Answer: Cloud computing is the on-demand delivery of IT resources (including compute, databases, storage, and networking) over the internet with pay-as-you-go pricing. Instead of buying, owning, and maintaining physical data centers, you rent technology services from cloud providers like AWS.

Answer:

• CapEx (Capital Expenditure): Upfront investment in physical infrastructure (servers, cooling, building data centers). You own the assets, but it requires massive capital upfront and has static capacity limits.
• OpEx (Operational Expenditure): Pay-as-you-go operational costs. You pay only for resources consumed, allowing you to scale up or down dynamically based on demand with no upfront overhead.

Answer: Elasticity is the ability of a system to scale its resources up and down automatically to match active load.

• Example: An e-commerce website during a Black Friday event automatically scales from 2 EC2 instances to 50 EC2 instances to handle the surge in traffic (scaling out), and automatically terminates the 48 instances when traffic returns to normal (scaling in) to optimize costs.

Answer:

• Public Cloud: Owned and operated by a third-party provider (e.g., AWS, GCP). Hardware is shared logically among multiple tenants over the public internet.
• Private Cloud: Infrastructure dedicated entirely to one business or organization. Can be hosted on-premises or by a third party.
• Hybrid Cloud: Integrates public cloud resources with private clouds/on-premises infrastructure, allowing data and applications to be shared between them securely.

Answer:

• IaaS (Infrastructure as a Service): Rents raw compute, networking, and storage. You manage the OS, runtime, and applications. Example: Amazon EC2.
• PaaS (Platform as a Service): Provides a managed runtime environment. You manage only the application code. Example: AWS Elastic Beanstalk or AWS Lambda.
• SaaS (Software as a Service): A complete, fully managed software application accessed via a web browser. Example: Amazon Chime or Microsoft 365.

Answer: EC2 is considered IaaS because AWS handles physical servers, virtualization hypervisors, power, and networking, but grants you full root access to the virtual machine. You are responsible for selecting, configuring, securing, and patching the operating system (OS), runtime, database, and application stack.

Answer: AWS Lambda is considered PaaS (or FaaS - Function as a Service) because you only write and upload your application code. AWS handles all server provisioning, scaling, patching, OS maintenance, and runtime execution automatically, charging you only for the exact milliseconds your code runs.

Answer: Spot Instances allow you to bid on spare, unused AWS EC2 capacity at up to a 90% discount compared to On-Demand.

• The Catch: AWS can reclaim the instance with only a 2-minute warning if they need the capacity back for On-Demand users. Spot pricing fluctuates dynamically based on regional supply and demand.

Answer: Choose Reserved Instances (RIs) or Savings Plans for predictable, steady-state production workloads running 24/7 (such as core relational databases or primary web servers). RIs require a 1-year or 3-year commitment in exchange for up to a 72% discount compared to On-Demand.

Answer: Databases require state persistence, high availability, and consistent execution. Because Spot Instances can be terminated abruptly with a 2-minute warning, using them for a database can lead to data corruption, lost transactions, and service downtime.

Answer: The Shared Responsibility Model divides security tasks between AWS and the customer:

• AWS is responsible for Security OF the Cloud: Protecting physical infrastructure, data centers, hypervisors, and core networking.
• The Customer is responsible for Security IN the Cloud: Managing user privileges (IAM), configuring network firewalls (Security Groups), patching OS/applications, and encrypting data.

Answer: AWS WAF (Web Application Firewall) is a Layer 7 firewall that monitors and filters incoming HTTP/HTTPS requests. It protects web applications against common web exploits (such as SQL Injection, Cross-Site Scripting, and bot traffic) before the request reaches the ALB, API Gateway, or CloudFront.

Answer: WAF inspects the body, query parameters, and headers of incoming HTTP requests for malicious SQL keyword patterns and signatures (e.g., ' OR '1'='1). If a match is found, WAF blocks the request and returns an HTTP 403 Forbidden, preventing the payload from reaching the application database.

Answer:

• Security Group: Operates at Layer 4 (Transport layer). It filters traffic based on IP address and Port ranges for specific resources (e.g., EC2 instances).
• AWS WAF: Operates at Layer 7 (Application layer). It inspects the actual content of HTTP payloads, headers, and query parameters to block web exploits.

Answer: AWS IAM (Identity and Access Management) is a secure administration service that controls authentication (who can log in) and authorization (what permissions they have) for your AWS resources.

Answer:

• IAM User: A persistent identity assigned to a single person or application (credentials: password or access keys).
• IAM Group: A collection of users. Granting a policy to a group assigns those permissions to all member users.
• IAM Role: A temporary identity assumed by users, applications, or AWS services (e.g., EC2) to execute tasks via dynamic security credentials.
• IAM Policy: A JSON document that explicitly lists Allowed or Denied permissions.

Answer: The Principle of Least Privilege dictates that users, resources, and applications should only be granted the minimum permissions necessary to complete their specific tasks, and nothing more. This minimizes security exposure if credentials are leaked.

Answer: The Root Account has unrestricted, complete administrative privileges that cannot be restricted by policies. If compromised or used incorrectly, it could lead to deletion of the entire AWS infrastructure, resource leaks, or major billing spikes.

Answer: Create an IAM Role with read/write access to the specific S3 bucket, and attach it to the EC2 instance as an Instance Profile. The AWS SDK running inside the EC2 instance will query the instance metadata service (IMDSv2) to obtain temporary security credentials automatically. Never hardcode access keys on the instance!

Answer: IAM Roles issue short-lived security tokens via the AWS Security Token Service (STS) that expire automatically (usually in 1–12 hours). Permanent access keys do not expire and must be rotated manually; if leaked (e.g., pushed to GitHub), they expose your account indefinitely.

Answer:

• SSM Parameter Store: Ideal for general configuration data, environment variables, and simple non-rotating secrets. It is free for standard parameters.
• Secrets Manager: Ideal for high-security database credentials, API keys, and certificates. It natively supports automatic secret rotation (with Lambda integration) and cross-account access rules, but charges a monthly fee per secret.

Answer:

• AWS KMS: A managed service used to create, control, and rotate cryptographic keys.
• Envelope Encryption: An encryption strategy combining symmetric speed with key management safety:
  1. KMS generates a plaintext Data Key and an encrypted version of that Data Key.
  2. The application uses the plaintext Data Key to encrypt data locally, then discards the plaintext key.
  3. The encrypted data is stored alongside the encrypted Data Key.
  4. To decrypt, the application sends the encrypted Data Key to KMS to get the plaintext key back.

Answer:

• AWS Organizations: A consolidated account management service that lets you consolidate multiple AWS accounts into an organizational hierarchy.
• SCPs: Permission guardrails applied at the Organization or OU level. SCPs restrict what services and actions can be run inside member accounts (e.g., denying member accounts from deleting CloudTrail logs or creating non-approved resources), even for the administrator of those sub-accounts.

Answer: Amazon S3 (Simple Storage Service) is object storage because it treats files as discrete, independent flat entities ("objects") containing data, metadata, and a unique key identifier. It does not use a traditional hierarchical directory structure or block allocation.

Answer:

• Bucket: A logical directory/container that hosts S3 files. Bucket names must be globally unique across all AWS accounts.
• Object: The actual file data (raw bytes) and its associated metadata key-value pairs stored within a bucket.

Answer:

• EBS (Elastic Block Store): Raw block storage attached directly to a single EC2 instance (like a local SSD/HDD). Optimized for low-latency, high-performance database execution and OS boot volumes.
• S3 (Simple Storage Service): Object storage accessed over the internet via HTTP REST APIs. Optimized for infinite scalability, high durability backups, static assets, and logs.

Answer: Relational databases require microsecond latency, high input/output operations (IOPS), and block-level modifications (updating a single row instead of re-uploading the entire database file). EBS provides block storage directly, whereas S3 is accessed via API and requires replacing the entire object for any change.

Answer: No. All newly created S3 buckets are private and block all public access by default. You must explicitly disable "Block Public Access" and apply a bucket policy or ACL to make files public.

Answer: S3 Bucket Policies are JSON documents attached directly to a bucket that define permission rules. They specify who (Principal) can perform what actions (Effect/Action, e.g., s3:GetObject) on which files (Resource) under specific conditions.

Answer: Using Origin Access Control (OAC):

1. Configure the S3 bucket to be completely private.
2. Enable OAC in CloudFront.
3. Configure the S3 bucket policy to allow read/GET access only from the CloudFront service principal. This prevents users from bypassing CDN restrictions to access the S3 bucket directly.

Answer: The AWS Command Line Interface (CLI) is a command tool used to manage AWS resources. It translates command actions into standard REST HTTPS API calls, signing requests with secret keys configured on your local workstation.

Answer:

• AWS Console: A graphical web interface best for beginners, ad-hoc changes, or viewing dashboards.
• AWS CLI: A text interface best for speed, script integration, CI/CD pipelines, and bulk resource automation.

Answer: Infrastructure as Code (IaC) is the practice of managing and provisioning infrastructure resources through machine-readable definition files (code), rather than manually configuring servers through interactive console interfaces.

Answer: Automate using declarative templates that state the desired target architecture:

• AWS CloudFormation: AWS-native tool, written in JSON/YAML, state is managed automatically by AWS under the hood, supports only AWS.
• HashiCorp Terraform: Cloud-agnostic, written in HCL (HashiCorp Configuration Language), uses state files you manage (e.g., in S3 backend), supports AWS, GCP, Azure, and SaaS providers.

Answer:

• RDS: A managed database service supporting standard database engines (PostgreSQL, MySQL, Oracle). It runs on standard EBS volumes. Scaling storage requires manual intervention or auto-scaling rules.
• Amazon Aurora: A cloud-native relational database engine. It separates compute from storage. Aurora storage replicates across 3 AZs automatically (6 copies) and dynamically scales up to 128TB. It offers up to 5x the performance of standard MySQL.

Answer:

• Multi-AZ:
  • Purpose: High Availability (HA) and disaster recovery.
  • Mechanism: Synchronous replication to a standby instance in a different AZ.
  • Traffic: Active-Passive. You cannot read from or write to the standby instance.
• Read Replicas:
  • Purpose: Read scaling.
  • Mechanism: Asynchronous replication.
  • Traffic: Active-Active (Read only). Applications route read queries to replicas to offload the primary database.

Answer:

• Partition Key Design: DynamoDB routes queries to physical partitions based on the hash value of the partition key. To prevent "hot partitions" (uneven throughput bottlenecks), choose partition keys with high cardinality (e.g., user_id instead of status).
• Autoscaling: DynamoDB automatically manages capacity through two models:
  • Provisioned Mode: Auto-scales Read Capacity Units (RCUs) and Write Capacity Units (WCUs) based on CloudWatch alarms.
  • On-Demand Mode: Dynamically adapts to traffic spikes instantly, charging per request.

Answer:

• No Servers: AWS manages provisioning, scaling, OS updates, and patching.
• Cost-Efficient: Pay-per-use model. Charges are based on request count and execution milliseconds; idle time costs $0.
• Automatic Scaling: Scales out instantly, running copies of functions in parallel.

Answer:

• SNS (Simple Notification Service): A pub/sub messaging service. It pushes messages instantly to all subscribed endpoints (e.g., Lambda, SQS queues, HTTP endpoints). It has no message retention; if there are no subscribers, the message is lost.
• SQS (Simple Queue Service): A message queuing service. It stores messages until consumers poll, process, and delete them. It provides durability and message buffering.

Answer:

• Standard Queue: Unlimited throughput. Guarantees at-least-once delivery, but messages can occasionally arrive out of order.
• FIFO (First-In-First-Out) Queue: Limited to 300 transactions per second (or 3000 with batching). Guarantees exactly-once processing and strict ordering.

Answer:

• Amazon EventBridge: A serverless event bus that ingests event data from your applications, SaaS systems, and AWS services, routing them to target destinations based on configured rules.
• AWS Step Functions: A serverless orchestrator that allows you to coordinate multiple AWS services into serverless workflows using visual state machines, managing retries, inputs/outputs, and decision branches.

Answer:

• VPC (Virtual Private Cloud): A logically isolated virtual network dedicated to your AWS account, granting you complete control over subnets, routing, and gateways.
• CIDR Notation: A method of specifying IP ranges (e.g., 10.0.0.0/16 defines a network containing 65,536 IPs, where /16 represents the network prefix bits).

Answer: AWS reserves 5 IP addresses in every subnet for infrastructure routing:

• .0 (Network address)
• .1 (VPC Router)
• .2 (Amazon Provided DNS Server)
• .3 (Future use)
• .255 (Network Broadcast Address)

Answer:

• Public Subnet: Has a Route Table entry directing default external traffic (0.0.0.0/0) to an Internet Gateway (IGW). Resources are reachable from the internet if assigned public IPs.
• Private Subnet: Does not have a direct route to an Internet Gateway. Resources inside are isolated from direct inbound internet traffic.

Answer: An Internet Gateway (IGW) is a redundant, horizontally scaled VPC component that enables bi-directional (inbound and outbound) communications between instances in public subnets and the public internet.

Answer: A NAT Gateway allows resources in private subnets to send outbound connections to the internet (e.g., to run updates) while blocking inbound connections from the internet. It must live in a public subnet because it must translate private IP requests and route them out through the Internet Gateway (IGW).

Answer:

Answer:

• Stateful (Security Groups): When traffic is allowed in one direction (e.g., inbound HTTP on Port 80), the return traffic is automatically allowed outbound, regardless of any outbound rules.
• Stateless (NACLs): Inbound and outbound rules are evaluated independently. Allowing inbound traffic on Port 80 does not allow outbound return traffic; you must write a rule allowing outbound traffic to ephemeral ports.

Answer:

• VPC Peering: A direct 1-to-1 connection between two VPCs. Very cost-effective for small environments because there is no hourly fee—you only pay for cross-AZ data transfers ($0.01/GB).
• Transit Gateway: A hub-and-spoke central routing service connecting many VPCs. Essential for enterprises (>10 VPCs) to avoid mesh peering complexity, but charges a monthly fee per attached VPC (~$36/month) plus data processing costs.

Answer:

• Internet Gateway (IGW): Enables bi-directional (inbound and outbound) public traffic for public subnet resources.
• NAT Gateway: Translates IP addresses to enable outbound-only traffic for private subnet resources while shielding them from incoming internet probes.

Answer:

• CloudWatch: The central monitoring and management service for AWS resources and applications.
• Alarms: Watch a single metric over a specified time window. If the metric exceeds a defined threshold (e.g., EC2 CPU utilization stays > 80% for 5 minutes), the alarm triggers automated actions, such as sending an SNS alert or invoking an Auto Scaling policy.

Answer: No. CloudWatch cannot see memory (RAM) utilization because RAM is an OS-level metric, and the hypervisor only monitors hardware-level performance (CPU, Disk, Network). To monitor RAM, you must install the CloudWatch Agent inside the EC2 operating system to collect and push custom memory metrics.

Answer:

• Container: A lightweight package that packages code, libraries, and dependencies, running isolated on a shared OS kernel.
• Container Orchestration: Automates the operational tasks of deploying, scaling, scheduling, load balancing, networking, and healing containers across clusters of host machines.

Answer: Amazon Elastic Container Registry (ECR) is a managed container registry service. It stores, manages, and distributes Docker container images securely within the AWS ecosystem.

Answer: Amazon Elastic Container Service (ECS) is an AWS-native container orchestration service. It is designed to deploy, run, and scale Docker containers easily, offering close integration with AWS services like IAM, Route 53, and Load Balancers.

Answer:

• ECS: AWS-proprietary container orchestrator. It is simple, highly integrated into the AWS console, and has low operational overhead.
• EKS: Managed Kubernetes service. It provides standard Kubernetes APIs, allowing multi-cloud portability and compatibility with the Kubernetes ecosystem, but has higher complexity and cost.

Answer:

• Task Definition: A blueprint (JSON file) describing container parameters (image, CPU, memory, port mappings, variables).
• Task: A running instance of a Task Definition.
• Service: An ECS controller that maintains the desired number of tasks, handles deployments (rolling updates), and integrates them with load balancers.

Answer:

• EC2 Launch Type: You provision, manage, and patch the EC2 servers that host your containers. Gives full system control.
• AWS Fargate: Serverless hosting. You specify container CPU/RAM needs, and AWS manages all underlying servers and hypervisors. You pay only for running containers.

Answer: Choose Fargate to reduce operational overhead. AWS handles scaling, VM provisioning, OS patching, and security isolation. It allows engineering teams to focus entirely on application deployment rather than server management.

Answer: Route 53 is AWS's managed Domain Name System (DNS) service. It provides advanced routing policies:

• Simple: Standard 1-to-1 DNS mapping.
• Weighted: Split traffic between endpoints based on defined ratios.
• Latency: Route users to the AWS region that provides the lowest network latency.
• Failover: Active-Passive setup (route to secondary disaster recovery if primary fails health checks).
• Geolocation: Route users based on their physical geographical continent or country.

Answer: CloudFront is AWS's Content Delivery Network (CDN). A CDN is a globally distributed network of servers (Edge Locations) that caches static and dynamic web content (images, HTML, APIs) closer to users, improving load speed and reducing origin server load.

Answer: CloudFront caches content at global Edge Locations. When a user requests a file, Route 53 routes them to the nearest Edge Location. If cached, the asset is returned immediately without hitting the origin server, drastically reducing network travel time.

Answer: Edge Locations are mini-data centers managed by AWS globally (outside of standard AWS Regions) used by CloudFront (CDN) and Route 53 (DNS) to cache content and execute low-latency edge computing scripts.

Answer: Deploy an Amazon CloudFront distribution in front of the application or S3 bucket origin hosting the images. Configure long Cache TTLs so images are cached globally at Edge Locations, ensuring users retrieve assets from nearby servers rather than cross-continent origins.

Answer: Amazon EKS manages the Kubernetes control plane across multiple AWS Availability Zones (AZs) to ensure high availability:

• Control Plane: EKS automatically provisions, scales, and manages three control plane nodes (kube-apiserver and etcd members) across three AZs behind an internal NLB.
• Data Plane (Worker Nodes): Customers run worker nodes (EC2 VMs or serverless Fargate pods) in their own subnets, communicating with the API Server load balancer.

Answer:

• Managed Node Groups: AWS automates node provisioning, group configuration, updates, and terminations. AWS handles OS patching and EKS agent version upgrades with a single API call or Terraform change.
• Self-Managed Node Groups: You build and configure your own EC2 instances using custom AMIs. This offers ultimate control over OS kernels and boot volumes, but places the responsibility of patching and upgrades entirely on you.

Answer: IRSA maps IAM Roles directly to Kubernetes ServiceAccounts:

1. EKS hosts a public OpenID Connect (OIDC) provider endpoint for the cluster.
2. An IAM Role is configured with a trust policy that trusts this OIDC provider.
3. The ServiceAccount is annotated with the IAM Role's ARN.
4. When a pod is scheduled, EKS injects a projected token volume containing a web identity token.
5. The AWS SDK inside the container automatically exchanges this token for temporary AWS credentials using the STS AssumeRoleWithWebIdentity API call.

Answer:

1. DNS Routing: Route 53 acts as the entry point, mapping domain names and routing users to CloudFront.
2. CDN Caching: CloudFront caches static assets at Edge Locations, sending dynamic requests to the load balancer.
3. Load Balancing: An Application Load Balancer (ALB) receives traffic and distributes it across multiple Availability Zones.
4. Container Execution: ECS Fargate runs container tasks across private subnets in multiple AZs, autoscaling tasks based on target CPU utilization.

Answer:

• CI (Continuous Integration): Developers merge code into a shared repository frequently. Automated builds and tests run on every commit to catch bugs early.
• CD (Continuous Delivery): Code builds and tests automatically, preparing a deployment release artifact that is ready to deploy to production at the click of a button.
• CD (Continuous Deployment): Automates the entire release pipeline, pushing every code change that passes the build/test stages straight to production with zero human intervention.

Answer:

• Continuous Delivery: The release artifact is built and tested, but requires manual human authorization/approval to trigger the actual production deploy.
• Continuous Deployment: The release is pushed to production automatically as soon as it passes the automated build and test pipeline.

Answer: Amazon CodeCommit is a fully managed private Git repository service. It provides source control hosting that integrates natively with AWS IAM, CodePipeline, and KMS encryption.

Answer: Amazon CodeBuild is a managed build service that compiles source code, runs unit tests, and packages deployable artifacts (such as jar files or Docker images). CodeBuild scales dynamically and bills you per build minute.

Answer: A buildspec.yml is a YAML configuration file placed in the root directory of your source code. It tells CodeBuild what commands to run during various execution phases (install, pre_build, build, post_build) and specifies which generated files to export as build artifacts.

Answer: Amazon CodeDeploy is a deployment service that automates application deployments to EC2 instances, on-premises servers, serverless Lambda functions, or ECS services, minimizing application downtime during releases.

Answer: An appspec.yml is a configuration file used by CodeDeploy to define deployment parameters. It specifies:

• Which source files should be copied to the destination.
• What scripts to run during specific deployment lifecycle hooks (e.g., BeforeInstall, AfterInstall, ApplicationStart, ValidateService).

Answer: Amazon CodePipeline is a managed continuous delivery tool that orchestrates the workflow of your release stages (Source, Build, Test, Deploy), passing artifacts between stages automatically.

Answer:

• CodeBuild: The worker. It performs compiling, testing, and packaging tasks inside temporary Docker containers.
• CodePipeline: The manager. It defines stages, coordinates workflow execution, monitors status, and triggers other services (like CodeBuild or CodeDeploy).

Answer: A build artifact is a zip archive, compiled binary, docker image, or deployment package generated during a pipeline stage (e.g., CodeBuild output) and passed as the input for a subsequent stage (e.g., CodeDeploy input), typically stored in an S3 bucket managed by CodePipeline.

Answer:

1. Source: Developer pushes code to GitHub/CodeCommit. CodePipeline detects the change.
2. Build/Test: CodePipeline triggers CodeBuild to run tests, compile code, and build a Docker image.
3. Registry: CodeBuild pushes the Docker image to Amazon ECR.
4. Deploy: CodePipeline triggers CodeDeploy to update the ECS service using the new image tag.

Answer: In-place deployment stops the running application version on active servers, copies the new version files, and starts the application again.

• Disadvantage: Causes application downtime during the deployment.

Answer: Blue/Green deployment maintains two identical environments:

• Blue: The active production environment.
• Green: The new release environment.
• Safety: The new version is deployed to Green. Once verified, traffic is rerouted instantly via a Load Balancer. If a bug is detected, you can roll back instantly by pointing the Load Balancer back to Blue, eliminating downtime and risk.

Answer: Deploy using a Blue/Green strategy or a Rolling Update with an Application Load Balancer. In a Rolling Update, new instances are added to the load balancer while old ones are slowly drained and terminated one by one, ensuring healthy instances are always serving traffic.

Answer: Since both Blue and Green environments run in parallel, rollback is simple: configure the load balancer/DNS to immediately route 100% of user traffic back to the old, stable (Blue) environment, and then terminate the problematic (Green) environment.

Answer: Lifecycle hooks are phases defined in the appspec.yml file that allow you to run scripts at specific points during a deployment. E.g., BeforeInstall to prepare files, AfterInstall to configure packages, or ValidateService to query health-check endpoints before routing traffic.

Answer:

1. Git repository fires a webhook to CodePipeline.
2. CodePipeline downloads the source and triggers CodeBuild.
3. CodeBuild compiles code, runs tests, and builds package.
4. CodeDeploy deploys the package using rolling/green-blue updates.
5. Monitoring systems check service health; if failed, auto-rollback is triggered.

Answer: A production-grade architecture leverages:

• Multi-AZ VPC subnets for network redundancy.
• ECS Fargate serverless containers managed by an Auto Scaling Group behind an Application Load Balancer.
• AWS Secrets Manager to inject credentials at runtime.
• CodePipeline, CodeBuild, and CodeDeploy to deploy changes using Blue/Green routing with automated rollback alarms.