"></a>Amazon EventBridge (formerly CloudWatch Events)</h3><ul><li>Schedule: Cron jobs (scheduled scripts) - Schedule Every hour -&gt;  Trigger script on Lambda function</li><li>Event Pattern: Event rules to react to a service doing something - IAM Root User Sign in Event -&gt;  SNS Topic with Email Notification</li><li>Trigger Lambda functions, send SQS&#x2F;SNS messages…</li></ul><p><img src="/../images/AWS-EventBridge-Rules.png" alt="EventBridge Rules"></p><h3 id="Service-Quotas-CloudWatch-Alarms"><a href="#Service-Quotas-CloudWatch-Alarms" class="headerlink" title="Service Quotas CloudWatch Alarms"></a>Service Quotas CloudWatch Alarms</h3><ul><li>Notify you when you’re close to a service quota value threshold</li><li>Create CloudWatch Alarms on the Service Quotas console</li><li>Example: Lambda concurrent executions</li><li>Helps you know if you need to request a quota increase or shutdown resources before limit is reached</li></ul><h3 id="Alternative-Trusted-Advisor-CW-Alarms"><a href="#Alternative-Trusted-Advisor-CW-Alarms" class="headerlink" title="Alternative: Trusted Advisor CW Alarms"></a>Alternative: Trusted Advisor CW Alarms</h3><ul><li>Limited number of Service Limits checks in Trusted Advisor (~50)</li><li>Trusted Advisor publishes its check results to CloudWatch</li></ul><h3 id="👀-For-each-production-EC2-instance-create-an-Amazon-CloudWatch-alarm-for-Status-Check-Failed-System-Set-the-alarm-action-to-recover-the-EC2-instance-Configure-the-alarm-notification-to-be-published-to-an-Amazon-Simple-Notification-Service-Amazon-SNS-topic"><a href="#👀-For-each-production-EC2-instance-create-an-Amazon-CloudWatch-alarm-for-Status-Check-Failed-System-Set-the-alarm-action-to-recover-the-EC2-instance-Configure-the-alarm-notification-to-be-published-to-an-Amazon-Simple-Notification-Service-Amazon-SNS-topic" class="headerlink" title="👀 For each production EC2 instance, create an Amazon CloudWatch alarm for Status Check Failed: System. Set the alarm action to recover the EC2 instance. Configure the alarm notification to be published to an Amazon Simple Notification Service (Amazon SNS) topic."></a><code>👀</code> For each production EC2 instance, create an <code>Amazon CloudWatch alarm</code> for Status <code>Check Failed: System</code>. Set the alarm action to <code>recover the EC2 instance</code>. Configure the alarm notification to be published to an Amazon Simple Notification Service (Amazon SNS) topic.</h3><p><code>Explanation</code>: By creating a <code>CloudWatch alarm</code> for Status <code>Check Failed: System</code>, you can<code> automate the recovery task of EC2 instances</code> (<code>stop, terminate, reboot, or recover your Amazon EC2 instances</code>). When the system health check fails for an EC2 instance, the alarm will be triggered and perform the configured action to recover the instance. This eliminates the need for manual intervention. Additionally, configuring the alarm to publish notifications to an SNS topic allows you to receive notifications whenever a system health check fails.</p><h3 id="Status-Check"><a href="#Status-Check" class="headerlink" title="Status Check"></a>Status Check</h3><p>Automated checks to identify <code>hardware</code> and <code>software issues</code>.</p><p>System Status Checks</p><ul><li>Monitors problems with AWS systems (software&#x2F;hardware issues on the physical host, loss of system power, …)</li><li>Check <code>Personal Health Dashboard</code> for any scheduled critical maintenance by AWS to your instance’s host</li><li>Resolution: stop and start the instance (instance migrated to a new host)<ul><li>Either wait for AWS to fix the host, OR</li><li>Move the EC2 instance to a new host &#x3D; STOP &amp; START the instance (if EBS backed)Instance Status Checks</li></ul></li><li>Monitors software&#x2F;network configuration of your instance (invalid network configuration, exhausted memory, …)</li><li>Resolution: reboot the instance or change instance configuration.</li></ul><h4 id="Status-Checks-CW-Metrics-amp-Recovery-👀-EXAM"><a href="#Status-Checks-CW-Metrics-amp-Recovery-👀-EXAM" class="headerlink" title="Status Checks - CW Metrics &amp; Recovery - 👀 EXAM"></a>Status Checks - CW Metrics &amp; Recovery - <code>👀 EXAM</code></h4><ul><li>CloudWatch Metrics (1 minute interval)<ul><li><code>StatusCheckFailed_System</code></li><li><code>StatusCheckFailed_Instance</code></li><li><code>StatusCheckFailed</code> (for both)</li></ul></li><li>Option 1: <code>CloudWatch Alarm</code><ul><li>Recover EC2 instance with the same private&#x2F;public IP, EIP, metadata, and Placement Group</li><li>Send notifications using SNS  trigger</li></ul></li><li>Option 2: <code>Auto Scaling Group</code><ul><li>Set min&#x2F;max&#x2F;desired 1 to recover an instance but <code>won&#39;t keep the same private and elastic IP</code>.&#96;</li></ul></li></ul><h4 id="Determine-which-instance-use-the-most-bandwidth"><a href="#Determine-which-instance-use-the-most-bandwidth" class="headerlink" title="Determine which instance use the most bandwidth"></a>Determine which instance use the most bandwidth</h4><p><code>NetworkIn</code> <code>and NetworkOut</code></p><h4 id="Identify-the-processing-power-required"><a href="#Identify-the-processing-power-required" class="headerlink" title="Identify the processing power required"></a>Identify the processing power required</h4><p><code>👀</code> <code>CPUUtilization</code> specifies the percentage of allocated EC2 compute units that are currently in use on the instance. This metric identifies the <code>processing power required</code> to <code>run</code> an <code>application on a selected instance</code>. This metric is expressed in Percent.</p><h4 id="Number-of-users"><a href="#Number-of-users" class="headerlink" title="Number of users."></a>Number of users.</h4><p><code>👀</code> <code>ActiveConnectionCount</code> This metric <code>represents</code> the <code>total number of concurrent TCP connections active</code> from clients to the load balancer and from the load balancer to targets.</p><h4 id="RAMUtilization-is-NOT-available-as-an-EC2-metric"><a href="#RAMUtilization-is-NOT-available-as-an-EC2-metric" class="headerlink" title="RAMUtilization is NOT available as an EC2 metric"></a>RAMUtilization is <code>NOT available as</code> an <code>EC2 metric</code></h4><p><code>RAMUtilization</code> You can publish your own metrics to CloudWatch using the AWS CLI or an API. You can view statistical graphs of your published metrics with the AWS Management Console. Metrics produced by AWS services are standard resolution by default.</p><h4 id="5xx-server-errors"><a href="#5xx-server-errors" class="headerlink" title="5xx server errors"></a>5xx server errors</h4><p>To monitor the number of 500 Internal Error responses that you’re getting, you can enable Amazon CloudWatch metrics. Amazon S3 CloudWatch request metrics include a metric for 5xx server errors.</p><h4 id="4xxx"><a href="#4xxx" class="headerlink" title="4xxx"></a>4xxx</h4><p>You can set an alarm to notify operators when the 404 filter metric exceeds a threshold.<code>👀</code> <code>HTTPCode_ELB_4XX_Count</code> metric stands for the number of HTTP 4XX client error codes that originate from the load balancer. This count does not include response codes generated by targets.</p><h4 id="Events"><a href="#Events" class="headerlink" title="Events"></a>Events</h4><p>You can run <code>CloudWatch Events</code> rules according to a <code>schedule</code>.</p><h4 id="EBS-Snapshots"><a href="#EBS-Snapshots" class="headerlink" title="EBS Snapshots"></a>EBS Snapshots</h4><p>It is possible to <code>create an automated snapshot of an existing Amazon Elastic Block Store (Amazon EBS)</code> volume on a schedule. You can choose a fixed rate to create a snapshot every few minutes or use a cron expression to specify that the snapshot is made at a specific time of day.</p><p>Snapshots are incremental backups, which means that only the blocks on the device that have changed after your most recent snapshot are saved. This minimizes the time required to create the snapshot and saves on storage costs by not duplicating data. Each snapshot contains all of the information that is needed to restore your data (from the moment when the snapshot was taken) to a new EBS volume.</p><p>Reference: <a href="https://docs.aws.amazon.com/AmazonCloudWatch/latest/events/TakeScheduledSnapshot.html">Schedule Automated Amazon EBS Snapshots Using CloudWatch Events</a></p><h3 id="Filters-QUESTION"><a href="#Filters-QUESTION" class="headerlink" title="Filters - QUESTION"></a><a href="https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/MonitoringLogData.html">Filters</a> - QUESTION</h3><p>You can create a <code>count</code> of <code>404</code> errors <code>and exclude</code> other <code>4xx</code> errors with a filter pattern on 404 errors.</p><h3 id="Agents"><a href="#Agents" class="headerlink" title="Agents"></a>Agents</h3><p>If your AMI contains a CloudWatch agent, it’s automatically installed on EC2 instances when you create an EC2 Auto Scaling group. With the stock Amazon Linux AMI, you need to install it (AWS recommends to install via yum).</p><h4 id="Install-Agents-to-track-the-state-of-each-of-the-instances"><a href="#Install-Agents-to-track-the-state-of-each-of-the-instances" class="headerlink" title="Install Agents to track the state of each of the instances"></a>Install Agents to track the state of each of the instances</h4><p>You must attach the <code>CloudWatchAgentServerRole</code> IAM role to the EC2 instance to be able to run the CloudWatch agent on the instance. This role enables the CloudWatch agent to perform actions on the instance.</p><h3 id="Publish-custom-metrics-to-CloudWatch"><a href="#Publish-custom-metrics-to-CloudWatch" class="headerlink" title="Publish custom metrics to CloudWatch."></a>Publish custom metrics to CloudWatch.</h3><p>You can publish your own metrics to CloudWatch using the AWS CLI or an API. You can view statistical graphs of your published metrics with the AWS Management Console. CloudWatch stores data about a metric as a series of data points. Each data point has an associated time stamp. You can even publish an aggregated set of data points called a statistic set.</p><p>The <code>put-metric-data</code> <code>command</code> publishes metric data to Amazon CloudWatch, which associates it with the specified metric. If the specified metric does not exist, CloudWatch creates the metric which can take up to fifteen minutes for the metric to appear in calls to <code>ListMetrics</code>.</p><h3 id="Collect-process-metrics-with-the-procstat-plugin"><a href="#Collect-process-metrics-with-the-procstat-plugin" class="headerlink" title="Collect process metrics with the procstat plugin"></a>Collect process metrics with the <code>procstat</code> plugin</h3><p>The <a href="https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-Agent-procstat-process-metrics.html">procstat</a> plugin enables you to <code>collect metrics from individual processes</code>. It is supported on Linux servers and on servers running Windows Server 2012 or later.</p><h3 id="Dashboard-Body-Structure-and-Syntax-EXAM"><a href="#Dashboard-Body-Structure-and-Syntax-EXAM" class="headerlink" title="Dashboard Body Structure and Syntax - EXAM"></a><a href="https://docs.aws.amazon.com/AmazonCloudWatch/latest/APIReference/CloudWatch-Dashboard-Body-Structure.html">Dashboard Body Structure and Syntax</a> - EXAM</h3><p>A <code>DashboardBody</code> is a string in JSON format. It can include an array of between 0 and 500 widget objects, as well as a few other parameters. The dashboard must include a widgets array, but that array can be empty.</p><p>When deploying resources using AWS CloudFormation, the goal is often to define as much of the desired infrastructure as possible directly within the template. This is achieved by taking the JSON representation of the prototype dashboard and embedding it directly within the CloudFormation template using the DashboardBody property.</p><figure class="highlight yml"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br></pre></td><td class="code"><pre><span class="line"><span class="attr">Resources:</span></span><br><span class="line">  <span class="attr">MyCloudWatchDashboard:</span></span><br><span class="line">    <span class="attr">Type:</span> <span class="string">AWS::CloudWatch::Dashboard</span></span><br><span class="line">    <span class="attr">Properties:</span></span><br><span class="line">      <span class="attr">DashboardName:</span> <span class="string">MyDashboard</span></span><br><span class="line">      <span class="attr">DashboardBody:</span> <span class="string">|</span></span><br><span class="line"><span class="string">        &#123;</span></span><br><span class="line"><span class="string">          &quot;widgets&quot;: [</span></span><br><span class="line"><span class="string">            &#123;</span></span><br><span class="line"><span class="string">              &quot;type&quot;: &quot;text&quot;,</span></span><br><span class="line"><span class="string">              &quot;x&quot;: 0,</span></span><br><span class="line"><span class="string">              &quot;y&quot;: 0,</span></span><br><span class="line"><span class="string">              &quot;width&quot;: 12,</span></span><br><span class="line"><span class="string">              &quot;height&quot;: 1,</span></span><br><span class="line"><span class="string">              &quot;properties&quot;: &#123;</span></span><br><span class="line"><span class="string">                &quot;markdown&quot;: &quot;### My Dashboard&quot;</span></span><br><span class="line"><span class="string">              &#125;</span></span><br><span class="line"><span class="string">            &#125;,</span></span><br><span class="line"><span class="string">            &#123;</span></span><br><span class="line"><span class="string">              &quot;type&quot;: &quot;metric&quot;,</span></span><br><span class="line"><span class="string">              &quot;x&quot;: 0,</span></span><br><span class="line"><span class="string">              &quot;y&quot;: 1,</span></span><br><span class="line"><span class="string">              &quot;width&quot;: 12,</span></span><br><span class="line"><span class="string">              &quot;height&quot;: 6,</span></span><br><span class="line"><span class="string">              &quot;properties&quot;: &#123;</span></span><br><span class="line"><span class="string">                &quot;metrics&quot;: [[&quot;AWS/EC2&quot;, &quot;CPUUtilization&quot;, &quot;InstanceId&quot;, &quot;i-1234567890abcdef0&quot;]],</span></span><br><span class="line"><span class="string">                &quot;title&quot;: &quot;EC2 CPU Utilization&quot;,</span></span><br><span class="line"><span class="string">                &quot;period&quot;: 300,</span></span><br><span class="line"><span class="string">                &quot;stat&quot;: &quot;Average&quot;,</span></span><br><span class="line"><span class="string">                &quot;region&quot;: &quot;us-east-1&quot;,</span></span><br><span class="line"><span class="string">                &quot;yAxis&quot;: &#123;&quot;left&quot;: &#123;&quot;min&quot;: 0, &quot;max&quot;: 100&#125;&#125;</span></span><br><span class="line"><span class="string">              &#125;</span></span><br><span class="line"><span class="string">            &#125;</span></span><br><span class="line"><span class="string">          ]</span></span><br><span class="line"><span class="string">        &#125;</span></span><br><span class="line"><span class="string"></span></span><br></pre></td></tr></table></figure><hr><h2 id="CloudTrail"><a href="#CloudTrail" class="headerlink" title="CloudTrail"></a>CloudTrail</h2><p><code>Provides governance, compliance and audit for your AWS Account</code></p><ul><li>CloudTrail is <code>enabled by default</code>!</li><li>Get <code>an history of events / API calls made within your AWS Account</code> by:<ul><li>Console</li><li>SDK</li><li>CLI</li><li>AWS Services</li></ul></li><li>Can put logs from CloudTrail into CloudWatch Logs or S3</li><li><code>A trail can be applied to All Regions (default) or a single Region</code></li><li>If a resource is deleted in AWS, investigate CloudTrail first!</li></ul><h3 id="CloudTrail-Insights"><a href="#CloudTrail-Insights" class="headerlink" title="CloudTrail Insights"></a>CloudTrail Insights</h3><ul><li>👀 Enable <code>CloudTrail Insights to detect unusual activity</code> in your account:<ul><li>inaccurate resource provisioning</li><li>hitting service limits</li><li>Bursts of AWS IAM actions</li><li>Gaps in periodic maintenance activity</li></ul></li><li>CloudTrail Insights analyzes normal management events to create a baseline</li><li>And then <code>continuously analyzes write events to detect unusual patterns</code>.<ul><li>Anomalies appear in the CloudTrail console</li><li>Event is sent to Amazon S3</li><li>An EventBridge event is generated (for automation needs)</li></ul></li></ul><h3 id="CloudTrail-Integration-with-EventBridge"><a href="#CloudTrail-Integration-with-EventBridge" class="headerlink" title="CloudTrail - Integration with EventBridge"></a>CloudTrail - Integration with EventBridge</h3><ul><li>Used to react to any API call being made in your account</li><li>CloudTrail is not “real-time”:<ul><li>Delivers an event within 15 minutes of an API call</li><li>Delivers log files to an S3 bucket every 5 minutes</li></ul></li></ul><h3 id="CloudTrail-Organizations-Trails"><a href="#CloudTrail-Organizations-Trails" class="headerlink" title="CloudTrail - Organizations Trails"></a>CloudTrail - Organizations Trails</h3><ul><li>A trail that will log all events for all AWS accounts in an AWS Organization</li><li>Log events for management and member accounts</li><li>Trail with the same name will be created in every AWS account (IAM permissions)</li><li>Member accounts can’t remove or modify the organization trail (view only)</li></ul><h3 id="CloudTrail-Log-File-Integrity-Validation"><a href="#CloudTrail-Log-File-Integrity-Validation" class="headerlink" title="CloudTrail - Log File Integrity Validation"></a>CloudTrail - Log File Integrity Validation</h3><p><strong><code>Digest Files</code></strong>:</p><ul><li><p>References the log files for the last hour and contains a hash of each</p></li><li><p>Stored in the same S3 bucket as log files (different folder)</p></li><li><p><code>Helps you determine whether a log file was modified/deleted after CloudTrail delivered it</code></p></li><li><p><code>Hashing using SHA-256, Digital Signing using SHA- 256 with RSĂ</code></p></li><li><p><code>Protect the S3 bucket using bucket policy, versioning, MFA Delete protection, encryption, object lock</code></p></li><li><p>Protect files using IAM</p><h3 id="Q-To-ensure-that-SysOps-administrators-can-easily-verify-that-the-CloudTrail-log-files-have-not-been-deleted-or-changed-the-following-action-should-be-taken"><a href="#Q-To-ensure-that-SysOps-administrators-can-easily-verify-that-the-CloudTrail-log-files-have-not-been-deleted-or-changed-the-following-action-should-be-taken" class="headerlink" title="Q. To ensure that SysOps administrators can easily verify that the CloudTrail log files have not been deleted or changed, the following action should be taken:"></a>Q. To ensure that SysOps administrators can easily verify that the CloudTrail log files have not been deleted or changed, the following action should be taken:</h3><p>Enable <code>CloudTrail log file integrity validation</code> when the trail is created or updated.</p><p><code>Explanation</code>: Enabling <code>CloudTrail log file integrity validation</code> ensures that the log files are protected against tampering or unauthorized modification. CloudTrail uses SHA-256 hashes to validate the integrity of the log files stored in Amazon S3. By enabling this feature, the SysOps administrators can easily verify the integrity of the log files and ensure that they have not been deleted or changed</p></li></ul><h3 id="Cloud-Trail-Integration-with-EventBridge-AWS-CloudTrail"><a href="#Cloud-Trail-Integration-with-EventBridge-AWS-CloudTrail" class="headerlink" title="Cloud Trail - Integration with EventBridge AWS CloudTrail"></a>Cloud Trail - Integration with EventBridge AWS CloudTrail</h3><ul><li>Used to react to any API call being made in your account</li><li>Cloud Trail is not “real-time”:<ul><li>Delivers an event within 15 minutes of an API call</li><li>Delivers log files to an S3 bucket every 5 minutes</li></ul></li></ul><h3 id="CloudTrail-Organizations-Trails-1"><a href="#CloudTrail-Organizations-Trails-1" class="headerlink" title="CloudTrail - Organizations Trails"></a>CloudTrail - Organizations Trails</h3><ul><li>A trail that will log all events for all AWS accounts in an AWS Organization</li><li>Log events for management and member accounts</li><li>Trail with the same name will be created in every AWS account (IAM permissions)</li><li><code>Member accounts can’t remove or modify the organization trail (view only)</code></li></ul><hr><h2 id="👀-AWS-Config"><a href="#👀-AWS-Config" class="headerlink" title="👀 AWS Config"></a><code>👀</code> <a href="https://aws.amazon.com/config/features/">AWS Config</a></h2><ul><li>Helps with <code>auditing</code> and recording <strong><code>compliance</code></strong> of your AWS resources.</li><li>Helps <code>record configurations</code> and changes over time.Questions that can be solved by AWS Config:<ul><li>Is there <strong>unrestricted SSH</strong> access to my security groups?</li><li>Do my <strong>buckets have any public access</strong>?</li><li>How has my <strong>ALB configuration changed over time</strong>?</li></ul></li><li>You can <code>receive alerts</code> (SNS notifications) for any changes</li><li>AWS Config is a <code>per-region service</code>.</li><li>Can be aggregated across regions and accounts.</li><li>Possibility of storing the configuration data into S3 (analyzed by Athena)</li></ul><p>AWS Config <code>keeps track of</code> the <code>configuration</code> of <code>your AWS resources and their relationships to other resources</code>. It can also <code>evaluate</code> those AWS resources for <u><strong><code>compliance</code></strong></u>. This service uses rules that can be configured to evaluate AWS resources against desired configurations.</p><p>For example,</p><ul><li>can track <code>changes</code> to <em><code>CloudFormation stacks</code></em>.</li></ul><p>AWS Config can track changes to CloudFormation stacks. A CloudFormation stack is a collection of AWS resources that you can manage as a single unit. With AWS Config, you can review the historical configuration of your CloudFormation stacks and review all changes that occurred to them.</p><p>For more information about how AWS Config can track changes to CloudFormation deployments, see <code>cloudformation-stack-drift-detection-check</code>.</p><ul><li>there are AWS Config <code>rules</code> that <code>check</code> whether or not your <em><code>Amazon S3 buckets have logging enabled</code></em> or your <code>IAM users have an MFA device enabled</code>.</li></ul><p>👀 AWS Config is a service that <code>enables</code> you to <code>assess</code>, <code>audit</code>, and <code>evaluate</code> the <code>configurations</code> of your <code>AWS resources</code>. It provides detailed <code>inventory</code> and <code>configuration</code> history of your resources, as well as configuration change notifications. With AWS Config, you can track the configuration of your S3 bucket, including its bucket policy.</p><p>AWS Config rules use AWS Lambda functions to perform the compliance evaluations, and the Lambda functions return the compliance status of the evaluated resources as compliant or noncompliant. The non-compliant resources are remediated using the remediation action associated with the AWS Config rule. With the Auto-Remediation feature of AWS Config rules, the remediation action can be executed automatically when a resource is found non-compliant.</p><p><code>AWS Config Auto Remediation feature</code> has auto remediate feature for any non-compliant S3 buckets using the following AWS Config rules:s3-bucket-logging-enabled s3-bucket-server-side-encryption-enabled s3-bucket-public-read-prohibited s3-bucket-public-write-prohibitedThese AWS Config rules act as controls to prevent any non-compliant S3 activities.</p><h3 id="Config-Rules"><a href="#Config-Rules" class="headerlink" title="Config Rules"></a>Config Rules</h3><p>AWS Config provides a number of AWS managed rules that address a wide range of security concerns such as checking if you <code>encrypted</code> your Amazon Elastic Block Store (Amazon EBS) volumes, tagged your resources appropriately, and enabled multi-factor authentication (MFA) for root accounts.</p><ul><li>Can use AWS <code>managed</code> config <code>rules</code> (over 75)</li><li>Can make <strong><code>custom config rules (must be defined in AWS Lambda)</code></strong>.<ul><li>Ex: evaluate if each EBS disk is of type gp2</li><li>Ex: evaluate if each EC2 instance is t2.micro</li></ul></li><li>Rules can be evaluated &#x2F; triggered:<ul><li>For each config change</li><li>And &#x2F; or: at regular time intervals</li></ul></li><li><strong><code>AWS Config Rules does not prevent actions from happening (no deny)</code></strong>.</li></ul><p>Managed rules:</p><ul><li><code>require-tags</code>: managed rule in AWS Config. This rule checks if a resource contains the tags that you specify.</li></ul><h3 id="Config-Rules-Remediations"><a href="#Config-Rules-Remediations" class="headerlink" title="Config Rules - Remediations"></a>Config Rules - Remediations</h3><p>Has auto remediate feature for any non-compliant S3 buckets using the following AWS Config rules:</p><p>s3-bucket-logging-enabled s3-bucket-server-side-encryption-enabled s3-bucket-public-read-prohibited s3-bucket-public-write-prohibited</p><p>These AWS Config rules act as controls to prevent any non-compliant S3 activities.</p><ul><li><code>Automate remediation of non-compliant resources using SSM Automation Documents</code>.</li><li>Use AWS-Managed Automation Documents or create custom Automation Documents<ul><li><code>Tip: you can create custom Automation Documents that invokes Lambda function</code>.</li></ul></li><li>You can set <code>Remediation Retries</code> if the resource is still non-compliant after autoremediation.</li></ul><h3 id="AWS-Config-Auto-Remediation"><a href="#AWS-Config-Auto-Remediation" class="headerlink" title="AWS Config Auto Remediation"></a>AWS Config Auto Remediation</h3><h3 id="Config-Rules-Notifications"><a href="#Config-Rules-Notifications" class="headerlink" title="Config Rules - Notifications"></a>Config Rules - Notifications</h3><ul><li>Use EventBridge to trigger notifications when AWS resources are noncompliant</li><li>Ability to send configuration changes and compliance state notifications to SNS (all events - use SNS Filtering or filter at client-side)</li><li><code>👀 QUESTION</code></li><li>If there are EC2s that are terminated in an environment, you should use the <strong><code>[EIP-attached Config rule](https://docs.aws.amazon.com/config/latest/developerguide/eip-attached.html)</code></strong> to find EIPs that are unattached in your environment.</li></ul><h3 id="AWS-Config-Aggregators"><a href="#AWS-Config-Aggregators" class="headerlink" title="AWS Config - Aggregators"></a>AWS Config - Aggregators</h3><ul><li>The aggregator is created <code>in one central aggregator account</code>.</li><li>Aggregates <code>rules, resources, etc... across multiple accounts &amp; regions</code>.</li><li>If using <code>AWS Organizations</code>, no need for individual Authorization</li><li>Rules are created in each individual source AWS account</li><li>Can <code>deploy rules</code> to multiple target accounts using <code>CloudFormation StackSets</code></li></ul><h2 id="CloudWatch-vs-CloudTrail-vs-Config"><a href="#CloudWatch-vs-CloudTrail-vs-Config" class="headerlink" title="CloudWatch vs CloudTrail vs Config"></a>CloudWatch vs CloudTrail vs Config</h2><ul><li>CloudWatch<ul><li>Performance monitoring (metrics, CPU, network, etc…) &amp; dashboards</li><li>Events &amp; Alerting</li><li>Log Aggregation &amp; Analysis</li></ul></li><li>CloudTrail<ul><li>Record API calls made within your Account by everyone</li><li>Can define trails for specific resources</li><li>Global Service</li></ul></li><li>Config<ul><li>Record configuration changes</li><li>Evaluate resources against compliance rules</li><li>Get timeline of changes and compliance</li></ul></li></ul><hr><h2 id="AWS-Task-Orchestrator-and-Executor-AWSTOE-👀-EXAM"><a href="#AWS-Task-Orchestrator-and-Executor-AWSTOE-👀-EXAM" class="headerlink" title="AWS Task Orchestrator and Executor (AWSTOE) - 👀 EXAM"></a>AWS Task Orchestrator and Executor (AWSTOE) - 👀 EXAM</h2><p>Use the <a href="https://docs.aws.amazon.com/imagebuilder/latest/userguide/toe-get-started.html">AWS Task Orchestrator and Executor (AWSTOE)</a> application <code>to orchestrate complex workflows</code>, <code>modify system configurations</code>, and <code>test your systems without writing code</code>. This application uses a declarative document schema. Because it is a standalone application, it does not require additional server setup.</p><hr><h2 id="96-AWS-Artifact-👀-EXAM"><a href="#96-AWS-Artifact-👀-EXAM" class="headerlink" title="&#96;AWS Artifact - 👀 EXAM"></a>&#96;<a href="https://docs.aws.amazon.com/artifact/latest/ug/what-is-aws-artifact.html">AWS Artifact</a> - 👀 EXAM</h2><p>AWS Artifact <code>keeps compliance-related reports and agreements</code>.</p><hr><h2 id="RDS"><a href="#RDS" class="headerlink" title="RDS"></a>RDS</h2><h3 id="Advantage-over-using-RDS-versus-deploying"><a href="#Advantage-over-using-RDS-versus-deploying" class="headerlink" title="Advantage over using RDS versus deploying"></a>Advantage over using RDS versus deploying</h3><ul><li>RDS is a managed service:<ul><li>Automated provisioning, OS patching</li><li>Continuous backups and restore to specific timestamp (Point in Time Restore)!</li><li>Monitoring dashboards</li><li>Read replicas for improved read performance</li><li>Multi AZ setup for DR (Disaster Recovery)</li><li>Maintenance windows for upgrades</li><li>Scaling capability (vertical and horizontal)</li><li>Storage backed by EBS (gp2 or io1)</li></ul></li><li>BUT you can’t SSH into your instances</li></ul><h3 id="RDS-Read-Replicas-for-read-scalability"><a href="#RDS-Read-Replicas-for-read-scalability" class="headerlink" title="RDS Read Replicas for read scalability"></a>RDS Read Replicas for read scalability</h3><ul><li>Up to 15 Read Replicas</li><li>Within <code>AZ, Cross AZ or Cross Region</code>.</li><li>Replication is <code>ASYNC</code>.</li><li>Replicas can be promoted to their own DB.</li></ul><h3 id="RDS-Read-Replicas-Network-Cost"><a href="#RDS-Read-Replicas-Network-Cost" class="headerlink" title="RDS Read Replicas - Network Cost"></a>RDS Read Replicas - Network Cost</h3><ul><li>In AWS there’s a network cost when data goes from one AZ to another</li><li><code>For RDS Read Replicas within the same region, you don’t pay that fee</code>.</li></ul><h3 id="RDS-Multi-AZ-Disaster-Recovery"><a href="#RDS-Multi-AZ-Disaster-Recovery" class="headerlink" title="RDS Multi AZ (Disaster Recovery)"></a>RDS Multi AZ (Disaster Recovery)</h3><ul><li><code>SYNC</code> replication.</li><li>One DNS name - automatic app failover to standby</li><li>Increase <code>availability</code>.</li><li>Failover in case of loss of AZ, loss of network, instance or storage failure</li></ul><p><code>👀 Exam</code> - <code>The Read Replicas be setup as Multi AZ for Disaster Recovery (DR)</code>.</p><h3 id="Lambda-in-VPC"><a href="#Lambda-in-VPC" class="headerlink" title="Lambda in VPC"></a>Lambda in VPC</h3><ul><li>You must define the VPC ID, the Subnets and the Security Groups</li><li>Lambda will create an ENI (Elastic Network Interface) in your subnets</li><li><code>AWSLambdaVPCAccessExecutionRole</code></li></ul><h3 id="RDS-Proxy-for-AWS-Lambda"><a href="#RDS-Proxy-for-AWS-Lambda" class="headerlink" title="RDS Proxy for AWS Lambda"></a>RDS Proxy for AWS Lambda</h3><ul><li>When using Lambda functions with RDS, it opens and maintains a database connection</li><li>This can result in a <code>“TooManyConnections”</code> exception</li><li>With <code>RDS Proxy</code>, you no longer need code that handles cleaning up idle connections and managing connection pools</li></ul><h3 id="DB-Parameter-Groups"><a href="#DB-Parameter-Groups" class="headerlink" title="DB Parameter Groups"></a>DB Parameter Groups</h3><ul><li><p>You can configure the DB engine using Parameter Groups</p></li><li><p>Dynamic parameters are applied immediately</p></li><li><p>Static parameters are applied after instance reboot</p></li><li><p>You can modify parameter group associated with a DB (must reboot)</p></li><li><p><em><code>Must-know parameter</code></em>:</p><ul><li>PostgreSQL &#x2F; SQL Server: <code>rds.force_ssl=1</code> &#x3D;&gt; force SSL connections</li><li>MySQL &#x2F; MariaDB: <code>require_secure_transport</code>&#x3D;1 &#x3D;&gt; force SSL connections</li></ul></li></ul><h3 id="RDS-Events-amp-Event-Subscriptions"><a href="#RDS-Events-amp-Event-Subscriptions" class="headerlink" title="RDS Events &amp; Event Subscriptions"></a>RDS Events &amp; Event Subscriptions</h3><p>RDS keeps record of events related to:</p><ul><li><p>DB instances</p></li><li><p>Snapshots</p></li><li><p>Parameter groups, security groups …</p></li><li><p>RDS Event Subscriptions</p><ul><li>Subscribe to events to be notified when an event occurs using SNS</li><li>Specify the Event Source (instances, SGs, …) and the Event Category (creation, failover, …)</li></ul></li><li><p><code>RDS delivers events to EventBridge</code></p></li></ul><h3 id="RDS-with-CloudWatch"><a href="#RDS-with-CloudWatch" class="headerlink" title="RDS with CloudWatch"></a>RDS with CloudWatch</h3><p>CloudWatch metrics associated with RDS (gathered from the hypervisor):</p><ul><li><p><code>DatabaseConnections</code></p></li><li><p><code>SwapUsage</code></p></li><li><p><code>ReadIOPS / WriteIOPS</code></p></li><li><p><code>ReadLatency / WriteLatency</code></p></li><li><p><code>ReadThroughPut / WriteThroughPut</code></p></li><li><p><code>DiskQueueDepth</code></p></li><li><p><code>FreeStorageSpace</code> - To monitor the available storage space for an RDS DB instance</p></li><li><p>BinLogDiskUsage: Tracks the amount of disk space occupied by binary logs on the master.</p></li><li><p>FreeableMemory: Tracks the amount of available random access memory and not the available storage space.</p></li><li><p>DiskQueueDepth:  Provides the number of outstanding IOs (read&#x2F;write requests) waiting to access the disk.</p></li><li><p><code>Enhanced Monitoring</code> (gathered from an agent on the DB instance). <code>👀</code></p><ul><li>Useful when you need to see how <code>different processes or threads use the CPU</code>.</li></ul></li><li><p>Access to over 50 new CPU, memory, file system, and disk I&#x2F;O metrics</p></li></ul><p>Amazon RDS provides <code>metrics</code> in real time for the operating system (OS) that your DB instance runs on. You can view the metrics for your DB instance using the console. Also, you can consume the &#96;Enhanced Monitoring&#96;&#96; JSON output from Amazon CloudWatch Logs in a monitoring system of your choice.</p><h3 id="RDS-storage-autoscaling-👀-EXAM"><a href="#RDS-storage-autoscaling-👀-EXAM" class="headerlink" title="RDS storage autoscaling - 👀 EXAM"></a><a href="https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_PIOPS.StorageTypes.html#USER_PIOPS.Autoscaling">RDS storage autoscaling</a> - <code>👀</code> EXAM</h3><p>With RDS storage autoscaling, you can set the desired maximum storage limit. Autoscaling will manage the storage size. RDS storage autoscaling monitors actual storage consumption and then scales capacity automatically when actual utilization approaches the provisioned storage capacity.</p><hr><h2 id="Amazon-Aurora-DB"><a href="#Amazon-Aurora-DB" class="headerlink" title="Amazon Aurora DB"></a>Amazon Aurora DB</h2><ul><li>Aurora is a proprietary technology from AWS (not open sourced)</li><li>Postgres and MySQL are both supported as Aurora DB (that means your drivers will work as if Aurora was a Postgres or MySQL database)</li><li>Aurora is “AWS cloud optimized” and claims 5x performance improvement over MySQL on RDS, over 3x the performance of Postgres on RDS</li><li><code>Aurora storage automatically grows in increments of 10GB, up to 128 TB</code>.</li><li>Aurora can have up to 15 replicas and the replication process is faster than MySQL (sub 10 ms replica lag)</li><li>Failover in Aurora is instantaneous. It’s HA (High Availability) native.</li><li>Aurora costs more than RDS (20% more) - but is more efficient</li></ul><h3 id="Aurora-High-Availability-and-Read-Scaling"><a href="#Aurora-High-Availability-and-Read-Scaling" class="headerlink" title="Aurora High Availability and Read Scaling"></a>Aurora High Availability and Read Scaling</h3><ul><li><p>One Aurora Instance takes writes (master)</p></li><li><p><code>Support for Cross Region Replication</code></p><p>  <code>Shared storage Volume</code>: Replication + Self Healing + Auto expanding</p><p>  Reader Endpoint Connection Load Balancing</p></li></ul><h3 id="RDS-amp-Aurora-Security"><a href="#RDS-amp-Aurora-Security" class="headerlink" title="RDS &amp; Aurora Security"></a>RDS &amp; Aurora Security</h3><ul><li><code>At-rest encryption</code>:<ul><li>Database master &amp; replicas encryption using AWS KMS - must be defined as launch time</li><li>If the master is not encrypted, the read replicas cannot be encryptedTo encrypt an un-encrypted database, go through a DB snapshot &amp; restore as encrypted</li></ul></li><li><code>In-flight encryption</code>: TLS-ready by default, use the AWS TLS root certificates client-side</li><li><code>IAM Authentication: IAM roles</code> to connect to your database (instead of username&#x2F;pw)</li><li><code>Security Groups</code>: Control Network access to your RDS &#x2F; Aurora DB</li><li><code>No SSH available except on RDS Custom</code></li><li><code>Audit Logs can be enabled and sent to CloudWatch Logs for longer retention</code></li></ul><h3 id="Aurora-for-SysOps"><a href="#Aurora-for-SysOps" class="headerlink" title="Aurora for SysOps"></a>Aurora for SysOps</h3><ul><li><p>You can associate a priority tier (0-15) on each Read Replica</p><ul><li>Controls the failover priority</li><li>RDS will promote the Read Replica with the highest priority (lowest tier)</li><li>If replicas have the same priority, RDS promotes the largest in size</li><li>If replicas have the same priority and size, RDS promotes arbitrary replica</li></ul></li><li><p><code>You can migrate an RDS MySQL snapshot to Aurora MySQL Cluster</code></p></li></ul><h3 id="Connect-to-Amazon-Aurora-DB-cluster-from-outside-a-VPC"><a href="#Connect-to-Amazon-Aurora-DB-cluster-from-outside-a-VPC" class="headerlink" title="Connect to Amazon Aurora DB cluster from outside a VPC"></a>Connect to Amazon Aurora DB cluster from outside a VPC</h3><p>To connect to an Amazon Aurora DB cluster directly from outside the VPC, the instances in the cluster must meet the following requirements:</p><ol><li>The DB instance must have a public IP address.</li><li>The DB instance must be running in a publicly accessible subnet.</li></ol><p>For Amazon Aurora DB instances, you can’t choose a specific subnet. Instead, choose a DB subnet group when you create the instance. Create a DB subnet group with subnets of similar network configuration. For example, a DB subnet group for Public subnets.</p><h3 id="Aurora-Replicas-TODO"><a href="#Aurora-Replicas-TODO" class="headerlink" title="Aurora Replicas - TODO"></a>Aurora Replicas - TODO</h3><p>Aurora Replicas are independent endpoints in an Aurora DB cluster, best used for scaling read operations and increasing availability. Up to 15 Aurora Replicas can be distributed across the Availability Zones that a DB cluster spans within an AWS Region. The DB cluster volume is made up of multiple copies of the data for the DB cluster. However, the data in the cluster volume is represented as a single, logical volume to the primary instance and to Aurora Replicas in the DB cluster.</p><p>Alternatively, you can also use Amazon Aurora Multi-Master which is a feature of the Aurora MySQL-compatible edition that adds the ability to scale out write performance across multiple Availability Zones, allowing applications to direct read&#x2F;write workloads to multiple instances in a database cluster and operate with higher availability.</p><h3 id="Metrics-to-generate-reports-on-the-Aurora-DB-Cluster-and-its-replicas"><a href="#Metrics-to-generate-reports-on-the-Aurora-DB-Cluster-and-its-replicas" class="headerlink" title="Metrics to generate reports on the Aurora DB Cluster and its replicas"></a>Metrics to generate reports on the Aurora DB Cluster and its replicas</h3><ol><li><code>AuroraReplicaLagMaximum</code> - This metric captures the <code>maximum amount of lag between the primary instance and each Aurora DB instance in the DB cluster</code>.</li><li><code>AuroraBinlogReplicaLag</code> - This metric captures the <code>amount of time a replica DB cluster running</code> on Aurora MySQL-Compatible Edition lags behind the source DB cluster.This metric reports the value of the Seconds_Behind_Master field of the <em>MySQL SHOW SLAVE STATUS</em> command. This metric is useful for monitoring replica lag between Aurora DB clusters that are replicating across different AWS Regions.</li><li><code>AuroraReplicaLag</code> - This metric captures the <code>amount of lag</code> an Aurora replica experiences <code>when replicating updates from the primary instance</code>.</li><li><code>InsertLatency</code> - This metric captures <code>the average duration of insert operations</code>.</li></ol><h2 id="Aurora-Reader-Endpoint-👀-EXAM"><a href="#Aurora-Reader-Endpoint-👀-EXAM" class="headerlink" title="Aurora Reader Endpoint - 👀 EXAM"></a>Aurora Reader Endpoint - 👀 EXAM</h2><p>To <code>perform queries</code>, you can connect to the reader endpoint, with Aurora automatically performing load-balancing among all the Aurora <code>Replicas</code>.</p><p>A reader endpoint for an Aurora DB cluster provides load-balancing support for read-only connections to the DB cluster. Use the reader endpoint <code>for read operations</code>, such as queries. By processing those statements on the read-only Aurora Replicas, this endpoint reduces the overhead on the primary instance. It also helps the cluster to scale the capacity to handle simultaneous SELECT queries, proportional to the number of Aurora Replicas in the cluster. Each Aurora DB cluster has one reader endpoint.</p><p>Reference:<a href="https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/Aurora.Overview.Endpoints.html">Amazon Aurora connection management</a></p><hr><h2 id="Amazon-ElastiCache-Overview"><a href="#Amazon-ElastiCache-Overview" class="headerlink" title="Amazon ElastiCache Overview"></a>Amazon ElastiCache Overview</h2><ul><li><p>The same way RDS is to get managed Relational Databases…</p></li><li><p>ElastiCache is to get managed <code>Redis or Memcached</code></p></li><li><p>Caches are in-memory databases with really high performance, low latency</p></li><li><p><code>Helps reduce load off of databases for read intensive workloads</code></p></li><li><p><code>Helps make your application stateless</code></p></li><li><p>AWS takes care of OS maintenance &#x2F; patching, optimizations, setup, configuration, monitoring, failure recovery and backups</p><pre><code>Using ElastiCache involves heavy application code changes</code></pre></li></ul><h3 id="ElastiCache-Replication-Redis-Cluster-Mode-Disabled"><a href="#ElastiCache-Replication-Redis-Cluster-Mode-Disabled" class="headerlink" title="ElastiCache Replication (Redis): Cluster Mode Disabled"></a>ElastiCache Replication (Redis): Cluster Mode Disabled</h3><ul><li>One primary node, up to 5 replicas</li><li>Asynchronous Replication.<ul><li>Therefore, when a primary node fails over to a replica, a small amount of data might be lost due to replication lag.</li></ul></li><li>The primary node is used for read&#x2F;write</li><li>The other nodes are read-only</li><li><code>One shard, all nodes have all the data</code></li><li>Guard against data loss if node failure</li><li>Multi-AZ enabled by default for failover</li><li>Helpful to scale read performance</li><li>Horizontal and vertical</li></ul><h3 id="ElastiCache-Replication-Cluster-Mode-Enabled"><a href="#ElastiCache-Replication-Cluster-Mode-Enabled" class="headerlink" title="ElastiCache Replication: Cluster Mode Enabled"></a>ElastiCache Replication: Cluster Mode Enabled</h3><p>Data is partitioned across shards (helpful to scale writes)</p><ul><li>Automatically increase&#x2F;decrease the desired shards or replicas</li><li>Supports both Target Tracking and Scheduled Scaling Policies</li><li>Works only for Redis with Cluster Mode Enabled</li></ul><hr><h2 id="Memcached"><a href="#Memcached" class="headerlink" title="Memcached"></a>Memcached</h2><h3 id="Fix-high-Memcached-evictions"><a href="#Fix-high-Memcached-evictions" class="headerlink" title="Fix high Memcached evictions"></a>Fix high Memcached evictions</h3><p>To fix the issue of high Memcached evictions in Amazon ElastiCache, the following actions should be taken:</p><ol><li><code>Increase</code> the <code>size of the nodes</code> in the cluster: This allows for more available memory in each node, reducing the likelihood of evictions due to limited cache space.</li><li><code>Increase</code> the <code>number of nodes</code> in the cluster: By adding more nodes, the overall cache capacity increases, reducing the chance of evictions.</li></ol><p>The <a href="https://docs.aws.amazon.com/AmazonElastiCache/latest/mem-ug/CacheMetrics.WhichShouldIMonitor.html#metrics-evictions">Evictions metric</a> for Amazon ElastiCache for Memcached represents the number of nonexpired items that the cache evicted to provide space for new items. If you are experiencing evictions with your cluster, it is usually a sign that you need to scale up (use a node that has a larger memory footprint)or scale out (add additional nodes to the cluster) to accommodate the additional data</p><hr><h2 id="VPC"><a href="#VPC" class="headerlink" title="VPC"></a><a href="https://docs.aws.amazon.com/vpc/latest/userguide/how-it-works.html#what-is-privatelink">VPC</a></h2><p>With Amazon Virtual Private Cloud (Amazon VPC), you can launch AWS resources in a logically isolated virtual network that you’ve defined. This virtual network closely resembles a traditional network that you’d operate in your own data center, with the benefits of using the scalable infrastructure of AWS.</p><h3 id="Configuration"><a href="#Configuration" class="headerlink" title="Configuration"></a>Configuration</h3><p><code>Regardless of the type of subnet, the internal IPv4 address range of the subnet is always private</code>. AWS never announces these address blocks to the internet.</p><p><code>When you create a VPC, you must specify a range of IPv4 addresses for the VPC</code> in the form of a Classless Inter-Domain Routing (CIDR) block; for example, 10.0.0.0&#x2F;16. This is the primary CIDR block for your VPC.</p><p><code>Subnets created in a VPC can communicate with each other</code>, this is default behaviour. The main route table facilitates this communication.</p><p>Reference: <a href="https://docs.aws.amazon.com/vpc/latest/userguide/how-it-works.html">How Amazon VPC works</a></p><p><img src="/../images/AWS-VPC-Diagram.png" alt="VCP Diagram"></p><h3 id="CIDR-IPv4"><a href="#CIDR-IPv4" class="headerlink" title="CIDR - IPv4"></a>CIDR - IPv4</h3><ul><li><p>Classless <code>Inter-Domain Routing</code> - a method for allocating IP addresses</p></li><li><p><code>Used in Security Groups</code> rules and <code>AWS networking</code> in general</p></li><li><p>A CIDR consists of two components</p></li><li><p><em>Base IP</em></p><ul><li>Represents an IP contained in the range (XX.XX.XX.XX)</li><li>Example: 10.0.0.0, 192.168.0.0, …</li></ul></li><li><p><em>Subnet Mask</em></p><ul><li>Defines how many bits can change in the IP</li><li>Example: &#x2F;0, &#x2F;24, &#x2F;32</li><li>Can take two forms:<ul><li>&#x2F;8 ó 255.0.0.0</li><li>&#x2F;16 ó 255.255.0.0</li><li>&#x2F;24 ó 255.255.255.0</li><li>&#x2F;32 ó 255.255.255.255</li></ul></li></ul></li></ul><h3 id="Public-vs-Private-IP-IPv4"><a href="#Public-vs-Private-IP-IPv4" class="headerlink" title="Public vs. Private IP (IPv4)"></a>Public vs. Private IP (IPv4)</h3><ul><li><p>The Internet Assigned Numbers Authority (IANA) established certain blocks of IPv4 addresses for the use of private (LAN) and public (Internet) addresses</p></li><li><p><code>Private IP</code> can only allow certain values:</p><ul><li>10.0.0.0 - 10.255.255.255 (10.0.0.0&#x2F;8) &lt;- in big networks</li><li>172.16.0.0 - 172.31.255.255 (172.16.0.0&#x2F;12) &lt;- <em>AWS default VPC in that range</em></li><li>192.168.0.0 - 192.168.255.255 (192.168.0.0&#x2F;16) &lt;- e.g., home networks</li></ul></li><li><p>All the rest of the IP addresses on the Internet are Public</p></li></ul><h3 id="VPC-in-AWS-IPv4"><a href="#VPC-in-AWS-IPv4" class="headerlink" title="VPC in AWS - IPv4"></a>VPC in AWS - IPv4</h3><ul><li><p><code>VPC = Virtual Private Cloud</code></p></li><li><p>You can have multiple VPCs in an AWS region (max. 5 per region - soft limit)</p><ul><li>Max. CIDR per VPC is 5, for each CIDR:</li><li>Min. size is &#x2F;28 (16 IP addresses)</li></ul></li><li><p>Max. size is &#x2F;16 (65536 IP addresses)</p></li><li><p>Because VPC is private, only the Private IPv4 ranges are allowed:</p><ul><li>10.0.0.0 - 10.255.255.255 (10.0.0.0&#x2F;8)</li><li>172.16.0.0 - 172.31.255.255 (172.16.0.0&#x2F;12)</li><li>192.168.0.0 - 192.168.255.255 (192.168.0.0&#x2F;16)</li></ul></li><li><p><u><code>Your VPC CIDR should NOT overlap with your other networks (e.g., corporate)</code></u></p></li></ul><h3 id="VPC-Subnet-IPv4"><a href="#VPC-Subnet-IPv4" class="headerlink" title="VPC - Subnet (IPv4)"></a>VPC - Subnet (IPv4)</h3><ul><li>AWS reserves <code>5 IP addresses</code> (<code>first 4 &amp; last 1</code>) in each subnet</li><li>These 5 IP addresses are not available for use and can’t be assigned to anEC2 instance</li><li>Example: if CIDR block 10.0.0.0&#x2F;24, then reserved IP addresses are:<ul><li><strong>10.0.0.0</strong> - Network Address</li><li><strong>10.0.0.1</strong> - reserved by AWS for the VPC router</li><li><strong>10.0.0.2</strong> - reserved by AWS for mapping to Amazon-provided DNS</li><li><strong>10.0.0.3</strong> - reserved by AWS for future use</li><li><strong>10.0.0.255</strong> - Network Broadcast Address. AWS does not support broadcast in a VPC, therefore the address is reserved</li></ul></li><li><code>Exam Tip</code>, if you need 29 IP addresses for EC2 instances:<ul><li>You can’t choose a subnet of size &#x2F;27 (32 IP addresses, 32 - 5 &#x3D; 27 &lt; 29)</li><li>You need to choose a subnet of size &#x2F;26 (64 IP addresses, 64 - 5 &#x3D; 59 &gt; 29)</li></ul></li></ul><h3 id="Internet-Gateway-IGW"><a href="#Internet-Gateway-IGW" class="headerlink" title="Internet Gateway (IGW)"></a>Internet Gateway (IGW)</h3><ul><li><p>Allows resources (e.g., EC2 instances) in a VPC connect to the Internet</p></li><li><p>It scales horizontally and is highly available and redundant</p></li><li><p>Must be created separately from a VPC</p></li><li><p>One VPC can only be attached to one IGW and vice versa</p></li><li><p>Internet Gateways on their own do not allow Internet access…</p></li><li><p>Route tables must also be edited!</p></li></ul><h3 id="Bastion-Hosts"><a href="#Bastion-Hosts" class="headerlink" title="Bastion Hosts"></a>Bastion Hosts</h3><p>Is an ec2 instance, it’s espcial because it’s in a public subnet, with its segurity group</p><ul><li>We can use a Bastion Host to SSH into our private EC2 instances</li><li>The bastion is in the public subnet which is then connected to all other private subnets</li><li><code>Bastion Host security group must allow</code> inbound from the internet on port 22 from restricted CIDR, for example the public CIDR of your corporation</li><li><code>Security Group of the EC2 Instances</code> must allow the Security Group of the Bastion Host, or the <em>private IP</em> of the Bastion host</li></ul><h3 id="NAT-Instance-outdated-but-still-at-the-exam"><a href="#NAT-Instance-outdated-but-still-at-the-exam" class="headerlink" title="NAT Instance (outdated, but still at the exam)"></a>NAT Instance (outdated, but still at the exam)</h3><ul><li>NAT &#x3D; Network Address Translation</li><li>Allows EC2 instances in private subnets toconnect to the Internet</li><li>Must be launched in a public subnet</li><li>Must disable EC2 setting: <code>Source / destination Check</code></li><li>Must have Elastic IP attached to it</li><li>Route Tables must be configured to route traffic from private subnets to the NAT instance</li></ul><h3 id="NAT-Gateway"><a href="#NAT-Gateway" class="headerlink" title="NAT Gateway"></a>NAT Gateway</h3><ul><li>AWS-managed NAT, higher bandwidth, high availability, no administration</li><li>Pay per hour for usage and bandwidth</li><li>NATGW is created in a specific Availability Zone, uses an Elastic IP</li><li>Can’t be used by EC2 instance in the same subnet (only from other subnets)</li><li>Requires an IGW (Private Subnet &#x3D;&gt; NATGW &#x3D;&gt; IGW)</li><li>5 Gbps of bandwidth with automatic scaling up to 45 Gbps</li><li>No Security Groups to manage &#x2F; required</li></ul><h3 id="NAT-Gateway-with-High-Availability"><a href="#NAT-Gateway-with-High-Availability" class="headerlink" title="NAT Gateway with High Availability"></a>NAT Gateway with High Availability</h3><ul><li><code>NAT Gateway is resilient within a single Availability Zone</code></li><li>Must create <code>multiple NAT Gateways</code> in <code>multiple AZs</code> for fault-tolerance</li><li>There is no cross-AZ failover needed because if an AZ goes down it doesn’t need NAT</li></ul><h3 id="Connect-the-Lambda-function-to-a-private-subnet-that-has-a-route-to-a-NAT-gateway-deployed-in-a-public-subnet-of-the-VPC"><a href="#Connect-the-Lambda-function-to-a-private-subnet-that-has-a-route-to-a-NAT-gateway-deployed-in-a-public-subnet-of-the-VPC" class="headerlink" title="Connect the Lambda function to a private subnet that has a route to a NAT gateway deployed in a public subnet of the VPC."></a>Connect the Lambda function to a private subnet that has a route to a NAT gateway deployed in a public subnet of the VPC.</h3><p><code>Explanation</code>: By connecting the Lambda function to a private subnet with a route to a NAT gateway, the function can access resources within the VPC while also leveraging the NAT gateway to access the internet and communicate with third-party APIs. The NAT gateway acts as a bridge between the private subnet and the internet, allowing the Lambda function to securely access external resources.</p><h4 id="DNS-Resolution-in-VPC"><a href="#DNS-Resolution-in-VPC" class="headerlink" title="DNS Resolution in VPC"></a>DNS Resolution in VPC</h4><ul><li><code>DNS Resolution (enableDnsSupport)</code><ul><li>Decides if DNS resolution from Route 53 Resolver server is supported for the VPC</li><li>True (default): it queries the Amazon Provider DNS Server at <code>169.254.169.253</code> or the reserved IP address at the base of the <code>VPC IPv4 network range plus two (.2)</code>.</li></ul></li></ul><p><code>enableDnsSupport</code> - Indicates whether the DNS resolution is supported for the VPC. If this attribute is false, the Amazon-provided DNS server in the VPC that resolves public DNS hostnames to IP addresses is not enabled. If this attribute is true, queries to the Amazon provided DNS server at the 169.254.169.253 IP address, or the reserved IP address at the base of the VPC IPv4 network range plus two will succeed.</p><ul><li><code>DNS Hostnames (enableDnsHostnames)</code><ul><li>By default,</li><li>True &#x3D;&gt; default VPC</li><li>False &#x3D;&gt; newly created VPCs</li></ul></li><li>Won’t do anything unless enableDnsSupport&#x3D;true</li><li>If True, assigns public hostname to EC2 instance if it has a public IPv4</li></ul><p><code>enableDnsHostnames</code> - Indicates whether the instances launched in the VPC get public DNS hostnames. If this attribute is true, instances in the VPC get public DNS hostnames, but only <code>if</code> the <code>enableDnsSupport</code> attribute is also set to <code>true</code>.</p><p>By default, both attributes are set to <code>true</code> in a default VPC or a VPC created by the VPC wizard. By default, only the <code>enableDnsSupport</code> attribute is set to true in a VPC created on the Your VPCs page of the VPC console or using the AWS CLI, API, or an AWS SDK.</p><h3 id="DNS-Resolution-in-VPC-1"><a href="#DNS-Resolution-in-VPC-1" class="headerlink" title="DNS Resolution in VPC"></a>DNS Resolution in VPC</h3><ul><li>If you use custom DNS domain names in a Private Hosted Zone in Route 53, you must set both these attributes (enableDnsSupport &amp; enableDnsHostname) to true</li></ul><h3 id="Network-Access-Control-List-NACL"><a href="#Network-Access-Control-List-NACL" class="headerlink" title="Network Access Control List (NACL)"></a>Network Access Control List (NACL)</h3><ul><li>NACL are like a firewall which control traffic from and <strong>to subnets</strong></li><li><strong>One NACL per subnet</strong>, new subnets are assigned the <strong>Default NACL</strong></li><li>You define <strong>NACL Rules</strong>:<ul><li>Rules have a number (1-32766), higher precedence with a lower number</li><li>First rule match will drive the decision</li><li>Example: if you define #100 ALLOW 10.0.0.10&#x2F;32 and #200 DENY 10.0.0.10&#x2F;32, the IP address will be allowed because 100 has a higher precedence over 200</li><li>The last rule is an asterisk (*) and denies a request in case of no rule match</li><li>AWS recommends adding rules by increment of 100</li></ul></li><li>Newly created NACLs will deny everything</li><li>NACL are a <code>great way of blocking a specific IP address</code> at the subnet level</li></ul><h3 id="Default-NACL"><a href="#Default-NACL" class="headerlink" title="Default NACL"></a>Default NACL</h3><ul><li><code>Accepts everything inbound/outbound</code> with the subnets it’s associated with</li></ul><h3 id="Ephemeral-Ports"><a href="#Ephemeral-Ports" class="headerlink" title="Ephemeral Ports"></a>Ephemeral Ports</h3><ul><li>For any two endpoints to establish a connection, they must use ports</li><li>Clients connect to a <code>defined port</code>, and expect a response on an <code>ephemeral port</code></li><li>Different Operating Systems use different port ranges, examples:<ul><li>IANA &amp; MS Windows 10 -&gt; 49152 - 65535</li><li>Many Linux Kernels -&gt; 32768 - 60999</li></ul></li></ul><table><thead><tr><th>Security Group</th><th>NACL</th></tr></thead><tbody><tr><td>Operates at the instance level</td><td>Operates at the subnet level</td></tr><tr><td>Supports allow rules only</td><td>Supports allow rules and deny rules</td></tr><tr><td><code>Stateful</code>: return traffic is automatically allowed, regardless of any rules</td><td><code>Stateless</code>: return traffic must be explicitly allowed by rules (think of ephemeral ports)</td></tr><tr><td>All rules are evaluated before deciding whether to allow traffic</td><td>Rules are evaluated in order (lowest to highest) when deciding whether to allow traffic, first match wins</td></tr><tr><td>Applies to an EC2 instance when specified by someone</td><td>Automatically applies to all EC2 instances in the subnet that it’s associated with</td></tr></tbody></table><h3 id="VPC-Reachability-Analyzer"><a href="#VPC-Reachability-Analyzer" class="headerlink" title="VPC - Reachability Analyzer"></a>VPC - Reachability Analyzer</h3><ul><li>A network diagnostics tool that troubleshoots network connectivity between two endpoints in your VPC(s)</li><li>It builds a model of the network configuration, then checks the reachability based on these configurations (<code>it doesn’t send packets</code>)</li><li>When the destination is<ul><li><code>Reachable</code> - it produces hop-by-hop details of the virtual network path</li><li><code>Not reachable</code> - it identifies the blocking component(s) (e.g., configuration issues in SGs, NACLs, Route Tables, …)</li></ul></li><li>Use cases: troubleshoot connectivity issues, ensure network configuration is as intended, …</li></ul><h3 id="VPC-Peering"><a href="#VPC-Peering" class="headerlink" title="VPC Peering"></a>VPC Peering</h3><ul><li><p>Privately connect two VPCs using AWS’ network</p></li><li><p>Make them behave as if they were in the same network</p></li><li><p>Must not have overlapping CIDRs</p></li><li><p>VPC Peering connection is <code>NOT transitive</code> (must be established for each VPC that need to communicate with one another)</p></li><li><p><code>You must update route tables in each VPC’s subnets to ensure EC2 instances can communicate with each other</code></p></li><li><p>You can create VPC Peering connection between VPCs in <code>different AWS accounts/regions</code></p></li><li><p>You can reference a security group in a peered VPC (<code>works cross accounts - same region</code>)</p></li></ul><h3 id="VPC-Endpoint-AWS-PrivateLink"><a href="#VPC-Endpoint-AWS-PrivateLink" class="headerlink" title="VPC Endpoint (AWS PrivateLink)"></a>VPC Endpoint (AWS PrivateLink)</h3><p>A VPC Endpoint allows you to <code>connect</code> your <code>VPC</code> directly <code>to AWS services</code> without the need for <code>internet gateways</code>, <code>NAT gateways</code>, or <code>VPN connections</code>. It enables private communication between your VPC and the AWS service without going over the internet.</p><ul><li>Most secure &amp; scalable way to <code>expose a service to 1000s of VPC</code> (own or other accounts)</li><li>Does &#96;not require VPC peering, internet gateway, NAT, route tables… (magical..)</li><li>Requires a <code>network load balancer</code> (Service VPC) and <code>ENI</code> (Customer VPC) <code>or GWLB</code></li><li>If the NLB is in multiple AZ, and the ENIs in multiple AZ, the solution is fault tolerant!</li></ul><p>To configure a VPC Endpoint for accessing AWS Systems Manager APIs, you can follow these steps:</p><ol><li>Create a VPC Endpoint for AWS Systems Manager in your Amazon VPC. This creates an elastic network interface with a private IP address within your VPC.</li><li>Update the route tables in your VPC to route traffic destined for the AWS Systems Manager API endpoints to the VPC Endpoint. This ensures that traffic is directed through the VPC Endpoint instead of going over the internet.</li><li>Verify that your on-premises instances and AWS managed instances are configured to use the appropriate VPC and route tables.</li></ol><h4 id="Types-of-Endpoints"><a href="#Types-of-Endpoints" class="headerlink" title="Types of Endpoints"></a>Types of Endpoints</h4><ul><li><code>Interface Endpoints (powered by PrivateLink)</code><ul><li>Provisions an ENI (private IP address) as an entry point (must attach a Security Group)</li><li>Supports most AWS services</li><li>$ per hour + $ per GB of data processed</li></ul></li><li><code>Gateway Endpoints</code><ul><li>Provisions a gateway and must be used as <code>a target in a route table (does not use security groups)</code></li><li>Supports both S3 and DynamoDB</li><li>Free</li></ul></li></ul><h3 id="Gateway-or-Interface-Endpoint-for-S3"><a href="#Gateway-or-Interface-Endpoint-for-S3" class="headerlink" title="Gateway or Interface Endpoint for S3?"></a>Gateway or Interface Endpoint for S3?</h3><ul><li><code>Gateway is most likely going to be preferred all the time at the exam</code>.</li><li>Cost: free for Gateway, $ for interface endpoint</li><li>Interface Endpoint is preferred access is <code>required</code> from <code>on premises</code> (Site to Site VPN or Direct Connect), a different VPC or a different region.</li></ul><h3 id="VPC-Flow-Logs"><a href="#VPC-Flow-Logs" class="headerlink" title="VPC Flow Logs"></a>VPC Flow Logs</h3><ul><li>Capture information about IP traffic going into your interfaces:<ul><li>VPC Flow Logs</li><li>Subnet Flow Logs</li><li>Elastic Network Interface (ENI) Flow Logs</li></ul></li><li>Helps to monitor &amp; troubleshoot connectivity issues</li><li>Flow logs data can go to S3, CloudWatch Logs, and Kinesis Data Firehose</li><li>Captures network information from AWS managed interfaces too: ELB, RDS, ElastiCache, Redshift, WorkSpaces, NATGW, Transit Gateway…</li></ul><h3 id="VPC-Flow-Logs-Syntax"><a href="#VPC-Flow-Logs-Syntax" class="headerlink" title="VPC Flow Logs Syntax"></a>VPC Flow Logs Syntax</h3><ul><li><code>srcaddr &amp; dstaddr</code> - help identify problematic IP</li><li><code>srcport &amp; dstport</code> - help identity problematic ports</li><li><code>Action</code> - success or failure of the request due to Security Group &#x2F; NACL</li><li>Can be used for analytics on usage patterns, or malicious behavior</li><li><code>Query VPC flow logs using Athena on S3 or CloudWatch Logs Insights</code></li><li>Flow Logs examples: <a href="https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs-records-examples.html">https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs-records-examples.html</a></li></ul><hr><h3 id="AWS-Site-to-Site-VPN"><a href="#AWS-Site-to-Site-VPN" class="headerlink" title="AWS Site-to-Site VPN"></a>AWS Site-to-Site VPN</h3><ul><li><code>Virtual Private Gateway (VGW)</code><ul><li>VPN concentrator on the AWS side of the VPN connection</li><li>VGW is created and attached to the VPC from which you want to create the Site-to-Site VPN connection</li><li>Possibility to customize the ASN (Autonomous System Number)</li></ul></li><li><code>Customer Gateway (CGW)</code><ul><li>Software application or physical device on customer side of the VPN connection</li><li><a href="https://docs.aws.amazon.com/vpn/latest/s2svpn/your-cgw.html#DevicesTested">https://docs.aws.amazon.com/vpn/latest/s2svpn/your-cgw.html#DevicesTested</a></li></ul></li></ul><p><img src="/../images/AWS-Site-to-Site-Connection.png" alt="AWS Site-to-Site VPN"></p><h3 id="Site-to-Site-VPN-Connections"><a href="#Site-to-Site-VPN-Connections" class="headerlink" title="Site-to-Site VPN Connections"></a>Site-to-Site VPN Connections</h3><ul><li><code>Customer Gateway Device (On-premises)</code><ul><li>👀 What IP address to use?<ul><li>Public Internet-routable IP address for your Customer Gateway device</li><li>If it’s behind a NAT device that’s enabled for NAT traversal (NAT-T), use the public IP address of the NAT device</li></ul></li></ul></li><li>👀 <code>Important step</code>: enable <code>Route Propagation</code> for the Virtual Private Gateway in the route table that is associated with your subnets</li><li>👀 If you need to <code>ping your EC2 instances</code> from on-premises, make sure you add the <code>ICMP protocol on the inbound of your security groups</code>.</li></ul><h4 id="AWS-VPN-CloudHub"><a href="#AWS-VPN-CloudHub" class="headerlink" title="AWS VPN CloudHub"></a>AWS VPN CloudHub</h4><ul><li>Provide secure communication between multiple sites, if you have multiple VPN connections</li><li><code>Low-cost</code> hub-and-spoke model for primary or secondary network connectivity between different locations (<code>VPN only</code>)</li><li>It’s a VPN connection so it goes over the <code>public Internet</code></li><li>To set it up, connect multiple VPN connections on the same VGW, setup dynamic routing and configure route tables</li></ul><h2 id="To-create-a-VPN"><a href="#To-create-a-VPN" class="headerlink" title="To create a VPN"></a>To create a VPN</h2><ol><li>Create Customer Gateway</li><li>Create Virtual Private Gateway</li><li>Use Site-to-Site VPN connection for both VGW and customers Gateway.</li></ol><hr><h3 id="Direct-Connect-DX"><a href="#Direct-Connect-DX" class="headerlink" title="Direct Connect (DX)"></a>Direct Connect (DX)</h3><ul><li>Provides a dedicated <code>private</code> connection from a <code>remote network to your VPC</code>.</li><li>Dedicated connection must be setup between your DC and AWS Direct Connect locations</li><li>You <code>need</code> to setup a <code>Virtual Private Gateway</code> on your VPC</li><li>Access public resources (S3) and private (EC2) on same connection</li><li>Use Cases:<ul><li>Increase bandwidth throughput - working with large data sets - lower cost</li><li>More consistent network experience - applications using real-time data feeds</li><li>Hybrid Environments (on prem + cloud)</li></ul></li><li>Supports both IPv4 and IPv6</li></ul><p><img src="/../images/AWS-Direct-Connect-Diagram.png" alt="Direct Connect"></p><h4 id="Direct-Connect-Gateway"><a href="#Direct-Connect-Gateway" class="headerlink" title="Direct Connect Gateway"></a>Direct Connect Gateway</h4><p><code>If you want to setup a Direct Connect to one or more VPC in many different regions (same account), you must use a Direct Connect Gateway</code>. - Exam 👀</p><p><img src="/../images/AWS-Direct-Connet-Gateway.png" alt="Direct Connect Gateway"></p><h3 id="Direct-Connect-Connection-Types"><a href="#Direct-Connect-Connection-Types" class="headerlink" title="Direct Connect - Connection Types"></a>Direct Connect - Connection Types</h3><ul><li><code>Dedicated Connections</code>: 1Gbps,10 Gbps and 100 Gbps capacity<ul><li>Physical ethernet port dedicated to a customer</li><li>Request made to AWS first, then completed by AWS Direct Connect Partners</li></ul></li><li><code>Hosted Connections</code>: 50Mbps, 500 Mbps, to 10 Gbps<ul><li>Connection requests are made via AWS Direct Connect Partners</li><li>Capacity can be <code>added or removed on demand</code></li><li>1, 2, 5, 10 Gbps available at select AWS Direct Connect Partners</li></ul></li><li>Lead times are often longer than 1 <code>month to establish a new connection</code> - 👀 EXAM</li></ul><h3 id="Direct-Connect-Encryption"><a href="#Direct-Connect-Encryption" class="headerlink" title="Direct Connect - Encryption"></a>Direct Connect - Encryption</h3><ul><li>Data in transit is <code>not encrypted</code> but is private</li><li><code>AWS Direct Connect + VPN provides</code> an IPsec-encrypted private connection</li></ul><h3 id="Direct-Connect-Resiliency"><a href="#Direct-Connect-Resiliency" class="headerlink" title="Direct Connect - Resiliency"></a>Direct Connect - Resiliency</h3><p><code>High Resiliency for Critical Workloads</code></p><p><code>Maximum Resiliency for Critical Workloads</code></p><h3 id="Site-to-Site-VPN-connection-as-a-backup"><a href="#Site-to-Site-VPN-connection-as-a-backup" class="headerlink" title="Site-to-Site VPN connection as a backup"></a>Site-to-Site VPN connection as a backup</h3><p>In case Direct Connect fails, you can <code>set up a backup Direct Connect</code> connection (<code>expensive</code>), or a <code>Site-to-Site</code> VPN connection.</p><h3 id="Transit-Gateway"><a href="#Transit-Gateway" class="headerlink" title="Transit Gateway"></a>Transit Gateway</h3><ul><li><code>For having transitive peering between thousands of VPC and on-premises, hub-and-spoke (star) connection</code></li><li><code>Regional resource</code>, can work cross-region</li><li>Share cross-account using Resource Access Manager (RAM)</li><li>You can peer Transit Gateways across regions</li><li>Route Tables: limit which VPC can talk with other VPC</li><li>Works with Direct Connect Gateway, VPN connections</li><li>Supports <code>IP Multicast</code> (not supported by any other AWS service)1</li></ul><h4 id="Transit-Gateway-Site-to-Site-VPN-ECMP"><a href="#Transit-Gateway-Site-to-Site-VPN-ECMP" class="headerlink" title="Transit Gateway: Site-to-Site VPN ECMP"></a>Transit Gateway: Site-to-Site VPN ECMP</h4><ul><li><code>ECMP = Equal-cost multi-path routing</code>.</li><li>Routing strategy to allow to forward a packet over multiple best path.</li></ul><ul><li>Use case: create multiple Site-to-Site VPN connections <code>to increase the bandwidth of your connection to AWS</code>.</li></ul><h3 id="VPC-Traffic-Mirroring"><a href="#VPC-Traffic-Mirroring" class="headerlink" title="VPC - Traffic Mirroring"></a>VPC - Traffic Mirroring</h3><ul><li>Capture the traffic<ul><li>From (Source) - ENIs</li><li>To (Targets) - an ENI or a Network Load Balancer</li></ul></li><li>Source and Target can be in the same VPC or different VPCs (VPC Peering)</li><li>Use cases: content inspection, threat  Auto Scaling group monitoring, troubleshooting, …</li></ul><h3 id="IPv6-in-VPC"><a href="#IPv6-in-VPC" class="headerlink" title="IPv6 in VPC"></a>IPv6 in VPC</h3><ul><li><code>IPv4 cannot be disabled for your VPC and subnets</code></li><li>You <code>can enable IPv6</code> (they’re public IP addresses) to operate in <code>dual-stack mode</code>.</li><li>Your EC2 instances</li><li>They can communicate using either IPv4 or IPv6to the internet through an Internet Gatewaywill get at least a private internal IPv4 and a public IPv6</li></ul><h2 id="IPv6-Troubleshooting"><a href="#IPv6-Troubleshooting" class="headerlink" title="IPv6 Troubleshooting"></a>IPv6 Troubleshooting</h2><ul><li><code>IPv4 cannot be disabled for your VPC and subnets</code></li><li><em>So, if you cannot launch an EC2 instance in your subnet</em><ul><li>It’s not because it cannot acquire an IPv6 (the space is very large)</li><li>It’s because <em>there are no available IPv4 in your subnet</em></li></ul></li><li><code>Solution</code>: create a new IPv4 CIDR in your subnet</li></ul><h3 id="Egress-only-Internet-Gateway"><a href="#Egress-only-Internet-Gateway" class="headerlink" title="Egress-only Internet Gateway"></a>Egress-only Internet Gateway</h3><p>An egress-only internet gateway is a horizontally scaled, redundant, and highly available VPC component that <code>allows outbound communication over IPv6 from instances in your VPC to the internet</code>, and prevents the internet from initiating an IPv6 connection with your instances. You must <code>update the Route Tables</code></p><p>An egress-only internet gateway is for use with <code>IPv6 traffic only</code>. To enable outbound-only internet communication <code>over IPv4</code>, use a <code>NAT gateway</code> instead.</p><p>Reference: <a href="https://docs.aws.amazon.com/vpc/latest/userguide/egress-only-internet-gateway.html">Enable outbound IPv6 traffic using an egress-only internet gateway</a></p><h3 id="Carrier-gateway"><a href="#Carrier-gateway" class="headerlink" title="Carrier gateway"></a>Carrier gateway</h3><p>A Carrier gateway is a highly available virtual appliance that <code>provides outbound IPv6 internet connectivity for instances in your VPC</code>. It acts as a gateway between your VPC and the internet, <code>allowing</code> IPv6 <code>traffic</code> to flow <code>in and out</code> of your <code>VPC</code>. By configuring a Carrier gateway, you can enable outbound communication over IPv6 for the EC2 instances in the private subnets while keeping them isolated from direct internet access.</p><h2 id="Security-Groups"><a href="#Security-Groups" class="headerlink" title="Security Groups"></a>Security Groups</h2><ul><li><code>By default</code>, security groups <code>allow all outbound traffic</code>.</li><li>Security group <code>rules are always permissive</code>; you can’t create rules that deny access.</li><li>Security groups are <code>stateful</code></li></ul><h3 id="The-reason-for-the-issue-where-the-new-EC2-instances-are-unable-to-mount-the-Amazon-EFS-file-system-in-a-new-Availability-Zone-could-be"><a href="#The-reason-for-the-issue-where-the-new-EC2-instances-are-unable-to-mount-the-Amazon-EFS-file-system-in-a-new-Availability-Zone-could-be" class="headerlink" title="The reason for the issue where the new EC2 instances are unable to mount the Amazon EFS file system in a new Availability Zone could be:"></a>The reason for the issue where the new EC2 instances are unable to mount the Amazon EFS file system in a new Availability Zone could be:</h3><p>The security group for the mount target does not allow inbound NFS connections from the security group used by the EC2 instances.</p><p><code>Explanation</code>: When mounting an Amazon EFS file system from EC2 instances, the security group associated with the mount target should allow inbound NFS (Network File System) connections from the security group used by the EC2 instances. By default, the security group associated with the mount target allows inbound connections from the default security group of the VPC. If the EC2 instances are using a different security group, it needs to be added to the mount target’s security group’s inbound rules to allow NFS connections.</p><p>👀 - Only support <code>allow</code> rules. You have to allow incoming traffic from your customers to your instances</p><h3 id="The-following-provides-an-overview-of-the-steps-to-enable-your-VPC-and-subnets-to-use-IPv6"><a href="#The-following-provides-an-overview-of-the-steps-to-enable-your-VPC-and-subnets-to-use-IPv6" class="headerlink" title="The following provides an overview of the steps to enable your VPC and subnets to use IPv6:"></a>The following provides an overview of the steps to enable your VPC and subnets to use IPv6:</h3><ul><li><p><code>Step 1</code>:Associate an IPv6 CIDR Block with Your VPC and Subnets - Associate an Amazon-provided IPv6 CIDR block with your VPC and with your subnets.</p></li><li><p><code>Step 2</code>:Update Your Route Tables - Update your route tables to route your IPv6 traffic. For a public subnet, create a route that routes all IPv6 traffic from the subnet to the Internet gateway. For a private subnet, create a route that routes all Internet-bound IPv6 traffic from the subnet to an egress-only Internet gateway.</p></li><li><p><code>Step 3</code>:Update Your Security Group Rules - Update your security group rules to include rules for IPv6 addresses. This enables IPv6 traffic to flow to and from your instances. If you’ve created custom network ACL rules to control the flow of traffic to and from your subnet, you must include rules for IPv6 traffic.</p></li><li><p><code>Step 4</code>:Change Your Instance Type - If your instance type does not support IPv6, change the instance type. If your instance type does not support IPv6, you must resize the instance to a supported instance type. In the example, the instance is an m3.large instance type, which does not support IPv6. You must resize the instance to a supported instance type, for example, m4.large.</p></li><li><p><code>Step 5</code>:Assign IPv6 Addresses to Your Instances - Assign IPv6 addresses to your instances from the IPv6 address range of your subnet.</p></li><li><p><code>Step 6</code>: (Optional)Configure IPv6 on Your Instances - If your instance was launched from an AMI that is not configured to use DHCPv6, you must manually configure your instance to recognize an IPv6 address assigned to the instance.</p></li></ul><h3 id="VPC-Section-Summary"><a href="#VPC-Section-Summary" class="headerlink" title="VPC Section Summary"></a>VPC Section Summary</h3><ul><li><code>CIDR</code> - IP Range</li><li><code>VPC</code> - Virtual Private Cloud &#x3D;&gt; we define a list of IPv4 &amp; IPv6 CIDR</li><li><code>Subnets</code> - tied to an AZ, we define a CIDR</li><li><code>Internet Gateway</code> - at the VPC level, provide IPv4 &amp; IPv6 Internet Access</li><li><code>Route Tables</code> - must be edited to add routes from subnets to the IGW, VPC Peering Connections, VPC Endpoints, …</li><li><code>Bastion Host</code> - public EC2 instance to SSH into, that has SSH connectivity to EC2 instances in private subnets</li><li><code>NAT Instances</code> - gives Internet access to EC2 instances in private subnets. Old, must be setup in a public subnet, disable Source &#x2F; Destination check flag</li><li><code>NAT Gateway</code> - managed by AWS, provides scalable Internet access to private EC2 instances, IPv4 only</li><li><code>Private DNS</code> + Route 53 - enable DNS Resolution + DNS Hostnames (VPC)-<code> NACL</code> - stateless, subnet rules for inbound and outbound, don’t forget Ephemeral Ports</li><li><code>Security Groups</code> - stateful, operate at the EC2 instance level</li><li><code>Reachability Analyzer</code> - perform network connectivity testing between AWS resources</li><li><code>VPC Peering</code> - connect two VPCs with non overlapping CIDR, non-transitive</li><li><code>VPC Endpoints</code> - provide private access to AWS Services (S3, DynamoDB, CloudFormation, SSM) within a VPC</li><li><code>VPC Flow Logs</code> - can be setup at the VPC &#x2F; Subnet &#x2F; ENI Level, for ACCEPT and REJECT traffic, helps identifying attacks, analyze using Athena or CloudWatch Logs Insights</li><li><code>Site-to-Site VPN</code> - setup a Customer Gateway on DC, a Virtual Private Gateway on VPC, and site-to-site VPN over public Internet</li><li><code>AWS VPN CloudHub</code> - hub-and-spoke VPN model to connect your sites</li><li><code>Direct Connect</code> - setup a Virtual Private Gateway on VPC, and establish a direct private connection to an AWS Direct Connect Location</li><li><code>Direct Connect Gateway</code> - setup a Direct Connect to many VPCs in different AWS regions</li><li><code>AWS PrivateLink / VPC Endpoint Services</code>:<ul><li>Connect services privately from your service VPC to customers VPC</li><li>Doesn’t need VPC Peering, public Internet, NAT Gateway, Route Tables</li><li>Must be used with Network Load Balancer &amp; ENI</li></ul></li><li><code>ClassicLink</code> - connect EC2-Classic EC2 instances privately to your VPC</li><li><code>Transit Gateway</code> - transitive peering connections for VPC, VPN &amp; DX</li><li><code>Traffic Mirroring</code> - copy network traffic from ENIs for further analysis</li><li><code>Egress-only Internet Gateway</code> - like a NAT Gateway, but for IPv6</li></ul><h3 id="Networking-Costs-in-AWS-per-GB"><a href="#Networking-Costs-in-AWS-per-GB" class="headerlink" title="Networking Costs in AWS per GB"></a>Networking Costs in AWS per GB</h3><ul><li>Use Private IP instead of Public IP for good savings and better network performance</li><li>Use same AZ for maximum savings (at the cost of high availability) - Exam 👀</li></ul><h3 id="S3-Data-Transfer-Pricing-Analysis-for-USA"><a href="#S3-Data-Transfer-Pricing-Analysis-for-USA" class="headerlink" title="S3 Data Transfer Pricing - Analysis for USA"></a>S3 Data Transfer Pricing - Analysis for USA</h3><ul><li><code>S3 ingress</code>: free</li><li><code>S3 to Internet</code>: $0.09 per GB</li><li><code>S3 Transfer Acceleration</code>:<ul><li>Faster transfer times (50 to 500% better)</li><li>Additional cost on top of Data Transfer Pricing: +$0.04 to $0.08 per GB</li></ul></li><li><code>S3 to CloudFront</code>: $0.00 per GB</li><li><code>CloudFront to Internet</code>: $0.085 per GB (slightly cheaper than S3)<ul><li>Caching capability (lower latency)</li><li>Reduce costs associated with S3 Requests Pricing (7x cheaper with CloudFront)</li></ul></li><li><code>S3 Cross Region Replication</code>: $0.02 per GB</li></ul><h3 id="AWS-Network-Firewall-👀-OJO-QUESTION"><a href="#AWS-Network-Firewall-👀-OJO-QUESTION" class="headerlink" title="AWS Network Firewall - 👀 OJO QUESTION"></a>AWS Network Firewall - 👀 OJO QUESTION</h3><ul><li><code>Protect your entire Amazon VPC</code><ul><li>Pass traffic through only from known AWS service domains or IP address endpoints, such as Amazon S3.</li><li>Use custom <code>lists of known bad domains to limit the types of domain names that your applications can access</code>.</li><li>Perform <code>deep packet inspection</code> DPI on traffic entering or leaving your VPC.</li><li>Use stateful protocol detection to filter protocols like HTTPS, independent of the port used.</li><li>From Layer 3 to Layer 7 protection</li></ul></li><li>Any direction, you can inspect<ul><li><code>VPC</code> to <code>VPC</code> traffic</li><li><code>Outbound</code> to internet</li><li><code>Inbound</code> from internet</li><li><code>To / from Direct Connect &amp; Site-to-Site VPN</code></li></ul></li><li>Internally, the AWS Network Firewall uses the AWS Gateway Load Balancer 👀</li><li>Rules can be centrally managed <code>cross-account</code> by <code>AWS Firewall Manager</code> to apply to many VPCs</li></ul><h3 id="Network-Firewall-Fine-Grained-Controls"><a href="#Network-Firewall-Fine-Grained-Controls" class="headerlink" title="Network Firewall - Fine Grained Controls"></a>Network Firewall - Fine Grained Controls</h3><ul><li><p>Supports 1000s of rules</p></li><li><p>IP &amp; port - example: 10,000s of IPs filtering</p></li><li><p>Protocol - example: block the SMB protocol for outbound communications</p></li><li><p>Stateful domain list rule groups: only allow outbound traffic to *.mycorp.com or third-party software repo</p></li><li><p>General pattern matching using regex</p></li><li><p><code>Traffic filtering: Allow, drop, or alert for the traffic that matches the rules</code></p></li><li><p><code>Active flow inspection</code> to protect against network threats with intrusion-prevention capabilities (like Gateway Load Balancer, but all managed by AWS)</p></li><li><p>Send logs of rule matches to Amazon S3, CloudWatch Logs, Kinesis Data Firehose</p></li></ul><hr><h2 id="CloudFormation"><a href="#CloudFormation" class="headerlink" title="CloudFormation"></a>CloudFormation</h2><h3 id="cfn-init"><a href="#cfn-init" class="headerlink" title="cfn-init"></a>cfn-init</h3><ul><li>AWS::CloudFormation::Init must be in the Metadata of a resource</li><li>With the cfn-init script, it helps make complex EC2 configurations readable</li><li>The EC2 instance will query the CloudFormation service to get init data</li><li>Logs go to &#x2F;var&#x2F;log&#x2F;cfn-init.log</li></ul><p>(More readable compared with user data scripts)</p><figure class="highlight yml"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br></pre></td><td class="code"><pre><span class="line"><span class="attr">UserData:</span></span><br><span class="line">  <span class="attr">Fn::Base64:</span></span><br><span class="line">    <span class="type">!Sub</span> <span class="string">|</span></span><br><span class="line"><span class="string">      #!/bin/bash -xe</span></span><br><span class="line"><span class="string">      # Get the latest CloudFormation package</span></span><br><span class="line"><span class="string">      yum update -y aws-cfn-bootstrap</span></span><br><span class="line"><span class="string">      # Start cfn-init</span></span><br><span class="line"><span class="string">      /opt/aws/bin/cfn-init -s $&#123;AWS::StackId&#125; -r MyInstance --region $&#123;AWS::Region&#125; || error_exit &#x27;Failed to run cfn-init&#x27;</span></span><br></pre></td></tr></table></figure><figure class="highlight yml"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br></pre></td><td class="code"><pre><span class="line"><span class="attr">Metadata:</span></span><br><span class="line">  <span class="attr">Comment:</span> <span class="string">Install</span> <span class="string">a</span> <span class="string">simple</span> <span class="string">Apache</span> <span class="string">HTTP</span> <span class="string">page</span></span><br><span class="line">  <span class="attr">AWS::CloudFormation::Init:</span></span><br><span class="line">    <span class="attr">config:</span></span><br><span class="line">      <span class="attr">packages:</span></span><br><span class="line">        <span class="attr">yum:</span></span><br><span class="line">          <span class="attr">httpd:</span> []</span><br><span class="line">      <span class="attr">files:</span></span><br><span class="line">        <span class="string">&quot;/var/www/html/index.html&quot;</span><span class="string">:</span></span><br><span class="line">          <span class="attr">content:</span> <span class="string">|</span></span><br><span class="line"><span class="string">            &lt;h1&gt;Hello World from EC2 instance!&lt;/h1&gt;</span></span><br><span class="line"><span class="string">            &lt;p&gt;This was created using cfn-init&lt;/p&gt;</span></span><br><span class="line"><span class="string"></span>          <span class="attr">mode:</span> <span class="string">&#x27;000644&#x27;</span></span><br><span class="line">      <span class="attr">commands:</span></span><br><span class="line">        <span class="attr">hello:</span></span><br><span class="line">          <span class="attr">command:</span> <span class="string">&quot;echo &#x27;hello world&#x27;&quot;</span></span><br><span class="line">      <span class="attr">services:</span></span><br><span class="line">        <span class="attr">sysvinit:</span></span><br><span class="line">          <span class="attr">httpd:</span></span><br><span class="line">            <span class="attr">enabled:</span> <span class="string">&#x27;true&#x27;</span></span><br><span class="line">            <span class="attr">ensureRunning:</span> <span class="string">&#x27;true&#x27;</span></span><br></pre></td></tr></table></figure><h3 id="cfn-signal-amp-wait-conditions"><a href="#cfn-signal-amp-wait-conditions" class="headerlink" title="cfn-signal &amp; wait conditions"></a>cfn-signal &amp; wait conditions</h3><ul><li><p>We still don’t know how to tell CloudFormation that the EC2 instance got properly configured after a <code>cfn-init</code></p></li><li><p>For this, we can use the <code>cfn-signal</code> script!</p><ul><li>We run cfn-signal right after cfn-init</li><li>Tell CloudFormation service to keep on going or fail</li></ul></li><li><p>We need to define <code>WaitCondition</code>:</p><ul><li>Block the template until it receives a signal from cfn-signal</li><li>We attach a <code>CreationPolicy</code> (also works on EC2, ASG)<ul><li>The creation policy is <code>invoked only</code> when AWS CloudFormation creates the associated resource. Currently, the only AWS CloudFormation resources that support creation policies are <code>AWS::AutoScaling::AutoScalingGroup, AWS::EC2::Instance, and AWS::CloudFormation::WaitCondition</code>.</li></ul></li></ul></li></ul><figure class="highlight yml"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment"># Start cfn-signal to the wait condition</span></span><br><span class="line"><span class="string">/opt/aws/bin/cfn-signal</span> <span class="string">-e</span> <span class="string">$?</span> <span class="string">--stack</span> <span class="string">$&#123;AWS::StackId&#125;</span> <span class="string">--resource</span> <span class="string">SampleWaitCondition</span> <span class="string">--region</span> <span class="string">$&#123;AWS::Region&#125;</span></span><br></pre></td></tr></table></figure><figure class="highlight yml"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br></pre></td><td class="code"><pre><span class="line"><span class="attr">SampleWaitCondition:</span></span><br><span class="line">  <span class="attr">Type:</span> <span class="string">AWS::CloudFormation::WaitCondition</span></span><br><span class="line">  <span class="attr">CreationPolicy:</span></span><br><span class="line">    <span class="attr">ResourceSignal:</span></span><br><span class="line">      <span class="attr">Timeout:</span> <span class="string">PT2M</span></span><br><span class="line">      <span class="attr">Count:</span> <span class="number">1</span></span><br></pre></td></tr></table></figure><h3 id="CloudFormation-StackSets"><a href="#CloudFormation-StackSets" class="headerlink" title="CloudFormation StackSets"></a>CloudFormation StackSets</h3><ul><li>Create, update, or delete stacks across multiple accounts and regions with a single operation</li><li>Administrator account to create StackSets</li><li>Trusted accounts to create, update, delete stack instances from StackSets</li></ul><h4 id="Use-AWS-CloudFormation-StackSets-for-Multiple-Accounts-in-an-AWS-Organization"><a href="#Use-AWS-CloudFormation-StackSets-for-Multiple-Accounts-in-an-AWS-Organization" class="headerlink" title="Use AWS CloudFormation StackSets for Multiple Accounts in an AWS Organization:"></a><code>Use</code> AWS CloudFormation <code>StackSets for Multiple Accounts in an AWS Organization</code>:</h4><p>Use AWS CloudFormation <code>StackSets</code> to <code>deploy a template</code> to <code>each account</code> to create the new IAM roles.</p><p><code>Explanation</code>: AWS CloudFormation StackSets allows you to deploy a CloudFormation template across multiple AWS accounts. By using StackSets, you can create and manage the same IAM roles in each account within the organization. This ensures consistent deployment of roles across accounts and simplifies the management process.</p><p><code>Reference</code>: <a href="https://aws.amazon.com/blogs/aws/new-use-aws-cloudformation-stacksets-for-multiple-accounts-in-an-aws-organization/">New: Use AWS CloudFormation StackSets for Multiple Accounts in an AWS Organization</a></p><h3 id="QUESTION-To-lunch-the-last-AMI"><a href="#QUESTION-To-lunch-the-last-AMI" class="headerlink" title="QUESTION To lunch the last AMI."></a><code>QUESTION</code> To lunch the last AMI.</h3><p>Use the Parameters section in the template to specify the Systems Manager (SSM) Parameter, which contains the latest version of the Windows regional AMI ID.</p><figure class="highlight yaml"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br></pre></td><td class="code"><pre><span class="line"><span class="attr">Parameters:</span></span><br><span class="line">  <span class="attr">LatestWindowsAMIParameter:</span></span><br><span class="line">    <span class="attr">Type:</span> <span class="string">AWS::SSM::Parameter::Value&lt;AWS::EC2::Image::Id&gt;</span></span><br><span class="line">    <span class="attr">Default:</span> <span class="string">/LatestWindowsAMI</span></span><br><span class="line"></span><br><span class="line"><span class="attr">Parameters:</span></span><br><span class="line">  <span class="attr">LatestWindowsAMIParameter:</span></span><br><span class="line">    <span class="attr">Type:</span> <span class="string">AWS::SSM::Parameter::Value&lt;AWS::EC2::Image::Id&gt;</span></span><br><span class="line">    <span class="attr">Default:</span> <span class="string">/LatestWindowsAMI</span></span><br></pre></td></tr></table></figure><h3 id="UpdatePolicy-attribute-👀-EXAM"><a href="#UpdatePolicy-attribute-👀-EXAM" class="headerlink" title="UpdatePolicy attribute - 👀 EXAM"></a>UpdatePolicy attribute - <code>👀 EXAM</code></h3><p>By adding the <code>UpdatePolicy</code> attribute in CloudFormation and enabling the WaitOnResourceSignals property, the Auto Scaling group update process will be handled more gracefully. This approach allows CloudFormation to monitor the health and success of each instance during the update process before moving on to the next instance.</p><p>Appending a health check at the end of the user data script allows the instance to signal CloudFormation that it has successfully completed its initialization. This helps ensure that the instance is fully operational before proceeding to the next instance in the Auto Scaling group update process.</p><figure class="highlight yml"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br></pre></td><td class="code"><pre><span class="line"><span class="attr">CreationPolicy:</span></span><br><span class="line">  <span class="attr">AutoScalingCreationPolicy:</span></span><br><span class="line">    <span class="attr">MinSuccessfulInstancesPercent:</span> <span class="string">Integer</span></span><br><span class="line">  <span class="attr">ResourceSignal:</span></span><br><span class="line">    <span class="attr">Count:</span> <span class="string">&#x27;3&#x27;</span></span><br><span class="line">    <span class="attr">Timeout:</span> <span class="string">PT15M</span></span><br><span class="line"></span><br><span class="line"><span class="attr">UpdatePolicy:</span></span><br><span class="line">  <span class="attr">AutoScalingRollingUpdate:</span></span><br><span class="line">    <span class="attr">MinInstancesInService:</span> <span class="string">&#x27;1&#x27;</span></span><br><span class="line">    <span class="attr">MaxBatchSize:</span> <span class="string">&#x27;2&#x27;</span></span><br><span class="line">    <span class="attr">PauseTime:</span> <span class="string">PT1M</span></span><br><span class="line">    <span class="attr">WaitOnResourceSignals:</span> <span class="string">&#x27;true&#x27;</span></span><br></pre></td></tr></table></figure><h3 id="👀-DependsOn-attribute"><a href="#👀-DependsOn-attribute" class="headerlink" title="👀 DependsOn attribute"></a>👀 <code>DependsOn</code> attribute</h3><p>With the DependsOn attribute, you can specify that the <code>creation</code> of a specific resource <code>follows another</code>. When you add a DependsOn attribute to a resource, that resource is created only after the creation of the resource specified in the DependsOn attribute.</p><h3 id="Set-Tags-consistently-in-AWS-across-all-accounts"><a href="#Set-Tags-consistently-in-AWS-across-all-accounts" class="headerlink" title="Set Tags consistently in AWS across all accounts"></a>Set Tags consistently in AWS across all accounts</h3><p>Use the CloudFormation <code>Resource Tags property</code> to apply tags to certain resource types upon creation.</p><figure class="highlight yaml"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br></pre></td><td class="code"><pre><span class="line"><span class="attr">Resources:</span></span><br><span class="line">  <span class="attr">MyEC2Instance:</span></span><br><span class="line">    <span class="attr">Type:</span> <span class="string">AWS::EC2::Instance</span></span><br><span class="line">    <span class="attr">Properties:</span></span><br><span class="line">      <span class="attr">ImageId:</span> <span class="string">ami-0123456789abcdef0</span></span><br><span class="line">      <span class="attr">InstanceType:</span> <span class="string">t2.micro</span></span><br><span class="line">      <span class="attr">Tags:</span></span><br><span class="line">        <span class="bullet">-</span> <span class="attr">Key:</span> <span class="string">Name</span></span><br><span class="line">          <span class="attr">Value:</span> <span class="string">MyEC2Instance</span></span><br><span class="line">        <span class="bullet">-</span> <span class="attr">Key:</span> <span class="string">Environment</span></span><br><span class="line">          <span class="attr">Value:</span> <span class="string">Production</span></span><br><span class="line">        <span class="bullet">-</span> <span class="attr">Key:</span> <span class="string">CostCenter</span></span><br><span class="line">          <span class="attr">Value:</span> <span class="string">MyCostCenter</span></span><br><span class="line"></span><br></pre></td></tr></table></figure><h3 id="Output-and-Export"><a href="#Output-and-Export" class="headerlink" title="Output and Export"></a>Output and Export</h3><figure class="highlight yml"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br></pre></td><td class="code"><pre><span class="line"><span class="attr">Outputs:</span></span><br><span class="line">  <span class="attr">SubnetId:</span></span><br><span class="line">    <span class="attr">Description:</span> <span class="string">Subnet</span> <span class="string">ID</span> <span class="string">created</span> <span class="string">in</span> <span class="string">Stack</span> <span class="string">A</span></span><br><span class="line">    <span class="attr">Value:</span> <span class="type">!Ref</span> <span class="string">YourSubnetResourceName</span></span><br><span class="line">    <span class="attr">Export:</span></span><br><span class="line">      <span class="attr">Name:</span> <span class="string">SubnetId-Exported</span></span><br></pre></td></tr></table></figure><figure class="highlight yml"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br></pre></td><td class="code"><pre><span class="line"><span class="attr">Resources:</span></span><br><span class="line">  <span class="attr">EC2Instance:</span></span><br><span class="line">    <span class="attr">Type:</span> <span class="string">AWS::EC2::Instance</span></span><br><span class="line">    <span class="attr">Properties:</span></span><br><span class="line">      <span class="attr">SubnetId:</span> <span class="type">!ImportValue</span> <span class="string">SubnetId-Exported</span></span><br><span class="line">      <span class="comment"># Other properties for the EC2 instance</span></span><br></pre></td></tr></table></figure><h3 id="No-conditions-in-parameters"><a href="#No-conditions-in-parameters" class="headerlink" title="No conditions in parameters"></a><a href="https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/parameters-section-structure.html">No conditions in parameters</a></h3><figure class="highlight yml"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br></pre></td><td class="code"><pre><span class="line"><span class="attr">Parameters:</span></span><br><span class="line">  <span class="attr">InstanceTypeParameter:</span></span><br><span class="line">    <span class="attr">Type:</span> <span class="string">String</span></span><br><span class="line">    <span class="attr">Default:</span> <span class="string">t2.micro</span></span><br><span class="line">    <span class="attr">AllowedValues:</span></span><br><span class="line">      <span class="bullet">-</span> <span class="string">t2.micro</span></span><br><span class="line">      <span class="bullet">-</span> <span class="string">m1.small</span></span><br><span class="line">      <span class="bullet">-</span> <span class="string">m1.large</span></span><br><span class="line">    <span class="attr">Description:</span> <span class="string">Enter</span> <span class="string">t2.micro,</span> <span class="string">m1.small,</span> <span class="string">or</span> <span class="string">m1.large.</span> <span class="string">Default</span> <span class="string">is</span> <span class="string">t2.micro.</span></span><br></pre></td></tr></table></figure><ul><li><code>!GetAtt</code> - The Fn::GetAtt intrinsic function returns the value of an attribute from a resource in the template. This example snippet returns a string containing the DNS name of the load balancer with the logical name myELB - YML : !GetAtt myELB.DNSName JSON : “Fn::GetAtt” : [ “myELB” , “DNSName” ]</li><li><code>!Sub</code> - The intrinsic function Fn::Sub substitutes variables in an input string with values that you specify. In your templates, you can use this function to construct commands or outputs that include values that aren’t available until you create or update a stack.</li><li><code>!Ref</code> - The intrinsic function Ref returns the value of the specified parameter or resource.</li><li><code>!FindInMap</code> - The intrinsic function Fn::FindInMap returns the value corresponding to keys in a two-level map that is declared in the Mappings section. For example, you can use this in the Mappings section that contains a single map, RegionMap, that associates AMIs with AWS regions.</li></ul><hr><h2 id="AWS-Backup"><a href="#AWS-Backup" class="headerlink" title="AWS Backup"></a>AWS Backup</h2><ul><li>Fully managed service</li><li><code>Centrally manage and automate backups across AWS services</code>.</li><li>No need to create custom scripts and manual processes</li><li>Supported services:<ul><li>Amazon <code>EC2 / Amazon EBS</code></li><li>Amazon <code>S3</code></li><li>Amazon <code>RDS (all DBs engines) / Amazon Aurora / Amazon DynamoDB</code></li><li>Amazon <code>DocumentDB / Amazon Neptune</code></li><li>Amazon <code>EFS / Amazon FSx (Lustre &amp; Windows File Server)</code></li></ul></li><li>AWS Storage Gateway (Volume Gateway)</li><li>Supports cross-region backups</li><li>Supports cross-account backups</li><li>On-Demand and Scheduled backups</li><li>Tag-based backup policies</li><li>You create backup policies known as <code>Backup Plans</code><ul><li>Backup frequency (every 12 hours, daily, weekly, monthly, cron expression)</li><li>Backup window</li><li>Transition to Cold Storage (Never, Days, Weeks, Months, Years)</li><li>Retention Period (Always, Days, Weeks, Months, Year</li></ul></li></ul><h3 id="👀-QUESTIONUESTION"><a href="#👀-QUESTIONUESTION" class="headerlink" title="👀 QUESTIONUESTION"></a><code>👀 QUESTIONUESTION</code></h3><p>AWS Backup is a fully managed and cost-effective backup service that simplifies and <code>automates data</code> backup across AWS services including <code>Amazon EBS</code>, <code>Amazon EC2</code>, <code>Amazon RDS</code>, <code>Amazon Aurora</code>, <code>Amazon DynamoDB</code>, <code>Amazon EFS</code>, and AWS <code>Storage Gateway</code>. In addition, AWS Backup <code>leverages</code> AWS <code>Organizations</code> to implement and maintain a central view of backup policy across resources in a multi-account AWS environment. Customers <code>simply tag</code> and associate their <code>AWS resources</code> with backup policies managed by AWS Backup for Cross-Region data replication.</p><h3 id="👀-QUESTIONUESTION-For-the-production-account-a-SysOps-administrator-must-ensure-that-all-data-is-backed-up-daily-for-all-current-and-future-Amazon-EC2-instances-and-Amazon-Elastic-File-System-Amazon-EFS-file-systems-Backups-must-be-retained-for-30-days"><a href="#👀-QUESTIONUESTION-For-the-production-account-a-SysOps-administrator-must-ensure-that-all-data-is-backed-up-daily-for-all-current-and-future-Amazon-EC2-instances-and-Amazon-Elastic-File-System-Amazon-EFS-file-systems-Backups-must-be-retained-for-30-days" class="headerlink" title="👀 QUESTIONUESTION  For the production account, a SysOps administrator must ensure that all data is backed up daily for all current and future Amazon EC2 instances and Amazon Elastic File System (Amazon EFS) file systems. Backups must be retained for 30 days"></a><code>👀 QUESTIONUESTION</code>  For the production account, a SysOps administrator must ensure that all data is backed up daily for all current and future Amazon EC2 instances and Amazon Elastic File System (Amazon EFS) file systems. Backups must be retained for 30 days</h3><p>Create a backup plan in AWS Backup. Assign resources by resource ID, selecting all existing EC2 and EFS resources that are running in the account. Edit the backup plan daily to include any new resources. Schedule the backup plan to run every day with a lifecycle policy to expire backups after 30 days.</p><p><code>Explanation</code>: AWS Backup provides a centralized and automated solution for backing up data. By creating a backup plan and assigning resources by resource ID, you can easily include all existing EC2 instances and EFS file systems in the backup process. Editing the backup plan daily ensures that any new resources are automatically included in the backups. By scheduling the backup plan to run every day and configuring a lifecycle policy to expire backups after 30 days, you meet the requirement of daily backups with a retention period of 30 days.</p><h3 id="AWS-Backup-does-not-reboot-EC2-instances-👀-QUESTIONUESTION"><a href="#AWS-Backup-does-not-reboot-EC2-instances-👀-QUESTIONUESTION" class="headerlink" title="AWS Backup does not reboot EC2 instances - 👀 QUESTIONUESTION"></a>AWS Backup does not reboot EC2 instances - <code>👀 QUESTIONUESTION</code></h3><p>AWS Backup does not reboot EC2 instances at any time. To maintain the file integrity of images created, you have to apply the reboot parameter when taking images.</p><p>To create a Lambda function that calls the <code>CreateImage API with a reboot parameter</code> and then <code>schedule the function to run on a daily basis via Amazon EventBridge</code> (Amazon CloudWatch Events).</p><h3 id="AWS-Backup-Vault-Lock"><a href="#AWS-Backup-Vault-Lock" class="headerlink" title="AWS Backup Vault Lock"></a>AWS Backup Vault Lock</h3><ul><li>Enforce a WORM (Write On1ce Read Many) state for all the backups that you store in your AWS Backup Vault</li><li>Additional layer of defense to protect your backups against:<ul><li>Inadvertent or malicious delete operations</li><li>Updates that shorten or alter retention periods</li></ul></li><li>Even the root user cannot delete backups when enabled</li></ul><hr><h2 id="AWS-Shared-Responsibility-Model"><a href="#AWS-Shared-Responsibility-Model" class="headerlink" title="AWS Shared Responsibility Model"></a>AWS Shared Responsibility Model</h2><ul><li>AWS responsibility - Security <code>of</code> the Cloud<ul><li>Protecting infrastructure (hardware, software, facilities, and networking) that runs all the AWS services</li><li>Managed services like S3, DynamoDB, RDS, etc.</li></ul></li><li>Customer responsibility - Security <code>in</code> the Cloud<ul><li>For EC2 instance, customer is responsible for management of the guest OS (including security patches and updates), firewall &amp; network configuration, IAM</li><li>Encrypting application data</li></ul></li><li>Shared controls:<ul><li>Patch Management, Configuration Management, Awareness &amp; Training</li></ul></li></ul><hr><h2 id="DDoS-Distributed-Denial-of-service-Protection-on-AWS"><a href="#DDoS-Distributed-Denial-of-service-Protection-on-AWS" class="headerlink" title="DDoS (Distributed Denial-of-service) Protection on AWS"></a>DDoS (Distributed Denial-of-service) Protection on AWS</h2><ul><li><code>AWS Shield Standard</code>: protects against DDoS attack for your website and applications, for all customers at no additional costs.</li><li><code>AWS Shield Advanced</code>: 24&#x2F;7 premium DDoS protection.</li><li><code>AWS WAF</code>: Filter specific requests based on rules.</li><li><code>CloudFront and Route 53</code>:<ul><li>Availability protection using global edge network</li><li>Combined with AWS Shield, provides attack mitigation at the edge</li></ul></li><li>Be ready to scale - leverage <code>AWS Auto Scaling</code>.</li></ul><h2 id="AWS-WAF-Web-Application-Firewall"><a href="#AWS-WAF-Web-Application-Firewall" class="headerlink" title="AWS WAF - Web Application Firewall"></a>AWS WAF - Web Application Firewall</h2><ul><li><p>Protects your web applications from common web exploits (Layer 7)</p></li><li><p><code>Layer 7 is HTTP</code> (vs Layer 4 is TCP)</p></li><li><p>Deploy on <code>Application Load Balancer, API Gateway, CloudFront</code></p></li><li><p>Define Web ACL (Web Access Control List):</p><ul><li>Rules can include: <code>IP addresses</code>, HTTP headers, HTTP body, or URI strings</li><li>Protects from common attack - <code>SQL injection</code> and <code>Cross-Site Scripting (XSS)</code>.</li><li>Size constraints, <code>geo-match (block countries)</code></li><li><code>Rate-based rules</code> (to count occurrences of events) - <code>for DDoS protection</code></li></ul></li></ul><h2 id="Penetration-Testing-on-AWS-Cloud"><a href="#Penetration-Testing-on-AWS-Cloud" class="headerlink" title="Penetration Testing on AWS Cloud"></a>Penetration Testing on AWS Cloud</h2><ul><li>AWS customers are welcome to carry out security assessments or penetration tests against their AWS infrastructure <code>without prior approval for 8 services</code>:<ul><li>Amazon EC2 instances, NAT Gateways, and Elastic Load Balancers</li><li>Amazon RDS</li><li>Amazon CloudFront</li><li>Amazon Aurora</li><li>Amazon API Gateways</li><li>AWS Lambda and Lambda Edge functions</li><li>Amazon Lightsail resources</li><li>Amazon Elastic Beanstalk environments</li></ul></li></ul><h3 id="Penetration-Testing-on-your-AWS-Cloud"><a href="#Penetration-Testing-on-your-AWS-Cloud" class="headerlink" title="Penetration Testing on your AWS Cloud"></a>Penetration Testing on your AWS Cloud</h3><ul><li><p><code>Prohibited Activities</code></p><ul><li>DNS zone walking via Amazon Route 53 Hosted Zones</li><li>Denial of Service (DoS), Distributed Denial of Service (DDoS), Simulated DoS, Simulated DDoS</li><li>Port flooding</li><li>Protocol flooding</li><li>Request flooding (login request flooding, API request flooding)</li></ul></li><li><p>Read more: <a href="https://aws.amazon.com/security/penetration-testing/">https://aws.amazon.com/security/penetration-testing/</a></p></li></ul><hr><p><a href="https://docs.aws.amazon.com/inspector/v1/userguide/inspector_assessments.html">Amazon Inspector</a>:Securiry Compliance for EC2 and Sofware deployed on AWS.</p><h2 id="AWS-Inspector-👀-EXAM"><a href="#AWS-Inspector-👀-EXAM" class="headerlink" title="AWS Inspector - 👀 EXAM"></a><a href="https://aws.amazon.com/inspector/">AWS Inspector</a> - 👀 EXAM</h2><ul><li>Amazon Inspector is <code>used for security compliance of instances and applications deployed on AWS</code>.</li><li>Amazon Inspector <code>checks</code> for <code>unintended network accessibility</code> of your Amazon EC2 instances and <em><code>vulnerabilities</code></em> on those EC2 instances.</li><li>Amazon Inspector also <code>integrates</code> with <code>AWS Security Hub</code> to provide a <code>view</code> of your <code>security posture across multiple AWS accounts</code>.</li></ul><p>Amazon Inspector is an automated security assessment service that helps you <code>test</code> the <code>network accessibility</code> of your Amazon EC2 instances and the <code>security state of your applications running on the instances</code>.</p><p>An <code>Amazon Inspector assessment report can be generated for an assessment run once it has been successfully completed</code>. An assessment report is a document that details what is tested in the assessment run, and the results of the assessment. The results of your assessment are formatted into a standard report, which can be generated to share results within your team for remediation actions, to enrich compliance audit data, or to store for future reference.</p><p>You can select from two types of report for your assessment, a findings report or a full report. The findings report contains an executive summary of the assessment, the instances targeted, the rules packages tested, the rules that generated findings, and detailed information about each of these rules along with the list of instances that failed the check. The full report contains all theinformation in the findings report and additionally provides the list of rules that were checked and passed on all instances in the assessment target.</p><h2 id="👀-Amazon-Inspector"><a href="#👀-Amazon-Inspector" class="headerlink" title="👀 Amazon Inspector"></a>👀 Amazon Inspector</h2><ul><li><code>Automated Security Assessments</code></li><li>For <code>EC2 instances</code><ul><li>Leveraging the AWS System Manager (SSM) agent</li><li>Analyze against unintended network accessibility</li><li>Analyze the running OS against known vulnerabilities</li></ul></li><li>For Container Images push to <code>Amazon ECR</code><ul><li>Assessment of Container Images as they are pushed  Amazon ECR</li></ul></li><li>For <code>Lambda Functions</code><ul><li>Identifies software vulnerabilities in function code and package ependencies</li><li>Assessment of functions as they are deployed</li></ul></li></ul><p>-&gt; Reporting &amp; integration with <code>AWS Security Hub</code>  To provide a view of your security posture across multiple AWS accounts.-&gt; Send findings to Amazon <code>Event Bridge</code></p><h3 id="AWS-Security-Hub-TODO"><a href="#AWS-Security-Hub-TODO" class="headerlink" title="AWS Security Hub - TODO"></a>AWS Security Hub - TODO</h3><p>Supports automated security checks aligned to the Center for Internet Security’s (CIS) AWS Foundations Benchmark version 1.4.0 requirements for Level 1 and 2 (CIS v1.4.0).</p><h3 id="CIS-AWS-Foundations-Benchmark-TODO"><a href="#CIS-AWS-Foundations-Benchmark-TODO" class="headerlink" title="CIS AWS Foundations Benchmark  - TODO"></a>CIS AWS Foundations Benchmark  - TODO</h3><p>Serves as a set of security configuration best practices for AWS. These industry-accepted best practices provide you with clear, step-by-step implementation and assessment procedures. Ranging from operating systems to cloud services and network devices, the controls in this benchmark help you protect the specific systems that your organization uses.</p><p><a href="https://docs.aws.amazon.com/securityhub/latest/userguide/cis-aws-foundations-benchmark.html">https://docs.aws.amazon.com/securityhub/latest/userguide/cis-aws-foundations-benchmark.html</a><a href="https://aws.amazon.com/about-aws/whats-new/2022/11/security-hub-center-internet-securitys-cis-foundations-benchmark-version-1-4-0/">https://aws.amazon.com/about-aws/whats-new/2022/11/security-hub-center-internet-securitys-cis-foundations-benchmark-version-1-4-0/</a></p><h3 id="What-does-Amazon-Inspector-evaluate"><a href="#What-does-Amazon-Inspector-evaluate" class="headerlink" title="What does Amazon Inspector evaluate?"></a>What does Amazon Inspector evaluate?</h3><ul><li><code>Only for EC2 instances, Container Images &amp; Lambda functions</code> - <code>EXAM</code></li><li>Continuous scanning of the infrastructure, only when needed</li><li>Package vulnerabilities (EC2, ECR &amp; Lambda) - database of CVE</li><li>Network reachability (EC2)</li><li>A risk score is associated with all vulnerabilities for prioritization</li></ul><p>Amazon Inspector discovers potential security issues by using security rules to analyze AWS resources. Amazon Inspector also integrates with AWS Security Hub to provide a view of your security posture across multiple AWS accounts.</p><hr><h2 id="Amazon-GuardDuty-👀-EXAM"><a href="#Amazon-GuardDuty-👀-EXAM" class="headerlink" title="Amazon GuardDuty -  👀 EXAM"></a>Amazon GuardDuty -  👀 EXAM</h2><ul><li><code>Intelligent Threat discovery to protect your AWS Account</code>.</li><li>Uses Machine Learning algorithms, anomaly detection, 3rd party data</li><li>One click to enable (30 days trial), no need to install software</li><li>Input data includes:<ul><li><code>CloudTrail Events Logs</code> - unusual API calls, unauthorized deployments<ul><li><code>CloudTrail Management Events</code> - create VPC subnet, create trail, …</li><li><code>CloudTrail S3 Data Events</code> - get object, list objects, delete object, …</li></ul></li><li><code>VPC Flow Logs</code> - unusual internal traffic, unusual IP address</li><li><code>DNS Logs</code> - compromised EC2 instances sending encoded data within DNS queries</li><li><code>Optional Feature</code> - EKS Audit Logs, RDS &amp; Aurora, EBS, Lambda, S3 Data Events…</li></ul></li><li>Can setup <code>EventBridge rules</code> to be notified in case of findings</li><li>EventBridge rules can target AWS Lambda or SNS</li><li><code>Can protect against CryptoCurrency attacks (has a dedicated “finding” for it)</code> - 👀 EXAM</li></ul><hr><h2 id="AWS-Macie"><a href="#AWS-Macie" class="headerlink" title="AWS Macie"></a>AWS Macie</h2><ul><li>Amazon Macie is a fully managed data security and data privacy service that uses <code>machine learning and pattern matching to discover andprotect your sensitive data in AWS</code>.</li><li>Macie helps identify and alert you to <code>sensitive data, such as personally identifiable information (PII)</code>.</li><li>Notify to Amazon EventBridge &#x3D;&gt; Integrations</li></ul><hr><h2 id="QUESTION-AWS-Trusted-Advisor"><a href="#QUESTION-AWS-Trusted-Advisor" class="headerlink" title="QUESTION AWS Trusted Advisor"></a><code>QUESTION</code> <a href="https://docs.aws.amazon.com/awssupport/latest/user/trusted-advisor.html">AWS Trusted Advisor</a></h2><p>Trusted Advisor provides real-time guidance to help users follow AWS best practices to provision their resources. <code>Hight level account assessment</code>.</p><p>E.g. AWS Trusted Advisor checks for service <code>usage</code> that is more than 80% of the <code>service limit</code>.</p><h3 id="Check-categories-👀-EXAM"><a href="#Check-categories-👀-EXAM" class="headerlink" title="Check categories - 👀 EXAM"></a>Check categories - 👀 EXAM</h3><ul><li><code>Cost optimization</code></li><li><code>Performance</code></li><li><code>Security</code></li><li><code>Fault tolerance</code></li><li><code>Service limits</code></li></ul><h3 id="Trusted-Advisor-Support-Plans-Exam"><a href="#Trusted-Advisor-Support-Plans-Exam" class="headerlink" title="Trusted Advisor - Support Plans - Exam"></a>Trusted Advisor - Support Plans - Exam</h3><ul><li><p>7 CORES CHECKS for Basic &amp; Developer Support plan</p><ul><li>S3 Bucket Permissions</li><li>Security Groups - Specific Ports Unrestricted</li><li>IAM Use (one IAM user minimum)</li><li>MFA on Root Account</li><li>EBS Public Snapshots</li><li>RDS Public Snapshots</li><li>Service Limits</li></ul></li><li><p>FULL CHECKS</p><ul><li>Full Checks available on the 5 categories</li><li>Ability to set CloudWatch alarms when   reaching limits</li><li><code>Programmatic Access using AWS Support API</code> - Exa,</li></ul></li></ul><hr><h2 id="AWS-KMS-Key-Management-Service"><a href="#AWS-KMS-Key-Management-Service" class="headerlink" title="AWS KMS (Key Management Service)"></a>AWS KMS (Key Management Service)</h2><ul><li>Anytime you hear “encryption” for an AWS service, it’s most likely KMS</li><li>AWS manages encryption keys for us</li><li>Fully integrated with IAM for authorization</li><li>Easy way to control access to your data</li><li><code>Able to audit KMS Key usage using CloudTrail</code> - Exam</li><li>Seamlessly integrated into most AWS services (EBS, S3, RDS, SSM…)</li><li>Never ever store your secrets in plaintext, especially in your code!</li><li>KMS Key Encryption also available through API calls (SDK, CLI)</li><li>Encrypted secrets can be stored in the code &#x2F; environment variables</li></ul><h3 id="KMS-Automatic-Key-Rotation"><a href="#KMS-Automatic-Key-Rotation" class="headerlink" title="KMS Automatic Key Rotation"></a>KMS Automatic Key Rotation</h3><ul><li><code>For Customer-managed CMK</code> (not AWS managed CMK)</li><li>If enabled: automatic key rotation happens <code>every 1 year</code>.</li><li>Previous key is kept active so you can decrypt old data</li><li>New Key has the same CMK ID (only the backing key is changed)</li></ul><h3 id="KMS-Manual-Key-Rotation"><a href="#KMS-Manual-Key-Rotation" class="headerlink" title="KMS Manual Key Rotation"></a>KMS Manual Key Rotation</h3><ul><li><code>When you want to rotate key every 90 days, 180 days, etc...</code></li><li>New Key has a different CMK ID</li><li>Keep the previous key active so you can decrypt old data</li><li>Better to use aliases in this case (to hide the change of key for the application)</li><li>Good solution to rotate CMK that are not eligible for automatic rotation (<code>like asymmetric CMK</code>)</li></ul><h3 id="Changing-The-KMS-Key-For-An-Encrypted-EBS-Volume"><a href="#Changing-The-KMS-Key-For-An-Encrypted-EBS-Volume" class="headerlink" title="Changing The KMS Key For An Encrypted EBS Volume"></a>Changing The KMS Key For An Encrypted EBS Volume</h3><ul><li>You <code>can’t</code> change <code>the encryptionkeys used by an EBS volume</code>.</li><li><code>Create an EBS snapshot</code> and create a new EBS volume and <code>specify the new KMS key</code>.</li></ul><h3 id="Sharing-KMS-Encrypted-RDS-DB-Snapshots"><a href="#Sharing-KMS-Encrypted-RDS-DB-Snapshots" class="headerlink" title="Sharing KMS Encrypted RDS DB Snapshots"></a>Sharing KMS Encrypted RDS DB Snapshots</h3><p>You can <code>share RDS DB snapshots encrypted with KMS CMK with other accounts</code>, but must f<code>irst share the KMS CMK</code> with the target account <code>using Key Policy</code>.</p><h3 id="KMS-Key-Deletion-Considerations"><a href="#KMS-Key-Deletion-Considerations" class="headerlink" title="KMS Key Deletion Considerations"></a>KMS Key Deletion Considerations</h3><ul><li>Schedule CMK for deletion with a waiting period of 7 to 30 days</li><li>CMK’s status is “Pending deletion” during the waiting period</li><li>During the CMK’s deletion waiting period:</li><li>The CMK can’t be used for cryptographic operations (e.g., can’t decrypt KMS- encrypted objects in S3 - SSE-KMS)</li><li>The key is not rotated even if planned</li><li>You can cancel the key deletion during the waiting period</li><li>Consider disabling your key instead of deleting it if you’re not sure!</li></ul><h2 id="👀"><a href="#👀" class="headerlink" title="👀"></a>👀</h2><p>You can allow IAM users or roles in one AWS account to use a customer master key (CMK) in a different AWS account. You can add these permissions when you create the CMK or change the permissions for an existing CMK.</p><p><code>To permit the usage of a CMK to users and roles in another account, you must use two different types of policies</code>:</p><ol><li>The key policy for the CMK must give the external account (or users and roles in the external account) permission to use the CMK. The key policy is in the account that owns the CMK.</li><li>IAM policies in the external account must delegate the key policy permissions to its users and roles. These policies are set in the external account and give permissions to users and roles in that account.</li></ol><hr><h2 id="CloudHSM-Dedicated-Hardware-HSM-x3D-Hardware-Security-Module"><a href="#CloudHSM-Dedicated-Hardware-HSM-x3D-Hardware-Security-Module" class="headerlink" title="CloudHSM - Dedicated Hardware (HSM &#x3D; Hardware Security Module)"></a>CloudHSM - Dedicated Hardware (HSM &#x3D; Hardware Security Module)</h2><ul><li>KMS &#x3D;&gt; AWS manages the <code>software</code> for encryption.</li><li>CloudHSM &#x3D;&gt; AWS provisions encryption <code>hardware</code>.</li><li><code>CUSTOMER MANAGED CMK</code>.</li><li>You manage your own encryption keys entirely (not AWS)</li><li><code>HSM device is tamper resistant, FIPS 140-2 Level 3 compliance</code>.</li><li>Supports both <code>symmetric</code> and <code>asymmetric</code> encryption (SSL&#x2F;TLS keys)</li><li>No free tier available</li><li>Must use the CloudHSM Client Software</li><li>Redshift supports CloudHSM for database encryption and key management</li><li><code>Good option to use with SSE-C encryption</code>.</li></ul><h3 id="CloudHSM-High-Availability"><a href="#CloudHSM-High-Availability" class="headerlink" title="CloudHSM - High Availability"></a>CloudHSM - High Availability</h3><ul><li>CloudHSM clusters are spread across Multi AZ (HA)</li><li>Great for availability and durability</li></ul><hr><h2 id="👀-AWS-Artifact-Not-really-a-service-👀-EXAM"><a href="#👀-AWS-Artifact-Not-really-a-service-👀-EXAM" class="headerlink" title="👀 AWS Artifact (Not really a service) - 👀 EXAM"></a>👀 <code>AWS Artifact</code> (Not really a service) - 👀 EXAM</h2><p>is a service that provides <code>on-demand</code> access to AWS <code>compliance reports</code> and other relevant documents.</p><ul><li><code>Artifact Reports</code> - Allows you to download AWS security and compliance documents from third-party auditors, like AWS ISO certifications, Payment Card Industry (PCI), and System and Organization Control (SOC) reports</li><li><code>Artifact Agreements</code> - Allows you to review, accept, and track the status of AWS agreements such as the Business Associate Addendum (BAA) or the Health Insurance Portability and Accountability Act (HIPAA) for an individual account or in your organization -</li></ul><p>Can be used to <code>support internal audit or compliance</code>.</p><hr><h2 id="AWS-Secrets-Manager"><a href="#AWS-Secrets-Manager" class="headerlink" title="AWS Secrets Manager"></a>AWS Secrets Manager</h2><ul><li>Newer service, meant for storing secrets</li><li>Capability to <code>force rotation of secrets</code> every X days</li><li>Automate generation of secrets on rotation (uses Lambda)</li><li><code>Integration with Amazon RDS</code> (MySQL, PostgreSQL, Aurora)</li><li>Secrets are encrypted using KMS</li><li>Mostly meant for RDS integration</li></ul><h3 id="AWS-Secrets-Manager-Multi-Region-Secrets"><a href="#AWS-Secrets-Manager-Multi-Region-Secrets" class="headerlink" title="AWS Secrets Manager - Multi-Region Secrets"></a>AWS Secrets Manager - Multi-Region Secrets</h3><ul><li>Replicate Secrets across multiple AWS Regions</li><li>Secrets Manager keeps read replicas in sync with the primary Secret</li><li>Ability to promote a read replica Secret to a standalone Secret</li><li>Use cases: multi-region apps, disaster recovery strategies, multi-region DB…</li></ul><h3 id="Secrets-Manager-Monitoring"><a href="#Secrets-Manager-Monitoring" class="headerlink" title="Secrets Manager - Monitoring"></a>Secrets Manager - Monitoring</h3><ul><li><p>CloudTrail captures API calls to the Secrets Manager API</p></li><li><p>CloudTrail captures other related events that might have a security or compliance impact on your AWS account or might help you troubleshoot operational problems.</p></li><li><p><code>CloudTrail records these events as non-API service events</code>:</p><ul><li>RotationStarted event</li><li>RotationSucceeded event</li><li><code>RotationFailed event</code></li><li>RotationAbandoned event - a manual change to a secret instead of automated rotation</li><li>StartSecretVersionDelete event</li><li>CancelSecretVersionDelete event</li></ul></li><li><p>EndSecretVersionDelete event</p></li><li><p><code>Combine with CloudWatch Logs and CloudWatch alarms for automations</code>.</p></li></ul><h3 id="SSM-Parameter-Store-vs-Secret-Manager"><a href="#SSM-Parameter-Store-vs-Secret-Manager" class="headerlink" title="SSM Parameter Store vs Secret Manager"></a>SSM Parameter Store vs Secret Manager</h3><ul><li>Secret Manager ($$$):<ul><li>Automatic rotation</li><li>Lambda func is provided for RDS, Redshift, DocumentDB</li><li>KMS enc is mandatory.</li><li>Integration with CloudFormation</li></ul></li><li>SSM Parameter Store ($)<ul><li>Simple API</li><li>No secret rotation</li><li>KMS enc optional</li><li>Integration with CloudFormation</li><li>Pull screcte from SSM Parater Store</li></ul></li></ul><h3 id="SSM-Patch-Manager"><a href="#SSM-Patch-Manager" class="headerlink" title="SSM - Patch Manager"></a>SSM - Patch Manager</h3><ul><li>Patch Baseline</li><li>Defines which patches should and shouldn’t be installed on your instances</li><li>Ability to create custom Patch Baselines (specify approved&#x2F;rejected patches)</li><li>Patches can be auto-approved within days of their release</li><li>By default, install only critical patches and patches related to security</li><li>Patch Group</li><li>Associate a set of instances with a specific Patch Baseline</li><li><strong><code>Example: create Patch Groups for different environments (dev, test, prod)</code></strong></li><li>Instances should be defined with the tag key <strong><code>Patch Group</code></strong>.</li><li>An instance can only be in one Patch Group</li><li>Patch Group can be registered with only one Patch Baseline</li></ul><h3 id="SSM-Patch-Manager-Patch-Baselines"><a href="#SSM-Patch-Manager-Patch-Baselines" class="headerlink" title="SSM - Patch Manager Patch Baselines"></a>SSM - <a href="https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-patch.html">Patch Manager Patch Baselines</a></h3><ul><li><p><strong>Pre-Defined Patch Baseline</strong></p><ul><li>Managed by AWS for different Operating Systems (can’t be modified)</li><li>A<strong>WS-RunPatchBaseline (SSM Document)</strong> - apply both operating system and application patches (Linux, macOS, Windows Server)</li></ul></li><li><p><strong>Custom Patch Baseline</strong></p><ul><li>Create your own Patch Baseline and choose which patches to auto-approve</li><li>Operating System, allowed patches, rejected patches, …</li><li>Ability to specify custom and alternative patch repositories</li></ul></li></ul><h2 id="A-patch-group-is-essentially-an-association-of-EC2-instances-that-share-the-same-patching-requirements-Within-Patch-Manager-a-patch-baseline-is-a-set-of-rules-that-dictate-which-patches-should-be-installed-By-using-separate-patch-baselines-for-each-group-it-provides-granular-control-over-the-patching-process"><a href="#A-patch-group-is-essentially-an-association-of-EC2-instances-that-share-the-same-patching-requirements-Within-Patch-Manager-a-patch-baseline-is-a-set-of-rules-that-dictate-which-patches-should-be-installed-By-using-separate-patch-baselines-for-each-group-it-provides-granular-control-over-the-patching-process" class="headerlink" title="A patch group is essentially an association of EC2 instances that share the same patching requirements. Within Patch Manager, a patch baseline is a set of rules that dictate which patches should be installed. By using separate patch baselines for each group, it provides granular control over the patching process"></a>A patch group is essentially an association of EC2 instances that share the same patching requirements. Within Patch Manager, a patch baseline is a set of rules that dictate which patches should be installed. By using separate patch baselines for each group, it provides granular control over the patching process</h2><h2 id="EBS"><a href="#EBS" class="headerlink" title="EBS"></a>EBS</h2><p><code>QUESTION</code></p><ul><li>Use <code>separate</code> Amazon EBS <code>volumes</code> for the <code>operating system</code> and <code>your data</code>, even though root volume persistence feature is available.</li><li>EBS snapshots <code>only capture data that has been written to your Amazon EBS volume</code>, which might exclude any data that has been locally cached by your application or operating system.</li><li>By default, <code>data</code> on a <code>non-root EBS volume</code> is <code>preserved</code> even if the instance is <code>shutdown or terminated</code>.  By default, when you attach a non-root EBS volume to an instance, its <code>DeleteOnTermination</code> attribute is <code>set</code> to <code>false</code>. Therefore, the default is to preserve these volumes. After the instance terminates, you can take a snapshot of the preserved volume or attach it to another instance. You must delete a volume to avoid incurring further charges.</li></ul><h3 id="QUESTION-To-set-up-a-backup-strategy-for-an-Amazon-Elastic-Block-Store-Amazon-EBS-volume-storing-a-custom-database-on-an-Amazon-EC2-instance-the-following-action-should-be-taken"><a href="#QUESTION-To-set-up-a-backup-strategy-for-an-Amazon-Elastic-Block-Store-Amazon-EBS-volume-storing-a-custom-database-on-an-Amazon-EC2-instance-the-following-action-should-be-taken" class="headerlink" title="QUESTION. To set up a backup strategy for an Amazon Elastic Block Store (Amazon EBS) volume storing a custom database on an Amazon EC2 instance, the following action should be taken:"></a><code>QUESTION.</code> To set up a backup strategy for an Amazon Elastic Block Store (Amazon EBS) volume storing a custom database on an Amazon EC2 instance, the following action should be taken:</h3><p>Create an Amazon <code>Data Lifecycle Manager (Amazon DLM)</code> policy to <code>take</code> a <code>snapshot of the EBS</code> volume on a <code>recurring schedule</code>.</p><p><code>Explanation</code>: Amazon Data Lifecycle Manager (Amazon DLM) allows you to create automated snapshot lifecycle policies for your Amazon EBS volumes. By creating an Amazon DLM policy, you can define the desired backup schedule and retention period for the EBS volume. The policy will then automatically create snapshots according to the defined schedule. This ensures that regular backups are taken and can be used for data recovery if needed.</p><h3 id="EBS-volumes-deleted-with-the-TerminateInstances-API-call-continue-to-show-for-some-time-on-AWS-Config-console-👀-EXAM"><a href="#EBS-volumes-deleted-with-the-TerminateInstances-API-call-continue-to-show-for-some-time-on-AWS-Config-console-👀-EXAM" class="headerlink" title="EBS volumes deleted with the TerminateInstances API call continue to show for some time on AWS Config console - 👀 EXAM"></a><a href="https://docs.amazonaws.cn/en_us/AWSEC2/latest/WindowsGuide/ebs-deleting-volume.html">EBS volumes deleted</a> with the <code>TerminateInstances</code> API call continue to show for some time on AWS Config console - 👀 EXAM</h3><p>Terminated Amazon EC2 instances use the <code>DeleteOnTermination</code> attribute for each attached EBS volume to determine to delete the volume. Amazon EC2 deletes the Amazon EBS volume that has the <code>DeleteOnTermination</code> attribute set to true, but it does not publish the <code>DeleteVolume</code> API call. This is because AWS Config uses the <em>DeleteVolume</em> API call as a trigger with the rule, and the resource changes aren’t recorded for the EBS volume. The EBS volume still shows as compliant or noncompliant.AWS Config performs a baseline every six hours to check for new configuration items with the ResourceDeleted status. The AWS Config rule then removes the deleted EBS volumes from the evaluation results.</p><p>Amazon EBS volumes deleted using the <code>DeleteVolume API call</code> invoke a <code>DescribeVolumes</code> API call on volume. The DescribeVolumes API call <code>returns an InvalidVolume</code>.<code>NotFound</code> error code and the Amazon EBS volume is <code>removed</code> from the list of resources in AWS Config</p><h3 id="SSD-backed-volumes-IOPS-intensive"><a href="#SSD-backed-volumes-IOPS-intensive" class="headerlink" title="SSD-backed volumes (IOPS-intensive)"></a>SSD-backed volumes (IOPS-intensive)</h3><h3 id="EBS-Volume-Types"><a href="#EBS-Volume-Types" class="headerlink" title="EBS Volume Types"></a>EBS Volume Types</h3><p>EBS Volumes come in 6 types</p><ul><li><code>gp2 / gp3</code> (SSD): <code>General purpose</code> SSD volume that balances price and performance for a wide variety of workloads.</li><li><code>io1 / io2</code> (SSD): <code>Highest-performance</code> SSD volume for <strong>mission-critical low-latency or high-throughput workloads</strong>. <code>Only multi-attach 16 instances at a time</code></li><li><code>st1</code> (HDD): <code>Low cost</code> HDD volume designed for <strong>frequently accessed, throughput intensive workloads</strong></li><li><code>sc1</code> (HDD): <code>Lowest cost</code> HDD volume designed for <strong>less frequently accessed workloads</strong></li></ul><p><img src="/../images/AWS-EBS-Types.png" alt="AWS EBS Types"></p><p>EBS Volumes are characterized in Size | Throughput | IOPS (I&#x2F;O Ops Per Sec).</p><p><strong><code>Only gp2/gp3 and io1/io2 can be used as boot volumes</code></strong></p><ul><li><code>EBS-optimized</code> <code>instance</code> uses an optimized configuration stack and provides additional, dedicated capacity for Amazon<code> EBS I/O</code>. This optimization provides the best performance for your EBS volumes by minimizing contention between Amazon EBS I&#x2F;O and other traffic from your instance.</li></ul><h2 id="Provisioned-IOPS-SSD-io2-Block-Express-io2-amp-io1-volumes"><a href="#Provisioned-IOPS-SSD-io2-Block-Express-io2-amp-io1-volumes" class="headerlink" title="Provisioned IOPS SSD (io2 Block Express, io2 &amp; io1) volumes"></a>Provisioned IOPS SSD (io2 Block Express, io2 &amp; <code>io1</code>) volumes</h2><p>Provisioned IOPS SSD volumes are designed to deliver a maximum of 256,000 IOPS, 4,000 MB&#x2F;s of throughput, and 64 TiB in size per volume1. io2 Block Express is the latest generation of the Provisioned IOPS SSD volumes that delivers 4x higher throughput, IOPS, and capacity than regular io2 volumes, along with sub-millisecond latency - at the same price as io2. io2 Block Express provides highest block storage performnce for the largest, most I&#x2F;O- intensive, mission-critical deployments of Oracle, Microsoft SQL Server, SAP HANA, and SAS Analytics</p><h4 id="General-purpose-SSD-gp3-and-gp2-volumes"><a href="#General-purpose-SSD-gp3-and-gp2-volumes" class="headerlink" title="General purpose SSD (gp3 and gp2) volumes"></a>General purpose SSD (<code>gp3 and gp2</code>) volumes</h4><p>General-purpose volumes are backed by solid-state drives (SSDs) and are suitable for a broad range of transactional workloads, virtual desktops, medium sized single instance databases, latency sensitive interactive applications, dev&#x2F;test environments, and boot volumes.</p><h3 id="HDD-backed-volumes-MB-x2F-s-intensive"><a href="#HDD-backed-volumes-MB-x2F-s-intensive" class="headerlink" title="HDD-backed volumes (MB&#x2F;s-intensive)"></a>HDD-backed volumes (MB&#x2F;s-intensive)</h3><h3 id="Throughput-optimized-HDD-st1-volumes"><a href="#Throughput-optimized-HDD-st1-volumes" class="headerlink" title="Throughput optimized HDD (st1) volumes"></a>Throughput optimized HDD (<code>st1</code>) volumes</h3><p>ST1 is backed by hard disk drives (HDDs) and is ideal for frequently accessed, throughput intensive workloads with large datasets and large I&#x2F;O sizes, such as MapReduce, Kafka, log processing, data warehouse, and ETL workloads.</p><h3 id="Cold-HDD-sc1-volumes"><a href="#Cold-HDD-sc1-volumes" class="headerlink" title="Cold HDD (sc1) volumes"></a>Cold HDD (<code>sc1</code>) volumes</h3><p>SC1 is backed by hard disk drives (HDDs) and provides the lowest cost per GB of all EBS volume types. It is ideal for less frequently accessed workloads with large, cold datasets.</p><h3 id="Changing-the-instance-type"><a href="#Changing-the-instance-type" class="headerlink" title="Changing the instance type"></a>Changing the instance type</h3><ol><li>The possibility to resize an instance depends on whether the root device is an EBS volume. If it is, you can easily change the instance size by modifying its instance type, also known as resizing. However, if the root device is an instance store volume, you need to migrate your application to a new instance with the desired instance type.</li><li>Before changing the instance type of your Amazon EBS-backed instance, you must stop it. AWS will then move the instance to new hardware, but the instance ID will remain the same.</li><li>If your instance belongs to an Auto Scaling group, the Amazon EC2 Auto Scaling service considers the stopped instance as unhealthy and may terminate it, launching a replacement instance instead. To avoid this, you can temporarily suspend the scaling processes for the group while resizing your instance.</li></ol><p>Reference: <a href="https://aws.amazon.com/ebs/features/">Amazon EBS features</a></p><h2 id="S3"><a href="#S3" class="headerlink" title="S3"></a>S3</h2><h3 id="QUESTION-S3-inventory"><a href="#QUESTION-S3-inventory" class="headerlink" title="QUESTION S3 inventory"></a><code>QUESTION</code> <a href="https://docs.aws.amazon.com/AmazonS3/latest/dev/storage-inventory.html">S3 inventory</a></h3><p>Is one of the tools Amazon S3 provides to help manage your storage. You can use it <code>to audit and report on the replication and encryption status of your objects</code> for business, compliance, and regulatory needs.You can also simplify and speed up business workflows and big data jobs using Amazon S3 inventory, which provides a scheduled alternative to the Amazon S3 synchronous List API operation.</p><h3 id="Retain-Until-Date"><a href="#Retain-Until-Date" class="headerlink" title="Retain Until Date"></a>Retain Until Date</h3><p>A retention period safeguards an object version for a specified duration. When a retention period is assigned to an object version, Amazon S3 records a timestamp in the object version’s metadata, indicating when the retention period concludes. Once the retention period ends, the object version can be overwritten or deleted, unless a legal hold has also been placed on it.</p><p>You can assign a retention period to an object version either explicitly or through a default setting at the bucket level. Explicitly applying a retention period involves specifying a “Retain Until Date” for the object version. Amazon S3 stores this setting in the object version’s metadata and ensures the protection of the object version until the retention period expires.</p><h4 id="References"><a href="#References" class="headerlink" title="References"></a>References</h4><ol><li><a href="https://docs.aws.amazon.com/AmazonS3/latest/dev/object-lock.html">https://docs.aws.amazon.com/AmazonS3/latest/dev/object-lock.html</a></li><li><a href="https://docs.aws.amazon.com/AmazonS3/latest/dev/object-lock-overview.html">https://docs.aws.amazon.com/AmazonS3/latest/dev/object-lock-overview.html</a></li><li><a href="https://docs.aws.amazon.com/AmazonS3/latest/dev/replication.html">https://docs.aws.amazon.com/AmazonS3/latest/dev/replication.html</a></li></ol><h3 id="S3-RTC-S3-Replication-Time-Control"><a href="#S3-RTC-S3-Replication-Time-Control" class="headerlink" title="S3 RTC S3 (Replication Time Control)"></a>S3 RTC S3 (Replication Time Control)</h3><p>S3 Replication Time Control (S3 RTC) helps you meet compliance or business requirements for data replication and provides visibility into Amazon S3 replication times. S3 RTC replicates most objects that you upload to Amazon S3 in seconds, and 99.99 percent of those objects within 15 minutes. Amazon S3 events are available through Amazon SQS, Amazon SNS, or AWS Lambda.</p><p>Reference: <a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication-time-control.html#using-s3-events-to-track-rtc">Using S3 Replication Time Control</a></p><h3 id="Amazon-S3-Access-Points"><a href="#Amazon-S3-Access-Points" class="headerlink" title="Amazon S3 Access Points"></a>Amazon S3 Access Points</h3><p>Allow you to <code>create unique entry points for accessing your S3 buckets</code>. Each access point can have its own access policy, allowing you to control access at a granular level. By using access points, you can assign specific permissions to each application or team accessing the shared bucket without affecting other applications. This helps in maintaining access control and minimizing the risk of unintended changes to the bucket policy.</p><p>Reference: <a href="https://aws.amazon.com/s3/features/access-points/">Amazon S3 Access Points</a></p><h3 id="Logs"><a href="#Logs" class="headerlink" title="Logs"></a>Logs</h3><h4 id="S3-Server-Access-Logging"><a href="#S3-Server-Access-Logging" class="headerlink" title="S3 Server Access Logging"></a>S3 Server Access Logging</h4><p>To <code>track requests for access to your bucket</code>, you can enable server access logging. Each access log record provides details about a single access request, such as the requester, bucket name, request time, request action, response status, and an error code, if relevant.</p><p>There is no extra charge for enabling server access logging on an Amazon S3 bucket, and you are not charged when the logs are PUT to your bucket. However, any log files that the system delivers to your bucket accrue the usual charges for storage. You can delete these log files at any time. Subsequent reads and other requests to these log files are charged normally, as for any other object, including data transfer charges.</p><p>By default, logging is disabled. When logging is enabled, logs are saved to a bucket in the same AWS Region as the source bucket.</p><p>Reference: <a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/using-s3-access-logs-to-identify-requests.html">Using Amazon S3 access logs to identify requests</a></p><h3 id="As-a-Website"><a href="#As-a-Website" class="headerlink" title="As a Website"></a>As a Website</h3><p>If you use an Amazon S3 bucket configured as a website endpoint, <code>you must set it up with CloudFront as a custom origin</code>. You can’t use the origin access identity feature. However, you can restrict access to content on a custom origin by setting up custom headers and configuring your origin to require them.</p><h3 id="Enable-MFA-Delete"><a href="#Enable-MFA-Delete" class="headerlink" title="Enable MFA-Delete"></a><a href="https://docs.aws.amazon.com/AmazonS3/latest/dev/Versioning.html#MultiFactorAuthenticationDelete">Enable MFA-Delete</a></h3><p>You should note that <code>only</code> the bucket owner (<code>root account</code>) <code>can enable MFA Delete</code> only <code>via</code> the AWS <code>CLI</code>. However, the bucket owner, the AWS account that created the bucket (root account), and all authorized IAM users can enable versioning.</p><h3 id="Vault-Lock-Policy"><a href="#Vault-Lock-Policy" class="headerlink" title="Vault Lock Policy"></a>Vault Lock Policy</h3><p>S3 Glacier Vault Lock <code>allows</code> you to easily deploy and <code>enforce compliance controls for individual S3 Glacier vaults</code> with a <code>vault lock policy</code>. You <code>can specify controls</code> such as <code>“write once read many” (WORM)</code> in a vault lock policy and lock the policy from future edits. Once locked, the policy can no longer be changed.</p><h3 id="QUESTION-Snowball-Edge"><a href="#QUESTION-Snowball-Edge" class="headerlink" title="QUESTION Snowball Edge"></a><code>QUESTION</code> Snowball Edge</h3><p>AWS Snowball is a service designed for large-scale data transfers. Snowball Edge appliances are rugged, petabyte-scale data transfer devices that can be used for offline data migration. By using multiple instances of the AWS Snowball client and multiple Snowball Edge Appliances, the company can achieve fast and cost-effective data migration.</p><p>Using multiple instances of the AWS Snowball client and Snowball Edge Appliances <code>allows</code> for <code>parallel data transfers</code>, significantly <code>reducing the migration time</code>. It also <code>avoids</code> the need for <code>network-based transfers</code>, which could be slower and potentially costly due to data transfer charges.</p><h3 id="Amazon-S3-Storage-Classes"><a href="#Amazon-S3-Storage-Classes" class="headerlink" title="Amazon S3 Storage Classes"></a><a href="https://aws.amazon.com/s3/storage-classes/">Amazon S3 Storage Classes</a></h3><h4 id="Amazon-S3-Standard-Infrequent-Access-S3-Standard-IA"><a href="#Amazon-S3-Standard-Infrequent-Access-S3-Standard-IA" class="headerlink" title="Amazon S3 Standard-Infrequent Access (S3 Standard-IA)"></a>Amazon S3 Standard-Infrequent Access (S3 Standard-IA)</h4><p>S3 Standard-IA is for data that is accessed less frequently, but requires rapid access when needed. S3 Standard-IA offers the high durability, high throughput, and low latency of S3 Standard, with a low per GB storage price and per GB retrieval charge.</p><h3 id="QUESTION-Access-to-Amazon-S3-via-Direct-Connect"><a href="#QUESTION-Access-to-Amazon-S3-via-Direct-Connect" class="headerlink" title="QUESTION Access to Amazon S3 via Direct Connect"></a><code>QUESTION</code> Access to Amazon S3 via Direct Connect</h3><p>It’s not possible to directly access an S3 bucket through a private virtual interface (VIF) using Direct Connect. This is true even if you have an Amazon Virtual Private Cloud (Amazon VPC) endpoint for Amazon S3 in your VPC because <code>VPC endpoint connections can&#39;t extend outside of a VPC</code>. Additionally, Amazon S3 resolves to public IP addresses, even if you enable a VPC endpoint for Amazon S3.</p><p>However, you can establish access to Amazon S3 using <code>Direct Connect</code> by following these steps (This configuration doesn’t require a VPC endpoint for Amazon S3, because traffic doesn’t traverse the VPC):</p><ol><li>Create a <code>connection</code>. You can request a <code>dedicated connection or a hosted connection</code>.</li><li>Establish a cross-network connection with the help of your network provider, and then create a public virtual interface for your connection.</li><li>Configure an end router for use with the public virtual interface.</li></ol><p>After the BGP is up and established, the Direct Connect router advertises all global public IP prefixes, including Amazon S3 prefixes. Traffic heading to Amazon S3 is routed through the Direct Connect public virtual interface through a private network connection between AWS and your data center or corporate network.</p><h3 id="Amazon-S3-Security-👀"><a href="#Amazon-S3-Security-👀" class="headerlink" title="Amazon S3 - Security 👀"></a>Amazon S3 - Security 👀</h3><ul><li><p><strong><code>User-Based</code></strong></p><ul><li><strong>IAM Policies</strong> - which API calls should be allowed for a specific user from IAM</li></ul></li><li><p><strong><code>Resource-Based</code></strong></p><ul><li><strong>Bucket Policies</strong> - bucket wide rules from the S3 console - <code>allows cross account</code></li><li><strong>Object Access Control List (ACL)</strong> - finer grain (can be disabled)</li><li><strong>Bucket Access Control List (ACL)</strong> - less common (can be disabled)</li></ul></li><li><p><strong><code>Note</code></strong>: an IAM principal can access an S3 object if</p><ul><li>The user IAM permissions ALLOW it OR the resource policy ALLOWS it</li><li>AND there’s no explicit DENY</li></ul></li><li><p><strong><code>Encryption</code></strong>: encrypt objects in Amazon S3 using encryption keys</p></li></ul><h3 id="S3-Bucket-Policies-👀-EXAM"><a href="#S3-Bucket-Policies-👀-EXAM" class="headerlink" title="S3 Bucket Policies 👀 EXAM"></a>S3 Bucket Policies 👀 EXAM</h3><ul><li><p>Use S3 bucket for policy to:</p><ul><li>Grant public access to the bucket</li><li>Force objects to be encrypted at upload</li><li><strong><code>Grant access to another account (Cross Account)</code></strong></li></ul></li><li><p>Optional Conditions on:</p><ul><li>Public IP or Elastic IP (not on Private IP)</li><li>Source VPC or Source VPC Endpoint - only works with VPC Endpoints</li><li>CloudFront Origin Identity</li><li>MFA</li></ul></li><li><p>Examples here: <a href="https://docs.aws.amazon.com/AmazonS3/latest/dev/example-bucket-policies.html">https://docs.aws.amazon.com/AmazonS3/latest/dev/example-bucket-policies.html</a></p></li></ul><h3 id="S3-Performance-👀-EXAM"><a href="#S3-Performance-👀-EXAM" class="headerlink" title="S3 Performance 👀 EXAM"></a>S3 Performance 👀 EXAM</h3><ul><li><p><strong><code>Multi-Part upload</code></strong>:</p><ul><li>recommended for files &gt; 100MB, must use for files &gt; 5GB</li><li>Can help parallelize uploads (speed up transfers)</li></ul></li><li><p><strong><code>S3 Transfer Acceleration</code></strong></p><ul><li>Increase transfer speed by transferring file to an AWS edge location which will forward the data to the S3 bucket in the target region</li><li>Compatible with multi-part upload</li></ul></li></ul><h3 id="S3-Batch-Operations"><a href="#S3-Batch-Operations" class="headerlink" title="S3 Batch Operations"></a>S3 Batch Operations</h3><p>Eg Encrypt un-encrypted objects.</p><p><strong><code>You can use S3 Inventory to get object list and use S3 Select to filter your objects.</code></strong></p><h3 id="S3-Inventory-👀-EXAM"><a href="#S3-Inventory-👀-EXAM" class="headerlink" title="S3 Inventory 👀 EXAM"></a>S3 Inventory 👀 EXAM</h3><ul><li>List objects and their corresponding metadata (alternative to S3 List API operation)</li><li>Usage examples:<ul><li><code>Audit and report on the replication and encryption status of your objects</code></li><li><code>Get the number of objects in an S3 bucket</code></li><li><code>Identify the total storage of previous object versions</code></li></ul></li><li><strong>Generate</strong> daily or weekly <strong>reports</strong></li><li><strong>Output files</strong>: CSV, ORC, or Apache Parquet</li><li><code>You can query all the data using Amazon Athena, Redshift, Presto, Hive, Spark...</code></li><li>You can filter generated report using S3 Select</li><li>Use cases: <code>Business</code>, <code>Compliance</code>, <code>Regulatory</code> needs, …</li></ul><h3 id="Amazon-S3-Analytics-Storage-Class-Analysis-👀-EXAM"><a href="#Amazon-S3-Analytics-Storage-Class-Analysis-👀-EXAM" class="headerlink" title="Amazon S3 Analytics - Storage Class Analysis 👀 EXAM"></a>Amazon S3 Analytics - Storage Class Analysis 👀 EXAM</h3><ul><li><p>Help you <strong><code>decide when to transition objects to the right storage class</code></strong></p></li><li><p>Recommendations for <code>Standard</code> and <code>Standard IA</code></p></li><li><p>Does NOT work for One-Zone IA or Glacier</p></li><li><p>Report is updated daily</p></li><li><p>24 to 48 hours to start seeing data analysis</p><pre><code>Good first step to put together Lifecycle Rules</code></pre></li></ul><h3 id="Amazon-S3-Glacier-Vault-Policies-amp-Vault-Lock-👀-EXAM"><a href="#Amazon-S3-Glacier-Vault-Policies-amp-Vault-Lock-👀-EXAM" class="headerlink" title="Amazon S3 Glacier - Vault Policies &amp; Vault Lock 👀 EXAM"></a>Amazon S3 Glacier - Vault Policies &amp; Vault Lock 👀 EXAM</h3><ul><li>Each Vault has:<ul><li>ONE vault access policy</li><li>ONE vault lock policy</li></ul></li><li>Vault Policies are written in JSON</li><li>Vault Access Policy is like a bucket policy (restrict user &#x2F; account permissions)</li><li>Vault Lock Policy is a policy you lock, for regulatory and compliance requirements.<ul><li>The policy is immutable, <strong><code>it can never be changed (that’s why it’s call LOCK)</code></strong></li><li>Example 1: forbid deleting an archive if less than 1 year old</li><li>Example 2: implement WORM policy (write once read many)</li></ul></li></ul><h3 id="Glacier-Notifications-for-Restore-Operations"><a href="#Glacier-Notifications-for-Restore-Operations" class="headerlink" title="Glacier - Notifications for Restore Operations"></a>Glacier - Notifications for Restore Operations</h3><p>S3 Event Notifications</p><ul><li>S3 supports the restoration of objects archivedto S3 Glacier storage classes</li><li><strong><code>s3:ObjectRestore:Post</code></strong> &#x3D;&gt; notify when object restoration initiated</li><li><strong><code>s3:ObjectRestore:Completed</code></strong> &#x3D;&gt; notify whenobject restoration completed</li></ul><h3 id="Amazon-S3-Object-Encryption"><a href="#Amazon-S3-Object-Encryption" class="headerlink" title="Amazon S3 - Object Encryption"></a>Amazon S3 - Object Encryption</h3><p>You can encrypt objects in S3 buckets using one of 4 methods</p><p>Server-Side Encryption (SSE)</p><ol><li><strong><code>Server-Side Encryption with Amazon S3-Managed Keys (SSE-S3)</code></strong> - Enabled by Default<ul><li>Encrypts S3 objects using keys handled, managed, and owned by AWS</li><li>Must set header <code>&quot;x-amz-server-side-encryption&quot;: &quot;AES256&quot;</code></li></ul></li><li><strong><code>Server-Side Encryption with KMS Keys stored in AWS KMS (SSE-KMS)</code></strong><ul><li>Leverage AWS Key Management Service (AWS KMS) to manage encryption keys</li><li>ust set header  <code>&quot;x-amz-server-side-encryption&quot;: &quot;aws:kms&quot;</code></li></ul></li><li><strong><code>Server-Side Encryption with Customer-Provided Keys (SSE-C)</code></strong><ul><li>When you want to manage your own encryption keys</li><li><code>HTTPS must be used</code></li></ul></li><li>Client-Side Encryption</li></ol><p>Amazon S3 - Force Encryption in Transitaws:SecureTransport</p><h2 id="CORS"><a href="#CORS" class="headerlink" title="CORS"></a>CORS</h2><p>Cross-origin resource sharing (CORS) defines a way for client web applications that are loaded in one domain to interact with resources in a different domain</p><ul><li><strong><code>Cross-Origin Resource Sharing (CORS)</code></strong></li><li>Origin &#x3D; scheme (protocol) + host (domain) + port<ul><li>example: <a href="https://www.example.com/">https://www.example.com</a> (implied port is 443 for HTTPS, 80 for HTTP)</li></ul></li><li>Web Browser based mechanism to allow requests to other origins while visiting the main origin</li><li>Same origin: <a href="http://example.com/app1">http://example.com/app1</a> &amp; <a href="http://example.com/app2">http://example.com/app2</a></li><li>Different origins: <a href="http://www.example.com/">http://www.example.com</a> &amp; <a href="http://other.example.com/">http://other.example.com</a></li><li>The requests won’t be fulfilled unless the other origin allows for the requests, using CORS Headers (example: <code>**Access-Control-Allow-Origin**</code>)</li></ul><h3 id="👀-EXAM-question"><a href="#👀-EXAM-question" class="headerlink" title="👀 EXAM question"></a>👀 EXAM question</h3><ul><li>If a client makes a cross-origin request on our S3 bucket, we need to enable the correct CORS headers.You can allow for a specific origin or for * (all origins)</li></ul><h3 id="Amazon-S3-MFA-Delete"><a href="#Amazon-S3-MFA-Delete" class="headerlink" title="Amazon S3 - MFA Delete"></a>Amazon S3 - MFA Delete</h3><ul><li><p><strong>MFA (Multi-Factor Authentication)</strong> - force users to generate a code on adevice (usually a mobile phone or hardware) before doing important operations on S3</p></li><li><p>MFA will be required to:</p><ul><li>Permanently delete an object version  Google Authenticator</li><li>Suspend Versioning on the bucket</li></ul></li><li><p>MFA won’t be required to:</p><ul><li>Enable Versioning</li><li>List deleted versions</li></ul></li><li><p>To use MFA Delete, <strong><code>Versioning must be enabled</code></strong> on the bucket</p></li><li><p><strong><code>Only the bucket owner (root account) can enable/disable MFA Delete</code></strong></p></li></ul><h4 id="Allow-access-if-users-are-MFA-authenticated"><a href="#Allow-access-if-users-are-MFA-authenticated" class="headerlink" title="Allow access if users are MFA authenticated"></a>Allow access if users are MFA authenticated</h4><p>use an MFA condition in a policy to check the following properties:</p><ul><li><p>Existence-To simply verify that the user did authenticate with MFA, check that the <code>aws:MultiFactorAuthPresent</code> key is True in a Bool condition. The key is only present when the user authenticates with short-term credentials. Long-term credentials, such as access keys, do not include this key.</p></li><li><p>Duration-If you want to grant access only within a specified time after MFA authentication, use a numeric condition type to compare the aws:MultiFactorAuthAge key’s age to a value (such as 3600 seconds). Note that the <code>aws:MultiFactorAuthAge</code> key is not present if MFA was not used.</p></li></ul><figure class="highlight json"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line"><span class="attr">&quot;Condition&quot;</span><span class="punctuation">:</span> <span class="punctuation">&#123;</span></span><br><span class="line">  <span class="attr">&quot;Bool&quot;</span><span class="punctuation">:</span> <span class="string">&quot;&#123;</span></span><br><span class="line"><span class="string">    &quot;</span>aws<span class="punctuation">:</span>MultiFactorAuthPresent<span class="string">&quot;: &quot;</span><span class="literal"><span class="keyword">true</span></span><span class="string">&quot;</span></span><br><span class="line"><span class="string">  &#125;</span></span><br><span class="line"><span class="string">&#125;</span></span><br></pre></td></tr></table></figure><h3 id="S3-Access-Logs"><a href="#S3-Access-Logs" class="headerlink" title="S3 Access Logs"></a>S3 Access Logs</h3><ul><li>For audit purpose, you may want to log all access to S3 buckets</li><li>Any request made to S3, from any account, authorized or denied, will be logged into another S3 bucket</li><li>That data can be analyzed using data analysis tools…</li><li>The target logging bucket must be in the same AWS region</li></ul><h2 id="Amazon-Athena"><a href="#Amazon-Athena" class="headerlink" title="Amazon Athena"></a>Amazon Athena</h2><ul><li><p>Serverless query service to analyze data stored in Amazon S3</p></li><li><p>Uses standard SQL language to query the files (built on Presto)</p></li><li><p>Supports CSV, JSON, ORC, Avro, and Parquet</p></li><li><p>Pricing: $5.00 per TB of data scanned</p></li><li><p>Commonly used with Amazon Quicksight for reporting&#x2F;dashboards</p></li><li><p><strong><code>Use cases</code></strong>: Business intelligence &#x2F; analytics &#x2F; reporting, analyze &amp; query VPC Flow Logs, ELB Logs, CloudTrail trails, etc…</p></li><li><p><strong><code>Exam Tip</code></strong>: analyze data in S3 using serverless SQL, use Athena</p></li></ul><h3 id="Amazon-Athena-Performance-Improvement"><a href="#Amazon-Athena-Performance-Improvement" class="headerlink" title="Amazon Athena - Performance Improvement"></a>Amazon Athena - Performance Improvement</h3><ul><li><strong><code>Use columnar</code></strong> data for cost-savings (less scan).</li><li><strong><code>Compress data</code></strong> for smaller retrievals (bzip2, gzip, lz4, snappy, zlip, zstd…).</li><li><strong><code>Partition</code></strong> datasets in S3 for easy querying on virtual columns.</li><li><strong><code>Use larger files</code></strong> (&gt; 128 MB) to minimize overhead.</li></ul><h3 id="Amazon-Athena-Federated-Query"><a href="#Amazon-Athena-Federated-Query" class="headerlink" title="Amazon Athena - Federated Query"></a>Amazon Athena - Federated Query</h3><p>Allows you to run SQL queries across data stored in relational, non-relational, object, and custom data sources (AWS or on-premises)</p><p>Uses Data Source Connectors that run on AWS Lambda to run Federated Queries (e.g., CloudWatch Logs, DynamoDB, RDS, …)</p><p>Store the results back in Amazon S3</p><h2 id="AWS-OpsHub"><a href="#AWS-OpsHub" class="headerlink" title="AWS OpsHub"></a><a href="https://docs.aws.amazon.com/snowball/latest/developer-guide/aws-opshub.html">AWS OpsHub</a></h2><p>AWS OpsHub for <code>Snow Family</code>, that you can use to <code>manage your devices and local AWS services</code>. You use AWS OpsHub on a client computer to perform tasks such as unlocking and configuring single or clustered devices, transferring files, and launching and managing instances running on Snow Family Devices. You can use AWS OpsHub to manage both the Storage Optimized and Compute Optimized device types and the Snow device. The AWS OpsHub application is available at no additional cost to you.</p><p>AWS OpsHub takes all the existing operations available in the Snowball API and presents them as a graphical user interface. This interface helps you quickly migrate data to the AWS Cloud and deploy edge computing applications on Snow Family Devices.</p><p>When your Snow device arrives at your site, you download, install, and launch the AWS OpsHub application on a client machine, such as a laptop. After installation, you can unlock the device and start managing it and using supported AWS services locally. AWS OpsHub provides a dashboard that summarizes key metrics such as storage capacity and active instances on your device. It also provides a selection of AWS services that are supported on the Snow Family Devices. Within minutes, you can begin transferring files to the device.</p><hr><h2 id="Amazon-FSx-Overview"><a href="#Amazon-FSx-Overview" class="headerlink" title="Amazon FSx - Overview"></a>Amazon FSx - Overview</h2><p><strong><code>Launch 3rd party high-performance file systems on AWS</code></strong></p><h3 id="FSx-for-Lustre"><a href="#FSx-for-Lustre" class="headerlink" title="FSx for Lustre"></a>FSx for Lustre</h3><p>Lustre is a type of <code>parallel distributed</code> file system, for large-scale computing. The name Lustre is derived from “Linux” and “cluster.</p><ul><li><strong><code>Machine Learning, High Performance Computing (HPC)</code></strong></li><li>Video Processing, Financial Modeling, Electronic Design Automation</li><li><strong><code>Seamless integration with S3</code></strong><ul><li>Can “read S3” as a file system (through FSx)</li><li>Can write the output of the computations back to S3 (through FSx)</li></ul></li><li><strong><code>Can be used from on-premises servers (VPN or Direct Connect)</code></strong></li></ul><h4 id="FSx-Lustre-File-System-Deployment-Options"><a href="#FSx-Lustre-File-System-Deployment-Options" class="headerlink" title="FSx Lustre - File System Deployment Options"></a>FSx Lustre - File System Deployment Options</h4><ol><li><strong><code>Scratch File System</code></strong>: Temporary storage</li><li><strong><code>Persistent File System</code></strong></li></ol><ul><li>Long-term storage</li><li>Data is replicated within same AZ</li></ul><h3 id="FSx-for-Windows-File-Server"><a href="#FSx-for-Windows-File-Server" class="headerlink" title="FSx for Windows File Server"></a>FSx for Windows File Server</h3><ul><li><strong><code>FSx for Windows</code></strong> is a fully managed Windows file system share drive</li><li>Supports <strong>SMB protocol &amp; Windows NTFS</strong></li><li>Microsoft Active Directory integration, ACLs, user quotas</li><li><strong><code>Can be mounted on Linux EC2 instances</code></strong></li><li>Supports <strong><code>Microsoft&#39;s Distributed File System (DFS)</code></strong> Namespaces (group files across multiple FS)</li></ul><h3 id="FSx-for-NetAppONTAP"><a href="#FSx-for-NetAppONTAP" class="headerlink" title="FSx for NetAppONTAP"></a>FSx for NetAppONTAP</h3><ul><li>Managed NetApp ONTAP on AWS</li><li>File System compatible with <strong><code>NFS, SMB, iSCSI protocols</code></strong></li><li><strong><code>Point-in-time instantaneous cloning (helpful for testing new workloads)</code></strong></li></ul><h3 id="FSx-for-OpenZFS"><a href="#FSx-for-OpenZFS" class="headerlink" title="FSx for OpenZFS"></a>FSx for OpenZFS</h3><ul><li>Managed OpenZFS file system on AWS</li><li>File System compatible with <strong><code>NFS</code></strong> (v3, v4, v4.1, v4.2)</li><li><strong><code>Point-in-time instantaneous cloning (helpful for testing new workloads)</code></strong></li></ul><hr><h2 id="AWS-Storage-Gateway"><a href="#AWS-Storage-Gateway" class="headerlink" title="AWS Storage Gateway"></a>AWS Storage Gateway</h2><p>Bridge between on-premises data and cloud data</p><p><img src="/../images/AWS-Store-Gateway-Architecture.png" alt="AWS Storage Gateway Architecture"></p><ul><li><p><code>File Gateway is POSIX compliant (Linux file system)</code></p><ul><li>POSIX metadata ownership, permissions, and timestamps stored in the object’s metadata in S3</li></ul></li><li><p>Reboot Storage Gateway VM: (e.g., maintenance)</p><ul><li><code>File Gateway</code>: simply restart the Storage Gateway VM</li><li><code>Volume and Tape Gateway</code>:<ul><li>Stop Storage Gateway Service (AWS Console, VM local Console, Storage Gateway API)</li><li>Reboot the Storage Gateway VM</li><li>Start Storage Gateway Service (AWS Console, VM local Console, Storage Gateway API)</li></ul></li></ul></li></ul><p><img src="/../images/AWS-Store-Gateway.png" alt="AWS Storage Gateway"></p><p>Types of Storage Gateway:</p><ol><li><code>S3 File Gateway</code></li></ol><ul><li>Configured S3 buckets are accessible using the <strong><code>NFS and SMB protocol</code></strong></li><li><strong><code>Most recently used data is cached in the file gateway</code></strong></li><li>Supports S3 Standard, S3 Standard IA, S3 One Zone A, S3 Intelligent Tiering</li><li>Transition to S3 Glacier using a Lifecycle Policy</li></ul><ol start="2"><li><code>FSx File Gateway</code></li></ol><ul><li>Native access to Amazon FSx for Windows File Server</li><li><strong><code>Local cache for frequently accessed data</code></strong></li><li><strong><code>Windows native compatibility (SMB, NTFS, Active Directory...)</code></strong></li><li>Useful for group file shares and home directories</li></ul><ol start="3"><li><code>Volume Gateway</code></li></ol><ul><li>Block storage using <strong><code>iSCSI protocol backed by S3</code></strong></li><li><code>Backed by EBS snapshots</code> which can help restore on-premises volumes!</li><li><code>Cached volumes</code>: low latency access to most recent data</li><li><code>Stored volumes</code>: entire dataset is on premise, scheduled backups to S3</li></ul><ol start="4"><li><code>Tape Gateway</code></li></ol><ul><li>Some companies have backup processes using physical tapes (!)</li><li>With Tape Gateway, companies use the same processes but, in the cloud</li><li><code>Virtual Tape Library (VTL)</code> backed by Amazon S3 and Glacier</li><li>Back up data using existing tape-based processes (and iSCSI interface)</li><li>Works with leading backup software vendors</li></ul><h3 id="Storage-Gateway-Activations"><a href="#Storage-Gateway-Activations" class="headerlink" title="Storage Gateway - Activations"></a>Storage Gateway - Activations</h3><p>Two ways to get Activation Key:</p><ul><li>Using the Gateway VM CLI</li><li>Make a web request to the Gateway VM (Port 80) old way</li></ul><p><code>Troubleshooting Activation Failures</code> - 👀 exam</p><ul><li>Make sure the Gateway VM has <code>port 80 opened</code></li><li>Check that the Gateway VM has the correct time and synchronizing its time automatically to a <code>Network Time Protocol (NTP)</code> server</li></ul><hr><h2 id="Amazon-CloudFront"><a href="#Amazon-CloudFront" class="headerlink" title="Amazon CloudFront"></a>Amazon CloudFront</h2><p>Content Delivery Network (CDN)</p><ul><li><strong><code>Improves read performance, content is cached at the edge</code></strong></li><li>Improves users experience</li><li>216 Point of Presence globally (edge locations)</li><li><strong><code>DDoS protection (because worldwide), integration with Shield, AWS Web Application Firewall</code></strong></li></ul><h3 id="CloudFront-Origins"><a href="#CloudFront-Origins" class="headerlink" title="CloudFront - Origins"></a>CloudFront - Origins</h3><p><code>S3 bucket</code></p><ul><li>For distributing files and caching them at the edge</li><li>Enhanced security with CloudFront <strong><code>Origin Access Control (OAC)</code></strong></li><li>OAC is replacing Origin Access Identity (OAI)</li><li>CloudFront can be used as an ingress (to upload files to S3)</li></ul><p> <code>Custom Origin (HTTP)</code></p><ul><li>Application Load Balancer</li><li>EC2 instance</li><li>S3 website (must first enable the bucket as a static S3 website)</li><li>Any HTTP backend you want</li></ul><h2 id="AwS-Origin-Shield-👀-EXAM"><a href="#AwS-Origin-Shield-👀-EXAM" class="headerlink" title="AwS Origin Shield - 👀 EXAM"></a><a href="https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/origin-shield.html">AwS Origin Shield</a> - 👀 EXAM</h2><p>Enabling the Origin Shield <code>feature</code> in <code>CloudFront</code> helps reduce the load on the origin server by <code>adding</code> an additional <code>caching layer</code> <em>between</em> <code>CloudFront edge locations</code> and &#96;the origin. It improves cache hit ratios and reduces the number of requests hitting the origin by serving content from the Origin Shield cache.</p><p><img src="/../images/AWS-CloudFront-Origin-Shield.png" alt="CloudFront Origin Shield"></p><h2 id="AWS-WAF-Web-Application-Firewall-1"><a href="#AWS-WAF-Web-Application-Firewall-1" class="headerlink" title="AWS WAF (Web Application Firewall)"></a>AWS WAF (Web Application Firewall)</h2><p>AWS WAF is a web application firewall that lets you monitor the HTTP and HTTPS requests that are forwarded to an Amazon <code>CloudFront</code> distribution, an Amazon <code>API Gateway</code> REST API, an <code>Application Load Balancer</code>, or an <code>AWS AppSync GraphQL API</code>.</p><h3 id="QUESTION-Change-AWS-Firewall-Manager-administration-account"><a href="#QUESTION-Change-AWS-Firewall-Manager-administration-account" class="headerlink" title="QUESTION Change AWS Firewall Manager administration account"></a><code>QUESTION</code> <a href="https://docs.aws.amazon.com/waf/latest/developerguide/fms-change-administrator.html">Change AWS Firewall Manager administration account</a></h3><p>You can designate <code>only one account in</code> an <code>organization as a Firewall Manager administrator account</code>. To create a new Firewall Manager administrator account, you must revoke the original administrator account first.</p><h3 id="CloudFront-Origin-Headers-vs-Cache-Behavior"><a href="#CloudFront-Origin-Headers-vs-Cache-Behavior" class="headerlink" title="CloudFront Origin Headers vs Cache Behavior"></a>CloudFront Origin Headers vs Cache Behavior</h3><p><code>Origin Custom Headers</code>:</p><ul><li>Origin-level setting</li><li>Set a constant header &#x2F; header value for all requests to origin</li></ul><p><code>Behavior setting</code>:</p><ul><li>Cache-related settings</li><li>Contains the whitelist of headers to forward</li></ul><h3 id="CloudFront-Caching-TTL"><a href="#CloudFront-Caching-TTL" class="headerlink" title="CloudFront Caching TTL"></a>CloudFront Caching TTL</h3><p><code>**“Cache-Control: max-age”**</code> is preferred to “Expires” header</p><h3 id="CloudFront-Increasing-Cache-Ratio"><a href="#CloudFront-Increasing-Cache-Ratio" class="headerlink" title="CloudFront - Increasing Cache Ratio"></a>CloudFront - Increasing Cache Ratio</h3><p>Monitor the CloudWatch metric <code>CacheHitRate</code></p><ul><li>Specify how long to cache your objects: <code>Cache-Control max-age</code> header</li><li>Specify none or the minimally required <code>headers</code></li><li>Specify none or the minimally required <code>cookies</code></li><li>Specify none or the minimally required <code>query string parameters</code></li><li>Separate static and dynamic distributions (two origins)</li></ul><h2 id="CloudFront-with-ALB-sticky-sessions-EXAM-QUESTION"><a href="#CloudFront-with-ALB-sticky-sessions-EXAM-QUESTION" class="headerlink" title="CloudFront with ALB sticky sessions - EXAM QUESTION"></a>CloudFront with <strong>ALB sticky sessions</strong> - EXAM QUESTION</h2><p>-<code> Must forward / whitelist the cookie that controls the session affinity to the origin</code> to allow the session affinity to work</p><ul><li>Set a TTL to a value lesser than when the authentication cookie expire</li></ul><p><code>Cookie: AWSALB=...</code></p><hr><h3 id="AWS-Health-Dashboard-Service-History"><a href="#AWS-Health-Dashboard-Service-History" class="headerlink" title="AWS Health Dashboard - Service History"></a>AWS Health Dashboard - Service History</h3><ul><li><p>Shows all regions, all services health</p></li><li><p>Shows historical information for each day</p></li><li><p>Has an RSS feed you can subscribe to</p></li><li><p>Previously called AWS Service Health Dashboard</p></li></ul><h3 id="AWS-Health-Dashboard-Your-Account"><a href="#AWS-Health-Dashboard-Your-Account" class="headerlink" title="AWS Health Dashboard - Your Account"></a>AWS Health Dashboard - Your Account</h3><ul><li><p>Previously called <code>AWS Personal Health Dashboard</code> (PHD).</p></li><li><p>AWS Account Health Dashboard provides <code>alerts and remediation guidance</code> when AWS is experiencing <code>events that may impact you</code>.</p></li><li><p>While the Service Health Dashboard displays the general status of AWS services, Account Health Dashboard gives you a <code>personalized view into the performance and availability of the AWS services underlying your AWS resources</code>.</p></li><li><p>The dashboard displays <code>relevant and timely information</code> to help you manage events in progress and <code>provides proactive</code> notification to helpyou plan for <code>scheduled activities</code>.</p></li><li><p><code>Can aggregate data from an entire AWS Organization</code></p></li><li><p>Global service</p></li><li><p>Shows how AWS outages directly impact you &amp; your AWS resources</p></li><li><p>Alert, remediation, proactive, scheduled activitie</p></li></ul><h3 id="Health-Event-NotificationsC"><a href="#Health-Event-NotificationsC" class="headerlink" title="Health Event NotificationsC"></a>Health Event NotificationsC</h3><ul><li>Use <code>EventBridge to react to changes for AWS Health events</code> in your AWS account</li><li>Example: receive email notifications when EC2 instances in your AWS account are scheduled for updates</li><li>This is possible for Account events (resources that are affected in your account) and Public Events (Regional availability of a service)</li><li>Use cases: send notifications, capture event information, take corrective action…</li></ul><h2 id="👀-QUESTION-AWS-Personal-Health-Dashboard"><a href="#👀-QUESTION-AWS-Personal-Health-Dashboard" class="headerlink" title="👀 QUESTION AWS Personal Health Dashboard"></a>👀 <code>QUESTION</code> AWS Personal Health Dashboard</h2><p>AWS Personal Health Dashboard provides <code>alerts</code> and <em><code>remediation guidance</code></em> when AWS is experiencing <code>events that may impact you</code>. While the Service Health Dashboard displays the general status of AWS services, Personal Health Dashboard gives you a personalized view into the <em>performance and availability</em> of the AWS services underlying your AWS resources.</p><p>What’s more, Personal Health Dashboard proactively notifies you when AWS experiences any events that may affect you, helping provide quick visibility and guidance to help you minimize the impact of events in progress, and plan for any scheduled changes, such as AWS hardware maintenance.</p><p>The <code>AWS Health API provides</code> programmatic <code>access</code> to the <code>AWS Health information</code> that appears in the AWS Personal Health Dashboard. You can use the API operations to get information about events that might affect your AWS services and resources.</p><hr><h2 id="AWS-Organizations"><a href="#AWS-Organizations" class="headerlink" title="AWS Organizations"></a>AWS Organizations</h2><p>If you have created an organization in AWS Organizations, you <code>can</code> also <code>create a trail</code> that will <code>log all events for all AWS accounts in that organization</code>. This is referred to as an organization trail.</p><p>Offers <code>policy-based</code> management for multiple AWS accounts. With Organizations, you can create groups of accounts, automate account creation, and apply and manage policies for those groups. Organizations enable you to centrally manage policies across multiple accounts without requiring custom scripts and manual processes. It allows you to create Service Control Policies (SCPs) that centrally control AWS service use across multiple AWS accounts.</p><ul><li>Global service.</li><li>Allows to manage multiple AWS accounts.</li><li>The main account is the <code>management account</code>.</li><li>Other accounts are <code>member accounts</code>.</li><li>Member accounts can only be part of one organization.</li><li>Consolidated Billing across all accounts - single payment method.</li><li>Pricing benefits from <code>aggregated usage</code> (volume discount for EC2, S3…).</li><li><code>Shared reserved instances and Savings Plans discounts across accounts</code>.</li><li>API is available to automate AWS account creation.</li></ul><h3 id="Advantages"><a href="#Advantages" class="headerlink" title="Advantages"></a>Advantages</h3><ul><li>Multi Account vs One Account Multi VPC.</li><li>Use tagging standards for billing purposes.</li><li>Enable CloudTrail on all accounts, send logs to central S3 account.</li><li>Send CloudWatch Logs to central logging account.</li><li>Establish Cross Account Roles for Admin purposes.</li></ul><h3 id="Security-Service-Control-Policies-SCP"><a href="#Security-Service-Control-Policies-SCP" class="headerlink" title="Security: Service Control Policies (SCP)"></a>Security: Service Control Policies (SCP)</h3><ul><li>IAM policies applied to OU or Accounts to restrict Users and Roles.</li><li>They do not apply to the management account (full admin power).</li><li>Must have an explicit allow (does not allow anything by default - like IAM).</li></ul><h3 id="AWS-Organizations-Reserved-Instances"><a href="#AWS-Organizations-Reserved-Instances" class="headerlink" title="AWS Organizations - Reserved Instances"></a>AWS Organizations - Reserved Instances</h3><ul><li>For billing purposes, the consolidated billing feature of AWS Organizations treats all the accounts in the organization as one account.</li><li>This means that <code>all accounts</code> in the organization can receive the hourly cost benefit of Reserved Instances that are purchased <code>by any other account</code>.</li><li><code>The payer account (master account) of an organization</code> can turn off Reserved Instance (RI) discount and Savings Plans discount sharing for any accounts in that organization, including the payer account</li><li>This means that RIs and Savings Plans discounts aren’t shared between any accounts that have sharing turned off.</li><li>To share an RI or Savings Plans discount with an account, <code>both accounts must have sharing turned on</code>.</li></ul><h3 id="AWS-Organizations-IAM-Policies"><a href="#AWS-Organizations-IAM-Policies" class="headerlink" title="AWS Organizations - IAM Policies"></a>AWS Organizations - IAM Policies</h3><p>Use <code>aws:PrincipalOrgID</code> condition key in your resource-based policies to restrict access to <a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-bucket-user-policy-specifying-principal-intro.html">IAM principals</a> from accounts in an AWS Organization&#96;&#96;</p><figure class="highlight json"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br></pre></td><td class="code"><pre><span class="line"><span class="punctuation">&#123;</span></span><br><span class="line">  <span class="attr">&quot;Version&quot;</span><span class="punctuation">:</span> <span class="string">&quot;2012-10-17&quot;</span><span class="punctuation">,</span></span><br><span class="line">  <span class="attr">&quot;Statement&quot;</span><span class="punctuation">:</span> <span class="punctuation">&#123;</span></span><br><span class="line">    <span class="attr">&quot;Sid&quot;</span><span class="punctuation">:</span> <span class="string">&quot;AllowGetObject&quot;</span><span class="punctuation">,</span></span><br><span class="line">    <span class="attr">&quot;Effect&quot;</span><span class="punctuation">:</span> <span class="string">&quot;Allow&quot;</span><span class="punctuation">,</span></span><br><span class="line">    <span class="attr">&quot;Principal&quot;</span><span class="punctuation">:</span> <span class="string">&quot;*&quot;</span><span class="punctuation">,</span></span><br><span class="line">    <span class="comment">// &quot;Principal&quot;:&#123;&quot;AWS&quot;:&quot;*&quot;&#125; // Equivalent to above statement</span></span><br><span class="line">    <span class="attr">&quot;Action&quot;</span><span class="punctuation">:</span> <span class="string">&quot;s3:GetObject&quot;</span><span class="punctuation">,</span></span><br><span class="line">    <span class="attr">&quot;Resource&quot;</span><span class="punctuation">:</span> <span class="string">&quot;arn:aws:s3:::policy-heneral-luna/*&quot;</span><span class="punctuation">,</span></span><br><span class="line">    <span class="attr">&quot;Condition&quot;</span><span class="punctuation">:</span> <span class="punctuation">&#123;</span></span><br><span class="line">      <span class="attr">&quot;StringEquals&quot;</span><span class="punctuation">:</span> <span class="punctuation">&#123;</span></span><br><span class="line">        <span class="attr">&quot;aws: PrincipalOrgID&quot;</span><span class="punctuation">:</span> <span class="punctuation">[</span><span class="string">&quot;o-xxxxxxxxxxx&quot;</span><span class="punctuation">]</span></span><br><span class="line">      <span class="punctuation">&#125;</span></span><br><span class="line">    <span class="punctuation">&#125;</span></span><br><span class="line">  <span class="punctuation">&#125;</span></span><br><span class="line"><span class="punctuation">&#125;</span></span><br></pre></td></tr></table></figure><h2 id="AWS-Organizations-Tag-Policies"><a href="#AWS-Organizations-Tag-Policies" class="headerlink" title="AWS Organizations - Tag Policies"></a>AWS Organizations - Tag Policies</h2><ul><li>Helps you standardize tags across resources in an AWS Organization</li><li>Ensure consistent tags, audit tagged resources, maintain proper resources categorization, …</li><li>You define tag keys and their allowed values</li><li>Helps with AWS Cost Allocation Tags and Attribute-based Access Control</li><li>Prevent any non-compliant tagging operations on specified services and resources (has no effect on resources without tags)</li><li>Generate a report that lists all tagged&#x2F;non-compliant resources</li><li>Use CloudWatch Events to monitor non-compliant tags</li></ul><hr><h2 id="AWS-Control-Tower-lt-AWS-Organizations-👀-EXAM"><a href="#AWS-Control-Tower-lt-AWS-Organizations-👀-EXAM" class="headerlink" title="AWS Control Tower - &lt;- AWS Organizations - 👀 EXAM"></a>AWS Control Tower - &lt;- AWS Organizations - 👀 EXAM</h2><pre><code>  Offers the easiest way to `set up` and `govern` a `secure, multi-account AWS environment`.</code></pre><p>Offers the easiest way to <code>set up and govern a secure, multi-account AWS environment</code>. It establishes a landing zone that is <code>based on the best-practices</code> blueprints and enables <code>governance</code> using <code>guardrails</code> you can choose from a pre-packaged list. The landing zone is a well-architected, multi-account baseline that follows AWS best practices. Guardrails implement governance rules for security, compliance, and operations.</p><ul><li>Benefits:<ul><li>Automate the set up of your environment in a few clicks</li><li>Automate ongoing policy management using guardrails</li><li>Detect policy violations and remediate them</li><li>Monitor compliance through an interactive dashboard</li></ul></li><li><code>AWS Control Tower runs on top of AWS Organizations</code>:<ul><li>It automatically sets up AWS Organizations to organize accounts and implement SCPs (Service Control Policies)</li></ul></li></ul><p>AWS Control Tower provides <code>three methods for creating member accounts</code>:</p><ul><li>Through the <code>Account Factory console</code> that is part of <code>AWS Service Catalog</code>.</li><li>Through the <code>Enroll account feature</code> within AWS <code>Control Tower</code>.</li><li>From your AWS <code>Control Tower landing zone’s management account</code>, using <code>Lambda</code> code and <code>appropriate IAM roles</code>.</li></ul><h2 id="AWS-Control-Tower"><a href="#AWS-Control-Tower" class="headerlink" title="AWS Control Tower"></a>AWS Control Tower</h2><p>It <code>establishes a landing zone that</code> is based on the best-practices blueprints and enables governance using guardrails you can choose from a pre-packaged list. The landing zone is a well-architected, multi-account baseline that follows AWS best practices. Guardrails implement governance rules for security, compliance, and operations.</p><hr><h2 id="👀-AWS-Service-Catalog"><a href="#👀-AWS-Service-Catalog" class="headerlink" title="👀 AWS Service Catalog"></a>👀 AWS Service Catalog</h2><p>AWS Service Catalog allows <code>organizations to create and manage catalogs of IT services that are approved for use on AWS</code>. These IT services can include everything from virtual machine images, servers, software, and databases to complete multi-tier application architectures. AWS Service Catalog allows you to centrally manage deployed IT services and your applications, resources, and metadata. This helps you achieve <code>consistent governance</code> and <code>meet your compliance requirements</code> while enabling users to quickly deploy only the approved IT services they need.</p><h4 id="Sharing-and-Importing-Portfolios-👀-EXAM"><a href="#Sharing-and-Importing-Portfolios-👀-EXAM" class="headerlink" title="Sharing and Importing Portfolios - 👀 EXAM"></a><a href="https://docs.aws.amazon.com/servicecatalog/latest/adminguide/catalogs_portfolios_sharing.html">Sharing and Importing Portfolios</a> - 👀 EXAM</h4><p>To make your <code>Service Catalog</code> products available to users who are not in your AWS accounts, such as users who belong to other organizations or to other AWS accounts in your organization, you share your portfolios with them. You can share in several ways, including <code>account-to-account</code> sharing, <code>organizational</code> sharing, and <code>deploying catalogs using stack sets</code>.</p><p>Before you share your products and portfolios to other accounts, you must decide whether you want to share a reference of the catalog or to deploy a copy of the catalog into each recipient account. Note that if you deploy a copy, you must redeploy if there are updates you want to propagate to the recipient accounts.</p><ul><li>Users that are new to AWS have too many options, and may create stacks that are not compliant &#x2F; in line with the rest of the organization</li><li>Some users just want a quick <code>self-service portal</code> to launch a set of <code>authorized products</code> pre-defined <code>by admins</code></li><li>Includes: virtual machines, databases, storage options, etc…</li></ul><h3 id="AWS-Service-Catalog-Sharing-Catalogs"><a href="#AWS-Service-Catalog-Sharing-Catalogs" class="headerlink" title="AWS Service Catalog - Sharing Catalogs"></a>AWS Service Catalog - Sharing Catalogs</h3><p><code>Share portfolios</code> with <code>individual AWS accounts or AWS Organizations</code>.</p><h3 id="AWS-Service-Catalog-TagOptions-Library-EXAM"><a href="#AWS-Service-Catalog-TagOptions-Library-EXAM" class="headerlink" title="AWS Service Catalog - TagOptions Library - EXAM"></a>AWS Service Catalog - TagOptions Library - EXAM</h3><ul><li>Easily manage tags on provisioned products</li><li><code>TagOption</code>:<ul><li>Key-value pair managed in AWS Service Catalog</li><li>Used to create an AWS Tag</li></ul></li><li>Can be associated with Portfolios and Products.</li><li>Use cases: <code>proper resources tagging</code>, <code>defined allowed</code> tags, …</li><li>Can be shared with other AWS accounts and AWS Organizations.</li><li>A consistent <code>taxonomy</code> - 👀 EXAM</li></ul><hr><h2 id="Cost-Explorer-👀-EXAM-OJO"><a href="#Cost-Explorer-👀-EXAM-OJO" class="headerlink" title="Cost Explorer - 👀 EXAM - OJO"></a>Cost Explorer - 👀 EXAM - OJO</h2><ul><li>Visualize, understand, and manage your AWS costs and usage over time</li><li>Create custom reports that analyze cost and usage data.</li><li>Analyze your data at a high level: total costs and usage across all accounts</li><li>Or Monthly, hourly, resource level granularity</li><li>Choose an optimal <code>Savings Plan</code> (to lower prices on your bill)</li><li><code>Forecast usage up to 12 months based on previous usage</code></li></ul><h2 id="👀-Collect-information-about-the-service-costs-of-each-developer"><a href="#👀-Collect-information-about-the-service-costs-of-each-developer" class="headerlink" title="👀 Collect information about the service costs of each developer"></a><code>👀</code> Collect information about the service costs of each developer</h2><ul><li><p>The AWS-generated <em>tag</em> <code>createdBy</code> defines and applies to supported AWS resources for cost allocation purposes. To use the AWS-generated tags, a management account owner must activate it in the Billing and Cost Management console. When a management account owner activates the tag, it is also activated for all member accounts.</p></li><li><p><code>Cost Explorer</code> is a tool that enables you to view and <code>analyze your costs and usage</code>. You can explore your usage and costs using the main graph, the Cost Explorer cost and usage reports, or the Cost Explorer RI reports.</p></li><li><p>AWS Cost Explorer provides the following prebuilt reports:</p><ul><li>EC2 <code>RI Utilization %</code> offers relevant data to identify and act on opportunities to increase your Reserved Instance usage efficiency. It’s calculated by dividing Reserved Instance used hours by total Reserved Instance purchased hours.</li><li>EC2 <code>RI Coverage %</code> shows how much of your overall instance usage is covered by Reserved Instances. This lets you make informed decisions about when to purchase or modify a Reserved Instance to ensure</li></ul></li></ul><hr><h2 id="AWS-Budgets"><a href="#AWS-Budgets" class="headerlink" title="AWS Budgets"></a>AWS Budgets</h2><ul><li><code>Create budget and send alarms when costs exceeds the budget</code>.</li><li>4 types of budgets: <code>Usage, Cost, Reservation, Savings Plans</code>.<ul><li>Usage e.g. to create a cost budget exclusively for <code>data transfer expenses</code></li></ul></li><li>For Reserved Instances (RI)<ul><li>Track utilization</li><li>Supports <code>EC2, ElastiCache, RDS, Redshift</code></li></ul></li><li>Up to 5 SNS notifications per budget</li><li>Can filter by: Service, Linked Account, Tag, Purchase Option, Instance Type, Region, Availability Zone, API Operation, etc…</li><li><code>Same options as AWS Cost Explorer!</code></li><li>2 budgets are free, then $0.02&#x2F;day&#x2F;budget</li></ul><h3 id="Cost-Allocation-Tags-EXAM"><a href="#Cost-Allocation-Tags-EXAM" class="headerlink" title="Cost Allocation Tags - EXAM"></a>Cost Allocation Tags - EXAM</h3><ul><li>Use <code>cost allocation tags</code> to track your AWS costs on a detailed level</li><li><code>AWS generated tags</code><ul><li>Automatically applied to the resource you create</li><li>Starts with Prefix <code>aws: (e.g. aws: createdBy)</code></li></ul></li><li><code>User-defined tags</code><ul><li>Defined by the user</li><li>Starts with Prefix <code>user:</code></li></ul></li></ul><h3 id="Cost-and-Usage-Reports-EXAM"><a href="#Cost-and-Usage-Reports-EXAM" class="headerlink" title="Cost and Usage Reports - EXAM"></a>Cost and Usage Reports - EXAM</h3><ul><li>Dive deeper into your AWS costs and usage</li><li>The AWS Cost &amp; Usage Report contains <code>the most comprehensive set of AWS cost and usage data available</code></li><li>Includes additional metadata about AWS services, pricing, and reservations (<code>e.g., Amazon EC2 Reserved Instances (RIs)</code>)</li><li>The AWS Cost &amp; Usage Report lists AWS usage for each:<ul><li>service category used by an account</li><li>in hourly or daily line items</li><li>any tags that you have activated for cost allocation purposes</li></ul></li><li><code>Can be configured for daily exports to S3</code></li><li>Can be integrated with Athena, Redshift or QuickSight</li></ul><h3 id="AWS-Compute-Optimizer-👀-EXAM-OJO-👀"><a href="#AWS-Compute-Optimizer-👀-EXAM-OJO-👀" class="headerlink" title="AWS Compute Optimizer - 👀 EXAM OJO - 👀"></a><a href="https://docs.aws.amazon.com/compute-optimizer/latest/ug/what-is-compute-optimizer.html">AWS Compute Optimizer</a> - 👀 EXAM OJO - 👀</h3><ul><li><code>Reduce costs and improve performance by</code> recommending optimal AWS resources for your workloads</li><li><code>Helps you choose optimal configurations and right-size your workloads (over/under provisioned)</code> - 👀 EXAM</li><li>Uses Machine Learning to analyze your <code>resources configurations and their utilization CloudWatch metrics</code></li><li>Supported resources<ul><li><code>EC2 instances</code></li><li>EC2 <code>Auto Scaling Groups</code></li><li><code>EBS</code> volumes</li><li><code>Lambda</code> functions</li></ul></li><li>Lower your costs by up to 25%</li><li>Recommendations can be exported to S3</li></ul><hr><h2 id="IAM"><a href="#IAM" class="headerlink" title="IAM"></a>IAM</h2><h3 id="If-an-IAM-user-with-full-access-to-IAM-and-Amazon-S3-assigns-a-bucket-policy-to-an-Amazon-S3-bucket-and-doesn’t-specify-the-AWS-account-root-user-as-a-principal-the-root-user-is-denied-access-to-that-bucket"><a href="#If-an-IAM-user-with-full-access-to-IAM-and-Amazon-S3-assigns-a-bucket-policy-to-an-Amazon-S3-bucket-and-doesn’t-specify-the-AWS-account-root-user-as-a-principal-the-root-user-is-denied-access-to-that-bucket" class="headerlink" title="If an IAM user, with full access to IAM and Amazon S3, assigns a bucket policy to an Amazon S3 bucket and doesn’t specify the AWS account root user as a principal, the root user is denied access to that bucket."></a>If an IAM user, with full access to IAM and Amazon S3, assigns a bucket policy to an Amazon S3 bucket and doesn’t specify the AWS account root user as a principal, the root user is denied access to that bucket.</h3><p>To fix this issue, the CTO needs to ensure that an IAM user with full access to both IAM and Amazon S3 explicitly includes the AWS account root user as a principal in the bucket policy of the S3 bucket. By adding the root user as a principal, access will be granted to the CTO and they will be able to access the S3 bucket in their AWS account.</p><h3 id="Reference-1"><a href="#Reference-1" class="headerlink" title="Reference:"></a>Reference:</h3><p><a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_iam-s3.html">https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_iam-s3.html</a></p><h3 id="IAM-Security-Tools"><a href="#IAM-Security-Tools" class="headerlink" title="IAM Security Tools"></a>IAM Security Tools</h3><ul><li><p><code>IAM Credentials Report (account-level)</code></p><ul><li>a report that lists all your account’s users and the status of their various credentials</li></ul></li><li><p><code>IAM Access Advisor (user-level)</code> - QUESTION</p><ul><li>Access advisor shows the service permissions granted to a user and when those services were last accessed.</li><li>You can use this in1formation to revise your policies.</li></ul></li></ul><h3 id="IAM-Access-Analyzer-👀-EXAM"><a href="#IAM-Access-Analyzer-👀-EXAM" class="headerlink" title="IAM Access Analyzer - 👀 EXAM"></a>IAM Access Analyzer - 👀 EXAM</h3><p>helps you <code>identify the resources in your organization and accounts</code>, such as <code>Amazon S3 buckets</code> or <code>IAM roles</code>, <code>shared with an external entity</code>. This lets you identify unintended access to your resources and data, which is a security risk. Access Analyzer identifies resources shared with external principals by using logic-based reasoning to analyze the resource-based policies in your AWS environment. For each instance of a resource shared outside of your account, Access Analyzer generates a finding.</p><ul><li><code>Find out which resources are shared externally</code> - 👀 EXAM<ul><li>S3 Buckets</li><li>IAM Roles</li><li>KMS Keys</li><li>Lambda Functions and Layers</li><li>SQS queues</li><li>Secrets Manager Secrets</li></ul></li><li>Define <code>Zone of Trust</code> &#x3D; AWS Account or AWS Organization</li><li>Access outside zone of trusts &#x3D;&gt; findings</li></ul><h3 id="IAM-Policy-Types"><a href="#IAM-Policy-Types" class="headerlink" title="IAM Policy Types"></a>IAM Policy Types</h3><p>You manage access in AWS by creating policies and attaching them to IAM identities (users, groups of users, or roles) or AWS resources. A policy is an object in AWS that, when associated with an identity or resource, defines their permissions. Resource-based policies are JSON policy documents that you attach to a resource such as an Amazon S3 bucket. These policies grant the specified principal permission to perform specific actions on that resource and define under what conditions this applies.</p><ul><li><code>Identity-based</code> policies are attached to an IAM user, group, or role. These policies let you specify what that identity can do (its permissions).</li><li><code>Resource-based</code> policies are attached to a resource. For example, you can attach resource-based policies to Amazon S3 buckets, Amazon SQS queues, and AWS Key Management Service encryption keys.</li><li><code>Identity-based</code> policies and <code>resource-based</code> policies are both permissions policies and are evaluated together. For a request to which only permissions policies apply, AWS first checks all policies for a Deny. If one exists, then the request is denied. Then AWS checks for each Allow. If at least one policy statement allows the action in the request, the request is allowed. It doesn’t matter whether the Allow is in the identity-based policy or the resource-based policy.</li></ul><p>References: <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_identity-vs-resource.html">Identity-based policies and resource-based policies</a> - 👀 EXAM</p><h4 id="Trust-policy"><a href="#Trust-policy" class="headerlink" title="Trust policy"></a>Trust policy</h4><p>Defines which principal entities (accounts, users, roles, and federated users) can assume the role. An IAM role is both an identity and a resource that supports resource-based policies. For this reason, you <code>must attach both a trust policy and an identity-based policy to an IAM role</code>. The <code>IAM service</code> <code>supports only one</code> type of <code>resource-based</code> policy called a <code>role trust policy</code>, which is attached to an IAM role.</p><p>References: <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_identity-vs-resource.html">Identity-based policies and resource-based policies</a></p><hr><h2 id="Identity-Federation"><a href="#Identity-Federation" class="headerlink" title="Identity Federation"></a>Identity Federation</h2><ul><li>Federation <code>lets users outside of AWS to assume temporary role for accessing AWS resources</code>.</li><li>These users assume identity provided access role.</li><li><code>Federation assumes a form of 3rd party authentication</code><ul><li>LDAP</li><li>Microsoft Active Directory (~&#x3D; SAML) - 👀 EXAM<br><img src="/../images/Microsoft-Active-Directory.png" alt="Microsoft Active Directory"></li><li>Single Sign On - 👀 EXAM</li><li>Open ID</li><li>Cognito - 👀 EXAM</li></ul></li><li><code>Using federation, you don’t need to create IAM users (user management is outside of AWS)</code>.</li></ul><h3 id="Custom-Identity-Broker-Application"><a href="#Custom-Identity-Broker-Application" class="headerlink" title="Custom Identity Broker Application"></a>Custom Identity Broker Application</h3><p><code>For Enterprises</code></p><ul><li>Use only if identity provider is <code>not compatible with SAML 2.0</code>.</li><li><code>The identity broker must determine the appropriate IAM policy</code>.</li></ul><hr><h2 id="AWS-DataSync"><a href="#AWS-DataSync" class="headerlink" title="AWS DataSync"></a>AWS DataSync</h2><ul><li><code>Move large amount of data</code> to and from<ul><li><code>On-premises</code> &#x2F; other cloud to AWS (NFS, SMB, HDFS, S3 API…) - needs agent</li><li><code>AWS to AWS</code> (different storage services) - no agent needed</li></ul></li><li>Can synchronize to:<ul><li>Amazon S3 (any storage classes - including Glacier)</li><li>Amazon EFS</li><li>Amazon FSx (Windows, Lustre, NetApp, OpenZFS…)</li></ul></li><li>Replication <code>tasks can be scheduled hourly, daily, weekly</code>.</li><li><code>File permissions and metadata are preserved (NFS POSIX, SMB...)</code>. - Exam</li><li>One agent task can use 10 Gbps, can setup a bandwidth limit</li></ul><p>Maybe for <code>large quantity of data</code> you can use <code>AWS Snowcone</code> with has the <code>DataSync agent pre-installed</code>.</p><hr><h2 id="AWS-STS-Security-Token-Service"><a href="#AWS-STS-Security-Token-Service" class="headerlink" title="AWS STS - Security Token Service"></a>AWS STS - Security Token Service</h2><ul><li><code>Allows to grant limited and temporary access to AWS resources.</code></li><li>Token is valid for up to one hour (must be refreshed)</li><li><code>AssumeRole</code><ul><li>Within your own account: for enhanced security</li><li>Cross Account Access: assume role in target account to perform actions there</li></ul></li><li><code>AssumeRoleWithSAML</code><ul><li>return credentials for users logged with SAML</li></ul></li><li><code>AssumeRoleWithWebIdentity</code><ul><li>return creds for users logged with an IdP (Facebook Login, Google Login, OIDC compatible…)</li><li>AWS recommends against using this, and using <code>Cognito</code> instead</li></ul></li><li><code>GetSessionToken</code><ul><li>for MFA, from a user or AWS account root user</li></ul></li></ul><hr><h2 id="Cognito-Identity-Pools-IAM-Roles"><a href="#Cognito-Identity-Pools-IAM-Roles" class="headerlink" title="Cognito Identity Pools - IAM Roles"></a>Cognito Identity Pools - IAM Roles</h2><ul><li><p>Default IAM roles for authenticated and guest users</p></li><li><p>Define rules to choose the role for each user based on the user’s ID</p></li><li><p>You can partition your users’ access using <code>policy variables</code>.</p></li><li><p>IAM credentials are obtained by Cognito Identity Pools through STS</p></li><li><p>The roles must have a “trust” policy of Cognito Identity Pools</p></li></ul><h3 id="Cognito-User-Pools-vs-Identity-Pools"><a href="#Cognito-User-Pools-vs-Identity-Pools" class="headerlink" title="Cognito User Pools vs Identity Pools"></a>Cognito User Pools vs Identity Pools</h3><ul><li><code>Cognito User Pools (for authentication = identity verification)</code>:<ul><li>Database of users for your web and mobile application</li><li>Allows to federate logins through Public Social, OIDC, SAML…</li><li>Can customize the hosted UI for authentication (including the logo)]</li><li>Has triggers with AWS Lambda during the authentication flow</li><li>Adapt the sign-in experience to different risk levels (MFA, etc…)</li></ul></li><li><code>Cognito Identity Pools (for authorization = access control)</code>:</li><li>Obtain AWS credentials for your users</li><li>Users can login through Public Social, OIDC, SAML &amp; Cognito User Pools</li><li>Users can be unauthenticated (guests)</li><li>Users are mapped to IAM roles &amp; policies, can leverage policy variables</li><li><code>CUP + CIP = manage user / password + access AWS services</code></li></ul><hr><h2 id="Amazon-Route-53"><a href="#Amazon-Route-53" class="headerlink" title="Amazon Route 53"></a>Amazon Route 53</h2><ul><li>A highly available, scalable, fully managed and Authoritative DNS<ul><li>Authoritative &#x3D; the customer (you) can update the DNS records</li></ul></li><li>Route 53 is also a Domain Registrar</li><li>Ability to check the health of your resources</li><li>The only AWS service which provides 100% availability SLA</li><li>Why Route 53? 53 is a reference to the traditional DNS port</li></ul><h3 id="Route-53-Records"><a href="#Route-53-Records" class="headerlink" title="Route 53 - Records"></a>Route 53 - Records</h3><ul><li>How you want to route traffic for a domain</li><li>Each record contains:<ul><li><code>Domain/subdomain Name</code> - e.g., example.com</li><li><code>Record Type</code> - e.g., A or AAAA</li><li><code>Value</code> - e.g., 12.34.56.78</li><li><code>Routing Policy</code> - how Route 53 responds to queries</li><li><code>TTL</code> - amount of time the record cached at DNS Resolvers</li></ul></li><li>Route 53 supports the following DNS record types:</li><li>(must know) A &#x2F; AAAA &#x2F; CNAME &#x2F; NS</li><li>(advanced) CAA &#x2F; DS &#x2F; MX &#x2F; NAPTR &#x2F; PTR &#x2F; SOA &#x2F; TXT &#x2F; SPF &#x2F; SRV</li></ul><h3 id="Route-53-Record-Types"><a href="#Route-53-Record-Types" class="headerlink" title="Route 53 - Record Types"></a>Route 53 - Record Types</h3><ul><li><code>A</code> - maps a hostname to IPv4</li><li><code>AAAA</code> - maps a hostname to IPv6</li><li><code>CNAME</code> - maps a hostname to another hostname<ul><li>The target is a domain name which must have an A or AAAA record</li><li>Can’t create a CNAME record for the top node of a DNS namespace (Zone Apex)</li><li>Example: you can’t create for example.com, but you can create for <a href="http://www.example.com/">www.example.com</a></li></ul></li><li><code>NS</code> - Name Servers for the Hosted Zone</li><li>Control how traffic is routed for a domain</li></ul><h3 id="Route-53-Hosted-Zones"><a href="#Route-53-Hosted-Zones" class="headerlink" title="Route 53 - Hosted Zones"></a>Route 53 - Hosted Zones</h3><ul><li>A container for records that define how to route traffic to a domain and its subdomains</li><li><strong><code>Public Hosted Zones</code></strong> - contains records that specify how to route traffic on the Internet (public domain names)<em>application1.mypublicdomain.com</em></li><li><strong><code>Private Hosted Zones</code></strong> - contain records that specify how you route traffic within one or more VPCs (private domain names)<em>application1.company.internal</em></li><li>You pay $0.50 per month per hosted zone</li></ul><h3 id="Route-53-Records-TTL-Time-To-Live"><a href="#Route-53-Records-TTL-Time-To-Live" class="headerlink" title="Route 53 - Records TTL (Time To Live)"></a>Route 53 - Records TTL (Time To Live)</h3><ul><li><code>High TTL - e.g., 24 hr</code><ul><li>Less traffic on Route 53</li><li>Possibly outdated records</li></ul></li><li><code>Low TTL - e.g., 60 sec.</code><ul><li>More traffic on Route 53 ($$)</li><li>Records are outdated for less time</li><li>Easy to change records</li></ul></li><li><code>Except for Alias records, TTL is mandatory for each DNS record</code></li></ul><h3 id="CNAME-vs-Alias"><a href="#CNAME-vs-Alias" class="headerlink" title="CNAME vs Alias"></a>CNAME vs Alias</h3><ul><li><p>AWS Resources (Load Balancer, CloudFront…) expose an AWS hostname:</p><ul><li><span style="color:blue">lb1-1234.us-east-2.elb.amazonaws.com</span> and you want <span style="color:blue">myapp.mydomain.com</span></li></ul></li><li><p>CNAME:</p><ul><li>Points a hostname to any other hostname. (app.mydomain.com &#x3D;&gt; blabla.anything.com)</li><li><u><strong>ONLY FOR NON ROOT DOMAIN (aka. something.mydomain.com)</strong></u></li></ul></li><li><p>Alias:</p><ul><li>Points a hostname to an AWS Resource (app.mydomain.com &#x3D;&gt; blabla.amazonaws.com)</li><li><u><strong>Works for ROOT DOMAIN and NON ROOT DOMAIN (aka mydomain.com)</strong></u></li><li>Free of charge.</li><li>Native health check.</li></ul></li></ul><h3 id="Route-53-Alias-Records"><a href="#Route-53-Alias-Records" class="headerlink" title="Route 53 - Alias Records"></a>Route 53 - Alias Records</h3><ul><li>Maps a hostname to an AWS resource</li><li>An extension to DNS functionality</li><li>Automatically recognizes changes in the resource’s IP addresses</li><li>Unlike CNAME, it can be used for the top node of a DNS namespace (Zone Apex), e.g.: example.com</li><li>Alias Record is always of type A&#x2F;AAAA for AWS resources (IPv4 &#x2F; IPv6)</li><li><code>You can’t set the TTL</code></li></ul><h2 id="Route-53-Alias-Records-Targets"><a href="#Route-53-Alias-Records-Targets" class="headerlink" title="Route 53 - Alias Records Targets"></a>Route 53 - Alias Records Targets</h2><p><strong>You cannot set an ALIAS record for an EC2 DNS name</strong> - 👀 EXAM</p><h2 id="Route-53-Routing-Policies"><a href="#Route-53-Routing-Policies" class="headerlink" title="Route 53 - Routing Policies"></a>Route 53 - Routing Policies</h2><ul><li>Define how Route 53 responds to DNS queries</li><li>Don’t get confused by the word “Routing”<ul><li>It’s not the same as Load balancer routing which routes the traffic</li><li>DNS does not route any traffic, it only responds to the DNS queries</li></ul></li><li>Route 53 Supports the following Routing Policies<ul><li>Simple</li><li>Weighted</li><li>Failover</li><li>Latency based</li><li>Geolocation</li><li>Multi-Value Answer</li><li>Geoproximity (using Route 53 Traffic Flow feature)</li></ul></li></ul><h3 id="Types-of-health-checks-👀-EXAM"><a href="#Types-of-health-checks-👀-EXAM" class="headerlink" title="Types of health checks - 👀 EXAM"></a>Types of health checks - 👀 EXAM</h3><ol><li><code>Health checks that monitor an endpoint</code> - You can configure a health check that monitors an endpoint that you specify either by IP address or by domain name. At regular intervals that you specify, Route 53 submits automated requests over the internet to your application, server, or other resources to verify that it’s reachable, available, and functional. Optionally, you can configure the health check to make requests similar to those that your users make, such as requesting a web page from a specific URL.</li><li><code>Health checks that monitor other health checks</code> (calculated health checks) - You can create a health check that monitors whether Route 53 considers other health checks healthy or unhealthy. One situation where this might be useful is when you have multiple resources that perform the same function, such as multiple web servers, and your chief concern is whether some minimum number of your resources are healthy. You can create a  health check for each resource without configuring notifications for those health checks. Then you can create a health check that monitors the status of the other health checks, and that notifies you only when the number of available web resources drops below a specified threshold.</li><li><code>Health checks that monitor CloudWatch alarms</code> - You can create CloudWatch alarms that monitor the status of CloudWatch metrics, such as the number of throttled read events for an Amazon DynamoDB database or the number of Elastic Load Balancing hosts that are considered healthy. After you create an alarm, you can create a health check that monitors the same data stream that CloudWatch monitors for the alarm.</li></ol><h3 id="“Evaluate-Target-Health”-👀-EXAM"><a href="#“Evaluate-Target-Health”-👀-EXAM" class="headerlink" title="“Evaluate Target Health” - 👀 EXAM"></a>“Evaluate Target Health” - 👀 EXAM</h3><p>You need to set the <code>Evaluate Target Health</code> flag to <code>true</code> on Route 53. This way, Route 53 will check both ALB entry to ensure that your ALBs are responding.</p><h3 id="Routing-Policies-Weighted"><a href="#Routing-Policies-Weighted" class="headerlink" title="Routing Policies - Weighted"></a>Routing Policies - Weighted</h3><ul><li>Control the % of the requests that go to each specific resource</li><li>Assign each record a relative weight:<ul><li>traffic (%) &#x3D; weight for a specific record &#x2F;sum of all weight records</li><li>Weights don’t need to sum up to 100</li></ul></li><li>DNS records must have the same name and type</li><li><code>Can be associated with Health Checks</code>.</li><li><code>Use cases: load balancing between regions, testing new application versions</code>…</li><li><code>Assign a weight of 0 to a record to stop sending traffic to a resource</code>.</li><li><code>If all records have weight of 0, then all records will be returned equally</code>.</li></ul><h3 id="Routing-Policies-Latency-based"><a href="#Routing-Policies-Latency-based" class="headerlink" title="Routing Policies - Latency-based"></a>Routing Policies - Latency-based</h3><ul><li>Redirect to the resource that has the least latency close to us</li><li>Super helpful when latency for users is a priority</li><li>Latency is based on traffic between users and AWS Regions</li><li>Germany users may be directed to the US (if that’s the lowest latency)</li><li>Can be associated with Health Checks (has a failover capability)</li></ul><h3 id="Route-53-Health-Checks"><a href="#Route-53-Health-Checks" class="headerlink" title="Route 53 - Health Checks"></a>Route 53 - Health Checks</h3><ul><li><p>HTTP Health Checks are only for <code>public resources</code></p></li><li><p>Health Check &#x3D;&gt; Automated DNS Failover:</p><ol><li>Health checks that monitor an endpoint (application, server, other AWS resource)</li><li>Health checks that monitor other health checks (Calculated Health Checks)</li><li>Health checks that monitor CloudWatch Alarms (full control !!) - e.g., throttles of DynamoDB, alarms on RDS, custom metrics,… (helpful for private resources)</li></ol></li><li><p>Health Checks are integrated with CW metrics</p></li></ul><h3 id="Health-Checks-Private-Hosted-Zones"><a href="#Health-Checks-Private-Hosted-Zones" class="headerlink" title="Health Checks - Private Hosted Zones"></a>Health Checks - Private Hosted Zones</h3><ul><li>Route 53 health checkers are outside the VPC.</li><li>They <code>can’t access private</code> endpoints (private VPC or on-premises resource)</li><li>You can create a <code>CloudWatch Metric</code> and associate a <code>CloudWatch Alarm</code>, then create a Health Check that checks the alarm itself.</li></ul><h3 id="Routing-Policies-Geolocation"><a href="#Routing-Policies-Geolocation" class="headerlink" title="Routing Policies - Geolocation"></a>Routing Policies - Geolocation</h3><ul><li>Different from Latency-based!</li><li>This routing is <code>based on user location</code></li><li>Specify location by Continent, Country or by US State (if there’s overlapping, most precise location selected)</li><li>Should create a “<code>Default”</code> record (in case there’s no match on location)</li><li>Use cases: website localization, restrict content distribution, load balancing, …</li><li>Can be associated with Health Checks</li></ul><h3 id="Routing-Policies-Geoproximity"><a href="#Routing-Policies-Geoproximity" class="headerlink" title="Routing Policies - Geoproximity"></a>Routing Policies - Geoproximity</h3><ul><li><p>Route traffic to your resources based on the geographic location of users and resources</p></li><li><p>Ability <code>to shift more traffic to resources based</code> on the defined <code>bias</code></p></li><li><p>To change the size of the geographic region, specify <code>bias</code> values:</p><ul><li>To expand (1 to 99) - more traffic to the resource</li><li>To shrink (-1 to -99) - less traffic to the resource</li></ul></li><li><p>Resources can be:</p><ul><li>AWS resources (specify AWS region)</li><li>Non-AWS resources (specify Latitude and Longitude)</li></ul></li><li><p>You must use Route 53 <code>Traffic Flow</code> to use this feature</p></li></ul><h3 id="Route-53-Traffic-flow"><a href="#Route-53-Traffic-flow" class="headerlink" title="Route 53 - Traffic flow"></a>Route 53 - Traffic flow</h3><ul><li>Simplify the process of creating and maintaining records in large and complex configurations</li><li>Visual editor to manage complex routing decision trees</li><li>Configurations can be saved as <code>Traffic Flow Policy</code><ul><li>Can be applied to different Route 53 Hosted Zones (different domain names)</li><li>Supports versioning</li></ul></li></ul><h3 id="Route-53-Hybrid-DNS-👀-EXAM"><a href="#Route-53-Hybrid-DNS-👀-EXAM" class="headerlink" title="Route 53 - Hybrid DNS - 👀 EXAM"></a>Route 53 - Hybrid DNS - 👀 EXAM</h3><ul><li>By default, Route 53 Resolver automatically answers DNS queries for:<ul><li>Local domain names for EC2 instances</li><li>Records in Private Hosted Zones</li><li>Records in public Name Servers</li></ul></li><li><code>Hybrid DNS</code> - resolving DNS queries between VPC (Route 53 Resolver) and your networks (other DNS Resolvers)</li><li>Networks can be:<ul><li>VPC itself &#x2F; Peered VPC</li><li>On-premises Network (connected through Direct Connect or AWS VPN)</li></ul></li></ul><h3 id="Route-53-Resolver-Endpoints-QUESTION"><a href="#Route-53-Resolver-Endpoints-QUESTION" class="headerlink" title="Route 53 - Resolver Endpoints - QUESTION"></a>Route 53 - Resolver Endpoints - QUESTION</h3><ul><li><p><code>Inbound Endpoint</code></p><ul><li>DNS Resolvers on your network can forward DNS queries to Route 53 Resolver</li><li>Allows your DNS Resolvers to resolve domain names for AWS resources (e.g., EC2 instances) and records in Route 53 Private Hosted Zones</li></ul></li><li><p><code>Outbound Endpoint</code></p><ul><li>Route 53 Resolver conditionally forwards DNS queries to your DNS Resolvers</li><li>Use <code>Resolver</code> Rules to forward DNS queries to your DNS Resolvers</li></ul></li><li><p>Associated with one or more VPCs in the same AWS Region</p></li><li><p>Create in two AZs for high availability</p></li><li><p>Each Endpoint supports 10,000 queries per second per IP address</p></li></ul><h3 id="Route-53-Resolver-Rules"><a href="#Route-53-Resolver-Rules" class="headerlink" title="Route 53 - Resolver Rules"></a>Route 53 - Resolver Rules</h3><ul><li>Control which DNS queries are forwarded to DNS Resolvers on your network</li><li><code>Conditional Forwarding Rules (Forwarding Rules)</code><ul><li>Forward DNS queries for a specified domain and all its subdomains <code>to target IP addresses</code></li></ul></li><li><code>System Rules</code><ul><li>Selectively overriding the behavior defined in Forwarding Rules (e.g., don’t forward DNS queries for a subdomain acme.example.com)</li></ul></li><li><code>Auto-defined System Rules</code><ul><li>Defines how DNS queries for selected domains are resolved (e.g., AWS internal domain names, Privated Hosted Zones)</li></ul></li><li>If multiple rules matched, Route 53 Resolver chooses the most specific match</li><li><code>Resolver Rules can be shared across accounts using AWS RAM</code><ul><li>Manage them centrally in one account</li><li>Send DNS queries from multiple VPC to the target IP defined in the rule</li></ul></li></ul><hr><h2 id="ELB"><a href="#ELB" class="headerlink" title="ELB"></a>ELB</h2><h3 id="Elastic-Load-Balancing-and-AWS-X-Ray"><a href="#Elastic-Load-Balancing-and-AWS-X-Ray" class="headerlink" title="Elastic Load Balancing and AWS X-Ray"></a><a href="https://docs.aws.amazon.com/xray/latest/devguide/xray-services-elb.html">Elastic Load Balancing and AWS X-Ray</a></h3><p>Elastic Load Balancing application load balancers add a trace ID to incoming HTTP requests in a header named X-Amzn-Trace-Id.</p><pre><code>  X-Amzn-Trace-Id: Root=1-5759e988-bd862e3fe1be46a994272793</code></pre><p><code>Load balancers do not send data to X-Ray</code>, and do not appear as a node on your service map.</p><h3 id="ELB-access-logs"><a href="#ELB-access-logs" class="headerlink" title="ELB access logs"></a>ELB access logs</h3><p>ELB access logs is an optional feature of Elastic Load Balancing that is disabled by default. The access logs capture detailed information about requests sent to your load balancer. Each log contains information such as the time the request was received, the <code>client&#39;s IP address, latencies, request paths, and server responses</code>. You can use these access logs to analyze traffic patterns and troubleshoot issues. Each access log file is automatically encrypted using SSE-S3 before it is stored in your S3 bucket and decrypted when you access it. You do not need to take any action; the encryption and decryption is performed transparently</p><h4 id="VPC-Flow-Logs-only-captures-information-about-the-IP-traffic-going-to-and-from-network-interfaces-in-a-VPC-0JO"><a href="#VPC-Flow-Logs-only-captures-information-about-the-IP-traffic-going-to-and-from-network-interfaces-in-a-VPC-0JO" class="headerlink" title="VPC Flow Logs only captures information about the IP traffic going to and from network interfaces in a VPC - 0JO"></a><code>VPC Flow Logs</code> only captures information about the <code>IP traffic</code> going to and from network interfaces in a VPC - 0JO</h4><p>Reference: <a href="https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-access-logs.html">Access logs for your Application Load Balancer</a></p><h3 id="CloudTrail-logs"><a href="#CloudTrail-logs" class="headerlink" title="CloudTrail logs"></a>CloudTrail logs</h3><p><code>Elastic Load Balancing</code> is <code>integrated</code> with <code>AWS CloudTrail</code>, a service that provides a record of actions taken by a user, role, or an AWS service in Elastic Load Balancing. <code>CloudTrail captures</code> all <code>API calls for Elastic Load Balancing as events</code>. The calls captured include calls from the AWS Management Console and code calls to the Elastic Load Balancing API operations.</p><hr><h2 id="Amazon-Machine-Images-AMIs"><a href="#Amazon-Machine-Images-AMIs" class="headerlink" title="Amazon Machine Images (AMIs)"></a>Amazon Machine Images (AMIs)</h2><h3 id="Sharing"><a href="#Sharing" class="headerlink" title="Sharing"></a>Sharing</h3><p>The key points to consider before planning the expansion and sharing of Amazon Machine Images (AMIs) are:</p><ol><li>AMIs are regional resources and can be shared across Regions: AMIs are specific to a particular AWS Region. If you want to use an AMI in a different Region, you need to copy the AMI to that Region. Sharing an AMI across Regions requires creating a new copy in each desired Region.2&#x2F; You need to share any CMKs used to encrypt snapshots and any Amazon EBS snapshots that the AMI references: If the AMI references Amazon Elastic Block Store (EBS) snapshots, you must also share those snapshots. Additionally, if the snapshots are encrypted using customer-managed customer master keys (CMKs), you need to share the CMKs as well.</li></ol><ul><li><code>Application-consistent AMI</code>: Create the AMI by disabling the <code>No reboot</code> option.</li><li><code>Crash-consistent AMI</code>: If <code>No reboot</code> option is selected, the AMI will be crash-consistent (all the volumes are snapshotted at the same time), but not application-consistent (all the operating system buffers are not flushed to disk before the snapshots are created).</li></ul><hr><h2 id="EC2"><a href="#EC2" class="headerlink" title="EC2"></a>EC2</h2><h3 id="Errors"><a href="#Errors" class="headerlink" title="Errors"></a>Errors</h3><h4 id="Client-InternalError-Client-error-on-launch"><a href="#Client-InternalError-Client-error-on-launch" class="headerlink" title="Client.InternalError: Client error on launch"></a><code>Client.InternalError: Client error on launch</code></h4><ol><li>error is caused when an Auto Scaling group attempts to launch an instance that has an encrypted EBS volume, but the service-linked role does not have access to the customer-managed CMK used to encrypt it. Additional setup is required to allow the Auto Scaling group to launch instances.</li></ol><h3 id="Termination-Policy"><a href="#Termination-Policy" class="headerlink" title="Termination Policy"></a>Termination Policy</h3><ol><li>You <code>can&#39;t enable termination protection for Spot Instances</code>, a Spot Instance is terminated when the Spot price exceeds the amount you’re willing to pay for Spot Instances. However, you can prepare your application to handle Spot Instance interruptions.</li><li>To prevent instances that are part of an Auto Scaling group from terminating on scale in, use instance protection. The <code>DisableApiTermination</code> attribute does not prevent Amazon EC2 Auto Scaling from terminating an instance.</li></ol><h3 id="Spot-Instances-Interruptions"><a href="#Spot-Instances-Interruptions" class="headerlink" title="Spot Instances Interruptions"></a>Spot Instances Interruptions</h3><p>You can specify that Amazon EC2 should do one of the following when it interrupts a Spot Instance:</p><ol><li><code>Stop</code> the Spot Instance</li><li><code>Hibernate</code> the Spot Instance</li><li><code>Terminate</code> the Spot Instance</li></ol><p>The default is to <code>terminate</code> Spot Instances when they are interrupted.</p><h3 id="EXAM-Spot-Fleet-Config-Cost-Optimization"><a href="#EXAM-Spot-Fleet-Config-Cost-Optimization" class="headerlink" title="EXAM Spot Fleet Config Cost Optimization"></a><code>EXAM</code> <a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/how-spot-fleet-works.html">Spot Fleet Config Cost Optimization</a></h3><p>Using <code>lowestPrice</code> allocation <code>strategy</code> a Spot Fleet automatically deploys the lowest price combination of instance types and Availability Zones based on the current Spot price across the number of Spot pools specified. You can use this combination to avoid the most expensive Spot Instances.</p><p><u>Spot Fleets allow us to automatically request Spot Instances with the lowest price</u></p><p>You can specify one of the following allocation strategies:</p><ul><li>priceCapacityOptimized</li><li>capacityOptimized</li><li>diversified</li><li><code>lowestPrice</code></li><li><code>InstancePoolsToUseCount</code></li></ul><h3 id="QUESTION-Get-public-IP-address"><a href="#QUESTION-Get-public-IP-address" class="headerlink" title="QUESTION Get public IP address"></a><code>QUESTION</code> Get public IP address</h3><p>EC2 instances in AWS have <code>metadata</code> associated with them that can be accessed from within the instance. This metadata includes information about the instance, such as its IP address, instance type, security groups, and more.</p><p>Can make an HTTP GET request to a specific URL provided by the instance metadata service. The URL is <a href="http://169.254.169.254/latest/meta-data/public-ipv4">http://169.254.169.254/latest/meta-data/public-ipv4</a>.</p><h3 id="👀-EC2-Detailed-monitoring-👀"><a href="#👀-EC2-Detailed-monitoring-👀" class="headerlink" title="👀 EC2 Detailed monitoring 👀"></a>👀 EC2 Detailed monitoring 👀</h3><p><code>Metrics are the fundamental concept in CloudWatch</code>. A metric represents a time-ordered set of data points that are published to CloudWatch. Think of a metric as a variable to monitor, and the data points as representing the values of that variable over time.</p><p><code>By default, your instance is enabled for basic monitoring</code>. You can optionally enable detailed monitoring. After you enable <code>detailed monitoring</code>, the Amazon EC2 console displays monitoring graphs with a <code>1-minute period</code> for the instance. .In <code>Basic monitoring</code>, data is available automatically in <code>5-minute periods</code> at no charge</p><p>Reference: <a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-cloudwatch-new.html">Enable or turn off detailed monitoring for your instances</a></p><h3 id="👀-EC2-Launch-Troubleshooting-👀-EXAM"><a href="#👀-EC2-Launch-Troubleshooting-👀-EXAM" class="headerlink" title="👀 EC2 Launch Troubleshooting - 👀 EXAM"></a>👀 EC2 Launch Troubleshooting - 👀 EXAM</h3><p><code>InstanceLimitExceeded</code>: if you get this error, it means that you have reached your limit of <code>max number of vCPUs</code> per <code>region</code>.&#96;&#96;InsufficientInstanceCapacity<code>: if you get this error, it means</code>AWS does not have that enough On-Demand capacity&#96; in the particular AZ wherethe instance is launched.</p><p><code>Instance Terminates Immediately</code> <strong>(goes from pending to terminated)</strong> - 👀 EXAM</p><ol><li>You’ve reached your EBS volume limit.</li><li>An EBS snapshot is corrupt.</li><li>The root EBS volume is encrypted and you do not have permissions to access the KMS key for decryption.</li><li>The instance store-backed AMI that you used to launch the instance is missing a required part (an image.part.xx file).</li></ol><h3 id="👀-EC2-SSH-Troubleshooting-👀"><a href="#👀-EC2-SSH-Troubleshooting-👀" class="headerlink" title="👀 EC2 SSH Troubleshooting 👀"></a>👀 EC2 SSH Troubleshooting 👀</h3><ol><li>SG is not configured correctly</li><li>NACL is not configured correctly</li><li>Check the route table for the subnet (routes traffic destined outside VPC to IGW)</li><li>Instance doesn’t have a public IPv4</li><li>CPU load of the instance is high</li></ol><h3 id="EC2-Instances-Purchasing-Options"><a href="#EC2-Instances-Purchasing-Options" class="headerlink" title="EC2 Instances Purchasing Options"></a>EC2 Instances Purchasing Options</h3><ol><li><code>On-Demand</code> Instances - short workload, predictable pricing, pay by second</li><li><code>Reserved</code> (1 &amp; 3 years)</li><li><code>Reserved Instances</code> - long workloads</li><li><code>Convertible Reserved Instances</code> - long workloads with flexible instances</li><li><code>Savings Plans (1 &amp; 3 years)</code> -commitment to an amount of usage, long workload</li><li><code>Spot Instances</code> - short workloads, cheap, can lose instances (less reliable)</li><li><code>Dedicated Hosts</code> - book an entire physical server, control instance placement</li><li><code>Dedicated Instances</code> - no other customers will share your hardware</li><li><code>Capacity Reservations</code> - reserve capacity in a specific AZ for any duration</li></ol><h2 id="AWS-Storage-Gateway-1"><a href="#AWS-Storage-Gateway-1" class="headerlink" title="AWS Storage Gateway"></a>AWS Storage Gateway</h2><p>AWS Storage Gateway is a set of hybrid cloud storage services that provide on-premises access to virtually unlimited cloud storage.</p><p>AWS Storage Gateway <code>uses SSL/TLS</code> (Secure Socket Layers&#x2F;Transport Layer Security) <code>to encrypt data</code> that is transferred <code>between your gateway appliance and AWS storage</code>. By default, Storage Gateway uses Amazon S3-Managed Encryption Keys (SSE-S3) to server-side encrypt all data it stores in Amazon S3. You have an option to use the Storage Gateway API to configure your gateway to encrypt data stored in the cloud using server-side encryption with AWS Key Management Service (SSE-KMS) customer master keys (CMKs).</p><p>File, Volume and Tape Gateway data is stored in Amazon S3 buckets by AWS Storage Gateway. Tape Gateway supports backing data to Amazon S3 Glacier apart from the standard storage.</p><p>Encrypting a file share: For a file share, you can configure your gateway to encrypt your objects with AWS KMS-managed keys by using SSE-KMS.</p><p>Encrypting a volume: For cached and stored volumes, you can configure your gateway to encrypt volume data stored in the cloud with AWS KMS-managed keys by using the Storage Gateway API.</p><p>Encrypting a tape: For a virtual tape, you can configure your gateway to encrypt tape data stored in the cloud with AWS KMS-managed keys by using the Storage Gateway API.</p><h3 id="Tape-Gateway"><a href="#Tape-Gateway" class="headerlink" title="Tape Gateway"></a>Tape Gateway</h3><p>Tape Gateway enables you to replace using physical tapes on-premises with virtual tapes in AWS without changing existing backup workflows. Tape Gateway supports all leading backup applications and caches virtual tapes on-premises for low-latency data access. Tape Gateway encrypts data between the gateway and AWS for secure data transfer and compresses data and transitions virtual tapes between Amazon S3 and Amazon S3 Glacier, or Amazon S3 Glacier Deep Archive, to minimize storage costs.</p><h3 id="File-Gateway"><a href="#File-Gateway" class="headerlink" title="File Gateway"></a>File Gateway</h3><p>File Gateway provides a seamless way to connect to the cloud in order to store application data files and backup images as durable objects in Amazon S3 cloud storage. File Gateway offers <code>SMB or NFS-based</code> access to data in Amazon S3 with local caching.</p><h3 id="Volume-Gateway"><a href="#Volume-Gateway" class="headerlink" title="Volume Gateway"></a>Volume Gateway</h3><p>You can configure the AWS Storage Gateway service as a Volume Gateway to present <code>cloud-based iSCSI block</code> storage volumes to your <code>on-premises</code> applications. The Volume Gateway provides either a local cache or full volumes on-premises while also storing full copies of your volumes in the AWS cloud. Volume Gateway also provides Amazon EBS Snapshots of your data for backup, disaster recovery, and migration. It’s easy to get started with the Volume Gateway: Deploy it as a virtual machine or hardware appliance, give it local disk resources, connect it to your applications, and start using your hybrid cloud storage for block data.</p><p>Reference: <a href="https://aws.amazon.com/storagegateway/">AWS Storage Gateway</a></p><h3 id="👀-Storage-Optimized-Instances"><a href="#👀-Storage-Optimized-Instances" class="headerlink" title="👀 Storage Optimized Instances"></a>👀 Storage Optimized Instances</h3><p>Designed for workloads that require high, sequential read and write access to very large data sets on local storage.They are optimized to deliver tens of thousands of <code>low-latency</code>, <code>random I/O operations per second (IOPS)</code> to applications compared with EBS-backed EC2 instances.</p><hr><h2 id="Posts"><a href="#Posts" class="headerlink" title="Posts"></a>Posts</h2><ol><li><code>RDP traffic</code>: Port 3389, TCP protocol.</li></ol><h2 id="👀-AWS-Directory-Services"><a href="#👀-AWS-Directory-Services" class="headerlink" title="👀 AWS Directory Services"></a>👀 AWS Directory Services</h2><p>service that automatically <code>creates</code> an AWS <code>security group</code> in your VPC with network rules for traffic in and out of AWS managed domain controllers. The default inbound rules <code>allow traffic from any source (0.0.0.0/0) to ports required by Active Directory</code>. These rules do not introduce security vulnerabilities, as traffic to the domain controllers is limited to traffic from your VPC, other peered VPCs, or networks connected using AWS Direct Connect, AWS Transit Gateway or Virtual Private Network.</p><p><code>By default</code>, AWS Directory Services creates security groups that <em><code>allow unrestricted access</code></em>, which can be &#96;flagged as a security concern. To address this issue, you need to review the security group rules and make necessary adjustments to restrict access based on your specific requirements and security best practices.</p><p>Using <code>AWS Trusted Advisor</code> can provide additional insights into security best practices and potential misconfigurations, but it may not specifically highlight the security group issue related to AWS Directory Services.</p><h2 id="QUESTION-SAML-federation"><a href="#QUESTION-SAML-federation" class="headerlink" title="QUESTION SAML federation"></a><code>QUESTION</code> <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_saml.html">SAML federation</a></h2><ul><li><code>SAML federation between AWS and</code> the corporate <code>Active Directory and mapping Active Directory groups to IAM groups</code> is the recommended way to make access more secure and streamlined.</li></ul><h2 id="Enhanced-networking"><a href="#Enhanced-networking" class="headerlink" title="Enhanced networking"></a>Enhanced networking</h2><p><code>QUESTION</code> Consider using enhanced networking for the following scenarios of <code>network performance issues</code>:</p><ol><li>If your packets-per-second rate reaches its ceiling, consider moving to enhanced networking. If your rate reaches its ceiling, you’ve likely reached the upper thresholds of the virtual network interface driver.</li><li>If your throughput is near or exceeding 20K packets per second (PPS) on the VIF driver, it’s a best practice to use enhanced networking.</li></ol><p>All current generation instance types support enhanced networking, except for T2 instances.</p><h2 id="Cost-Allocation-Tags"><a href="#Cost-Allocation-Tags" class="headerlink" title="Cost Allocation Tags"></a>Cost Allocation Tags</h2><p>A tag is a label that you or AWS assigns to an AWS resource. Each tag consists of a key and a value. For each resource, each tag key must be unique, and each tag key can have only one value. You can use tags to organize your resources, and cost allocation tags to track your AWS costs on a detailed level. After you activate cost allocation tags, AWS uses the cost allocation tags to organize your resource costs on your cost allocation report, to make it easier for you to categorize and track your AWS costs.</p><h2 id="👀-QUESTION-AWS-Resource-Groups-Tag-Editor"><a href="#👀-QUESTION-AWS-Resource-Groups-Tag-Editor" class="headerlink" title="👀 QUESTION AWS Resource Groups Tag Editor"></a>👀 <code>QUESTION</code> <a href="https://docs.aws.amazon.com/ARG/latest/userguide/tag-editor.html">AWS Resource Groups Tag Editor</a></h2><p>With Resource Groups, you can create, maintain, and view a collection of resources that share common tags. Tag Editor manages <code>tags across services and AWS Regions</code>. Tag Editor can perform a global search and can edit a large number of tags at one time.</p><h2 id="OpsWorks"><a href="#OpsWorks" class="headerlink" title="OpsWorks"></a>OpsWorks</h2><p>AWS OpsWorks is a <code>configuration management service</code> that provides managed instances of <code>Chef</code> and <code>Puppet</code>.</p><h3 id="👀-Chef-Server"><a href="#👀-Chef-Server" class="headerlink" title="👀 Chef Server"></a>👀 Chef Server</h3><p>You can <code>add nodes</code> automatically to your Chef Server using the <code>unattended method</code>. The recommended method of unattended (or automatic) association of new nodes is to <code>configure</code> the <code>Chef Client Cookbook</code>.With this method, a script is used to run the opsworks-cm API associate-node command to associate a new node with your Chef server. Steps are found in the references.</p><h2 id="QUESTION-AWS-Service-Health-Dashboard"><a href="#QUESTION-AWS-Service-Health-Dashboard" class="headerlink" title="QUESTION AWS Service Health Dashboard"></a><code>QUESTION</code> AWS Service Health Dashboard</h2><p>Publishes the most up-to-the-minute information on the status and availability of all AWS services in tabular form for all Regions that AWS is present in. You can check on this page <a href="https://status.aws.amazon.com/">https://status.aws.amazon.com/</a> to get current status information.</p><h2 id="👀-Cost-Allocation-Tags-Account-Level"><a href="#👀-Cost-Allocation-Tags-Account-Level" class="headerlink" title="👀 Cost Allocation Tags - Account Level"></a>👀 Cost Allocation Tags - Account Level</h2><p>A tag is a label that you or AWS assigns to an AWS resource. Each tag consists of a key and a value. For each resource, each tag key must be unique, and each tag key can have only one value. You can use tags to organize your resources, and cost allocation tags to track your AWS costs on a detailed level. After you activate cost allocation tags, AWS uses the cost allocation tags to organize your resource costs on your cost allocation report, to make it easier for you to categorize and track your AWS costs.</p><h2 id="Protecting-data-using-encryption-QUESTION"><a href="#Protecting-data-using-encryption-QUESTION" class="headerlink" title="Protecting data using encryption - QUESTION"></a><a href="https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingEncryption.html">Protecting data using encryption</a> - QUESTION</h2><h3 id="SSE-S3-Server-Side-Encryption-with-Amazon-S3-Managed-Keys-SSE-S3"><a href="#SSE-S3-Server-Side-Encryption-with-Amazon-S3-Managed-Keys-SSE-S3" class="headerlink" title="SSE-S3 - Server-Side Encryption with Amazon S3-Managed Keys (SSE-S3)"></a>SSE-S3 - Server-Side Encryption with Amazon S3-Managed Keys (SSE-S3)</h3><p>Using SSE-S3 each object is encrypted with a unique key employing strong multi-factor encryption. As an additional safeguard, it encrypts the key itself with a master key that it regularly rotates. Amazon S3 server-side encryption uses one of the strongest block ciphers available, 256-bit Advanced Encryption Standard (AES-256), to encrypt your data.</p><h3 id="SSE-KMS"><a href="#SSE-KMS" class="headerlink" title="SSE-KMS"></a>SSE-KMS</h3><p>Similar to SSE-S3 and also <code>provides</code> you with an <code>audit trail</code> of when your key was used and by whom. Additionally, you have the <code>option</code> to <code>create</code> and <code>manage encryption keys yourself</code>.</p><h3 id="SSE-C"><a href="#SSE-C" class="headerlink" title="SSE-C"></a>SSE-C</h3><p><code>You manage the encryption keys</code> and <code>Amazon S3 manages the encryption</code> as it writes to disks and decryption when you access your objects.</p><h3 id="Client-Side-Encryption"><a href="#Client-Side-Encryption" class="headerlink" title="Client-Side Encryption"></a>Client-Side Encryption</h3><p>You can encrypt data client-side and upload the encrypted data to Amazon S3. In this case, you manage the encryption process, the encryption keys, and related tools.</p><h2 id="AWS-Elastic-Beanstalk"><a href="#AWS-Elastic-Beanstalk" class="headerlink" title="AWS Elastic Beanstalk"></a>AWS Elastic Beanstalk</h2><h3 id="deployment-policy-in-Elastic-Beanstalk"><a href="#deployment-policy-in-Elastic-Beanstalk" class="headerlink" title="deployment policy in Elastic Beanstalk:"></a>deployment policy in Elastic Beanstalk:</h3><ul><li><p><code>All at once</code>: Deploy the new version to all instances simultaneously. All instances in your environment are out of service for a short time while the deployment occurs.</p></li><li><p><code>Rolling</code>: Deploy the new version in batches. Each batch is taken out of service during the deployment phase, reducing your environment’s capacity by the number of instances in a batch.</p></li><li><p><code>Rolling with additional batch</code>: Deploy the new version in batches, but first launch a new batch of instances to ensure full capacity during the deployment process.</p></li><li><p><code>Immutable</code>: Deploy the new version to a fresh group of instances by performing an immutable update.</p></li></ul><p>With deployment policies such as ‘All at once’, AWS Elastic Beanstalk performs an in-place update when you update your application versions and your application can become unavailable to users for a short period of time. You can avoid this downtime by performing a blue&#x2F;green deployment, where you deploy the new version to a separate environment, and then swap CNAMEs (via Route 53) of the two environments to redirect traffic to the new version instantly. In case of any deployment issues, the rollback process is very quick via swapping the URLs for the two environments.</p><p>Reference: <a href="https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/using-features.deploy-existing-version.html">Deploying applications to Elastic Beanstalk environments</a></p><h2 id="Dedicated-Hosts-and-Dedicated-Instances"><a href="#Dedicated-Hosts-and-Dedicated-Instances" class="headerlink" title="Dedicated Hosts and Dedicated Instances"></a>Dedicated Hosts and Dedicated Instances</h2><h2 id="Dedicated-Instances"><a href="#Dedicated-Instances" class="headerlink" title="Dedicated Instances"></a><a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/dedicated-instance.html">Dedicated Instances</a></h2><p>Are Amazon EC2 instances that run in a virtual private cloud (VPC) on <code>hardware</code> that’s <code>dedicated</code> to a <code>single customer</code>. Dedicated Instances that belong to different AWS accounts are physically isolated at a hardware level, even if those accounts are linked to a single-payer account. <code>Note</code> that Dedicated Instances may share hardware with other instances from the same AWS account that are not Dedicated Instances.</p><h2 id="Dedicated-Host"><a href="#Dedicated-Host" class="headerlink" title="Dedicated Host"></a><a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/dedicated-hosts-overview.html">Dedicated Host</a></h2><p>Is a <code>physical server</code> with EC2 instance capacity fully dedicated to your use.</p><ul><li>Dedicated Hosts <code>allow</code> you to <code>use</code> your <code>existing software licenses</code> on EC2 instances. With a Dedicated Host, you have <code>visibility and control</code> over how <code>instances</code> are placed on the server.</li><li>Dedicated Hosts allow you to use your existing <code>per-socket</code>, <code>per-core</code>, or <code>per-VM software licenses</code>, including <code>Windows Server</code>, <code>Microsoft SQL Server</code>, <code>SUSE</code>, and <code>Linux Enterprise Server</code>.</li></ul><p>Reference: <a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/dedicated-hosts-overview.html#dedicated-hosts-dedicated-instances">Dedicated Hosts</a></p><h2 id="AWS-CloudHSM-Hardware-Security-Module"><a href="#AWS-CloudHSM-Hardware-Security-Module" class="headerlink" title="AWS CloudHSM (Hardware Security Module)"></a><a href="https://docs.aws.amazon.com/cloudhsm/latest/userguide/clusters.html">AWS CloudHSM (Hardware Security Module)</a></h2><p>CloudHSM provides <code>tamper-resistant hardware</code> that is <code>available</code> in <code>multiple Availability Zones</code> (AZs), ensuring <code>high availability</code> and <code>durability of the keys</code>.</p><p>AWS CloudHSM provides dedicated <code>hardware security</code> modules to store and <code>manage cryptographic KEYS securely</code>. It offers <code>FIPS 140-2 Level 3</code> validated HSMs, which are ideal for meeting compliance requirements. With CloudHSM, you have full control over the key lifecycle and can perform key operations within the HSM, ensuring strong security and compliance for your keys.</p><p>You can use stack sets to deploy your catalog to many accounts at the same time. If you want to share a reference (an imported version of your portfolio that stays in sync with the original), you can use account-to-account sharing or you can share using AWS Organizations.</p><h2 id="Amazon-EFS-Elastic-File-System"><a href="#Amazon-EFS-Elastic-File-System" class="headerlink" title="Amazon EFS - Elastic File System"></a>Amazon EFS - Elastic File System</h2><ul><li><p>Use cases: content management, web serving, data sharing, Wordpress</p></li><li><p>Uses NFSv4.1 protocol</p></li><li><p>Uses security group to control access to EFS</p></li><li><p><strong>Compatible with Linux based AMI (not Windows)</strong></p></li><li><p>Encryption at rest using KMS</p></li><li><p>POSIX file system (~Linux) that has a standard file API</p></li><li><p>File system scales automatically, pay-per-use, no capacity planning!</p></li></ul><h3 id="Creating-security-groups"><a href="#Creating-security-groups" class="headerlink" title="Creating security groups"></a><a href="https://docs.aws.amazon.com/efs/latest/ug/accessing-fs-create-security-groups.html">Creating security groups</a></h3><p>Regardless, to enable traffic between an EC2 instance and a mount target (and thus the file system), you must configure the following rules in these security groups:</p><ul><li>The <code>security groups</code> that you associate with a <code>mount target must allow inbound access</code> for the TCP protocol <code>on the NFS port from all EC2</code> instances on which you want to mount the file system.</li><li>Each EC2 instance that <code>mounts the file system must have a security group that allows outbound</code> access to the mount target <code>on the NFS port</code>.</li></ul><h3 id="EFS-vs-EBS"><a href="#EFS-vs-EBS" class="headerlink" title="EFS vs EBS"></a>EFS vs EBS</h3><h3 id="EFS-Access-Points"><a href="#EFS-Access-Points" class="headerlink" title="EFS - Access Points"></a>EFS - Access Points</h3><ul><li>Easily manage applications access to NFS environments</li><li>Enforce a POSIX user and group to use when accessing the file system</li><li>Restrict access to a directory within the file system and optionally specify a different root directory</li><li>Can restrict access from NFS clients using IAM policies</li></ul><h3 id="EFS-Operations"><a href="#EFS-Operations" class="headerlink" title="EFS - Operations"></a>EFS - Operations</h3><ul><li>Operations that can be done in place:<ul><li>Lifecycle Policy (enable IA or change IA settings)</li><li>Throughput Mode and Provisioned Throughput Numbers</li><li>EFS Access Points</li></ul></li><li>Operations that require a migration using DataSync (replicates all file attributes and metadata)<ul><li><code>Migration to encrypted EFS</code></li><li><code>Performance Mode (e.g. Max IO)</code></li></ul></li></ul><h3 id="Amazon-Data-Lifecycle-Manager-👀-EXAM"><a href="#Amazon-Data-Lifecycle-Manager-👀-EXAM" class="headerlink" title="Amazon Data Lifecycle Manager - 👀 EXAM"></a>Amazon Data Lifecycle Manager - <code>👀 EXAM</code></h3><ul><li>Automate the creation, retention, and deletion of EBS snapshots and EBS-backed AMIs.</li><li>Schedule backups, cross-account snapshot copies, delete outdated backups, …</li><li>Uses resource tags to identify the resources (EC2 instances, EBS volumes).</li><li>Can’t be used to manage snapshots&#x2F;AMIs created outside DLM.</li><li>Can’t be used to manage instance-store backed AMIs</li></ul><h3 id="EFS-Storage-Classes"><a href="#EFS-Storage-Classes" class="headerlink" title="EFS - Storage Classes"></a>EFS - Storage Classes</h3><p><strong><code>Storage Tiers (lifecycle management feature - move file after N days)</code></strong></p><ul><li>Standard: for frequently accessed files</li><li>Infrequent access (EFS-IA): cost to retrieve files, lower price to store. Enable EFS-IA with a Lifecycle Policy</li></ul><p><strong><code>Availability and durability</code></strong></p><ul><li><p>Standard: Multi-AZ, great for prod</p></li><li><p>One Zone: One AZ, great for dev, backup enabled by default, compatible with IA (EFS One Zone-IA)</p></li><li><p>Over 90% in cost savings</p></li></ul><h3 id="EFS-CloudWatch-Metrics"><a href="#EFS-CloudWatch-Metrics" class="headerlink" title="EFS - CloudWatch Metrics"></a>EFS - CloudWatch Metrics</h3><p><strong><code>PercentIOLimit</code></strong></p><ul><li>How close the file system reaching the I&#x2F;O limit (General Purpose)</li><li>If at 100%, move to Max I&#x2F;O (migration) - <code>👀 EXAM</code></li></ul><p><strong><code>BurstCreditBalance</code></strong></p><ul><li>The number of burst credits the file system can use to achieve higher throughput levels</li></ul><p><strong><code>StorageBytes</code></strong></p><ul><li>File system’s size in bytes (15 minutes interval)</li><li>Dimensions: Standard, IA, Total (Standard + IA)</li></ul><h3 id="Enforce-creation-that-is-encrypted-at-rest"><a href="#Enforce-creation-that-is-encrypted-at-rest" class="headerlink" title="Enforce creation that is encrypted at rest"></a><a href="https://docs.aws.amazon.com/efs/latest/ug/encryption-at-rest.html">Enforce creation that is encrypted at rest</a></h3><ul><li>Use the <code>elasticfilesystem:Encrypted</code> IAM condition key in AWS IAM identity-based policies to mandate users for creating only encrypted-at-rest Amazon EFS file systems</li></ul><p>You can create an AWS Identity and Access Management (IAM) identity-based policy to control whether users can create Amazon EFS file systems that are encrypted at rest. The Boolean condition key elasticfilesystem:Encrypted specifies the type of file system, encrypted or unencrypted, that the policy applies to. You use the condition key with the elasticfilesystem:CreateFileSystem action and the policy effect, allow or deny, to create a policy for creating encrypted or unencrypted file systems.</p><ul><li>Define <code>Service Control Policies (SCPs)</code> inside <code>AWS Organizations</code> to enforce EFS encryption for all AWS accounts in your organization.</li></ul><p>Service control policies (SCPs) are a type of organization policy that you can use to manage permissions in your organization. SCPs offer central control over the maximum available permissions for all accounts in your organization.</p><p>An SCP restricts permissions for IAM users and roles in member accounts, including the member account’s root user. If a user or role has an IAM permission policy that grants access to an action that is either not allowed or explicitly denied by the applicable SCPs, the user or role can’t perform that action. You can also define service control policies (SCPs) inside AWS Organizations to enforce EFS encryption for all AWS accounts in your organization.</p><h3 id="EC2-instances-are-unable-to-mount-the-file-system"><a href="#EC2-instances-are-unable-to-mount-the-file-system" class="headerlink" title="EC2 instances are unable to mount the file system."></a>EC2 instances are unable to mount the file system.</h3><p>The <code>security groups</code> that you associate with a mount target must allow inbound access for the <code>TCP protocol</code> on the <code>NFS port</code> <code>from</code> the <code>security group</code> used by the instances.To connect your Amazon EFS file system to your Amazon EC2 instance, you <code>must create two security groups</code>: <code>one</code> for your Amazon <code>EC2 instance</code> and <code>another</code> for your Amazon <code>EFS mount target</code>.</p><p>Reference: <a href="https://docs.aws.amazon.com/efs/latest/ug/accessing-fs-create-security-groups.html">Creating security groups</a></p><h3 id="Mounting-EFS-file-systems"><a href="#Mounting-EFS-file-systems" class="headerlink" title="Mounting EFS file systems"></a><a href="https://docs.aws.amazon.com/efs/latest/ug/mounting-fs.html">Mounting EFS file systems</a></h3><ul><li>Mounting on supported EC2 instances.</li><li>Mounting with IAM authorization.</li><li>Mounting with Amazon EFS access points.</li><li>Mounting with an on-premise Linux client.</li><li>Auto-mounting EFS file systems when an EC2 instance reboots.</li><li>Mounting a file system when creating a new EC2 instance.</li></ul><hr><hr><h2 id="AWS-X-Ray"><a href="#AWS-X-Ray" class="headerlink" title="AWS X-Ray"></a>AWS X-Ray</h2><ul><li>Debugging in Production, the good old way:<ul><li>Test locally</li><li>Add log statements everywhere</li><li>Re-deploy in production</li></ul></li><li>Log formats differ across applications and log analysis is hard.</li><li>Debugging: one big monolith “easy”, distributed services “hard”</li><li>No common views of your entire architecture</li></ul><ol><li><code>S3</code> - AWS X-Ray integrates with Amazon S3 to trace upstream requests to update your application’s S3 buckets.</li><li><code>Lambda functions</code> - Lambda runs the X-Ray daemon and records a segment with details about the function invocation and execution.</li><li><code>API Gateway APIs</code> - You can use X-Ray to trace and analyze user requests as they travel through your Amazon API Gateway APIs to the underlying services.</li></ol><h3 id="AWS-X-Ray-advantages"><a href="#AWS-X-Ray-advantages" class="headerlink" title="AWS X-Ray advantages"></a>AWS X-Ray advantages</h3><ul><li>Troubleshooting performance (bottlenecks)</li><li>Understand dependencies in a microservice architecture</li><li>Pinpoint service issues</li><li>Review request behavior</li><li>Find errors and exceptions</li><li>Are we meeting time SLA?</li><li>Where I am throttled?</li><li>Identify users that are impacted</li></ul><hr><h2 id="DNS-Resolution"><a href="#DNS-Resolution" class="headerlink" title="DNS Resolution"></a>DNS Resolution</h2><p>DNS Resolution is used to enable resolution of public DNS hostnames to private IP addresses when queried from the <a href="https://docs.aws.amazon.com/vpc/latest/peering/what-is-vpc-peering.html">peered VPC</a>.</p><h2 id="👀-Traffic-Mirroring"><a href="#👀-Traffic-Mirroring" class="headerlink" title="👀 Traffic Mirroring"></a><code>👀</code> <a href="https://docs.aws.amazon.com/vpc/latest/mirroring/what-is-traffic-mirroring.html">Traffic Mirroring</a></h2><p><code>Traffic Mirroring provides</code> the ability to create a copy of a packet flow to examine the contents of a packet. This feature is useful for <code>threat monitoring</code>, <code>content inspection</code>, and <code>troubleshooting</code>.</p><p>A packet is truncated to the <code>MTU</code> value when both of the following are true:</p><ul><li>The traffic <code>mirror target is a standalone instance</code>.</li><li>The traffic <code>packet size from the mirror source is greater</code> than the MTU size for the traffic mirror <code>target</code>.</li></ul><hr><h2 id="👀-IMPORTANT-NOTES-👀"><a href="#👀-IMPORTANT-NOTES-👀" class="headerlink" title="👀 IMPORTANT NOTES 👀"></a>👀 IMPORTANT NOTES 👀</h2><h3 id="By-default-Amazon-EC2-and-Amazon-VPC-use-the-IPv4-addressing-protocol"><a href="#By-default-Amazon-EC2-and-Amazon-VPC-use-the-IPv4-addressing-protocol" class="headerlink" title="By default, Amazon EC2 and Amazon VPC use the IPv4 addressing protocol"></a>By default, Amazon EC2 and Amazon VPC use the IPv4 addressing protocol</h3><p>Amazon EC2 and Amazon VPC support both the IPv4 and IPv6 addressing protocols. By default, Amazon EC2 and Amazon VPC use the IPv4 addressing protocol; you can’t disable this behavior. When you create a VPC, you must specify an IPv4 CIDR block (a range of private IPv4 addresses). You can optionally assign an IPv6 CIDR block to your VPC and subnets, and assign IPv6 addresses from that block to instances in your subnet.</p><h2 id="Dynamo-DB"><a href="#Dynamo-DB" class="headerlink" title="Dynamo DB"></a>Dynamo DB</h2><h3 id="Cross-Account-access"><a href="#Cross-Account-access" class="headerlink" title="Cross Account access"></a><a href="https://docs.aws.amazon.com/glue/latest/dg/cross-account-access.html">Cross Account access</a></h3><p>When you export your DynamoDB tables from Account A to an S3 bucket in Account B, the objects are still owned by Account A. The AWS Identify Access Management (IAM) users in Account B can’t access the objects by default. The export function doesn’t write data with the access control list (ACL) bucket-owner-full-control. As a workaround to this object ownership issue, include the <code>PutObjectAcl</code> permission on all exported objects after the export is complete. This workaround grants access to all exported objects for the bucket owners in Account B.</p><h2 id="ClientConnections-Metric"><a href="#ClientConnections-Metric" class="headerlink" title="ClientConnections Metric"></a><code>ClientConnections</code> Metric</h2><p>To track the number of Amazon EC2 instances that are connected to a file system, you can monitor the Sum statistic of the ClientConnections metric. To calculate the average ClientConnections for periods greater than one minute, divide the sum by the number of minutes in the period.</p><h2 id="👀-AWS-Budgets"><a href="#👀-AWS-Budgets" class="headerlink" title="👀 AWS Budgets"></a>👀 AWS Budgets</h2><p>Give you the ability to <code>set custom budgets that alert you</code> when your costs or <code>usage exceed</code> (or are <code>forecasted</code> to exceed) your budgeted amount.</p><p>You can also use AWS Budgets to <code>set reservation utilization or coverage targets and receive alerts</code> when your utilization drops below the threshold you define. Reservation alerts are supported for <code>Amazon EC2, Amazon RDS, Amazon Redshift, Amazon ElastiCache, and Amazon Elasticsearch reservations</code>.</p><h2 id="👀-AWS-Cost"><a href="#👀-AWS-Cost" class="headerlink" title="👀 AWS Cost"></a>👀 AWS Cost</h2><p>In <code>AWS Cost</code> and <code>Usage Reports</code>, you can choose to have AWS <code>publish billing reports</code> to an <code>Amazon Simple Storage</code> Service (Amazon S3) bucket that you own. You can receive reports that break down your costs by the hour or month, by product or product resource, or by tags that you define yourself. AWS updates the report in your bucket once a day in a comma-separated value (CSV) format. You can view the reports using spreadsheet software such as Microsoft Excel or Apache OpenOffice Calc or access them from an application using the Amazon S3 API.</p><h2 id="AWS-Database-Migration-Service-DMS"><a href="#AWS-Database-Migration-Service-DMS" class="headerlink" title="AWS Database Migration Service (DMS)"></a>AWS Database Migration Service (DMS)</h2><h2 id="Amazon-Macie"><a href="#Amazon-Macie" class="headerlink" title="Amazon Macie"></a>Amazon Macie</h2><p>is a fully managed data security and data privacy service that uses <code>machine learning</code> and pattern matching to help you discover, monitor, and protect sensitive data in your AWS environment. Macie automates the discovery of sensitive data, such as <code>personally identifiable information (PII)</code> and financial data, to provide you with a better understanding of the data that your organization stores in Amazon S3.Amazon Macie <code>only supports S3 as a data source</code>.</p><h2 id="👀-Run-Command"><a href="#👀-Run-Command" class="headerlink" title="👀 Run Command"></a>👀 Run Command</h2><h2 id="👀-EC2Rescue"><a href="#👀-EC2Rescue" class="headerlink" title="👀 EC2Rescue"></a><code>👀</code> <a href="https://docs.aws.amazon.com/systems-manager/latest/userguide/automation-ec2rescue.html">EC2Rescue</a></h2><p><code>EC2Rescue can help you diagnose and troubleshoot problems on Amazon EC2 Linux and Windows Server instances</code>.</p><p>You can <code>run</code> the tool manually, as described in Using EC2Rescue for Linux Server and Using EC2Rescue for Windows Server. Or, you can run the tool automatically by using <code>Systems Manager Automation</code> and the <code>AWSSupport-ExecuteEC2Rescue</code> document. The AWSSupport-ExecuteEC2Rescue document is designed to perform a combination of Systems Manager actions, AWS CloudFormation actions, and Lambda functions that automate the steps normally required to use EC2Rescue.</p><p>EC2Rescue for EC2 Windows is a convenient, straightforward, GUI-based troubleshooting tool that can be run on your Amazon EC2 Windows Server instances to <code>troubleshoot operating system-level issues and collect advanced logs</code> and configuration files for further analysis. EC2Rescue simplifies and expedites the troubleshooting of EC2 Windows instances.</p><h2 id="Service-Control-Policies"><a href="#Service-Control-Policies" class="headerlink" title="Service Control Policies"></a>Service Control Policies</h2><h3 id="Groups"><a href="#Groups" class="headerlink" title="Groups"></a>Groups</h3><p>Can be granted permissions using access control policies - Groups can be granted permissions using access control policies. This makes it easier to manage permissions for a collection of users, rather than having to manage permissions for each user.<a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_groups.html">https://docs.aws.amazon.com/IAM/latest/UserGuide/id_groups.html</a></p><hr><h2 id="Billing-Stuff"><a href="#Billing-Stuff" class="headerlink" title="Billing Stuff"></a>Billing Stuff</h2><p>Activate a <code>cost allocation</code> tag that is named Department in the <code>AWS Billing</code> and <code>Cost Management console in the Organizations management account</code>. Use a tag policy to mandate a Department tag on new resources.</p><p>Correct. You must activate a tag in the Billing and Cost Management console before viewing the expense by cost allocation tag. You should mandate the use of tags to ensure that the resources are tagged correctly.</p><p><a href="https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_tag-policies.html">https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_policies_tag-policies.html</a></p><h3 id="👀-Generate-Billing-Alerts"><a href="#👀-Generate-Billing-Alerts" class="headerlink" title="👀 Generate Billing Alerts"></a>👀 Generate Billing Alerts</h3><p><code>Before</code> you can <code>create an alarm for your estimated charges</code>, you <code>must enable billing alerts on your Accounts Preferences page first</code>, so that you can monitor your estimated AWS charges and create an alarm using billing metric data. After you enable billing alerts, you cannot disable data collection, but you can delete any billing alarms that you created.</p><hr><p>Use the <code>AWS Resource Groups</code> Tag Editor to identify resources that are not tagged in each account. Apply a tag that is named Department to any untagged resources.</p><p>With Resource Groups, you can create, maintain, and view a collection of resources that share common tags. Tag Editor manages tags across services and AWS Regions. Tag Editor can perform a global search and can edit a large number of tags at one time.</p><p>For more information about resource groups and tagging, see Tag Editor.</p><h2 id="👀-Billing-Preferences"><a href="#👀-Billing-Preferences" class="headerlink" title="👀 Billing Preferences"></a>👀 Billing Preferences</h2><p>The management account of an organization can change this setting by turning off <code>RI</code> (Reserved Instances) sharing for <code>an individual member account</code> the more suitable service is AWS WAF</p><h2 id="👀-AWS-Shield-Advanced"><a href="#👀-AWS-Shield-Advanced" class="headerlink" title="👀 AWS Shield Advanced"></a>👀 AWS Shield Advanced</h2><p>is more suitable to be used against <code>distributed denial of service (DDoS</code>) attacks but <code>NOT</code> for common web exploits such as <code>cross-site scripting</code>, <code>SQL injection</code>, and <code>brute-force HTTP flood attacks</code>.</p><h2 id="👀-A-placement-group"><a href="#👀-A-placement-group" class="headerlink" title="👀 A placement group"></a>👀 A placement group</h2><p>is a logical <code>grouping</code> of <code>instances</code> <code>within</code> a <code>single Availability Zone</code>. By placing the EC2 instances in a placement group, you can ensure that the instances are physically located close to each other, which can significantly <code>reduce network latency between them</code>. This can <code>improve the performance</code> of inter-instance communication and reduce the overall latency in data transfer.</p><p>Sometimes you want control over the EC2 Instance placement strategy, When you create a placement group, you specify one of the following strategies for the group:</p><ul><li><code>Cluster-clusters</code> instances into a <code>low-latency</code> group in a <code>single Availability Zone</code>.<ul><li><code>Pros</code>: Great network (10 Gbps bandwidth between instances with Enhanced Networking enabled - recommended)</li><li><code>Cons</code>: If the rack fails, all instances fails at the same time</li><li><code>Use</code> case: Big Data job that needs to complete fast</li></ul></li><li><code>Spread-spreads</code> instances across <code>underlying hardware</code> (max 7 instances per group per AZ) - critical applications<ul><li><code>Pros</code>:<ul><li>Can span across Availability Zones (AZ)</li><li>Reduced risk is simultaneous failure</li><li>EC2 Instances are on different  physical hardware</li></ul></li><li><code>Cons</code>:<ul><li>Limited to 7 instances per AZ per placement group</li></ul></li><li><code>Use case</code>:<ul><li>Application that needs to maximize high availability</li><li>Critical Applications where each instance must be isolated from failure from each other</li></ul></li></ul></li><li><code>Partition-spreads</code> <code>instances across many different partitions</code> (which rely on different sets of racks) within an AZ. Scales to 100s of EC2 instances per group (Hadoop, Cassandra, Kafka)<ul><li>Up to 7 partitions per AZ  Can span across multiple AZs in the same region</li><li>Up to 100s of EC2 instances</li><li>The instances in a partition do not share racks with the instances in the other partitions</li><li>A partition failure can affect many EC2 but won’t affect other partitions</li><li>EC2 instances get access to the partition information as metadata</li><li>Use cases: HDFS, HBase, Cassandra, Kafka</li></ul></li></ul><h2 id="👀-Access-Analyzer"><a href="#👀-Access-Analyzer" class="headerlink" title="👀 Access Analyzer"></a>👀 Access Analyzer</h2><p>helps you identify the resources in your organization and accounts, such as Amazon S3 buckets or IAM roles, <code>shared with an external entity</code>. This lets you identify unintended access to your resources and data, which is a security risk. Access Analyzer <code>identifies resources shared</code> with <code>external principals</code> by using logic-based reasoning to analyze the resource-based policies in your AWS environment. For each instance of a resource shared outside of your account, Access Analyzer generates a finding.</p><h2 id="AWS-System-Manager"><a href="#AWS-System-Manager" class="headerlink" title="AWS System Manager"></a>AWS System Manager</h2><p>👀 AWS Systems Manager provides a unified, centralized way to manage both your Amazon EC2 instances and on-premises servers (including <code>Raspbian</code> systems, devices such as <code>Raspberry Pi</code> through a single interface). It offers a wide range of capabilities, including <code>inventory management</code>, <code>patch management</code>, <code>automation</code>, and <code>configuration management</code>, allowing you to efficiently manage your hybrid infrastructure from a single console. With Systems Manager, you can maintain consistent configurations, apply patches, and automate administrative tasks for your on-premises servers, just like you would for your EC2 instances.</p><ul><li>Helps you manage your <strong>EC2</strong> and <strong>On-Premises</strong> systems at scale.</li><li>Get operational insights about the state of your infrastructure.</li><li>Easily detect problems.</li><li><strong>Patching automation for enhanced compliance</strong>.</li><li>Works for both Windows and Linux OS.</li><li><code>Integrated with CloudWatch metrics / dashboards</code>.</li><li><code>Integrated with AWS Config</code>.</li><li>Free service.</li></ul><h3 id="Main-Features-for-the-EXAM"><a href="#Main-Features-for-the-EXAM" class="headerlink" title="Main Features for the EXAM"></a>Main Features for the EXAM</h3><ul><li>Resource Groups</li><li>Shared ResourcesDocuments</li><li>Change Management<ul><li>Automation</li><li>Maintenance Windows</li></ul></li><li>Application Management<ul><li>Parameter Store</li></ul></li><li>Node Management<ul><li>Inventory</li><li>Session Manager</li><li>Run Command</li><li>State Manager</li><li>Patch Manager</li></ul></li><li><code>Create</code> custom <code>runbooks or use pre-defined runbooks maintained</code> by AWS.</li><li><code>Receive notifications</code> about Automation tasks and runbooks <code>by using Amazon EventBridge</code>.</li><li><code>Monitor Automation progress and details</code> by using the AWS <code>Systems Manager console</code>.</li></ul><h3 id="👀-Fleet-Manager"><a href="#👀-Fleet-Manager" class="headerlink" title="👀 Fleet Manager"></a>👀 <a href="https://docs.aws.amazon.com/systems-manager/latest/userguide/fleet.html">Fleet Manager</a></h3><p>Helps you remotely <code>manage</code> your <code>server fleet</code> that runs on <code>AWS</code> or on <code>premises</code>. With Fleet Manager, you can gather data from individual instances to perform common troubleshooting and management tasks from a single console. However, you cannot use Fleet Manager to upload a script to start or stop instances.</p><h3 id="Recover-impaired-instances"><a href="#Recover-impaired-instances" class="headerlink" title="Recover impaired instances"></a>Recover impaired instances</h3><p>A Systems Manager <code>Automation document</code> defines the <code>Automation workflow</code> (the actions that Systems Manager performs on your managed instances and AWS resources). Automation includes several pre-defined Automation documents that you can use to perform common tasks like restarting one or more EC2 instances or creating an Amazon Machine Image (AMI).</p><p>Use the <code>AWSSupport-ExecuteEC2Rescue</code> document to recover impaired instances.</p><h3 id="👀-AWS-Systems-Manager-Inventory"><a href="#👀-AWS-Systems-Manager-Inventory" class="headerlink" title="👀 AWS Systems Manager Inventory"></a>👀 AWS Systems Manager Inventory</h3><p>AWS Systems Manager Inventory provides visibility into your <code>Amazon EC2</code> and <em><code>on-premises</code></em> computing environment. You can use Inventory to <code>collect metadata</code> from your <code>managed instances</code>. You can store this metadata in a central Amazon Simple Storage Service (Amazon S3) bucket, and then use built-in tools to query the data and quickly determine which instances are running the software and configurations required by your software policy, and which instances need to be updated. You can configure Inventory on all of your managed instances by using a one-click procedure. You can also configure and view inventory data from multiple AWS Regions and AWS accounts.</p><p>If the pre-configured metadata types collected by Systems Manager Inventory don’t meet your needs, then you can create custom inventory. <code>Custom inventory</code> is simply a JSON file with information that you provide and add to the managed instance in a specific directory. When Systems Manager Inventory collects data, it captures this custom inventory data.</p><p>Systems Manager Inventory collects only metadata from your managed instances. Inventory doesn’t access proprietary information or data.</p><h3 id="AWS-Tags"><a href="#AWS-Tags" class="headerlink" title="AWS Tags"></a>AWS Tags</h3><ul><li>You can add text key-value pairs called Tags to many AWS resources</li><li>Commonly used in EC2</li><li>Free naming, common tags are Name, Environment, Team …</li><li>They’re used for<ul><li>Resource grouping</li><li>Automation</li><li>Cost allocation</li></ul></li></ul><h3 id="Resource-Groups"><a href="#Resource-Groups" class="headerlink" title="Resource Groups"></a>Resource Groups</h3><ul><li>Create, view or manage logical group of resources thanks to <strong>tags</strong>.</li><li>Allows creation of logical groups of resources such as<ul><li>Applications</li><li>Different layers of an application stack</li><li>Production versus development environments</li></ul></li><li>Regional service</li><li>Works with EC2, S3, DynamoDB, Lambda, etc…</li></ul><h3 id="SSM-Inventory"><a href="#SSM-Inventory" class="headerlink" title="SSM - Inventory"></a>SSM - Inventory</h3><ol><li>Collect metadata from your managed instances (EC2&#x2F;On-premises)</li><li>Metadata includes installed software, OS drivers, configurations, installed updates, running services …</li><li>View data in AWS Console or store in S3 and query and analyze using Athena and QuickSight</li><li>Specify metadata collection interval (minutes, hours, days)</li><li>Query data from multiple AWS accounts and regions</li><li>Create Custom Inventory for your custom metadata (e.g., rack location of each managed instance)</li></ol><h2 id="AWS-Systems-Manager-Distributor"><a href="#AWS-Systems-Manager-Distributor" class="headerlink" title="AWS Systems Manager - Distributor"></a>AWS Systems Manager - Distributor</h2><p>Allows you to securely distribute and install software packages, like your custom software’s .msi installer, across a large set of instances.</p><h3 id="AWS-Systems-Manager-State-Manager"><a href="#AWS-Systems-Manager-State-Manager" class="headerlink" title="AWS Systems Manager State Manager"></a>AWS Systems Manager State Manager</h3><h2 id="Uses-associations-to-enforce-a-desired-state-for-your-instances-By-setting-up-an-association-to-run-the-AWS-ConfigureAWSPackage-document-you’re-effectively-telling-the-Systems-Manager-to-install-or-update-the-specified-package-in-this-case-your-custom-software-on-instances-with-the-specified-tags"><a href="#Uses-associations-to-enforce-a-desired-state-for-your-instances-By-setting-up-an-association-to-run-the-AWS-ConfigureAWSPackage-document-you’re-effectively-telling-the-Systems-Manager-to-install-or-update-the-specified-package-in-this-case-your-custom-software-on-instances-with-the-specified-tags" class="headerlink" title="Uses associations to enforce a desired state for your instances. By setting up an association to run the AWS-ConfigureAWSPackage document, you’re effectively telling the Systems Manager to install or update the specified package (in this case, your custom software) on instances with the specified tags"></a>Uses associations to enforce a desired state for your instances. By setting up an association to run the AWS-ConfigureAWSPackage document, you’re effectively telling the Systems Manager to install or update the specified package (in this case, your custom software) on instances with the specified tags</h2><h2 id="Scalability-amp-High-Availability"><a href="#Scalability-amp-High-Availability" class="headerlink" title="Scalability &amp; High Availability"></a>Scalability &amp; High Availability</h2><p>Scalability means that an application &#x2F; system can handle greater loads by adapting.</p><p><strong>Scalability is linked but different to High Availability</strong></p><h3 id="Vertical-Scalability"><a href="#Vertical-Scalability" class="headerlink" title="Vertical Scalability"></a>Vertical Scalability</h3><p>Vertically scalability means increasing the size of the resource (instance)</p><h3 id="Horizontal-Scalability"><a href="#Horizontal-Scalability" class="headerlink" title="Horizontal Scalability"></a>Horizontal Scalability</h3><p>Horizontal Scalability means increasing the number of instances &#x2F; systems for your application</p><h3 id="High-Availability-amp-Scalability-For-EC2"><a href="#High-Availability-amp-Scalability-For-EC2" class="headerlink" title="High Availability &amp; Scalability For EC2"></a>High Availability &amp; Scalability For EC2</h3><ul><li>Vertical Scaling: Increase instance size (&#x3D; scale up &#x2F; down)<ul><li>From: t2.nano - 0.5G of RAM, 1 vCPU</li><li>To: u-12tb1.metal - 12.3 TB of RAM, 448 vCPUs</li></ul></li><li>Horizontal Scaling: Increase number of instances (&#x3D; scale out &#x2F; in)<ul><li>Auto Scaling Group</li><li>Load Balancer</li></ul></li><li>High Availability: Run instances for the same application across multi-AZ<ul><li>Auto Scaling Group multi-AZ</li><li>Load Balancer multi-AZ</li></ul></li></ul><h2 id="Gateway-Load-Balancer"><a href="#Gateway-Load-Balancer" class="headerlink" title="Gateway Load Balancer"></a>Gateway Load Balancer</h2><p>Uses the <strong>GENEVE</strong> protocol on port <strong>6081</strong></p><h2 id="Application-Load-Balancers"><a href="#Application-Load-Balancers" class="headerlink" title="Application Load Balancers"></a>Application Load Balancers</h2><h3 id="Monitoring"><a href="#Monitoring" class="headerlink" title="Monitoring"></a>Monitoring</h3><ul><li><code>**RequestCountPerTarget**</code></li><li><code>👀 EXAM</code> <code>SpilloverCount</code> represents the total <code>number of requests</code> that were <code>rejected</code> <code>because</code> the surge <code>queue</code> is <code>full</code>.To solve this use-case, you need to configure the Auto Scaling groups to scale your instances based on the <code>SurgeQueueLength</code> metric.</li><li><code>**SurgeQueueLength**</code>: The total of requests (HTTP listener) or connections (TCP listener) that are pending routing to a healthy instance. Help to scale out ASG. Max value is 1024</li></ul><h3 id="Target-Groups-Settings"><a href="#Target-Groups-Settings" class="headerlink" title="Target Groups Settings"></a>Target Groups Settings</h3><ul><li><code>deregisteration_delay.timeout_seconds</code>: time the load balancer waits before deregistering a target.</li><li><code>slow_start.duration_seconds</code>: (see next slide).</li><li><code>load_balancing.algorithm.type</code>: how the load balancer selects targets when routing requests (Round Robin, Least Outstanding Requests).</li><li><code>stickiness.enabled</code>.</li><li><code>stickiness.type</code>: application-based or duration-based cookie.</li><li><code>stickiness.app_cookie.cookie_name</code>: name of the application cookie.</li><li><code>stickiness.app_cookie.duration_seconds</code>: application-based cookie expiration period.</li><li><code>stickiness.lb_cookie.duration_seconds</code>: duration-based cookie expiration period.</li></ul><h2 id="ASG"><a href="#ASG" class="headerlink" title="ASG"></a>ASG</h2><h3 id="Good-metrics-to-scale-on"><a href="#Good-metrics-to-scale-on" class="headerlink" title="Good metrics to scale on"></a>Good metrics to scale on</h3><ul><li><code>CPUUtilization</code>: Average CPU utilization across your instances (Processing power)</li><li><code>RequestCountPerTarget</code>: to make sure the number of requests per EC2 instances is stable</li><li>Average Network In &#x2F; Out (if you’re application is network bound)</li><li>Any custom metric (that you push using CloudWatch)</li></ul><p>ApproximateNumberOfMessages -</p><h2 id="AWS-Auto-Scaling"><a href="#AWS-Auto-Scaling" class="headerlink" title="AWS Auto Scaling"></a>AWS Auto Scaling</h2><p>Backbone service of auto scaling for scalable resources in AWS:</p><ul><li><code>Amazon EC2 Auto Scaling groups</code>: Launch or terminate EC2 instances</li><li><code>Amazon EC2 Spot Fleet requests</code>: Launch or terminate instances from a Spot Fleet request, or automatically replace instances that get interrupted for price or capacity reasons.</li><li><code>Amazon ECS</code>: Adjust the ECS service desired count up or down</li><li><code>Amazon DynamoDB</code> (table or global secondary index):WCU &amp; RCU</li><li><code>Amazon Aurora</code>: Dynamic Read Replicas Auto Scaling</li></ul><h3 id="Target-Groups"><a href="#Target-Groups" class="headerlink" title="Target Groups"></a>Target Groups</h3><ul><li><p>EC2 instances (can be managed by an Auto Scaling Group) - HTTP</p></li><li><p>ECS tasks (managed by ECS itself) - HTTP</p></li><li><p>Lambda functions - HTTP request is translated into a JSON event</p></li><li><p>IP Addresses - must be private IPs</p></li><li><p>ALB can route to multiple target groups</p></li><li><p>Health checks are at the target group level</p></li></ul><h2 id="UpdatePolicy-Attribute"><a href="#UpdatePolicy-Attribute" class="headerlink" title="UpdatePolicy Attribute"></a>UpdatePolicy Attribute</h2><p>Use it to handle updates for below resources</p><ul><li><code>AWS::AppStream::Fleet</code></li><li><code>AWS::AutoScaling::AutoScalingGroup</code></li><li><code>AWS::ElastiCache::ReplicationGroup</code></li><li><code>AWS::OpenSearchService::Domain</code></li><li><code>AWS::Elasticsearch::Domain</code></li><li><code>AWS::Lambda::Alias</code></li></ul><h3 id="AutoScalingReplacingUpdate-policy-EXAM"><a href="#AutoScalingReplacingUpdate-policy-EXAM" class="headerlink" title="AutoScalingReplacingUpdate policy - EXAM"></a>AutoScalingReplacingUpdate policy - <code>EXAM</code></h3><h3 id="AutoScalingRollingUpdate-policy"><a href="#AutoScalingRollingUpdate-policy" class="headerlink" title="AutoScalingRollingUpdate policy"></a><a href="https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-attribute-updatepolicy.html">AutoScalingRollingUpdate policy</a></h3><p>With rolling updates, you can specify whether CloudFormation performs updates in batches or all at once for instances that are in an Auto Scaling group. The <code>AutoScalingRollingUpdate</code> policy is the only CloudFormation feature that provides such an incremental update throughout the Auto Scaling group.</p><h3 id="AutoScalingScheduledAction-policy"><a href="#AutoScalingScheduledAction-policy" class="headerlink" title="AutoScalingScheduledAction policy"></a>AutoScalingScheduledAction policy</h3><p>Applies when you update a stack that includes an Auto Scalling group with an associated scheduled action.</p><h3 id="Lambda-Tracing-with-X-Ray"><a href="#Lambda-Tracing-with-X-Ray" class="headerlink" title="Lambda Tracing with X-Ray"></a>Lambda Tracing with X-Ray</h3><ul><li>Enable in Lambda configuration (<code>Active Tracing</code>)</li><li>Environment variables to communicate with X-Ray<ul><li>_X_AMZN_TRACE_ID: contains the tracing header</li><li>AWS_XRAY_CONTEXT_MISSING: by default, LOG_ERROR</li><li><code>AWS_XRAY_DAEMON_ADDRESS</code>: the X-Ray Daemon IP_ADDRESS:PORT</li></ul></li></ul><h2 id="Lambda-Function-Configuration"><a href="#Lambda-Function-Configuration" class="headerlink" title="Lambda Function Configuration"></a>Lambda Function Configuration</h2><ul><li>RAM-The more RAM you add, the more vCPU credits you get<ul><li>At 1,792 MB, a function has the equivalent of one full vCPU</li></ul></li></ul><ul><li><code>If your application is CPU-bound (computation heavy), increase RAM</code> - <code>*EXAM</code></li><li><code>Timeout</code>: default 3 seconds, maximum is 900 seconds (15 minutes)</li></ul><p><em>Cold Starts &amp; Provisioned Concurrency</em></p><ul><li><code>Cold Start</code>:<ul><li>New instance &#x3D;&gt; code is loaded and code outside the handler run (init)</li><li>If the init is large (code, dependencies, SDK…) this process can take some time.</li><li>First request served by new instances has higher latency than the rest</li></ul></li><li><code>Provisioned Concurrency</code>:<ul><li>Concurrency is allocated before the function is invoked (in advance)</li><li>So the cold start never happens and all invocations have low latency</li><li>Application Auto Scaling can manage concurrency (schedule or target utilization)</li></ul></li><li>Note:<ul><li>Note: cold starts in VPC have been dramatically reduced in Oct &amp; Nov 2019</li><li><a href="https://aws.amazon.com/blogs/compute/announcing-improved-vpc-networking-for-aws-lambda-functions/">https://aws.amazon.com/blogs/compute/announcing-improved-vpc-networking-for-aws-lambda-functions/</a></li></ul></li></ul><p>Lambda Monitoring - CloudWatch Metrics</p><ul><li><code>Invocations</code> - number of times your function is invoked (success&#x2F;failure)</li><li><code>Duration</code> - amount of time your function spends processing an event</li><li><code>Errors</code> - number of invocations that result in a function error</li><li><code>Throttles</code> - number of invocation requests that are throttled (no concurrency available)</li><li><code>DeadLetterErrors</code> - number of times Lambda failed to send an event to a DLQ (async invocations)</li><li><code>IteratorAge</code> - time between when a Stream receives a record and when the Event Source Mapping sends the event to the function (for Event Source Mapping that reads from Stream)</li><li><code>ConcurrentExecutions</code> - number of function instances that are processing events</li></ul><hr><h2 id="CodeDeploy-👀-EXAM"><a href="#CodeDeploy-👀-EXAM" class="headerlink" title="CodeDeploy - 👀 EXAM"></a>CodeDeploy - 👀 EXAM</h2><p><a href="https://docs.aws.amazon.com/codedeploy/latest/userguide/welcome.html">CodeDeploy</a> is a deployment service that automates application deployments to <code>Amazon EC2 instances</code>, <code>on-premises instances</code>, or <code>serverless Lambda functions</code>. It allows you to rapidly release new features, update Lambda function versions, avoid downtime during application deployment, and handle the complexity of updating your applications, without many of the risks associated with error-prone manual deployments.</p><ul><li><p><em>Application</em>: Container</p></li><li><p><em>Deployment Group</em> : Setup config setting in code deploy</p><ul><li>Refers to the set of instances of Lambda functions where you deply the code revision</li><li>You can create multiple deployment groups within the application</li></ul></li><li><p><em>Deployment Configuration</em></p><ul><li>Set of conditions and deployment rules that CodeDeploy applies during a deployment.</li></ul></li><li><p><em>Application Specificaton (AppSpec) file</em></p><ul><li>manages deployment stages as lifecycle event hooks.</li></ul></li></ul><hr><h2 id="ElasticSearch-OpenSearch"><a href="#ElasticSearch-OpenSearch" class="headerlink" title="ElasticSearch - OpenSearch"></a>ElasticSearch - OpenSearch</h2><p><code>Amazon ElasticSearch Service</code> is now <code>Amazon OpenSearch Service</code></p><ul><li><p>May be called <code>Amazon ES at the exam</code></p></li><li><p>Managed version of ElasticSearch (open source project)</p></li><li><p>Needs to run on servers (not a serverless offering)</p></li><li><p>Use cases:</p><ul><li>Log Analytics</li><li>Real Time application monitoring</li><li>Security Analytics</li><li>Full Text Search</li><li>Clickstream Analytics</li><li>Indexing</li></ul></li></ul><h3 id="ElasticSearch-Access-Policy"><a href="#ElasticSearch-Access-Policy" class="headerlink" title="ElasticSearch Access Policy"></a>ElasticSearch Access Policy</h3><ul><li><code>IP-based Policies</code><ul><li>Resource-based policies used to restrict access to an ES domain to IP address(es) or CIDR blocks</li><li>Allows unsigned requests to an ES domain (e.g., curl, Kibana, …)</li></ul></li></ul><h3 id="ElasticSearch-Production-Setup"><a href="#ElasticSearch-Production-Setup" class="headerlink" title="ElasticSearch - Production Setup"></a>ElasticSearch - Production Setup</h3><p>It’s recommended to:</p><ul><li>Use <em>3 dedicated Master nodes</em></li><li>Use at least <em>2 Data nodes per AZ</em> (for replication)</li><li><em>Deploy</em> the domain across <em>3 AZ</em></li><li><em>Create</em> at least <em>one replica or each index in the cluster</em></li></ul><hr><h2 id="AWS-IAM-Identity-Center-successor-to-AWS-Single-Sign-On-EXAM"><a href="#AWS-IAM-Identity-Center-successor-to-AWS-Single-Sign-On-EXAM" class="headerlink" title="AWS IAM Identity Center (successor to AWS Single Sign-On) - EXAM"></a>AWS IAM Identity Center (successor to AWS Single Sign-On) - EXAM</h2><ul><li><p>One login (single sign-on) for all your</p><ul><li><strong><code>AWS accounts in AWS Organizations</code></strong></li><li>Business cloud applications (e.g., Salesforce, Box, Microsoft 365, …)</li><li>SAML2.0-enabled applications</li><li>EC2 Windows Instances</li></ul></li><li><p>Identity providers</p></li><li><p>Built-in identity store in IAM Identity Center</p></li><li><p>3rd party: Active Directory (AD), OneLogin, Okta…</p></li></ul><hr><h2 id="AWS-Systems-Manager-AWS-Systems-Manager-OpsCenter"><a href="#AWS-Systems-Manager-AWS-Systems-Manager-OpsCenter" class="headerlink" title="AWS Systems Manager - AWS Systems Manager OpsCenter"></a>AWS Systems Manager - AWS Systems Manager OpsCenter</h2><p>Provides a central location where operations engineers and IT professionals can manage operational work items (OpsItems) related to AWS resources.</p><p>An <code>OpsItem</code> is any operational issue or interruption that needs investigation and remediation. Using OpsCenter, you can view contextual investigation data about each OpsItem, including related OpsItems and related resources. You can also run Systems Manager Automation runbooks to resolve OpsItems.</p><hr><h2 id="Amazon-EMR-Optional"><a href="#Amazon-EMR-Optional" class="headerlink" title="Amazon EMR - Optional"></a>Amazon <a href="https://aws.amazon.com/emr/">EMR</a> - Optional</h2><p>is the industry-leading cloud big data solution for petabyte-scale data processing, interactive analytics, and machine learning using open-source frameworks such as Apache Spark, Apache Hive, and Presto.</p><hr><h2 id="AWS-Global-Accelerator"><a href="#AWS-Global-Accelerator" class="headerlink" title="AWS Global Accelerator"></a>AWS Global Accelerator</h2><p>service that <code>improves</code> the <code>availability and performance of your applications with local or global users</code>. It provides static IP addresses that act as a fixed entry point to your application endpoints in a single or multiple AWS Regions, such as your Application Load Balancers, Network Load Balancers or Amazon EC2 instances. AWS Global Accelerator will not help in accelerating the file transfer speeds into S3 for the given use-case.</p><p>Global Accelerator service does not work with S3. It only supports endpoints like application load balancers, network load balancers, EC2 instances, or elastic IP addresses.</p><hr><h2 id="ASG-WARM-Pool"><a href="#ASG-WARM-Pool" class="headerlink" title="ASG WARM Pool"></a>ASG WARM Pool</h2><p>A warm pool gives your the ability to decrease latency for apps that have exceptionally long boot times, eg because instance need to write massive amounts of data to disk.</p><hr><h2 id="Other-Quetions-Link"><a href="#Other-Quetions-Link" class="headerlink" title="Other Quetions - Link"></a>Other Quetions - <a href="https://collin-smith.medium.com/passing-the-aws-certified-sysops-administrator-associate-certification-in-2023-a1e5f08d1b12">Link</a></h2><ol><li>If an S3 Bucket implemented <a href="https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-lock-overview.html">Governance Mode S3 Object Locking</a> and you wanted to bypass this you. You must have the <code>s3:BypassGovernanceRetention</code> permission and must explicitly include <code>x-amz-bypass-governance-retention:true</code> as a request header with any request that requires overriding governance mode.</li></ol><p>S3 Object Lock provides two retention modes:</p><ul><li>Governance mode</li><li>Compliance mode</li></ul><ul><li>In <code>compliance mode</code>, a protected object version <code>can’t be overwritten or deleted by any user</code>, including the root user in your AWS account.</li><li>In <code>governance mode</code>, users <code>can’t overwrite or delete an object</code> version or alter its lock settings unless <strong><code>they have special permissions</code></strong>.</li></ul><ol start="2"><li><p>If you encounter the <strong><code>OUTDATED</code></strong> status when running a <a href="https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-concepts.html">CloudFormation StackSet</a> for one region. According to <a href="https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/stacksets-troubleshooting.html">Troubleshooting AWS CloudFormation StackSets</a> coud be a result that “the template could be trying to create global resources that must be unique but aren’t, such as S3 buckets.”</p></li><li><p>If you had a single AWS Aurora cluster with one writer and reader and you were encountering memory issues, you might want to deal with this using AWS Aurora DB Multi-Master. However, I believe the AWS Aurora DB Multi-Master has been phased out. You can read further on trouble shooting <a href="https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/CHAP_Troubleshooting.html">AWS Aurora Memory Issues</a>.</p></li><li><p>If there are EC2s that are terminated in an environment, you should use the EIP-attached Config rule to find EIPs that are unattached in your environment.</p></li><li><p>If you have an Lambda which processes&#x2F;updates an S3 object and writes the updated object back to the same S3 bucket, you might want to consider <a href="https://aws.amazon.com/blogs/compute/avoiding-recursive-invocation-with-amazon-s3-and-aws-lambda/">ways to avoid recursive Lambda calls on the same S3 bucket</a>. Generally using a separate bucket is preferred. If you must use the same bucket you can consider some of the following options:</p></li></ol><ul><li>(1) Using a prefix or suffix in the S3 event notification</li><li>(2) Using object metadata to identify the original S3 object</li><li>(3) Using an Amazon DynamoDB table to filter duplicate events</li></ul><ol start="6"><li><p>If you have an on premise server with a fixed IP address and you are migrating this to an EC2 behind a load balancer,you should consider using an A record as an A Record maps to one or more IP Addresses. A CNAME record should not be used as it maps an alias name to another name (Not an IP Address)</p></li><li><p>If you have some existing EC2 and you are a client who wishes to convert some of these to Fargate. You should consider <a href="https://aws.amazon.com/savingsplans/">Cost Savings Plans</a> and <a href="https://docs.aws.amazon.com/savingsplans/latest/userguide/sp-applying.html">different scenarios</a> to reduce costs ensure that there are no unused reservations. Options to be considered:</p></li></ol><ul><li>Compute Savings Plan with no upfront costs.</li><li>Compute Savings Plan with partial upfront costs.</li><li>EC2 Instance Savings Plans.</li></ul><ol start="8"><li>If there are many EC2s behind an autoscaler that are failing intermittently and it will take weeks to solve the actual issue. Some ways to deal with this could include:</li></ol><ul><li>(a) Use CloudWatch agent with health checks and restart them</li><li>(b) AWS System State Manager&#x2F;AWS System Session Manager to check the status of these applications every 5 minutes and restart them.</li></ul><ol start="9"><li>Given S3 bucket and enabled <code>S3 Object Lock in governance</code> mode to ensure data integrity and retention that adheres to the write-once-read-many (WORM) model.</li></ol><h3 id="More-questions-from-Reddit"><a href="#More-questions-from-Reddit" class="headerlink" title="More questions from Reddit"></a>More questions from Reddit</h3><p>Two interesting questions from my exam:</p><ol><li>How to configure ECS to have flow logs ONLY FROM CONTAINERS (two answers) options:</li></ol><ul><li>a) use aws vpc network mode.</li><li>b) something.</li><li>c) use bridge network mode.</li><li>d) enable container ENI flow logs.</li></ul><p>The first one seems to be quite simple, in awsvpc mode each container has it’s own elastic network interface and you can have flow flog for ENI. So that seems to be the correct answer.</p><ol start="2"><li>Someone created a lambda that is triggered by S3 PutObject event and this lambda writes new file to the same bucket. How should the admin stop the loop (one answer)</li></ol><ul><li>a) set reserved concurrency to 0</li><li>b) deny the lambda bucket access</li><li>c) something</li><li>d) something</li></ul><p><a href="https://docs.aws.amazon.com/lambda/latest/dg/configuration-concurrency.html">https://docs.aws.amazon.com/lambda/latest/dg/configuration-concurrency.html</a>“To throttle a function, set the reserved concurrency to zero” so i guess setting it to 0 is the right answer.</p><ol start="3"><li>What would a sysops need to connect to a managed kubernetes service from his own machine after he set the cluster up</li></ol><ul><li>a) kubeconfig</li><li>b) kube-proxy.yaml</li><li>c) something</li><li>d) something</li></ul><p>I also remember that there was one question about</p><ul><li><code>S3 Object Lock</code> and one answer was <code>with Governance mode and the other one with Compliance mode</code></li></ul><h3 id="Review-berfore-exam"><a href="#Review-berfore-exam" class="headerlink" title="Review berfore exam"></a>Review berfore exam</h3><ul><li><p><code>Amazon Inspector</code> - Amazon Inspector is an automated <strong><code>security assessment service that helps improve the security and compliance of applications deployed on AWS</code></strong>. Amazon Inspector automatically assesses applications for exposure, vulnerabilities, and deviations from best practices. After performing an assessment, Amazon Inspector <strong><code>produces a detailed list of security findings</code></strong> prioritized by level of severity.</p></li><li><p><code>AWS Control Tower</code> - AWS Control Tower offers the easiest way to set up and govern a secure, multi-account AWS environment. It establishes a landing zone that is based on the best-practices blueprints and enables governance using guardrails you can choose from a pre-packaged list. The landing zone is a well-architected, multi-account baseline that follows AWS best practices. Guardrails implement governance rules for security, compliance, and operations.</p></li><li><p><code>AWS Service Catalog</code> - AWS Service Catalog allows organizations to create and manage catalogs of IT services that are approved for use on AWS. These IT services can include everything from virtual machine images, servers, software, and databases to complete multi-tier application architectures. AWS Service Catalog allows you to centrally manage deployed IT services and your applications, resources, and metadata. This helps you achieve consistent governance and meet your compliance requirements while enabling users to quickly deploy only the approved IT services they need.</p></li><li><p><code>Checks Security</code></p><ul><li>Security Checks inspect the AWS aws and make “Recommendations”: <code>AWS Trusted Advisor</code><ul><li>AWS Config unlike does recommendations</li></ul></li><li><code>AWS Inspector</code> targets <code>only EC2 instances</code> that run on a number of supported operating systems.</li></ul></li><li><p><code>Systems Manager</code></p></li><li><p>Build <code>automation to configure and manage instances and AWS resources</code>.</p><ul><li>Create custom runbooks or use pre-defined runbooks maintained by AWS.</li><li>Receive notifications about Automation tasks and runbooks by using Amazon EventBridge.</li><li>Monitor Automation progress and details by using the AWS Systems Manager console.</li></ul></li></ul><h3 id="Checks-Health"><a href="#Checks-Health" class="headerlink" title="Checks Health"></a>Checks Health</h3><ul><li>AWS Personal Health Dashboard (Use the Personal Health Dashboard which provides information about AWS Health events that can affect your account)  to be notified of any issues that occur in the underlying hardware that hosts the AWS resources.</li></ul><h3 id="Costs"><a href="#Costs" class="headerlink" title="Costs"></a>Costs</h3><p>Q) Provides the most detailed information about your AWS Bill and can generate reports with hourly, daily, or monthly granularity. Reports are stored in your selected S3 bucket and can be analyzed using Amazon Athena, Amazon Redshift or Amazon QuickSight</p><pre><code>AWS Cost and Usage Report</code></pre><p>Q) An easy-to-use interface that lets you visualize your AWS costs and provides a set of ready-to-use default reports to help you get started.</p><pre><code>AWS Cost Explorer</code></pre><p>Q) To provide them a way to <code>get billing updates more than once a month. using a spreadsheet</code></p><ul><li>Configure your <code>AWS Cost and Usage Report</code> to generate and publish billing reports in CSV format to an S3 bucket every day.</li><li>AWS Budgets simply gives you the ability to set custom budgets that alert you when your costs or usage exceed or forecasted to exceed your budgeted amount</li></ul><p>Q) Best way to properly get <code>billing reports for the different company departments</code>, with the least possible administrative overhead?</p><pre><code>Cost Allocation Tags</code></pre><p>A tag is a label that you or AWS assigns to an AWS resource. Each tag consists of a key and a value. For each resource, each tag key must be unique, and each tag key can have only one value. You can use tags to organize your resources, and cost allocation tags to track your AWS costs on a detailed level. After you activate cost allocation tags, AWS uses the cost allocation tags to organize your resource costs on your cost allocation report, to make it easier for you to categorize and track your AWS costs.</p><p>Q) To see a <code>report showing the allocation of costs for these EIPs</code> by department.</p><pre><code>Define Cost Allocation Tags and generate a report using Cost Explorer</code></pre><h3 id="Tags"><a href="#Tags" class="headerlink" title="Tags"></a>Tags</h3><p>Q) Tags are consistently applied when your resources are created in AWS across all accounts.</p><pre><code>A: AWS Service Catalog to tag the provisioned resources with corresponding unique identifiers for portfolio, product, and users.A: AWS CloudFormation Resource Tags property to apply tags to certain resource types upon creation.</code></pre><h3 id="Other"><a href="#Other" class="headerlink" title="Other"></a>Other</h3><p>Q) Provides the most detailed information about your AWS Bill and can generate reports with hourly, daily, or monthly granularity. Reports are stored in your selected S3 bucket and can be analyzed using Amazon Athena, Amazon Redshift or Amazon QuickSight</p><pre><code>AWS Cost and Usage Report</code></pre><p>Q) An easy-to-use interface that lets you visualize your AWS costs and provides a set of ready-to-use default reports to help you get started.</p><pre><code>AWS Cost Explorer</code></pre><p>Q) An Amazon EFS performance mode that is designed for highly parallelized workloads that can tolerate high latencies:</p><pre><code>Max I/0</code></pre><p>Q) A type of Amazon EFS Throughput Mode that is recommended if you want a throughput that scales with the amount of storage in your file system.</p><pre><code>Bursting Throughput</code></pre><p>Q) One of the Throughput Modes in Amazon EFS that is recommended if you have spiky or unpredictable workloads and performance requirements that aredifficult to forecast.</p><pre><code>Elastic Throughput</code></pre><p>Q) A type of Performance Mode in Amazon EFS that provides the lowest per-operation latency</p><pre><code>Max Throughput</code></pre><p>Q) A networking service that provides static IP addresses that act as a fixed entry point to your applications and eliminate the complexity of managing specific IP addresses for different AWS Regions and Availability Zones.</p><pre><code>AWS Global Accelerator</code></pre><p>Q) Automatically collects log data from your AWS resources and uses machine learning, statistical analysis, and graph theory to build a linked set of data that enables you to easily conduct faster and more efficient security investigations.</p><pre><code>Amazon Detective</code></pre><p>Q) Responds recursively to DNS queries from AWS resources for public records, Amazon VPC-specific DNS names, and Amazon Route 53 private hosted zones, and is available by default in all VPCs.</p><pre><code>AWS Route 53 Resolver</code></pre><hr><p>Parquet</p><p>CloudWatch Agent</p><p>CloudWatch Insight</p><p>S3 + CloudFormation</p><p>Athena Sources S3 CloudWatch</p><p>Status Checks</p><p>AMI Sharing other Account List of AMI</p><p>EC2 Image Builder</p><p>SSM Parameter Store</p><p>SSM – Run Command</p><p>TTL Route 53 CloudFront</p><p>ACNAME to ALB could be IP o name</p><p><a href="http://www.example.com/">www.example.com</a>example</p><p>CloudFront – Origins</p><p>Network Load Balancer</p><p>Sticky Sessions (Session Affinity)</p><p>ESB Faster In wake up</p><p>CloudFormation    set Cloudformation dnsprivate name ip?</p><pre><code>Cross Stack ReferenceRetaining Data on Deletes ec2 whole instanceStackSetsAWS::SecretsManager::RotationSchedule</code></pre><p>CloudFront with ALB sticky sessionsImprove Cache</p><p>Lambda</p><p>ASG WARM Pool</p><p>AWS IAM Identity Center issue with group permissions</p><p>instance type reserved changeable</p><p>EBS resizing</p><p>• FSR helps you to create a volume from a snapshotthat is fully initialized at creation (no I&#x2F;O latency)</p><p>EFS</p><p>Share EBS</p><p>Share an Amazon EBS snapshot</p><p>Share</p><p>s3 host web site and CloudFront</p><p>Poolicies with root accounts</p><p>S3 Performance• Multi-Part upload:• S3 Transfer Acceleration</p><p> AWS::SecretsManager::RotationSchedule</p><p> VPC Flow Logs Syntax</p><p>Volume Gateway for on-promises locally</p>]]></content>
    
    
      
      
    <summary type="html">&lt;h1 id=&quot;Summary-of-concepts-for-AWS-SysOps-Administrator-Certification&quot;&gt;&lt;a href=&quot;#Summary-of-concepts-for-AWS-SysOps-Administrator-Certifica</summary>
      
    
    
    
    <category term="AWS" scheme="https://blog.pablo-magro-gaspar.site/categories/AWS/"/>
    
    
    <category term="Certifications" scheme="https://blog.pablo-magro-gaspar.site/tags/Certifications/"/>
    
    <category term="SysOps" scheme="https://blog.pablo-magro-gaspar.site/tags/SysOps/"/>
    
    <category term="SOA-C02" scheme="https://blog.pablo-magro-gaspar.site/tags/SOA-C02/"/>
    
  </entry>
  
  <entry>
    <title>Prompts</title>
    <link href="https://blog.pablo-magro-gaspar.site/2023/05/01/Prompts/"/>
    <id>https://blog.pablo-magro-gaspar.site/2023/05/01/Prompts/</id>
    <published>2023-05-01T19:03:33.000Z</published>
    <updated>2026-04-14T20:03:04.027Z</updated>
    
    <content type="html"><![CDATA[<h2 id="How-to-find-better-talent-faster"><a href="#How-to-find-better-talent-faster" class="headerlink" title="How to find better talent faster"></a>How to find better talent faster</h2><h3 id="Find-the-right-candidates"><a href="#Find-the-right-candidates" class="headerlink" title="Find the right candidates"></a>Find the right candidates</h3><pre><code>I am looking to hire a [insert role]. I have no prior experience hiring for this role. Give me a list of 10 online job boards and communities where I can find good potential candidates for this role.</code></pre><h3 id="Create-a-job-listing"><a href="#Create-a-job-listing" class="headerlink" title="Create a job listing"></a>Create a job listing</h3><pre><code>Create a job listing for the role of [insert role]. The listing should be no longer than [insert word limit]. The job posting should cover the following skills: [insert skills]</code></pre><h3 id="Create-an-interview-process"><a href="#Create-an-interview-process" class="headerlink" title="Create an interview process"></a>Create an interview process</h3><pre><code>I am interviewing candidates for the role of [insert role]. Create an interview with 3 rounds that test for the following traits: culture fit, growth mindset, learning ability, and adaptability. Also create one technical assignment to test their technical ability. Also add in the answer key for each question so I can evaluate and grade their answers.</code></pre><h2 id="How-to-make-better-decisions"><a href="#How-to-make-better-decisions" class="headerlink" title="How to make better decisions"></a>How to make better decisions</h2><p>Need to make an important decision but don’t feel like you have all the information you need?</p><pre><code>I am trying to decide if I should [insert decision]. Give me a list of pros and cons that tell me why I should or shouldn&#39;t make this decision.</code></pre><h2 id="How-to-learn-anything-fast"><a href="#How-to-learn-anything-fast" class="headerlink" title="How to learn anything fast"></a>How to learn anything fast</h2><p>Want to learn a new skill but not sure where to start?</p><pre><code>I want to get better at [insert skill]. I am a beginner and have no prior experience. Create a 30 day plan for me to learn [insert skill] from scratch.</code></pre><h2 id="How-to-craft-your-elevator-pitch"><a href="#How-to-craft-your-elevator-pitch" class="headerlink" title="How to craft your elevator pitch"></a>How to craft your elevator pitch</h2><p>That’s where an elevator pitch comes in handy: short and to the point, it lets the person we’re talking to understand why they should care about what we do.</p><p>Use this prompt to find your elevator pitch:</p><pre><code>  Generate a 30 second elevator pitch using the description of my company (or career) below. The pitch should be brief, punchy, and compelling.  [insert description]</code></pre><h2 id="How-to-learn-new-concepts-faster-Concepts"><a href="#How-to-learn-new-concepts-faster-Concepts" class="headerlink" title="How to learn new concepts faster - Concepts"></a>How to learn new concepts faster - Concepts</h2><p>Are you struggling to understand a difficult concept? Or maybe you want to explain a difficult concept to someone but don’t have the words?</p><pre><code>  Explain the concept of [insert concept or idea] in simple terms, and provide relevant examples of how it can be applied in a real-world situation. Simplify complex terms or concepts.</code></pre><h2 id="How-to-generate-stunning-portraits"><a href="#How-to-generate-stunning-portraits" class="headerlink" title="How to generate stunning portraits"></a>How to generate stunning portraits</h2><p>Use the prompt below to generate stunning portraits on Leonardo:</p><pre><code>street style photo of a young woman, red gucci jacket, blue gucci shirt, wide shot, natural lighting, soho, shot on Agfa Vista 200, 4k --ar 16:9</code></pre><p><img src="https://cdn.leonardo.ai/users/a9c4fb87-7f37-4197-a753-5a3ba06ebb13/generations/1af1965c-d1bc-489a-bf08-ac58a8cd46f0/RPG_40_Design_a_black_and_white_template_for_kids_White_backgr_0.jpg" alt="Leonardo AI" title="Gucci Young Woman"></p><h2 id="How-to-generate-beautiful-shots"><a href="#How-to-generate-beautiful-shots" class="headerlink" title="How to generate beautiful shots"></a>How to generate beautiful shots</h2><p>Use the prompt below to generate a picture of an elderly Spanish woman with a dog in Leonardo:</p><pre><code>Medium-full shot of an elderly Spanish woman with deep wrinkles and a warm smile, petting a golden retriever in Retiro park, wearing a bright pastel floral blazer made of linen, sun glasses, natural afternoon light reflecting off her eyeglasses, shot on Agfa Vista 200, side-angle view, 4k --ar 16:9 --stylize 1000 --v 5</code></pre><h2 id="How-to-generate-selfie-pictures"><a href="#How-to-generate-selfie-pictures" class="headerlink" title="How to generate selfie pictures"></a>How to generate selfie pictures</h2><pre><code>A hyper-realistic GoPro selfie of [Character] in [Location]. --ar 3:2</code></pre><h2 id="How-to-generate-hyper-realistic-landscape-shots"><a href="#How-to-generate-hyper-realistic-landscape-shots" class="headerlink" title="How to generate hyper-realistic landscape shots"></a>How to generate hyper-realistic landscape shots</h2><p>If you want to create hyper-realistic beautiful landscape shots in Midjourney, try the prompt below:</p><pre><code>[LOCATION] shot with Nikon D850 and Nikon AF-S NIKKOR 14-24mm f/2.8G ED lens, natural light, style of National GeographicDoñana Spain National Park shot with Nikon D850 and Nikon AF-S NIKKOR 14-24mm f/2.8G ED lens, natural light, style of National Geographic</code></pre><p><img src="https://cdn.leonardo.ai/users/a9c4fb87-7f37-4197-a753-5a3ba06ebb13/generations/e252d503-9337-4e13-bbe1-5bf324d937ee/Leonardo_Creative_Doana_Spain_National_Park_shot_with_Nikon_D8_0.jpg" alt="Leonardo AI" title="Doñana Spain National Park"></p><p><img src="https://cdn.leonardo.ai/users/a9c4fb87-7f37-4197-a753-5a3ba06ebb13/generations/41147fe7-96e4-42f0-87b4-678acb5871a1/Spatial_landscape_Doana_Spain_National_Park_shot_with_Nikon_D8_0.jpg" alt="Leonardo AI" title="Doñana Spain National Park"></p><h2 id="👀-How-to-create-a-resume-to-land-you-your-dream-job"><a href="#👀-How-to-create-a-resume-to-land-you-your-dream-job" class="headerlink" title="👀 How to create a resume to land you your dream job"></a>👀 How to create a resume to land you your dream job</h2><pre><code>Analyze [applicant&#39;s details] and construct a winning resume to apply for [job position details]. Step into the shoes of the employer and unveil the key attributes they seek in [job position details] and make the resume stand out and attract the employer.Applicant&#39;s details = &quot;Insert here&quot;Job position details = &quot;Insert here&quot;Analyze [applicant&#39;s details] and construct a winning resume to apply for [job positiondetails]. Step into the shoes of the employer and unveil the key attributes they seek in [job position details] and make the resume stand out and attract the employer.Applicant&#39;s details = &quot;Name: John DoeEducation: Bachelors of Science in Computer Science from Royal HollowaySkills: Python, C++, Angular JS, Project Planning and Execution, Team Leadership and Collaboration, Risk Management, Stakeholder Management, Problem-Solving and Decision Making, excellent communication skills and familiarity with data science.Experience = Project Manager, ABC Company (May 2018 - Present)&quot;Job position details = &quot;Senior Project ManagerOversees strategic plan, monitoring and adapting as neededReports on project progress, offer viable solutions and opportunities as they ariseImplements change practicesLead meetings and set expectations for the project teamMaintain budgetReporting on projects and portfoliosleading cross-functional teams, coordinating resources, managing timelines, and ensuring impeccable execution of software development initiatives&quot;</code></pre><h2 id="👀-How-to-prepare-for-an-interview"><a href="#👀-How-to-prepare-for-an-interview" class="headerlink" title="👀 How to prepare for an interview"></a>👀 How to prepare for an interview</h2><p>Try using ChatGPT as your mock interviewer with this prompt:</p><pre><code>  Act as an interviewer. I got shortlisted for the position of a [job post] at a renowned [type of company] so I want to prepare accordingly. Don&#39;t reply to this prompt all at once, follow a conversational style so I can give you my answers too.</code></pre><h2 id="How-to-craft-a-customer-journey-process"><a href="#How-to-craft-a-customer-journey-process" class="headerlink" title="How to craft a customer-journey process"></a>How to craft a customer-journey process</h2><p>Understanding your ideal customer’s journey in choosing your product is key when crafting a marketing strategy.</p><p>Try this prompt below:</p><pre><code>  I want to create and launch [product] called [name]. Apply the &quot;hook model&quot; by Nir Eyal to explain the customer journey in purchasing the [product].  I want to create and launch a new soft drink called FizzPop. Apply the &quot;hook model&quot; by NirEyal to explain the customer journey in purchasing the drink.</code></pre><h2 id="ow-to-create-an-ad-script"><a href="#ow-to-create-an-ad-script" class="headerlink" title="ow to create an ad script"></a>ow to create an ad script</h2><p>If you want a script for an ad that you’re working on, ChatGPT can help.</p><p>Try this prompt below:</p><pre><code>  Write a 1 minute advertisement script for [product], called [product name]. I want the ad to highlight the product as [intended use of the product].  Write a 1 minute advertisement script for canned water, called Eco-Water. I want the ad to highlight the product as an alternative to single use plastics as the more eco-friendly option.</code></pre><hr><h1 id="🧠-AI-tools-to-supercharge-your-productivity"><a href="#🧠-AI-tools-to-supercharge-your-productivity" class="headerlink" title="🧠 AI tools to supercharge your productivity"></a>🧠 AI tools to supercharge your productivity</h1><h2 id="AI-Scout-AI-Directory"><a href="#AI-Scout-AI-Directory" class="headerlink" title="AI Scout - AI Directory"></a><a href="hhttps://aiscout.net/">AI Scout</a> - AI Directory</h2><p>Free AI tool directory featuring hundreds of AI tools across dozens of categories, empowering businesses, developers, students, and freelancers to easily discover and compare the latest AI apps.</p><h2 id="Aiko-Transcriptions"><a href="#Aiko-Transcriptions" class="headerlink" title="Aiko - Transcriptions"></a><a href="https://sindresorhus.com/aiko">Aiko</a> - Transcriptions</h2><p>An AI-powered transcription app that converts speech to text with exceptional accuracy and ease:</p><p>• High quality on-device transcription• 100+ languages• Ensures user privacy</p><h2 id="Reemix"><a href="#Reemix" class="headerlink" title="Reemix"></a><a href="https://reemix.co/">Reemix</a></h2><p>An AI-powered Discord bot that transforms text prompts into captivating three-second videos. Try it <a href="https://reemix.co/">here</a>.</p><h2 id="LingoSync-AI"><a href="#LingoSync-AI" class="headerlink" title="LingoSync AI"></a><a href="https://lingosync.ai/">LingoSync AI</a></h2><p>An AI-powered tool that provides video translation services for over 40 languages, catering to various industries, such as e-learning, social media marketing, and customer engagement. Try it <a href="https://lingosync.ai/">here</a>.</p><h2 id="Raycast-AI"><a href="#Raycast-AI" class="headerlink" title="Raycast AI"></a><a href="https://www.raycast.com/">Raycast AI</a></h2><p>An AI-powered tool to write smarter, code faster, and answer questions quicker with ChatGPT. It lets you complete tasks, calculate, share common links, and do much more. Try it <a href="https://www.raycast.com/">here</a>.</p><h2 id="LearnSmarter-AI"><a href="#LearnSmarter-AI" class="headerlink" title="LearnSmarter AI"></a><a href="https://learnsmarter.ai/">LearnSmarter AI</a></h2><p>An AI-powered platform designed to revolutionize the way you learn:• Quick Summaries• Book Recommendations• AI Chatbot</p><p>Try it <a href="https://learnsmarter.ai/">here</a>.</p><h2 id="tl-dv"><a href="#tl-dv" class="headerlink" title="tl;dv"></a><a href="https://tldv.io/">tl;dv</a></h2><p>tl;dv is here to transcribe, summarize, and mark key moments in your calls in 20+ languages. Try it <a href="https://tldv.io/">here</a></p><h2 id="Artflow-AI"><a href="#Artflow-AI" class="headerlink" title="Artflow AI"></a><a href="https://app.artflow.ai/">Artflow AI</a></h2><p>Artflow allows users to create unique animated stories using AI-generated assets, characters, and scenes. It has an easy-to-use interface that transforms storytelling into an effortless and enjoyable experience. Try it <a href="https://app.artflow.ai/">here</a></p><h2 id="Fini-AI"><a href="#Fini-AI" class="headerlink" title="Fini AI"></a><a href="https://www.usefini.com/">Fini AI</a></h2><p>An AI tool to transform your knowledge base into an AI chat agent for customer support, providing instant answers and a seamless user experience without any integration required. Try it <a href="https://www.usefini.com/">here</a>.Scribe (sponsored)</p><h2 id="Scribe"><a href="#Scribe" class="headerlink" title="Scribe"></a><a href="https://scribehow.com/">Scribe</a></h2><p>Scribe AI automates the most dreaded part of your job: documenting processes. Scribe AI automatically creates SOPs, help centers, new user guides, and process overviews for any business process. Try it <a href="https://scribehow.com/">here</a>.</p>]]></content>
    
    
      
      
    <summary type="html">&lt;h2 id=&quot;How-to-find-better-talent-faster&quot;&gt;&lt;a href=&quot;#How-to-find-better-talent-faster&quot; class=&quot;headerlink&quot; title=&quot;How to find better talent fa</summary>
      
    
    
    
    <category term="Open AI" scheme="https://blog.pablo-magro-gaspar.site/categories/Open-AI/"/>
    
    
    <category term="Prompts" scheme="https://blog.pablo-magro-gaspar.site/tags/Prompts/"/>
    
  </entry>
  
  <entry>
    <title>React Hooks - Some React Hooks Explained</title>
    <link href="https://blog.pablo-magro-gaspar.site/2023/04/14/React-Hooks-All-React-Hooks-Explained/"/>
    <id>https://blog.pablo-magro-gaspar.site/2023/04/14/React-Hooks-All-React-Hooks-Explained/</id>
    <published>2023-04-14T21:31:01.000Z</published>
    <updated>2026-04-14T20:03:04.027Z</updated>
    
    <content type="html"><![CDATA[<h1 id="Built-in-React-Hooks"><a href="#Built-in-React-Hooks" class="headerlink" title="Built-in React Hooks"></a><a href="https://react.dev/reference/react">Built-in React Hooks</a></h1><p>Hooks are a new addition in <a href="https://legacy.reactjs.org/blog/2019/02/06/react-v16.8.0.html">React 16.8</a>. They let you use state and other React features without writing a class. Tey are build-in in the chore of React.</p><p>One of the benefits of React is that it does for you, if you determine some sort of system to manage the state of the application</p><p>Changing the state of the application and as you change the state of the application the webpage itself re-renders automatically to show the new values.</p><h1 id="List-of-Hooks"><a href="#List-of-Hooks" class="headerlink" title="List of Hooks"></a>List of Hooks</h1><ol><li><a href="#state-hooks">State Hooks</a><ol><li><a href="#useState">useState</a></li><li><a href="#useReducer">useReducer</a></li></ol></li><li><a href="#Effect-Hooks">Effect Hooks</a><ol><li><a href="#useEffect">useEffect</a></li><li><a href="#useLayoutEffect">useLayoutEffect</a></li></ol></li><li><a href="#Ref-Hooks">Ref Hooks</a><ol><li><a href="#useRef">useRef</a></li></ol></li><li><a href="#Context-Hooks">Context Hooks</a><ol><li><a href="#useContext">useContext</a></li></ol></li><li><a href="performance-hooks">Performance Hooks</a><ol><li><a href="#useMemo">useMemo</a></li><li><a href="#useCallback">useCallback</a></li><li><a href="#useDeferredValue">useDeferredValue</a></li></ol></li><li><a href="#other-hooks">Other Hooks</a><ol><li><a href="#useDebugValue">useDebugValue</a></li></ol></li></ol><h2 id="State-Hooks"><a href="#State-Hooks" class="headerlink" title="State Hooks"></a><a href="https://react.dev/reference/react#state-hooks">State Hooks</a><a id="state-hooks"></a></h2><p>To add state to a component, use one of these Hooks:</p><ul><li><p><code>useState</code> declares a state variable that you can update directly.</p></li><li><p><code>useReducer</code> declares a state variable with the update logic inside a reducer function</p></li></ul><h3 id="useState"><a href="#useState" class="headerlink" title="useState"></a><a href="https://react.dev/reference/react/useState">useState</a><a id="useState"></a></h3><p>useState is a React Hook that lets you add a state variable to your <code>component</code>.</p><pre><code>When data changes re-render de UI</code></pre><h4 id="An-example-of-using-useState"><a href="#An-example-of-using-useState" class="headerlink" title="An example of using useState"></a>An example of using useState</h4><figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment">// Reactive value, setter</span></span><br><span class="line"><span class="keyword">const</span> [state, setState] = <span class="title function_">useState</span>(initialState);</span><br><span class="line"></span><br><span class="line"></span><br><span class="line"><span class="comment">// A function example</span></span><br><span class="line"><span class="keyword">function</span> <span class="title function_">UseStateEffect</span>(<span class="params"></span>) &#123;</span><br><span class="line">  <span class="keyword">const</span> [data, setData] = <span class="title function_">useState</span>(<span class="string">&quot;&quot;</span>);</span><br><span class="line">  <span class="keyword">const</span> [inputValue, setInputValue] = <span class="title function_">useState</span>(<span class="string">&quot;&quot;</span>);</span><br><span class="line"></span><br><span class="line">  <span class="keyword">let</span> <span class="title function_">onChange</span> = (<span class="params">event</span>) =&gt; &#123;</span><br><span class="line">    <span class="keyword">const</span> newValue = event.<span class="property">target</span>.<span class="property">value</span></span><br><span class="line">    <span class="title function_">setInputValue</span>(newValue);</span><br><span class="line">  &#125;</span><br><span class="line"></span><br><span class="line">  <span class="title function_">useEffect</span>(<span class="function">() =&gt;</span> &#123;</span><br><span class="line">    <span class="title function_">getDummyData</span>(<span class="keyword">async</span> () =&gt; &#123;</span><br><span class="line">      <span class="keyword">const</span> &#123; data&#125; = <span class="keyword">await</span> axios.<span class="title function_">get</span>(<span class="string">&quot;https://jsonplaceholder.typicode.com/comments&quot;</span>)</span><br><span class="line">      <span class="title function_">setData</span>(response.<span class="property">data</span>[<span class="number">0</span>].<span class="property">email</span>);</span><br><span class="line">      <span class="variable language_">console</span>.<span class="title function_">log</span>(<span class="string">&quot;API WAS CALLED&quot;</span>);</span><br><span class="line">    &#125;)</span><br><span class="line">  &#125;, []);</span><br><span class="line"></span><br><span class="line">  <span class="keyword">return</span> (</span><br><span class="line">    <span class="language-xml"><span class="tag">&lt;<span class="name">div</span>&gt;</span></span></span><br><span class="line"><span class="language-xml">      <span class="tag">&lt;<span class="name">input</span> <span class="attr">placeholder</span> = <span class="string">&quot;Enter something...&quot;</span> <span class="attr">onChange</span>=<span class="string">&#123;onChange&#125;</span> /&gt;</span></span></span><br><span class="line"><span class="language-xml">      &#123;inputValue&#125;</span></span><br><span class="line"><span class="language-xml">      &#123;/* <span class="tag">&lt;<span class="name">h1</span>&gt;</span>&#123;data&#125;<span class="tag">&lt;/<span class="name">h1</span>&gt;</span> */&#125;</span></span><br><span class="line"><span class="language-xml">    <span class="tag">&lt;/<span class="name">div</span>&gt;</span></span></span><br><span class="line">  );</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line"><span class="keyword">export</span> <span class="keyword">default</span> <span class="title class_">UseStateEffect</span>;</span><br></pre></td></tr></table></figure><h3 id="useReducer"><a href="#useReducer" class="headerlink" title="useReducer"></a><a href="https://react.dev/reference/react/useReducer">useReducer</a><a id="useReducer"></a></h3><p>It’s an alternative to the useState, which form me is less cleaner and adding extra complexity. <code>I wouldn&#39;t use</code> <code>Redux</code> is more complex rather than use <code>setState</code> to manage the state when it grows.</p><p>Declares a state variable with the update logic inside a <a href="https://react.dev/learn/extracting-state-logic-into-a-reducer">reducer function</a>.</p><p>Call useReducer at the top level of your component to manage its state with a reducer.</p><h4 id="An-example-of-using-useReduce"><a href="#An-example-of-using-useReduce" class="headerlink" title="An example of using useReduce"></a>An example of using useReduce</h4><figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment">// Similar to set state, but a different way to set/manage state using the REDUX pattern.</span></span><br><span class="line"><span class="title function_">useReducer</span>(reducer, initialArg, init?)</span><br><span class="line"></span><br><span class="line"><span class="comment">// An example</span></span><br><span class="line"><span class="keyword">const</span> <span class="title function_">reducer</span> = (<span class="params">state, action</span>) =&gt; &#123;</span><br><span class="line">  <span class="keyword">switch</span> (action.<span class="property">type</span>) &#123;</span><br><span class="line">    <span class="keyword">case</span> <span class="string">&quot;INCREMENT&quot;</span>:</span><br><span class="line">      <span class="keyword">return</span> &#123; <span class="attr">count</span>: state.<span class="property">count</span> + <span class="number">1</span>, <span class="attr">showText</span>: state.<span class="property">showText</span> &#125;;</span><br><span class="line">    <span class="keyword">case</span> <span class="string">&quot;toggleShowText&quot;</span>:</span><br><span class="line">      <span class="keyword">return</span> &#123; <span class="attr">count</span>: state.<span class="property">count</span>, <span class="attr">showText</span>: !state.<span class="property">showText</span> &#125;;</span><br><span class="line">    <span class="attr">default</span>:</span><br><span class="line">      <span class="keyword">return</span> state;</span><br><span class="line">  &#125;</span><br><span class="line">&#125;;</span><br><span class="line"></span><br><span class="line"><span class="keyword">const</span> <span class="title function_">UseReducer</span> = (<span class="params"></span>) =&gt; &#123;</span><br><span class="line">  <span class="keyword">const</span> [state, dispatch] = <span class="title function_">useReducer</span>(reducer, &#123; <span class="attr">count</span>: <span class="number">0</span>, <span class="attr">showText</span>: <span class="literal">true</span> &#125;);</span><br><span class="line"></span><br><span class="line">  <span class="keyword">return</span> (</span><br><span class="line">    <span class="language-xml"><span class="tag">&lt;<span class="name">div</span>&gt;</span></span></span><br><span class="line"><span class="language-xml">      <span class="tag">&lt;<span class="name">h1</span>&gt;</span>&#123;state.count&#125;<span class="tag">&lt;/<span class="name">h1</span>&gt;</span></span></span><br><span class="line"><span class="language-xml">      <span class="tag">&lt;<span class="name">button</span></span></span></span><br><span class="line"><span class="tag"><span class="language-xml">        <span class="attr">onClick</span>=<span class="string">&#123;()</span> =&gt;</span> &#123;</span></span><br><span class="line"><span class="language-xml">          dispatch(&#123; type: &quot;INCREMENT&quot; &#125;);</span></span><br><span class="line"><span class="language-xml">          dispatch(&#123; type: &quot;toggleShowText&quot; &#125;);</span></span><br><span class="line"><span class="language-xml">        &#125;&#125;</span></span><br><span class="line"><span class="language-xml">      &gt;</span></span><br><span class="line"><span class="language-xml">        Click Here</span></span><br><span class="line"><span class="language-xml">      <span class="tag">&lt;/<span class="name">button</span>&gt;</span></span></span><br><span class="line"><span class="language-xml"></span></span><br><span class="line"><span class="language-xml">      &#123;state.showText &amp;&amp; <span class="tag">&lt;<span class="name">p</span>&gt;</span>This is a text<span class="tag">&lt;/<span class="name">p</span>&gt;</span>&#125;</span></span><br><span class="line"><span class="language-xml">    <span class="tag">&lt;/<span class="name">div</span>&gt;</span></span></span><br><span class="line">  );</span><br><span class="line">&#125;;</span><br><span class="line"></span><br></pre></td></tr></table></figure><hr><h2 id="Effect-Hooks"><a href="#Effect-Hooks" class="headerlink" title="Effect Hooks"></a><a href="https://react.dev/reference/react#effect-hooks">Effect Hooks</a><a id="Effect-Hooks"></a></h2><p>Effects let a component connect to and synchronize with external systems. This includes dealing with network, browser DOM, animations, widgets written using a different UI library, and other non-React code.</p><ul><li><code>useEffect</code> connects a component to an external system.</li></ul><p>Effects are an “escape hatch” from the React paradigm. Don’t use Effects to orchestrate the data flow of your application. If you’re not interacting with an external system, <a href="https://react.dev/learn/you-might-not-need-an-effect">you might not need an Effect</a>.</p><p>There are two rarely used variations of <code>useEffect</code> with differences in timing:</p><ul><li><code>useLayoutEffect</code> fires before the browser repaints the screen. You can measure layout here.</li><li><a href="https://react.dev/reference/react/useInsertionEffect">useInsertionEffect</a> fires before React makes changes to the DOM. Libraries can insert dynamic CSS here.</li></ul><h3 id="useEffect"><a href="#useEffect" class="headerlink" title="useEffect"></a><a href="https://react.dev/reference/react/useEffect"><strong>useEffect</strong></a><a id="useEffect"></a></h3><p><code>useEffect</code> is a React Hook that lets you <a href="https://react.dev/learn/synchronizing-with-effects">synchronize a component with an external system</a>.</p><pre><code>  useEffect(setup, dependencies?)</code></pre><h4 id="An-example-of-using-useEffect"><a href="#An-example-of-using-useEffect" class="headerlink" title="An example of using useEffect"></a>An example of using useEffect</h4><p>Call <code>useEffect</code> at the top level of your component to declare an Effect:</p><figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">import</span> &#123; useEffect &#125; <span class="keyword">from</span> <span class="string">&#x27;react&#x27;</span>;</span><br><span class="line"><span class="keyword">import</span> &#123; createConnection &#125; <span class="keyword">from</span> <span class="string">&#x27;./chat.js&#x27;</span>;</span><br><span class="line"></span><br><span class="line"><span class="keyword">function</span> <span class="title function_">ChatRoom</span>(<span class="params">&#123; roomId &#125;</span>) &#123;</span><br><span class="line">  <span class="comment">// Reactive value, setter</span></span><br><span class="line">  <span class="keyword">const</span> [serverUrl, setServerUrl] = <span class="title function_">useState</span>(<span class="string">&#x27;https://localhost:1234&#x27;</span>);</span><br><span class="line"></span><br><span class="line">  <span class="title function_">useEffect</span>(</span><br><span class="line">    <span class="function">() =&gt;</span> &#123;</span><br><span class="line">      <span class="comment">// RUN when mounted and when state changes (2).</span></span><br><span class="line">      <span class="comment">// alert(&quot;Hello side effect!&quot;)</span></span><br><span class="line">      <span class="keyword">const</span> connection = <span class="title function_">createConnection</span>(serverUrl, roomId);</span><br><span class="line">      connection.<span class="title function_">connect</span>();</span><br><span class="line">      <span class="comment">// RUN before the component is removed from the DOM</span></span><br><span class="line">      <span class="keyword">return</span> <span class="function">() =&gt;</span> &#123;</span><br><span class="line">        connection.<span class="title function_">disconnect</span>();</span><br><span class="line">      &#125;;</span><br><span class="line">    &#125;,</span><br><span class="line">    <span class="comment">// Array of dependencies, with [] there is no dependencies, it&#x27;s triggered once.</span></span><br><span class="line">    <span class="comment">// RUN when serverUrl or roomId change.</span></span><br><span class="line">    [serverUrl, roomId]</span><br><span class="line">  );</span><br><span class="line">  <span class="comment">// ...</span></span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure><h2 id="useLayoutEffect"><a href="#useLayoutEffect" class="headerlink" title="useLayoutEffect"></a><a href="https://react.dev/reference/react/useLayoutEffect"><strong>useLayoutEffect</strong></a><a id="useLayoutEffect"></a></h2><h2 style="color: red; font-weight: bold;">Pitfall: <span style="color: black; font-weight: normal;">useLayoutEffect can hurt performance. Prefer  <a href="[Ref-Hooks](https://react.dev/reference/react/useEffect)">useEffect</a> when possible</span></h2><ul><li><strong>Similar</strong> to <strong>useEffect</strong> but</li><li><strong>RUNS</strong> after render, but before pointing the script.</li><li><strong>CAUTION</strong> blocks visual updates until your callback is finished.</li></ul><p>useLayoutEffect is a version of <a href="https://react.dev/reference/react/useEffect">useEffect</a> that fires before the browser repaints the screen.</p><pre><code>useLayoutEffect(setup, dependencies?)</code></pre><h4 id="An-example-of-using-useLayoutEffect"><a href="#An-example-of-using-useLayoutEffect" class="headerlink" title="An example of using useLayoutEffect"></a>An example of using useLayoutEffect</h4><p>Call <code>useLayoutEffect</code> perform the layout measurements before the browser repaints the screen:</p><figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">import</span> <span class="title class_">React</span>, &#123; useState, useLayoutEffect, useRef &#125; <span class="keyword">from</span> <span class="string">&#x27;react&#x27;</span>;</span><br><span class="line"></span><br><span class="line"><span class="keyword">function</span> <span class="title function_">MyComponent</span>(<span class="params"></span>) &#123;</span><br><span class="line">  <span class="keyword">const</span> [width, setWidth] = <span class="title function_">useState</span>(<span class="number">0</span>);</span><br><span class="line">  <span class="keyword">const</span> ref = <span class="title function_">useRef</span>(<span class="literal">null</span>);</span><br><span class="line"></span><br><span class="line">  <span class="comment">/* ***************************************************************</span></span><br><span class="line"><span class="comment">   * Similar to useEffect, but</span></span><br><span class="line"><span class="comment">   * RUNS after render, but before pointing the script.</span></span><br><span class="line"><span class="comment">   * CAUTION blocks visual updates until your callback is finished</span></span><br><span class="line"><span class="comment">   * *************************************************************** */</span></span><br><span class="line"></span><br><span class="line">  <span class="comment">// Use useLayoutEffect to measure the width of the element</span></span><br><span class="line">  <span class="title function_">useLayoutEffect</span>(<span class="function">() =&gt;</span> &#123;</span><br><span class="line">    <span class="keyword">if</span> (ref.<span class="property">current</span>) &#123;</span><br><span class="line">      <span class="keyword">const</span> newWidth = ref.<span class="property">current</span>.<span class="title function_">getBoundingClientRect</span>().<span class="property">width</span>;</span><br><span class="line">      <span class="title function_">setWidth</span>(newWidth);</span><br><span class="line">    &#125;</span><br><span class="line">  &#125;, []);</span><br><span class="line"></span><br><span class="line">  <span class="keyword">return</span> (</span><br><span class="line">    <span class="language-xml"><span class="tag">&lt;<span class="name">div</span> <span class="attr">ref</span>=<span class="string">&#123;ref&#125;</span>&gt;</span></span></span><br><span class="line"><span class="language-xml">      This element has a width of &#123;width&#125;px.</span></span><br><span class="line"><span class="language-xml">    <span class="tag">&lt;/<span class="name">div</span>&gt;</span></span></span><br><span class="line">  );</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure><p>Note that <code>useLayoutEffect</code> should be used sparingly, as it can negatively impact the performance of your application if used excessively or inefficiently. You should only use <code>useLayoutEffect</code> when you need to perform a measurement or layout calculation that affects the visual appearance of your application.</p><ul><li><a href="https://react.dev/reference/react/useLayoutEffect#reference">Reference</a><ul><li><a href="https://react.dev/reference/react/useLayoutEffect#useinsertioneffect">useLayoutEffect(setup, dependencies?)</a></li></ul></li><li><a href="https://react.dev/reference/react/useLayoutEffect#usage">Usage</a><ul><li><a href="https://react.dev/reference/react/useLayoutEffect#measuring-layout-before-the-browser-repaints-the-screen">Measuring layout before the browser repaints the screen</a></li></ul></li><li><a href="https://react.dev/reference/react/useLayoutEffect#troubleshooting">Troubleshooting</a><ul><li><a href="https://react.dev/reference/react/useLayoutEffect#im-getting-an-error-uselayouteffect-does-nothing-on-the-server">I’m getting an error: ”useLayoutEffect does nothing on the server”</a></li></ul></li></ul><h2 id="Ref-Hooks"><a href="#Ref-Hooks" class="headerlink" title="Ref Hooks "></a><a href="https://react.dev/reference/react#effect-hooks">Ref Hooks</a> <a id="Ref-Hooks"></a></h2><p><em>Refs</em> let a component <a href="https://react.dev/learn/referencing-values-with-refs">hold some information that isn’t used for rendering,</a> like a DOM node or a timeout ID. Unlike with state, updating a ref does not re-render your component. Refs are an “escape hatch” from the React paradigm. They are useful when you need to work with non-React systems, such as the built-in browser APIs.</p><ul><li><a href="https://react.dev/reference/react/useRef">useRef</a> declares a ref. You can hold any value in it, but most often it’s used to hold a DOM node.</li><li><a href="https://react.dev/reference/react/useImperativeHandle">useImperativeHandle</a> lets you customize the ref exposed by your component. This is rarely used.</li></ul><p>Easiest way to manipulate and access DOM elements.</p><h3 id="useRef"><a href="#useRef" class="headerlink" title="useRef"></a><a href="https://react.dev/reference/react/useRef">useRef</a><a id="useRef"></a></h3><p>useRef is a React Hook that lets you reference a value that’s not needed for rendering.</p><pre><code>  const ref = useRef(initialValue)</code></pre><h4 id="An-example-of-using-useRef"><a href="#An-example-of-using-useRef" class="headerlink" title="An example of using useRef"></a>An example of using useRef</h4><p>Use the <code>useRef</code> hook in a React component to store a reference to a DOM element:</p><figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">import</span> <span class="title class_">React</span>, &#123; useRef &#125; <span class="keyword">from</span> <span class="string">&#x27;react&#x27;</span>;</span><br><span class="line"></span><br><span class="line"><span class="keyword">function</span> <span class="title function_">MyComponent</span>(<span class="params"></span>) &#123;</span><br><span class="line">  <span class="keyword">const</span> inputRef = <span class="title function_">useRef</span>(<span class="literal">null</span>);</span><br><span class="line"></span><br><span class="line">  <span class="keyword">function</span> <span class="title function_">handleButtonClick</span>(<span class="params"></span>) &#123;</span><br><span class="line">    <span class="comment">// Focus the input element</span></span><br><span class="line">    inputRef.<span class="property">current</span>.<span class="title function_">focus</span>();</span><br><span class="line">  &#125;</span><br><span class="line"></span><br><span class="line">  <span class="keyword">return</span> (</span><br><span class="line">    <span class="language-xml"><span class="tag">&lt;<span class="name">div</span>&gt;</span></span></span><br><span class="line"><span class="language-xml">      <span class="tag">&lt;<span class="name">input</span> <span class="attr">type</span>=<span class="string">&quot;text&quot;</span> <span class="attr">placeholder</span>=<span class="string">&quot;Example...&quot;</span> <span class="attr">ref</span>=<span class="string">&#123;inputRef&#125;</span> /&gt;</span></span></span><br><span class="line"><span class="language-xml">      <span class="tag">&lt;<span class="name">button</span> <span class="attr">onClick</span>=<span class="string">&#123;handleButtonClick&#125;</span>&gt;</span>Focus input<span class="tag">&lt;/<span class="name">button</span>&gt;</span></span></span><br><span class="line"><span class="language-xml">    <span class="tag">&lt;/<span class="name">div</span>&gt;</span></span></span><br><span class="line">  );</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure><p>By using the <code>useRef</code> hook to store a reference to the input element, we can avoid the need to rely on DOM queries or selectors to manipulate the input element, which can be slower and less reliable. Instead, we can directly access the input element using the <code>current</code> property of the <code>inputRef</code> object.</p><ul><li><a href="https://react.dev/reference/react/useRef#reference">Reference</a><ul><li><a href="https://react.dev/reference/react/useRef#useref">useRef(initialValue)</a></li></ul></li><li><a href="https://react.dev/reference/react/useRef#usage">Usage</a><ul><li><a href="https://react.dev/reference/react/useRef#referencing-a-value-with-a-ref">Referencing a value with a ref</a></li><li><a href="https://react.dev/reference/react/useRef#manipulating-the-dom-with-a-ref">Manipulating the DOM with a ref</a></li><li><a href="https://react.dev/reference/react/useRef#avoiding-recreating-the-ref-contents">Avoiding recreating the ref contents</a></li></ul></li><li><a href="https://react.dev/reference/react/useRef#troubleshooting">Troubleshooting</a><ul><li><a href="https://react.dev/reference/react/useRef#i-cant-get-a-ref-to-a-custom-component">I can’t get a ref to a custom component</a></li></ul></li></ul><p>Creating a some short of to-do application, clear an input file when submitted the value</p><hr><h2 id="Context-Hooks"><a href="#Context-Hooks" class="headerlink" title="Context Hooks "></a><a href="https://react.dev/reference/react#context-hooks">Context Hooks</a> <a name="Context-Hooks"></a></h2><p><em>Context</em> lets a component <a href="https://react.dev/learn/passing-props-to-a-component">receive information from distant parents without passing it as props.</a> For example, your app’s top-level component can pass the current UI theme to all components below, no matter how deep.</p><ul><li><a href="https://react.dev/reference/react/useContext">useContext</a> reads and subscribes to a context.</li></ul><h3 id="useContext"><a href="#useContext" class="headerlink" title="useContext "></a><a href="https://react.dev/reference/react/useContext"><strong>useContext</strong></a> <a name="useContext"></a></h3><p>To share value through disconnected components, we can create a context object.</p><p><em>useContext</em> is a React Hook that lets you read and subscribe to <a href="https://react.dev/learn/passing-data-deeply-with-context">context</a> from your component.</p><pre><code>  const value = useContext(SomeContext)</code></pre><h4 id="Examples-of-using-useContext"><a href="#Examples-of-using-useContext" class="headerlink" title="Examples of using useContext"></a>Examples of using useContext</h4><figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">import</span> &#123; createContext, useContext &#125; <span class="keyword">from</span> <span class="string">&quot;react&quot;</span>;</span><br><span class="line"></span><br><span class="line"><span class="keyword">const</span> moods = &#123;</span><br><span class="line">  <span class="attr">happy</span>: <span class="string">&quot;😄&quot;</span>,</span><br><span class="line">  <span class="attr">sad</span>: <span class="string">&quot;😒&quot;</span>,</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line"><span class="comment">// To share value through disconnected components, we can create a context object.</span></span><br><span class="line"><span class="comment">// CONTEXT share data without passing props. during the entire component tree.</span></span><br><span class="line"><span class="keyword">const</span> <span class="title class_">MoodContext</span> = <span class="title function_">createContext</span>(moods)</span><br><span class="line"></span><br><span class="line"><span class="keyword">function</span> <span class="title function_">MoodEmoji</span>(<span class="params"></span>) &#123;</span><br><span class="line">  <span class="comment">// Consume value from nearest parent provider.</span></span><br><span class="line">  <span class="keyword">const</span> mood = <span class="title function_">useContext</span>(<span class="title class_">MoodContext</span>)</span><br><span class="line"></span><br><span class="line">  <span class="keyword">return</span> <span class="language-xml"><span class="tag">&lt;<span class="name">p</span>&gt;</span>&#123; mood.happy &#125;<span class="tag">&lt;/<span class="name">p</span>&gt;</span></span></span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line"><span class="keyword">function</span> <span class="title function_">ReactHooksExplained</span> () &#123;</span><br><span class="line">  <span class="comment">// Get the context value.</span></span><br><span class="line">  <span class="keyword">const</span> <span class="title class_">MoodContextValue</span> = <span class="title function_">useContext</span>(<span class="title class_">MoodContext</span>);</span><br><span class="line"></span><br><span class="line">  <span class="keyword">return</span> (</span><br><span class="line">    <span class="comment">// Create context to scope the mood there,</span></span><br><span class="line">    <span class="comment">// and not need to use pass props down to the child components.</span></span><br><span class="line">    <span class="language-xml"><span class="tag">&lt;<span class="name">MoodContext.Provider</span> <span class="attr">value</span>=<span class="string">&#123;MoodContextValue&#125;</span>&gt;</span></span></span><br><span class="line"><span class="language-xml">      <span class="tag">&lt;<span class="name">MoodEmoji</span> /&gt;</span></span></span><br><span class="line"><span class="language-xml">    <span class="tag">&lt;/<span class="name">MoodContext.Provider</span>&gt;</span></span></span><br><span class="line">  );</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure><figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">const</span> <span class="title class_">ThemeContext</span> = <span class="title class_">React</span>.<span class="title function_">createContext</span>(<span class="string">&#x27;light&#x27;</span>);</span><br><span class="line"></span><br><span class="line"><span class="keyword">const</span> <span class="title function_">Display</span> = (<span class="params"></span>) =&gt; &#123;</span><br><span class="line"> <span class="keyword">const</span> theme = <span class="title function_">useContext</span>(<span class="title class_">ThemeContext</span>);</span><br><span class="line"> <span class="keyword">return</span> <span class="language-xml"><span class="tag">&lt;<span class="name">div</span></span></span></span><br><span class="line"><span class="tag"><span class="language-xml">        <span class="attr">style</span>=<span class="string">&#123;&#123;</span></span></span></span><br><span class="line"><span class="tag"><span class="language-xml">        <span class="attr">background:</span> <span class="attr">theme</span> === <span class="string">&#x27;dark&#x27;</span> ? &#x27;<span class="attr">black</span>&#x27; <span class="attr">:</span> &#x27;<span class="attr">papayawhip</span>&#x27;,</span></span></span><br><span class="line"><span class="tag"><span class="language-xml">        <span class="attr">color:</span> <span class="attr">theme</span> === <span class="string">&#x27;dark&#x27;</span> ? &#x27;<span class="attr">white</span>&#x27; <span class="attr">:</span> &#x27;<span class="attr">palevioletred</span>&#x27;,</span></span></span><br><span class="line"><span class="tag"><span class="language-xml">        <span class="attr">width:</span> &#x27;<span class="attr">100</span>%&#x27;,</span></span></span><br><span class="line"><span class="tag"><span class="language-xml">        <span class="attr">minHeight:</span> &#x27;<span class="attr">200px</span>&#x27;</span></span></span><br><span class="line"><span class="tag"><span class="language-xml">        &#125;&#125;</span></span></span><br><span class="line"><span class="tag"><span class="language-xml">    &gt;</span></span></span><br><span class="line"><span class="language-xml">        &#123;&#x27;The theme here is &#x27; + theme&#125;</span></span><br><span class="line"><span class="language-xml">    <span class="tag">&lt;/<span class="name">div</span>&gt;</span></span></span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure><ul><li><a href="https://react.dev/reference/react/useContext#reference">Reference</a><ul><li><a href="https://react.dev/reference/react/useContext#usecontext">useContext(SomeContext)</a></li></ul></li><li><a href="https://react.dev/reference/react/useContext#usage">Usage</a><ul><li><a href="https://react.dev/reference/react/useContext#passing-data-deeply-into-the-tree">Passing data deeply into the tree</a></li><li><a href="https://react.dev/reference/react/useContext#updating-data-passed-via-context">Updating data passed via context</a></li><li><a href="https://react.dev/reference/react/useContext#specifying-a-fallback-default-value">Specifying a fallback default value</a></li><li><a href="https://react.dev/reference/react/useContext#overriding-context-for-a-part-of-the-tree">Overriding context for a part of the tree</a></li><li><a href="https://react.dev/reference/react/useContext#optimizing-re-renders-when-passing-objects-and-functions">Optimizing re-renders when passing objects and functions</a></li></ul></li><li><a href="https://react.dev/reference/react/useContext#troubleshooting">Troubleshooting</a><ul><li><a href="https://react.dev/reference/react/useContext#my-component-doesnt-see-the-value-from-my-provider">My component doesn’t see the value from my provider</a></li><li><a href="https://react.dev/reference/react/useContext#i-am-always-getting-undefined-from-my-context-although-the-default-value-is-different">I am always getting undefined from my context although the default value is different</a></li></ul></li></ul><h2 id="Performance-Hooks"><a href="#Performance-Hooks" class="headerlink" title="Performance Hooks "></a><a href="https://react.dev/reference/react#performance-hooks"><strong>Performance Hooks</strong></a> <a name="performance-hooks"></a></h2><p>A common way to optimize re-rendering performance is to skip unnecessary work. For example, you can tell React to reuse a cached calculation or to skip a re-render if the data has not changed since the previous render.</p><p>To skip calculations and unnecessary re-rendering, use one of these Hooks:</p><ul><li><a href="https://react.dev/reference/react/useMemo">useMemo</a> lets you cache the result of an expensive calculation.</li><li><a href="https://react.dev/reference/react/useCallback">useCallback</a> lets you cache a function definition before passing it down to an optimized component.</li></ul><p>Sometimes, you can’t skip re-rendering because the screen actually needs to update. In that case, you can improve performance by separating blocking updates that must be synchronous (like typing into an input) from non-blocking updates which don’t need to block the user interface (like updating a chart).</p><p>To prioritize rendering, use one of these Hooks:</p><ul><li><a href="https://react.dev/reference/react/useTransition">useTransition</a> lets you mark a state transition as non-blocking and allow other updates to interrupt it.</li><li><a href="https://react.dev/reference/react/useDeferredValue">useDeferredValue</a> lets you defer updating a non-critical part of the UI and let other parts update first.</li></ul><h3 id="useMemo"><a href="#useMemo" class="headerlink" title="useMemo "></a><a href="https://react.dev/reference/react/useMemo"><strong>useMemo</strong></a> <a name="useMemo"></a></h3><p>useMemo is a React Hook that lets you cache the result of a calculation between re-renders.</p><ul><li><strong>MEMOIZATION</strong>: cache result of function call, to optimize performance</li><li><strong>CAUTION</strong>: this only used as needed for expensive computations</li></ul><h4 id="An-example-of-using-useMemo"><a href="#An-example-of-using-useMemo" class="headerlink" title="An example of using useMemo"></a>An example of using useMemo</h4><figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment">// When data changes re-render de UI</span></span><br><span class="line"><span class="keyword">const</span> [count, setCount] = <span class="title function_">useState</span>(<span class="number">0</span>)</span><br><span class="line"></span><br><span class="line"><span class="comment">// MEMOIZATION: cache result of function call, to optimize performance</span></span><br><span class="line"><span class="comment">// CAUTION: this only used as needed for expensive computations</span></span><br><span class="line"><span class="keyword">const</span> expensiveCount = <span class="title function_">useMemo</span>(<span class="function">() =&gt;</span> &#123;</span><br><span class="line">  <span class="keyword">return</span> count ** <span class="number">2</span></span><br><span class="line">&#125;, [count]) <span class="comment">// RECOMPUTE: when count changes</span></span><br><span class="line"></span><br><span class="line"><span class="keyword">return</span> (</span><br><span class="line">    <span class="language-xml"><span class="tag">&lt;<span class="name">div</span> <span class="attr">className</span>=<span class="string">&quot;App&quot;</span>&gt;</span></span></span><br><span class="line"><span class="language-xml">      <span class="tag">&lt;<span class="name">div</span>&gt;</span>&#123;count&#125;<span class="tag">&lt;/<span class="name">div</span>&gt;</span></span></span><br><span class="line"><span class="language-xml">    <span class="tag">&lt;/<span class="name">div</span>&gt;</span></span></span><br><span class="line">)</span><br></pre></td></tr></table></figure><ul><li><a href="https://react.dev/reference/react/useMemo#reference">Reference</a><ul><li><a href="https://react.dev/reference/react/useMemo#usememo">useMemo(calculateValue, dependencies)</a></li></ul></li><li><a href="https://react.dev/reference/react/useMemo#usage">Usage</a><ul><li><a href="https://react.dev/reference/react/useMemo#skipping-expensive-recalculations">Skipping expensive recalculations</a></li><li><a href="https://react.dev/reference/react/useMemo#skipping-re-rendering-of-components">Skipping re-rendering of components</a></li><li><a href="https://react.dev/reference/react/useMemo#memoizing-a-dependency-of-another-hook">Memoizing a dependency of another Hook</a></li><li><a href="https://react.dev/reference/react/useMemo#memoizing-a-function">Memoizing a function</a></li></ul></li><li><a href="https://react.dev/reference/react/useMemo#troubleshooting">Troubleshooting</a><ul><li><a href="https://react.dev/reference/react/useMemo#my-calculation-runs-twice-on-every-re-render">My calculation runs twice on every re-render</a></li><li><a href="https://react.dev/reference/react/useMemo#my-usememo-call-is-supposed-to-return-an-object-but-returns-undefined">My useMemo call is supposed to return an object, but returns undefined</a></li><li><a href="https://react.dev/reference/react/useMemo#every-time-my-component-renders-the-calculation-in-usememo-re-runs">Every time my component renders, the calculation in useMemo re-runs</a></li><li><a href="https://react.dev/reference/react/useMemo#i-need-to-call-usememo-for-each-list-item-in-a-loop-but-its-not-allowed">I need to call useMemo for each list item in a loop, but it’s not allowed</a></li></ul></li></ul><h3 id="useCallback"><a href="#useCallback" class="headerlink" title="useCallback "></a><a href="https://react.dev/reference/react/useCallback"><strong>useCallback</strong></a> <a name="useCallback"></a></h3><p>useCallback is a React Hook that lets you cache a function definition between re-renders.</p><h4 id="An-example-of-useCallback"><a href="#An-example-of-useCallback" class="headerlink" title="An example of useCallback"></a>An example of useCallback</h4><p>In this example, the <code>ChildComponent</code> receives the <code>onClick</code> prop from the <code>ParentComponent</code> and uses it to handle a click event on a button element. Because the <code>onClick</code> prop is a memoized callback function, the <code>ChildComponent</code> can safely use it without needing to worry about unnecessary re-renders due to changes in the function reference.</p><figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment">// Maybe we want to memoize the function, passing the function to multiple child components,</span></span><br><span class="line"><span class="comment">// especially with big lists, wrapping the function with avoid unnecessary re-rendering in the child components</span></span><br><span class="line"><span class="comment">// because is using always the same function object.</span></span><br><span class="line"></span><br><span class="line"><span class="keyword">import</span> <span class="title class_">React</span>, &#123; useState, useCallback &#125; <span class="keyword">from</span> <span class="string">&#x27;react&#x27;</span>;</span><br><span class="line"><span class="keyword">import</span> <span class="title class_">ChildComponent</span> <span class="keyword">from</span> <span class="string">&#x27;./ChildComponent&#x27;</span>;</span><br><span class="line"></span><br><span class="line"><span class="keyword">function</span> <span class="title function_">ParentComponent</span>(<span class="params"></span>) &#123;</span><br><span class="line">  <span class="keyword">const</span> [count, setCount] = <span class="title function_">useState</span>(<span class="number">0</span>);</span><br><span class="line"></span><br><span class="line">  <span class="comment">// Define a memoized callback function using the useCallback hook</span></span><br><span class="line">  <span class="keyword">const</span> handleClick = <span class="title function_">useCallback</span>(<span class="function">() =&gt;</span> &#123;</span><br><span class="line">    <span class="title function_">setCount</span>(<span class="function"><span class="params">prevCount</span> =&gt;</span> prevCount + <span class="number">1</span>);</span><br><span class="line">  &#125;, []);</span><br><span class="line"></span><br><span class="line">  <span class="keyword">return</span> (</span><br><span class="line">    <span class="language-xml"><span class="tag">&lt;<span class="name">div</span>&gt;</span></span></span><br><span class="line"><span class="language-xml">      <span class="tag">&lt;<span class="name">p</span>&gt;</span>Count: &#123;count&#125;<span class="tag">&lt;/<span class="name">p</span>&gt;</span></span></span><br><span class="line"><span class="language-xml">      <span class="tag">&lt;<span class="name">ChildComponent</span> <span class="attr">onClick</span>=<span class="string">&#123;handleClick&#125;</span> /&gt;</span></span></span><br><span class="line"><span class="language-xml">    <span class="tag">&lt;/<span class="name">div</span>&gt;</span></span></span><br><span class="line">  );</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line"><span class="keyword">function</span> <span class="title function_">ChildComponent</span>(<span class="params">&#123; onClick &#125;</span>) &#123;</span><br><span class="line">  <span class="keyword">return</span> (</span><br><span class="line">    <span class="language-xml"><span class="tag">&lt;<span class="name">button</span> <span class="attr">onClick</span>=<span class="string">&#123;onClick&#125;</span>&gt;</span></span></span><br><span class="line"><span class="language-xml">      Click me!</span></span><br><span class="line"><span class="language-xml">    <span class="tag">&lt;/<span class="name">button</span>&gt;</span></span></span><br><span class="line">  );</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure><ul><li><a href="https://react.dev/reference/react/useCallback#reference">Reference</a><ul><li><a href="https://react.dev/reference/react/useCallback#usecallback">useCallback(fn, dependencies)</a></li></ul></li><li><a href="https://react.dev/reference/react/useCallback#usage">Usage</a><ul><li><a href="https://react.dev/reference/react/useCallback#skipping-re-rendering-of-components">Skipping re-rendering of components</a></li><li><a href="https://react.dev/reference/react/useCallback#updating-state-from-a-memoized-callback">Updating state from a memoized callback</a></li><li><a href="https://react.dev/reference/react/useCallback#preventing-an-effect-from-firing-too-often">Preventing an Effect from firing too often</a></li><li><a href="https://react.dev/reference/react/useCallback#optimizing-a-custom-hook">Optimizing a custom Hook</a></li></ul></li><li><a href="https://react.dev/reference/react/useCallback#troubleshooting">Troubleshooting</a><ul><li><a href="https://react.dev/reference/react/useCallback#every-time-my-component-renders-usecallback-returns-a-different-function">Every time my component renders, useCallback returns a different function</a></li><li><a href="https://react.dev/reference/react/useCallback#i-need-to-call-usememo-for-each-list-item-in-a-loop-but-its-not-allowed">I need to call useCallback for each list item in a loop, but it’s not allowed</a></li></ul></li></ul><h3 id="useDeferredValue"><a href="#useDeferredValue" class="headerlink" title="useDeferredValue "></a><a href="https://react.dev/reference/react/useDeferredValue"><strong>useDeferredValue</strong></a> <a name="useDeferredValue"></a></h3><p>The <code>useDeferredValue</code> Hook is a new addition to React 18 and it lets you defer updating a part of the UI.</p><pre><code>  const deferredValue = useDeferredValue(value)</code></pre><p><code>useDeferredValue</code> allows you to defer the rendering of a value until a future point in time, which can be incredibly useful in situations where you want to avoid unnecessary rendering.</p><figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">const</span> [valueToDefer, setValueToDefer] = <span class="title function_">useState</span>(<span class="string">&quot;&quot;</span>)</span><br><span class="line"><span class="keyword">const</span> deferredValue = <span class="title function_">useDeferredValue</span>(valueToDefer)</span><br><span class="line"></span><br><span class="line"><span class="keyword">return</span> (</span><br><span class="line">  <span class="language-xml"><span class="tag">&lt;<span class="name">p</span>&gt;</span>&#123;deferredValue&#125;<span class="tag">&lt;/<span class="name">p</span>&gt;</span></span></span><br><span class="line">  )</span><br></pre></td></tr></table></figure><p>By using the <code>useDeferredValue</code> Hook, you can avoid this problem by deferring the rendering of the search results until the user stops typing. This is similar to how <em>debouncing</em> works; it can dramatically improve performance.</p><p>The following example shows how to use the <code>useDeferredValue</code> Hook to simulate a debouncing pattern retrieving Star War’s characters names.</p><figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">import</span> &#123; useDeferredValue, useEffect, useState &#125; <span class="keyword">from</span> <span class="string">&quot;react&quot;</span></span><br><span class="line"></span><br><span class="line"><span class="keyword">function</span> <span class="title function_">UseDeferredHook</span>(<span class="params"></span>) &#123;</span><br><span class="line">  <span class="keyword">const</span> [searchQuery, setSearchQuery] = <span class="title function_">useState</span>(<span class="string">&#x27;&#x27;</span>)</span><br><span class="line">  <span class="keyword">const</span> deferredSearchQuery = <span class="title function_">useDeferredValue</span>(searchQuery)</span><br><span class="line">  <span class="keyword">const</span> [resultQuery, setResultQuery] = <span class="title function_">useState</span>([])</span><br><span class="line"></span><br><span class="line">  <span class="title function_">useEffect</span>(<span class="function">() =&gt;</span> &#123;</span><br><span class="line">    <span class="keyword">async</span> <span class="keyword">function</span> <span class="title function_">fetchPeople</span>(<span class="params"></span>) &#123;</span><br><span class="line">      <span class="keyword">if</span> (!searchQuery) &#123;</span><br><span class="line">        <span class="title function_">setResultQuery</span>([])</span><br><span class="line">        <span class="keyword">return</span></span><br><span class="line">      &#125;</span><br><span class="line"></span><br><span class="line">      <span class="keyword">const</span> response = <span class="keyword">await</span> <span class="title function_">fetch</span>(<span class="string">`https://swapi.dev/api/people/?search=<span class="subst">$&#123;deferredSearchQuery&#125;</span>`</span>)</span><br><span class="line">      <span class="keyword">const</span> &#123; results &#125; = <span class="keyword">await</span> response.<span class="title function_">json</span>()</span><br><span class="line">      <span class="title function_">setResultQuery</span>(results)</span><br><span class="line">    &#125;</span><br><span class="line"></span><br><span class="line">    <span class="title function_">fetchPeople</span>()</span><br><span class="line">  <span class="comment">// eslint-disable-next-line react-hooks/exhaustive-deps</span></span><br><span class="line">  &#125;, [deferredSearchQuery])</span><br><span class="line"></span><br><span class="line">  <span class="keyword">function</span> <span class="title function_">handleOnChange</span>(<span class="params">event: any</span>) &#123;</span><br><span class="line">    <span class="title function_">setSearchQuery</span>(event.<span class="property">target</span>.<span class="property">value</span>)</span><br><span class="line">  &#125;</span><br><span class="line"></span><br><span class="line">  <span class="keyword">return</span> (</span><br><span class="line">    <span class="language-xml"><span class="tag">&lt;<span class="name">div</span>&gt;</span></span></span><br><span class="line"><span class="language-xml">      <span class="tag">&lt;<span class="name">input</span> <span class="attr">type</span>=<span class="string">&quot;input&quot;</span> <span class="attr">placeholder</span>=<span class="string">&quot;Type a character&quot;</span> <span class="attr">value</span>=<span class="string">&#123;searchQuery&#125;</span> <span class="attr">onChange</span>=<span class="string">&#123;handleOnChange&#125;</span> /&gt;</span></span></span><br><span class="line"><span class="language-xml">      <span class="tag">&lt;<span class="name">ul</span>&gt;</span></span></span><br><span class="line"><span class="language-xml">        &#123;resultQuery &amp;&amp; (resultQuery.map((person : any) =&gt; (</span></span><br><span class="line"><span class="language-xml">          <span class="tag">&lt;<span class="name">li</span> <span class="attr">key</span>=<span class="string">&#123;person.name&#125;</span>&gt;</span>&#123;person.name&#125;<span class="tag">&lt;/<span class="name">li</span>&gt;</span></span></span><br><span class="line"><span class="language-xml">        )))&#125;</span></span><br><span class="line"><span class="language-xml">      <span class="tag">&lt;/<span class="name">ul</span>&gt;</span></span></span><br><span class="line"><span class="language-xml">    <span class="tag">&lt;/<span class="name">div</span>&gt;</span></span></span><br><span class="line">  )</span><br><span class="line">&#125;</span><br><span class="line"></span><br><span class="line"><span class="keyword">export</span> <span class="keyword">default</span> <span class="title class_">UseDeferredHook</span></span><br></pre></td></tr></table></figure><p>In this example, it’s using the <code>useState</code> hook to manage the <code>searchQuery</code> state, which holds the user’s search input. We’re also using the <code>useDeferredValue</code> hook to create a <code>deferredSearchQuery</code> variable, which we pass to the Star Wars API search endpoint after a 1 second delay.</p><ul><li><a href="https://react.dev/reference/react/useDeferredValue#reference">Reference</a><ul><li><a href="https://react.dev/reference/react/useDeferredValue#usedeferredvalue">useDeferredValue(value)</a></li></ul></li><li><a href="https://react.dev/reference/react/useDeferredValue#usage">Usage</a><ul><li><a href="https://react.dev/reference/react/useDeferredValue#showing-stale-content-while-fresh-content-is-loading">Showing stale content while fresh content is&gt; loading</a></li><li><a href="https://react.dev/reference/react/useDeferredValue#indicating-that-the-content-is-stale">Indicating that the content is&gt; stale</a></li><li><a href="https://react.dev/reference/react/useDeferredValue#deferring-re-rendering-for-a-part-of-the-ui">Deferring re-rendering for a part of the&gt; UI</a></li></ul></li></ul><hr><h2 id="Other-Hooks"><a href="#Other-Hooks" class="headerlink" title="Other Hooks "></a><strong>Other Hooks</strong> <a name="other-hooks"></a></h2><p>These <a href="(https://react.dev/reference/react#other-hooks)">Hooks</a> are mostly useful to library authors and aren’t commonly used in the application code.</p><ul><li><a href="https://react.dev/reference/react/useDebugValue">useDebugValue</a> lets you customize the label React DevTools displays for your custom Hook.</li><li><a href="https://react.dev/reference/react/useId">useId</a> lets a component associate a unique ID with itself. Typically used with accessibility APIs.</li><li><a href="https://react.dev/reference/react/useSyncExternalStore">useSyncExternalStore</a> lets a component subscribe to an external store.</li></ul><h3 id="useDebugValue"><a href="#useDebugValue" class="headerlink" title="useDebugValue "></a><a href="https://react.dev/reference/react/useDebugValue"><strong>useDebugValue</strong></a> <a name="useDebugValue"></a></h3><p>useDebugValue is a React Hook that lets you add a label to a custom Hook in <a href="https://react.dev/learn/react-developer-tools">React DevTools.</a></p><pre><code>useDebugValue(value, format?)</code></pre><h4 id="An-example-of-using-useDebugValue"><a href="#An-example-of-using-useDebugValue" class="headerlink" title="An example of using useDebugValue"></a>An example of using useDebugValue</h4><figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment">// Use in multiple components.</span></span><br><span class="line"><span class="keyword">function</span> <span class="title function_">useDisplayName</span>(<span class="params"></span>) &#123;</span><br><span class="line">  <span class="keyword">const</span> [displayName, setDisplayName] = useState&lt;string&gt;();</span><br><span class="line"></span><br><span class="line">  <span class="title function_">useEffect</span>(<span class="function">() =&gt;</span> &#123;</span><br><span class="line">    <span class="keyword">const</span> data = <span class="title function_">fetchFromDatabase</span>(props.<span class="property">userId</span>);</span><br><span class="line">    <span class="title function_">setDisplayName</span>(data.<span class="property">id</span>);</span><br><span class="line">  &#125;, []);</span><br><span class="line"></span><br><span class="line">  <span class="title function_">useDebugValue</span>(displayName ?? <span class="string">&#x27;loading...&#x27;</span>)</span><br><span class="line"></span><br><span class="line">  <span class="keyword">return</span> displayName;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure><ul><li><a href="https://react.dev/reference/react/useDebugValue#reference">Reference</a><ul><li><a href="https://react.dev/reference/react/useDebugValue#usedebugvalue">useDebugValue(value, format?)</a></li></ul></li><li><a href="https://react.dev/reference/react/useDebugValue#usage">Usage</a><ul><li><a href="https://react.dev/reference/react/useDebugValue#adding-a-label-to-a-custom-hook">Adding a label to a custom Hook</a></li><li><a href="https://react.dev/reference/react/useDebugValue#deferring-formatting-of-a-debug-value">Deferring formatting of a debug value</a></li></ul></li></ul>]]></content>
    
    
      
      
    <summary type="html">&lt;h1 id=&quot;Built-in-React-Hooks&quot;&gt;&lt;a href=&quot;#Built-in-React-Hooks&quot; class=&quot;headerlink&quot; title=&quot;Built-in React Hooks&quot;&gt;&lt;/a&gt;&lt;a href=&quot;https://react.dev</summary>
      
    
    
    
    <category term="React" scheme="https://blog.pablo-magro-gaspar.site/categories/React/"/>
    
    
    <category term="Hooks" scheme="https://blog.pablo-magro-gaspar.site/tags/Hooks/"/>
    
  </entry>
  
  <entry>
    <title>Coding Resources</title>
    <link href="https://blog.pablo-magro-gaspar.site/2023/04/03/Coding-Resources/"/>
    <id>https://blog.pablo-magro-gaspar.site/2023/04/03/Coding-Resources/</id>
    <published>2023-04-03T19:08:15.000Z</published>
    <updated>2026-04-14T20:03:04.026Z</updated>
    
    <content type="html"><![CDATA[<ol><li><p><strong>JavaScript &amp; Node.js Testing best practices</strong></p><ul><li>Website: <a href="https://github.com/goldbergyoni/javascript-testing-best-practices">javascript-testing-best-practices</a></li><li>Description: This is a guide for JavaScript &amp; Node.js reliability from A-Z. It summarizes and curates for you dozens of the best blog posts, books, and tools the market has to offer</li></ul></li><li><p><strong>OverApi.com</strong></p><ul><li>Website: <a href="https://overapi.com/">overapi.com</a></li><li>Description: Collects all the cheat sheets.</li></ul></li><li><p><strong>medusa</strong></p><ul><li>Website: <a href="https://medusajs.com/">medusaJS.com</a></li><li>Description: Headless e-commerce engine. the Open Source logo Shopify -&gt; Alternative</li></ul></li></ol>]]></content>
    
    
      
      
    <summary type="html">&lt;ol&gt;
&lt;li&gt;&lt;p&gt;&lt;strong&gt;JavaScript &amp;amp; Node.js Testing best practices&lt;/strong&gt;&lt;/p&gt;
&lt;ul&gt;
&lt;li&gt;Website: &lt;a href=&quot;https://github.com/goldbergyoni/</summary>
      
    
    
    
    <category term="Coding" scheme="https://blog.pablo-magro-gaspar.site/categories/Coding/"/>
    
    
    <category term="Resources" scheme="https://blog.pablo-magro-gaspar.site/tags/Resources/"/>
    
  </entry>
  
  <entry>
    <title>Refranes, Citas y Proverbios</title>
    <link href="https://blog.pablo-magro-gaspar.site/2023/03/08/Refranes-Citas-y-Proverbios/"/>
    <id>https://blog.pablo-magro-gaspar.site/2023/03/08/Refranes-Citas-y-Proverbios/</id>
    <published>2023-03-08T18:30:15.000Z</published>
    <updated>2026-04-14T20:03:04.027Z</updated>
    
    <content type="html"><![CDATA[<h2 id="Refranes"><a href="#Refranes" class="headerlink" title="Refranes"></a>Refranes</h2><ol><li><code>Bástale a cada día su afán.</code></li><li><code>Hasta las seras, todo son vendimias.</code></li><li>Ni bebas sin ver, ni firmes sin leer.</li><li><code>Quien cuece y amasa, de todo pasa.</code></li><li>Guarda y no prestes; porfía y no apuestes.</li><li>El que no te ama, burlando te difama</li><li>Cree el fraile que todos son de su aire.</li><li>To err is human, to moo bovine.</li><li>Caridad y amor no quieren tambor; en silencio viven mejor.</li><li><code>Lo ajeno, más que lo propio, parece bueno.</code></li><li>De dinero y bondad, siempre la mitad.</li><li>Freedom cannot exist without privacy.</li><li><code>El buey no es de donde nace, sino de donde pace.</code></li><li>Aceite y romero frito, bálsamo bendito.</li><li>El que apura su vida, apura su muerte.</li><li><code>Más vale en paz un huevo que en guerra un gallinero.</code></li><li>El que sale a bailar, pierde su lugar.</li><li><code>Se primero en sembrar si quieres aventajar</code>.</li><li>Carne que se lleva el gato, no vuelve al plato.</li><li><code>Oigamos, pero no creamos hasta que lo veamos</code>.</li><li>Moneda ahorrada, moneda ganada.</li><li>Lleno de pasión, vacío de razón.</li><li><code>No hay atajo sin trabajo.</code></li><li>El que solo come su gallo, solo ensilla su caballo.</li><li>La abeja y la oveja, en abril dejan la pelleja.</li><li><code>Al bien, buscarlo, al mal espantarlo.</code></li><li>Lleva con ánimo igual lo que es bien y lo que es mal.</li><li>En casa del rico, el vinagre se vuelve vino.</li><li>Por lo que uno tira, otro suspira.</li><li>En mayo crece el tallo.</li><li>Fui donde no debí ¡y cómo salí!.</li></ol><h2 id="Citas"><a href="#Citas" class="headerlink" title="Citas"></a>Citas</h2><blockquote><p>El alma es aquello por lo que vivimos, sentimos y pensamos.– Aristóteles. (384-322 A.C.) Filósofo griego.</p></blockquote><blockquote><p>La vida es una serie de colisiones con el futuro; no es una suma de lo que hemos sido, sino de lo que anhelamos ser.– José Ortega y Gasset. (1883-1955) Filósofo y ensayista</p></blockquote><blockquote><p>Después de la verdad, nada hay tan bello como la ficción.– Antonio Machado. (1875-1939) Poeta español.</p></blockquote><blockquote><p>If a man has a strong faith he can indulge in the luxury of skepticism.– Friedrich Nietzsche</p></blockquote><h2 id="Proverbios"><a href="#Proverbios" class="headerlink" title="Proverbios"></a>Proverbios</h2><ol><li>Nunca permitas que tus pies vayan por delante de tus zapatos. <code>Proverbio escocés</code>.</li></ol>]]></content>
    
    
      
      
    <summary type="html">&lt;h2 id=&quot;Refranes&quot;&gt;&lt;a href=&quot;#Refranes&quot; class=&quot;headerlink&quot; title=&quot;Refranes&quot;&gt;&lt;/a&gt;Refranes&lt;/h2&gt;&lt;ol&gt;
&lt;li&gt;&lt;code&gt;Bástale a cada día su afán.&lt;/code&gt;</summary>
      
    
    
    
    <category term="Refranes, Citas, Proverbios" scheme="https://blog.pablo-magro-gaspar.site/categories/Refranes-Citas-Proverbios/"/>
    
    
  </entry>
  
  <entry>
    <title>Kubernetes Notes</title>
    <link href="https://blog.pablo-magro-gaspar.site/2023/02/28/Kubernetes-Notes/"/>
    <id>https://blog.pablo-magro-gaspar.site/2023/02/28/Kubernetes-Notes/</id>
    <published>2023-02-28T22:31:32.000Z</published>
    <updated>2026-04-14T20:03:04.027Z</updated>
    
    <content type="html"><![CDATA[<p>Kubernetes is an open-source platform for automating the deployment, scaling, and management of containerized applications.</p><ol><li>Kubernetes is a tool for running a bunch of different containers.</li><li>We give it some configuration to describe how we want our containers to run and interact with each other.</li></ol><p><strong>What?</strong>System for running many different type of containers over multiple different virtual machines.</p><p><strong>Why?</strong>When you need scale an app to run many different containers with different images.</p>]]></content>
    
    
      
      
    <summary type="html">&lt;p&gt;Kubernetes is an open-source platform for automating the deployment, scaling, and management of containerized applications.&lt;/p&gt;
&lt;ol&gt;
&lt;li&gt;</summary>
      
    
    
    
    <category term="Kubernetes" scheme="https://blog.pablo-magro-gaspar.site/categories/Kubernetes/"/>
    
    
    <category term="Doc" scheme="https://blog.pablo-magro-gaspar.site/tags/Doc/"/>
    
  </entry>
  
  <entry>
    <title>How to add Open Folder with X when I right click in an folder in Dolphin</title>
    <link href="https://blog.pablo-magro-gaspar.site/2023/02/17/How-to-add-Open-Folder-with-X-when-I-right-click-in-an-folder-in-Dolphin/"/>
    <id>https://blog.pablo-magro-gaspar.site/2023/02/17/How-to-add-Open-Folder-with-X-when-I-right-click-in-an-folder-in-Dolphin/</id>
    <published>2023-02-17T01:12:01.000Z</published>
    <updated>2026-04-14T20:03:04.026Z</updated>
    
    <content type="html"><![CDATA[<p><a href="https://develop.kde.org/docs/extend/dolphin/service-menus/">Dolphin custom service menus</a></p><p>You can do that by adding a file with a name ending in <code>.desktop</code> in the location that the command <code>kf5-config --path services</code> gives you with the contents below:</p><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">/home/pablo/.local/share/kservices5/:/usr/share/kservices5/</span><br></pre></td></tr></table></figure><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br></pre></td><td class="code"><pre><span class="line">[Desktop Entry]</span><br><span class="line">Type=Service</span><br><span class="line">X-KDE-ServiceTypes=KonqPopupMenu/Plugin</span><br><span class="line">MimeType=inode/directory;</span><br><span class="line">Actions=openInVsCode</span><br><span class="line"></span><br><span class="line">[Desktop Action openInVsCode]</span><br><span class="line">Name=Open Directory in VSCode</span><br><span class="line">Icon=com.visualstudio.code</span><br><span class="line">Exec=code --open-url %u</span><br></pre></td></tr></table></figure><p><img src="/../images/open-vscode-desktop-screenshot.png" alt="alt text"></p><p>Note that inside the <code>/usr/share/kservices5/</code> folder there are more examples that can be taken as reference.</p>]]></content>
    
    
      
      
    <summary type="html">&lt;p&gt;&lt;a href=&quot;https://develop.kde.org/docs/extend/dolphin/service-menus/&quot;&gt;Dolphin custom service menus&lt;/a&gt;&lt;/p&gt;
&lt;p&gt;You can do that by adding a </summary>
      
    
    
    
    <category term="KDE" scheme="https://blog.pablo-magro-gaspar.site/categories/KDE/"/>
    
    <category term="Dolphin" scheme="https://blog.pablo-magro-gaspar.site/categories/KDE/Dolphin/"/>
    
    
    <category term="Menu, Option" scheme="https://blog.pablo-magro-gaspar.site/tags/Menu-Option/"/>
    
  </entry>
  
</feed>
