1) What Service we should use when want to connect between private instance account A to private instance account B? Options 1) VPN 2) VPC Peering 3) Internet gateway 4) All of Above
AWS Systems Manager Agent (SSM Agent) is Amazon software that runs on your Amazon EC2 instances and your hybrid instances that are configured for Systems Manager (hybrid instances). SSM Agent processes requests from the Systems Manager service in the cloud and configures your machine as specified in the request. SSM Agent sends status and execution information back to the Systems Manager service by using the EC2 Messaging service. If you monitor traffic, you will see your instances communicating with ec2messages.* endpoints. For more information, see Reference: ec2messages, ssmmessages, and Other API Calls.
Starting with version 2.3.50.0 of SSM Agent, the agent creates a local user account called ssm-user and adds it to /etc/sudoers (Linux) or to the Administrators group (Windows) every time the agent starts. This ssm-user is the default OS user when a Session Manager session is started, and the password for this user is reset on every session. You can change the permissions by moving ssm-user to a less-privileged group or by changing the sudoers file. The ssm-user account is not removed from the system when SSM Agent is uninstalled.
SSM Agent is installed, by default, on the following Amazon EC2 Amazon Machine Images (AMIs):
Windows Server (all SKUs)
Amazon Linux
Amazon Linux 2
Ubuntu Server 16.04
Ubuntu Server 18.04
You must manually install SSM Agent on Amazon EC2 instances created from other Linux AMIs. You must also manually install SSM Agent on servers or virtual machines in your on-premises environment. For more information, see Setting Up AWS Systems Manager in Hybrid Environments.
DevSecOps is the philosophy of integrating security practices within the DevOps process. DevSecOps involves creating a ‘Security as Code’ culture with ongoing, flexible collaboration between release DevOps engineers and security teams. The DevSecOps movement, like DevOps itself, is focused on creating new solutions for application development processes within an agile framework.
Now, in the collaborative framework of DevSecOps is a shared responsibility integrated from end to end. It’s a mindset that is so important, “DevSecOps” to emphasize the need to build a secure foundation into DevOps initiatives.
DevOps isn’t just about development and operations teams. If you want to take full advantage of the agility and responsiveness of a DevOps approach, IT security must also play an integrated role in the full life cycle of your apps.
Why DevSecOps is important?
IT infrastructure has undergone huge changes in recent years. The shift to dynamic provisioning, shared resources, and cloud computing has driven benefits around IT speed, agility, and cost, and all of this has helped to improve application development.
“DevOps has become second nature for agile, high-performing enterprises and a foundation for the success of their online business,” says Pascal Geenens, a security evangelist and researcher at Radware.
“However, application security was most important, and at times perceived as a roadblock to staying ahead of the competition,” says Geenens. “Given the reliance of applications to keep operations running, bypassing security must be considered a high-risk strategy -- a distributed or permanent denial of service attack could easily catch you out.
KEEP READING THIS SPACE FOR LATEST DEVSECOPS UPDATE
Your Amazon ECS service can optionally be configured to use Elastic Load Balancing to distribute traffic evenly across the tasks in your service.
Elastic Load Balancing supports the following types of load balancers: Application Load Balancers, Network Load Balancers, and Classic Load Balancers, and Amazon ECS services can use either type of load balancer. Application Load Balancers are used to route HTTP/HTTPS (or Layer 7) traffic. Network Load Balancers and Classic Load Balancers are used to route TCP (or Layer 4) traffic. For more information, see Load Balancer Types.
Application Load Balancers offer several features that make them attractive for use with Amazon ECS services:
Application Load Balancers allow containers to use dynamic host port mapping (so that multiple tasks from the same service are allowed per container instance).
Application Load Balancers support path-based routing and priority rules (so that multiple services can use the same listener port on a single Application Load Balancer).
We recommend that you use Application Load Balancers for your Amazon ECS services so that you can take advantage of these latest features, unless your service requires a feature that is only available with Network Load Balancers or Classic Load Balancers. For more information about Elastic Load Balancing and the differences between the load balancer types, see the Elastic Load Balancing User Guide.
Amazon CloudWatch is a monitoring service for AWS cloud resources and the applications you run on AWS. You can use Amazon CloudWatch to collect and track metrics, collect and monitor log files, set alarms, and automatically react to changes in your AWS resources. Amazon CloudWatch can monitor AWS resources such as Amazon EC2 instances, Amazon DynamoDB tables, and Amazon RDS DB instances, as well as custom metrics generated by your applications and services, and any log files your applications generate. You can use Amazon CloudWatch to gain system-wide visibility into resource utilization, application performance, and operational health. You can use these insights to react and keep your application running smoothly.
Ans. Fully Baked AMI, JeOS (just enough operating system) AMI, and Hybrid AMI.
Q2. What is Geo Restriction in CloudFront?
Ans. Geo-restriction, also known as geoblocking, is used to prevent users in specific geographic locations from accessing content that you’re distributing through a CloudFront web distribution.
Q3. Explain what is T2 instances?
Ans. T2 instances are designed to provide moderate baseline performance and the capability to burst to higher performance as required by the workload.
Q4. What is AWS Lambda?
Ans. AWS Lambda is a compute service that lets you run code in the AWS Cloud without provisioning or managing servers.
Q5. What is a Serverless application in AWS?
Ans. The AWS Serverless Application Model (AWS SAM) extends AWS CloudFormation to provide a simplified way of defining the Amazon API Gateway APIs, AWS Lambda functions, and Amazon DynamoDB tables needed by your serverless application.
Q6. What is the use of Amazon ElastiCache?
Ans. Amazon ElastiCache is a web service that makes it easy to deploy, operate, and scale an in-memory data store or cache in the cloud.
Q7. Explain how the buffer is used in Amazon web services?
Ans. The buffer is used to make the system more robust to manage traffic or load by synchronizing different component.
Q8. Differentiate between stopping and terminating an instance
Ans. When an instance is stopped, the instance performs a normal shutdown and then transitions to a stopped state.
When an instance is terminated, the instance performs a normal shutdown, then the attached Amazon EBS volumes are deleted unless the volume’s deleteOnTermination attribute is set to false.
Q9. Is it possible to change the private IP addresses of an EC2 while it is running/stopped in a VPC?
Ans. The primary private IP address cannot be changed. Secondary private addresses can be unassigned, assigned or moved between interfaces or instances at any point.
Q10. Give one instance where you would prefer Provisioned IOPS over Standard RDS storage?
Ans. When you have batch-oriented workloads.
=========================================
FOR MORE DETAILS OF AWS CLOUD/ DEVOPS/ TERRAFORM/ CLOUD FORMATION / DEVOPS TOOLS VISIT ================================================
