Ravindra BagaleCourses & study guides मराठी Track your progress

AWS VPC and Subnet Revision Cards (Ravi Sir's Cards): CIDR, Public vs Private Subnet, NAT

By Last updated:

Ravi Sir's Cards for AWS networking: 13 quick revision cards on VPC and subnets. Each card has a few short questions with an easy answer and a real example, plus a short why. Save them on your phone or download the PNG. The QR code on each card opens its full lesson.

Contents

VPC and CIDR basics

What is a VPC: your own private network inside one AWS Region, example ThreeTierVpc 10.0.0.0/16.
Card 1 of 13: What is a VPC? · Download PNG · Open card page

Lesson: What Is AWS VPC and How to Calculate CIDR IP Ranges

Default VPC: AWS makes one in every Region with CIDR 172.31.0.0/16, a /20 subnet in each AZ and an internet gateway.
Card 2 of 13: The default VPC · Download PNG · Open card page

Lesson: What Is AWS VPC and How to Calculate CIDR IP Ranges

CIDR host count: total IPs = 2 to the power of (32 minus prefix); /16 = 65,536, /20 = 4,096, /24 = 256; AWS subnets lose 5.
Card 3 of 13: CIDR math: how many IPs? · Download PNG · Open card page

Lesson: What Is AWS VPC and How to Calculate CIDR IP Ranges

AWS reserves 5 IPs in subnet 10.0.0.0/20: .0 network, .1 VPC router, .2 DNS, .3 future use, 10.0.15.255 broadcast.
Card 4 of 13: The 5 reserved IPs in a subnet · Download PNG · Open card page

Lesson: How to Create Public and Private Subnets in AWS VPC

AZs and subnets: one subnet lives in exactly one AZ; put a copy of each tier in AZ 2a and AZ 2b so one AZ failure does not stop the app.
Card 10 of 13: AZs and subnet placement · Download PNG · Open card page

Lesson: What Is AWS VPC and How to Calculate CIDR IP Ranges

Subnets, gateways and routes

Public vs private subnet: a public subnet has a route 0.0.0.0/0 to the internet gateway; a private subnet does not.
Card 7 of 13: Public vs private subnet · Download PNG · Open card page

Lesson: How to Create Public and Private Subnets in AWS VPC

Internet gateway: one per VPC, attach it first, then add route 0.0.0.0/0 to the IGW in the public route table.
Card 5 of 13: Internet gateway (IGW) · Download PNG · Open card page

Lesson: How to Create Public and Private Subnets in AWS VPC

Route tables: the local route 10.0.0.0/16 is always there; the public route table adds 0.0.0.0/0 to the internet gateway.
Card 6 of 13: Route tables · Download PNG · Open card page

Lesson: How to Create Public and Private Subnets in AWS VPC

NAT gateway: sits in a public subnet with an Elastic IP; private route 0.0.0.0/0 to the NAT lets private servers go out but blocks incoming connections.
Card 8 of 13: NAT gateway · Download PNG · Open card page

Lesson: How to Build a 3-Tier Architecture in AWS Step by Step (VPC, ALB, Auto Scaling, RDS)

Internet gateway vs NAT gateway: IGW is two-way for public subnets and free; NAT is outbound-only for private subnets and billed hourly.
Card 9 of 13: IGW vs NAT gateway · Download PNG · Open card page

Lesson: How to Create Public and Private Subnets in AWS VPC

3-tier plan, security and cheat sheet

3-tier subnet plan for 10.0.0.0/16: eight /20 subnets, Public 10.0.0.0 and 10.0.16.0, Web 10.0.32.0 and 10.0.48.0, App 10.0.64.0 and 10.0.80.0, DB 10.0.96.0 and 10.0.112.0, across AZs a and b.
Card 11 of 13: 3-tier subnet plan · Download PNG · Open card page

Lesson: How to Build a 3-Tier Architecture in AWS Step by Step (VPC, ALB, Auto Scaling, RDS)

Security group vs NACL: SG works on the instance, is stateful and has allow rules only; NACL works on the subnet, is stateless and has allow and deny rules checked by number.
Card 12 of 13: Security group vs NACL · Download PNG · Open card page

Lesson: Security Group vs NACL in AWS

VPC cheat sheet: VPC, subnet, IGW, route table, NAT gateway, /16 = 65,536 IPs, /20 = 4,096 IPs, 5 reserved IPs per subnet.
Card 13 of 13: VPC cheat sheet · Download PNG · Open card page

Lesson: What Is AWS VPC and How to Calculate CIDR IP Ranges

Comparison cards

Quick X vs Y cards for every comparison in the AWS course. Each card explains both terms, gives a real example and says when to use which.

Networking & IP

Comparison card: Static IP vs Dynamic IP. Static IP: An IP address that is set once and stays the same. Dynamic IP: An IP address given automatically by a DHCP server.
Comparison: Static IP vs Dynamic IP · Download PNG · Open card page

Lesson: 1.6 Static vs dynamic IP

Comparison card: Public IP vs Private IP. Public IP: A unique address on the internet. Private IP: An address used only inside a network: 10.x.x.x, 172.16–31.x.x or 192.168.x.x.
Comparison: Public IP vs Private IP · Download PNG · Open card page

Lesson: 1.7 Public vs private IP

Comparison card: Auto-assigned public IP vs Elastic IP. Auto-assigned public IP: A public IPv4 that AWS gives a new EC2 automatically. Elastic IP: A public IPv4 you reserve in your account and attach to an EC2.
Comparison: Auto-assigned public IP vs Elastic IP · Download PNG · Open card page

Lesson: What Is Amazon EC2 and How Does It Work

Comparison card: HTTP vs HTTPS. HTTP: Web protocol on port 80. Data travels as plain text. HTTPS: HTTP with TLS encryption, on port 443.
Comparison: HTTP vs HTTPS · Download PNG · Open card page

Lesson: Public vs Private IP Address Explained

Comparison card: OSI model vs TCP/IP model. OSI model: A teaching model that splits networking into steps. TCP/IP model: The model the real internet runs on.
Comparison: OSI model vs TCP/IP model · Download PNG · Open card page

Lesson: 2.3 The TCP/IP model and comparison

Comparison card: TCP vs UDP. TCP: Connection-based. Data arrives in order. UDP: No connection. Just sends packets.
Comparison: TCP vs UDP · Download PNG · Open card page

Lesson: ALB vs NLB vs Gateway Load Balancer in AWS

Comparison card: Public internet vs AWS backbone. Public internet: The shared network of many ISPs. AWS backbone: AWS's own private fibre network between its Regions.
Comparison: Public internet vs AWS backbone · Download PNG · Open card page

Lesson: AWS Regions and Availability Zones Explained

Comparison card: Region vs Availability Zone (AZ). Region: A geographic area with its own AWS data centres. Availability Zone (AZ): One or more data centres inside a Region, with separate power and network.
Comparison: Region vs Availability Zone (AZ) · Download PNG · Open card page

Lesson: AWS Regions and Availability Zones Explained

Cloud basics

Comparison card: On-premises vs Cloud. On-premises: Your own servers in your own office or data centre. Cloud: Servers rented from a provider like AWS over the internet.
Comparison: On-premises vs Cloud · Download PNG · Open card page

Lesson: 5.1 Why EC2? Cloud vs on-premises

Comparison card: Capex vs Opex. Capex: Capital expense: a big one-time purchase of assets. Opex: Operating expense: regular pay-as-you-go spending.
Comparison: Capex vs Opex · Download PNG · Open card page

Lesson: What Is Linux? History, Kernel and Basic File Commands

Comparison card: On-Demand vs Savings Plans / Spot. On-Demand: Pay per second or hour, no commitment. Savings Plans / Spot: Savings Plans: commit for 1 or 3 years. Spot: use spare AWS capacity.
Comparison: On-Demand vs Savings Plans / Spot · Download PNG · Open card page

Lesson: 5.2 What is EC2? Key concepts

Comparison card: VirtualBox VM vs Cloud server (EC2). VirtualBox VM: A virtual computer running on your own laptop. Cloud server (EC2): A virtual computer running in an AWS data centre.
Comparison: VirtualBox VM vs Cloud server (EC2) · Download PNG · Open card page

Lesson: Linux File Commands: touch, cat, nano and vi Tutorial

Comparison card: IAM user vs Linux user. IAM user: A person or app in your AWS account. Linux user: An account inside one server's operating system.
Comparison: IAM user vs Linux user · Download PNG · Open card page

Lesson: Linux Users, Groups and sudo for Beginners

EC2

Comparison card: Stop vs Terminate. Stop: Shuts the EC2 down. You can start it again. Terminate: Deletes the EC2 forever. It cannot start again.
Comparison: Stop vs Terminate · Download PNG · Open card page

Lesson: What Is Amazon EC2 and How Does It Work

Comparison card: Scale up (vertical) vs Scale out (horizontal). Scale up (vertical): Make one server bigger: more CPU and RAM. Scale out (horizontal): Add more servers of the same size.
Comparison: Scale up (vertical) vs Scale out (horizontal) · Download PNG · Open card page

Lesson: AWS Elastic IP, AMI and EBS Snapshots Explained

Comparison card: Launch template vs Auto Scaling group. Launch template: Saved settings for launching an EC2. Auto Scaling group: A group that keeps the right number of EC2 running.
Comparison: Launch template vs Auto Scaling group · Download PNG · Open card page

Lesson: What Is Auto Scaling in AWS? Min, Max and Desired Explained

Comparison card: Load balancer alone vs Load balancer + Auto Scaling. Load balancer alone: Spreads traffic over a fixed list of servers. Load balancer + Auto Scaling: Spreads traffic, and an Auto Scaling group keeps the server count.
Comparison: Load balancer alone vs Load balancer + Auto Scaling · Download PNG · Open card page

Lesson: What Is Auto Scaling in AWS? Min, Max and Desired Explained

Comparison card: Basic monitoring vs Detailed monitoring. Basic monitoring: EC2 metrics CloudWatch collects by default. Detailed monitoring: Extra option you turn on for EC2.
Comparison: Basic monitoring vs Detailed monitoring · Download PNG · Open card page

Lesson: How to Set Up a CloudWatch CPU Alarm with SNS in AWS

Storage & images

Comparison card: EBS snapshot vs AMI. EBS snapshot: A backup copy of ONE EBS disk at a point in time. AMI: Amazon Machine Image: a whole server image (disk snapshots + launch settings).
Comparison: EBS snapshot vs AMI · Download PNG · Open card page

Lesson: AWS Elastic IP, AMI and EBS Snapshots Explained

Comparison card: AMI vs Launch template. AMI: The disk image: OS plus installed software. Launch template: All launch settings, and it points to an AMI.
Comparison: AMI vs Launch template · Download PNG · Open card page

Lesson: How to Recover Data from a Broken EC2 Instance

Comparison card: Disable AMI vs Deregister AMI. Disable AMI: Hides the AMI so no one can launch new EC2 from it. Deregister AMI: Deletes the AMI.
Comparison: Disable AMI vs Deregister AMI · Download PNG · Open card page

Lesson: How to Recover Data from a Broken EC2 Instance

Comparison card: Grow a volume vs Add a new volume. Grow a volume: Make an existing EBS disk bigger. Add a new volume: Create a second EBS disk and attach it.
Comparison: Grow a volume vs Add a new volume · Download PNG · Open card page

Lesson: How to Add, Format and Mount an EBS Volume on EC2 (fstab)

Comparison card: EBS vs S3. EBS: A block disk attached to an EC2, in one AZ. S3: Object storage for files, reached over HTTPS, in a Region.
Comparison: EBS vs S3 · Download PNG · Open card page

Lesson: How to Build a 3-Tier Architecture in AWS with VPC, NAT Gateway and RDS

Comparison card: lsblk vs df -h. lsblk: Lists disks and partitions. df -h: Shows space on mounted filesystems.
Comparison: lsblk vs df -h · Download PNG · Open card page

Lesson: How to Add, Format and Mount an EBS Volume on EC2 (fstab)

Comparison card: du vs df. du: Disk usage: space used by files and folders. df: Disk free: space of whole filesystems.
Comparison: du vs df · Download PNG · Open card page

Lesson: How to Set Up Passwordless SSH Between Linux Servers

Comparison card: EBS volume vs Instance store. EBS volume: A network disk that lives separately from the EC2. Instance store: A disk physically inside the host computer.
Comparison: EBS volume vs Instance store · Download PNG · Open card page

Lesson: Interview Questions

VPC & security

Comparison card: Default VPC vs Custom VPC. Default VPC: A VPC AWS makes for you in every Region. Custom VPC: A VPC you create yourself.
Comparison: Default VPC vs Custom VPC · Download PNG · Open card page

Lesson: Security Group vs NACL in AWS

Comparison card: Stateful vs Stateless. Stateful: A firewall that remembers each request. Stateless: A firewall that checks every packet on its own.
Comparison: Stateful vs Stateless · Download PNG · Open card page

Lesson: Security Group vs NACL in AWS

Comparison card: Public route table vs Private route table. Public route table: Route table used by public subnets. Private route table: Route table used by private subnets.
Comparison: Public route table vs Private route table · Download PNG · Open card page

Lesson: 15.6 Route tables: public and private subnets

Comparison card: Zonal NAT gateway vs Regional NAT gateway. Zonal NAT gateway: The classic NAT gateway, living in one AZ, in a public subnet. Regional NAT gateway: A newer mode (Nov 2025): one NAT gateway for the whole VPC, across AZs.
Comparison: Zonal NAT gateway vs Regional NAT gateway · Download PNG · Open card page

Lesson: How to Build a 3-Tier Architecture in AWS with VPC, NAT Gateway and RDS

Comparison card: Anywhere (0.0.0.0/0) vs My IP. Anywhere (0.0.0.0/0): Security group source that allows every IP. My IP: Security group source that allows only your current IP.
Comparison: Anywhere (0.0.0.0/0) vs My IP · Download PNG · Open card page

Lesson: AWS IAM User, Root User and MFA: Launch Your First EC2 Instance

Comparison card: Hardcoded password vs AWS Secrets Manager. Hardcoded password: The password written inside the code. AWS Secrets Manager: An AWS service that stores the password encrypted.
Comparison: Hardcoded password vs AWS Secrets Manager · Download PNG · Open card page

Lesson: How to Build a 3-Tier Architecture in AWS Step by Step (VPC, ALB, Auto Scaling, RDS)

Load balancing & DNS

Comparison card: ALB vs NLB. ALB: Application Load Balancer. Reads web requests (HTTP/HTTPS, layer 7). NLB: Network Load Balancer. Passes TCP/UDP on without reading (layer 4).
Comparison: ALB vs NLB · Download PNG · Open card page

Lesson: ALB vs NLB vs Gateway Load Balancer in AWS

Comparison card: Internet-facing LB vs Internal LB. Internet-facing LB: A load balancer with a public DNS name. Internal LB: A load balancer with private IPs only.
Comparison: Internet-facing LB vs Internal LB · Download PNG · Open card page

Lesson: 18.16 Internet-facing and internal load balancers

Comparison card: Short connection vs Long-lived connection. Short connection: Opens, gets one answer, closes. Long-lived connection: Stays open for minutes or hours.
Comparison: Short connection vs Long-lived connection · Download PNG · Open card page

Lesson: ALB vs NLB vs Gateway Load Balancer in AWS

Comparison card: Pull vs Push. Pull: The app keeps asking the server: anything new? Push: The server sends news when it happens.
Comparison: Pull vs Push · Download PNG · Open card page

Lesson: ALB vs NLB vs Gateway Load Balancer in AWS

Comparison card: HTTPS ends at the LB vs End-to-end encryption. HTTPS ends at the LB: Users to the load balancer are encrypted; the LB to servers is plain HTTP. End-to-end encryption: Encrypted all the way to the server too.
Comparison: HTTPS ends at the LB vs End-to-end encryption · Download PNG · Open card page

Lesson: ALB vs NLB vs Gateway Load Balancer in AWS

Comparison card: Two A records vs Load balancer. Two A records: One domain name with two server IPs in DNS. Load balancer: One name in front of many servers, with health checks.
Comparison: Two A records vs Load balancer · Download PNG · Open card page

Lesson: How to Set Up a CloudWatch CPU Alarm with SNS in AWS

Comparison card: CNAME record vs Alias record (Route 53). CNAME record: Points a name to another name. (An A record points a name to an IPv4.) Alias record (Route 53): Route 53 record that points a name to an AWS resource like an ALB.
Comparison: CNAME record vs Alias record (Route 53) · Download PNG · Open card page

Lesson: How to Set Up a CloudWatch CPU Alarm with SNS in AWS

Databases

Comparison card: Database on your own EC2 vs Amazon RDS. Database on your own EC2: You install MySQL on an EC2 yourself. Amazon RDS: AWS runs the database for you.
Comparison: Database on your own EC2 vs Amazon RDS · Download PNG · Open card page

Lesson: Amazon RDS Multi-AZ vs Read Replicas Explained

Comparison card: Multi-AZ vs Read replica. Multi-AZ: A standby copy of the database in another AZ. Read replica: A read-only copy of the database.
Comparison: Multi-AZ vs Read replica · Download PNG · Open card page

Lesson: Amazon RDS Multi-AZ vs Read Replicas Explained

Comparison card: Synchronous copy vs Asynchronous copy. Synchronous copy: A write is done only after BOTH copies have it. Asynchronous copy: A write is done on the primary; the copy follows a bit later.
Comparison: Synchronous copy vs Asynchronous copy · Download PNG · Open card page

Lesson: Amazon RDS Multi-AZ vs Read Replicas Explained

Comparison card: Reads vs Writes. Reads: Queries that only fetch data. Writes: Queries that change data.
Comparison: Reads vs Writes · Download PNG · Open card page

Lesson: Amazon RDS Multi-AZ vs Read Replicas Explained

Comparison card: SQL database vs NoSQL database. SQL database: Tables with fixed columns, joined with SQL. NoSQL database: Documents or key-value items with a flexible shape.
Comparison: SQL database vs NoSQL database · Download PNG · Open card page

Lesson: Interview Questions

Comparison card: Primary key vs Unique key. Primary key: The main ID of each row. Unique key: A rule that a column has no duplicates.
Comparison: Primary key vs Unique key · Download PNG · Open card page

Lesson: SQL ALTER TABLE Command with Examples

Comparison card: DELETE vs TRUNCATE vs DROP. DELETE: Removes chosen rows. TRUNCATE: Removes ALL rows at once. DROP: Removes the whole table.
Comparison: DELETE vs TRUNCATE vs DROP · Download PNG · Open card page

Lesson: SQL ALTER TABLE Command with Examples

Comparison card: UPDATE vs ALTER TABLE. UPDATE: Changes the data inside rows. ALTER TABLE: Changes the structure of the table.
Comparison: UPDATE vs ALTER TABLE · Download PNG · Open card page

Lesson: SQL ALTER TABLE Command with Examples

Comparison card: COUNT(*) vs COUNT(column). COUNT(*): Counts all rows. COUNT(column): Counts rows where that column is not NULL.
Comparison: COUNT(*) vs COUNT(column) · Download PNG · Open card page

Lesson: SQL SELECT Query Examples for Beginners

Web servers & apps

Comparison card: Apache (httpd) vs Nginx. Apache (httpd): A classic web server with .htaccess files and modules. Nginx: A fast web server and reverse proxy.
Comparison: Apache (httpd) vs Nginx · Download PNG · Open card page

Lesson: 6.2 Nginx vs Apache

Comparison card: LAMP vs LEMP. LAMP: Linux + Apache + MySQL/MariaDB + PHP. LEMP: Linux + Nginx ('engine-x') + MySQL/MariaDB + PHP.
Comparison: LAMP vs LEMP · Download PNG · Open card page

Lesson: How to Install LAMP Stack on Amazon Linux (EC2)

Comparison card: MEAN vs MERN. MEAN: MongoDB + Express + Angular + Node.js. MERN: MongoDB + Express + React + Node.js.
Comparison: MEAN vs MERN · Download PNG · Open card page

Lesson: 12.1 What is a "stack" and why does it matter?

Comparison card: Amazon Linux vs Ubuntu. Amazon Linux: AWS's own Linux for EC2. Ubuntu: A popular Linux from Canonical.
Comparison: Amazon Linux vs Ubuntu · Download PNG · Open card page

Lesson: How to Install LAMP and LEMP Stack on Ubuntu (EC2)

Comparison card: Static website vs Dynamic website. Static website: Ready HTML, CSS and image files. Dynamic website: Pages built by code and a database for each visitor.
Comparison: Static website vs Dynamic website · Download PNG · Open card page

Lesson: How to Host a Website on AWS EC2 with Apache

Comparison card: Website hosting vs API hosting. Website hosting: Serves pages for people in a browser. API hosting: Serves data for other programs.
Comparison: Website hosting vs API hosting · Download PNG · Open card page

Lesson: How to Host a Website on AWS EC2 with Apache

Comparison card: Software (install) vs Service (start/enable). Software (install): Putting the program files on disk. Service (start/enable): Running the program in the background.
Comparison: Software (install) vs Service (start/enable) · Download PNG · Open card page

Lesson: How to Host a Website on AWS EC2 with Apache

Comparison card: Python Flask app vs Node.js Express app. Python Flask app: A web app written in Python. Node.js Express app: A web app written in JavaScript.
Comparison: Python Flask app vs Node.js Express app · Download PNG · Open card page

Lesson: Host a Node.js Express App on AWS EC2 with PM2 and Nginx

Comparison card: localhost vs 127.0.0.1. localhost: A name for 'this same computer'. 127.0.0.1: The IPv4 loopback address of this computer.
Comparison: localhost vs 127.0.0.1 · Download PNG · Open card page

Lesson: Common Mistakes I See Students Make

Comparison card: WSGI vs ASGI. WSGI: Python standard for synchronous web apps. ASGI: Python standard for asynchronous web apps.
Comparison: WSGI vs ASGI · Download PNG · Open card page

Lesson: Interview Questions

Comparison card: scp vs FTP / SFTP (FileZilla). scp: Command-line copy over SSH. FTP / SFTP (FileZilla): File transfer protocol; FileZilla is a GUI app for it.
Comparison: scp vs FTP / SFTP (FileZilla) · Download PNG · Open card page

Lesson: How to Fix WordPress After the Server IP Changes

Linux

Comparison card: Kernel vs Operating system. Kernel: The core program that talks to the hardware. Operating system: The kernel plus tools, shell and libraries.
Comparison: Kernel vs Operating system · Download PNG · Open card page

Lesson: What Is Linux? History, Kernel and Basic File Commands

Comparison card: Modify time vs Change time. Modify time: When the file's content last changed. Change time: When the file's details last changed.
Comparison: Modify time vs Change time · Download PNG · Open card page

Lesson: What Is Linux? History, Kernel and Basic File Commands

Comparison card: File vs Folder (directory). File: Holds data: text, code, images. Folder (directory): Holds files and other folders.
Comparison: File vs Folder (directory) · Download PNG · Open card page

Lesson: Linux Directory Commands: pwd, ls, cd, mkdir for Beginners

Comparison card: chmod 766 vs chmod 776. chmod 766: Owner rwx, group rw-, others rw-. chmod 776: Owner rwx, group rwx, others rw-.
Comparison: chmod 766 vs chmod 776 · Download PNG · Open card page

Lesson: Linux chmod Command Explained: File Permissions 755, 644, 400

Comparison card: touch vs sudo touch. touch: Creates an empty file as you. sudo touch: Creates an empty file as root.
Comparison: touch vs sudo touch · Download PNG · Open card page

Lesson: Linux Users, Groups and sudo for Beginners

Comparison card: su ravi vs su - ravi. su ravi: Switch to user ravi, keep your current setup. su - ravi: Switch to ravi with a full fresh login.
Comparison: su ravi vs su - ravi · Download PNG · Open card page

Lesson: Linux User Management: useradd, passwd and sudo Access

Comparison card: userdel vs userdel -r. userdel: Deletes the user account. userdel -r: Deletes the account AND its home folder and mail.
Comparison: userdel vs userdel -r · Download PNG · Open card page

Lesson: Linux User Management: useradd, passwd and sudo Access

Comparison card: mv on the same disk vs mv across disks. mv on the same disk: Moving a file inside one filesystem. mv across disks: Moving a file to another filesystem.
Comparison: mv on the same disk vs mv across disks · Download PNG · Open card page

Lesson: Linux mv and rm Commands: Move, Rename and Delete Files

Comparison card: root vs ec2-user. root: The super user with full power. ec2-user: The default login user on Amazon Linux.
Comparison: root vs ec2-user · Download PNG · Open card page

Lesson: How to Set Up Passwordless SSH Between Linux Servers

CloudWatch cards: revision, comparison and interview

Revision, X vs Y and interview cards for Amazon CloudWatch: metrics, alarms, health checks, logs and dashboards.

Amazon CloudWatch Explained: Metrics, Namespaces, Alarms and SNS Email Alerts

Revision card: What is Amazon CloudWatch?. Nobody can watch 50 servers all night. A tool must watch and shout only when something is wrong. CloudWatch is the AWS monitoring service: metrics (numbers), alarms (warnings), logs (text) and dashboards (graphs). Open CloudWatch in the console. EC2 metrics are already there; no install needed for CPU and network. Sale night: CPU of a web server goes from 20% to 95%. CloudWatch records it every 5 minutes.
Revision card: What is Amazon CloudWatch? · Download PNG

Lesson: Amazon CloudWatch Explained: Metrics, Namespaces, Alarms and SNS Email Alerts

Revision card: Metric, namespace and dimension. AWS stores thousands of numbers. You need names to find the one you want. Metric = one number measured again and again. Namespace = folder of one service. Dimension = label that says which resource. Pick namespace, then metric, then dimension value. Memory of one server: namespace CWAgent, metric mem_used_percent, InstanceId i-0abc123.
Revision card: Metric, namespace and dimension · Download PNG

Lesson: Amazon CloudWatch Explained: Metrics, Namespaces, Alarms and SNS Email Alerts

Revision card: How a CloudWatch alarm decides. A graph is useless at 3 AM. An alarm watches one metric for you and acts. Period = time box. Threshold = the line. M out of N = how many of the last N boxes must cross the line. Set period 300 s, threshold 80, 2 out of 3. States: OK, ALARM, INSUFFICIENT_DATA. CPU averages 85, 70, 90 → two boxes above 80 → ALARM.
Revision card: How a CloudWatch alarm decides · Download PNG

Lesson: Amazon CloudWatch Explained: Metrics, Namespaces, Alarms and SNS Email Alerts

Revision card: Alarm email with Amazon SNS. An alarm knows something is wrong but cannot send email by itself. SNS (Simple Notification Service) is a messenger. A topic is like a WhatsApp group; people subscribe by email. Create a Standard topic, add an email subscription, click Confirm in the email, select the topic in the alarm. Alarm web1-cpu-high goes to ALARM → email "ALARM: web1-cpu-high" arrives in a minute.
Revision card: Alarm email with Amazon SNS · Download PNG

Lesson: Amazon CloudWatch Explained: Metrics, Namespaces, Alarms and SNS Email Alerts

Comparison: Basic monitoring vs Detailed monitoring. Basic monitoring: EC2 metrics sent to CloudWatch by default. Detailed monitoring: EC2 metrics at a finer step, turned on per instance.
Comparison: Basic monitoring vs Detailed monitoring · Download PNG

Lesson: Amazon CloudWatch Explained: Metrics, Namespaces, Alarms and SNS Email Alerts

Comparison: Metrics vs Logs. Metrics: Numbers measured over time, like CPU %. Logs: Text lines written by apps and servers.
Comparison: Metrics vs Logs · Download PNG

Lesson: Amazon CloudWatch Explained: Metrics, Namespaces, Alarms and SNS Email Alerts

Comparison: Average vs Maximum. Average: Statistic that adds values and divides by their count. Maximum: Statistic that takes the highest value.
Comparison: Average vs Maximum · Download PNG

Lesson: Amazon CloudWatch Explained: Metrics, Namespaces, Alarms and SNS Email Alerts

Comparison: CloudWatch alarm vs SNS topic. CloudWatch alarm: A rule that watches one metric against a threshold. SNS topic: A messenger that delivers a message to subscribers.
Comparison: CloudWatch alarm vs SNS topic · Download PNG

Lesson: Amazon CloudWatch Explained: Metrics, Namespaces, Alarms and SNS Email Alerts

Interview card: Basic vs detailed monitoring in CloudWatch: what is the difference?. Basic sends EC2 metrics every 5 minutes, free. Detailed sends every 1 minute, paid. A sale spike can grow in 2 minutes. 1-minute data shows it sooner and lets alarms react faster. EC2 › Actions › Monitor and troubleshoot › Manage detailed monitoring › Enable.
Interview card: Basic vs detailed monitoring in CloudWatch: what is the difference? · Download PNG

Lesson: Amazon CloudWatch Explained: Metrics, Namespaces, Alarms and SNS Email Alerts

Interview card: Why does CloudWatch not show EC2 memory by default?. AWS sees the instance from the hypervisor, outside the OS. Memory is inside the OS. Java or .NET apps often die from memory, not CPU. You need that number. Install the CloudWatch agent with an IAM role; read CWAgent mem_used_percent.
Interview card: Why does CloudWatch not show EC2 memory by default? · Download PNG

Lesson: Amazon CloudWatch Explained: Metrics, Namespaces, Alarms and SNS Email Alerts

Interview card: What does "2 out of 3 datapoints" mean in a CloudWatch alarm?. Look at the last 3 periods. Go to ALARM if at least 2 of them crossed the threshold. It ignores one short spike but still catches a real problem. Threshold 80, values 85, 70, 90 → 2 above 80 → ALARM. With 3 of 3 it stays OK.
Interview card: What does "2 out of 3 datapoints" mean in a CloudWatch alarm? · Download PNG

Lesson: Amazon CloudWatch Explained: Metrics, Namespaces, Alarms and SNS Email Alerts

Interview card: What are the three CloudWatch alarm states?. OK (inside the line), ALARM (crossed long enough), INSUFFICIENT_DATA (not enough data). Actions run on a state change, so you can email on ALARM and again on OK. A new alarm or a stopped instance shows INSUFFICIENT_DATA at first; then OK or ALARM.
Interview card: What are the three CloudWatch alarm states? · Download PNG

Lesson: Amazon CloudWatch Explained: Metrics, Namespaces, Alarms and SNS Email Alerts

How to Stop, Start, Reboot or Recover an EC2 Instance with a CloudWatch Alarm

Revision card: EC2 alarm actions. An email still needs a person to log in. Simple fixes should happen at once, even at 3 AM. A CloudWatch alarm can press 4 EC2 buttons: stop, terminate, reboot, recover. There is no start button. In the alarm: Add EC2 action → In alarm → choose the action. Dev server idle: CPU below 5% for 12 x 5 min (1 hour) → stop. Saves the night's bill.
Revision card: EC2 alarm actions · Download PNG

Lesson: How to Stop, Start, Reboot or Recover an EC2 Instance with a CloudWatch Alarm

Revision card: How to start a stopped EC2 automatically. A payroll server must come on at 1 AM. Alarms have no start action, because a stopped server sends no metrics. EventBridge Scheduler calls the EC2 StartInstances API on a clock. Lambda can call it from an alarm. Scheduler: cron 0 1 * * ? *, time zone Asia/Calcutta, target EC2 StartInstances, role with ec2:StartInstances. Lambda (Python): start_instances(InstanceIds=["i-0standby"]) when alarm main-web-down fires.
Revision card: How to start a stopped EC2 automatically · Download PNG

Lesson: How to Stop, Start, Reboot or Recover an EC2 Instance with a CloudWatch Alarm

Revision card: Reboot and recover actions. A hung server or broken AWS hardware takes the site down at night. Reboot restarts the OS on the same host. Recover moves the instance to new AWS hardware. Reboot on StatusCheckFailed_Instance (3 of 3 min). Recover on StatusCheckFailed_System (2 of 2 min). After recover: same instance ID, private IP and Elastic IP. Users notice nothing.
Revision card: Reboot and recover actions · Download PNG

Lesson: How to Stop, Start, Reboot or Recover an EC2 Instance with a CloudWatch Alarm

Revision card: EventBridge Scheduler for EC2 on/off. Dev servers run 24 hours but people work 9 to 9. Half the bill is wasted. EventBridge Scheduler runs an AWS API call at a fixed time, like an alarm clock for AWS. Make two schedules: StartInstances at 9 AM and StopInstances at 9 PM, time zone Asia/Calcutta. t3.large dev box: 24 h → 12 h a day halves its compute hours.
Revision card: EventBridge Scheduler for EC2 on/off · Download PNG

Lesson: How to Stop, Start, Reboot or Recover an EC2 Instance with a CloudWatch Alarm

Comparison: Alarm stop action vs EventBridge Scheduler start. Alarm stop action: A CloudWatch alarm action that stops an instance. EventBridge Scheduler start: A schedule that calls EC2 StartInstances.
Comparison: Alarm stop action vs EventBridge Scheduler start · Download PNG

Lesson: How to Stop, Start, Reboot or Recover an EC2 Instance with a CloudWatch Alarm

Comparison: Reboot action vs Recover action. Reboot action: Restarts the operating system. Recover action: Moves the instance to new AWS hardware.
Comparison: Reboot action vs Recover action · Download PNG

Lesson: How to Stop, Start, Reboot or Recover an EC2 Instance with a CloudWatch Alarm

Comparison: EventBridge Scheduler vs Alarm + Lambda. EventBridge Scheduler: A service that runs an AWS API call at set times. Alarm + Lambda: A function the alarm runs when it goes to ALARM.
Comparison: EventBridge Scheduler vs Alarm + Lambda · Download PNG

Lesson: How to Stop, Start, Reboot or Recover an EC2 Instance with a CloudWatch Alarm

Interview card: Which EC2 actions can a CloudWatch alarm take?. Stop, terminate, reboot and recover. There is no start action. They fix simple problems at once without waking a person. Idle dev server: CPU < 5% for 1 hour → Stop this instance.
Interview card: Which EC2 actions can a CloudWatch alarm take? · Download PNG

Lesson: How to Stop, Start, Reboot or Recover an EC2 Instance with a CloudWatch Alarm

Interview card: How do you start a stopped EC2 instance automatically?. With EventBridge Scheduler on a clock, or from an alarm on another metric through a Lambda function. Alarms have no start action: a stopped instance sends no metrics to watch. Scheduler target EC2 StartInstances, cron 0 1 * * ? *, time zone Asia/Calcutta.
Interview card: How do you start a stopped EC2 instance automatically? · Download PNG

Lesson: How to Stop, Start, Reboot or Recover an EC2 Instance with a CloudWatch Alarm

Interview card: When would you use a stop action and when a terminate action?. Stop pauses the server and keeps its disk. Terminate deletes the server for ever. A wrong terminate loses data; termination protection blocks it on important servers. Jenkins agent idle → stop. Python batch job done, output in S3 → terminate.
Interview card: When would you use a stop action and when a terminate action? · Download PNG

Lesson: How to Stop, Start, Reboot or Recover an EC2 Instance with a CloudWatch Alarm

Interview card: How can a CloudWatch alarm run your own code?. Add a Lambda action to the alarm, or send the alarm to SNS and subscribe a Lambda function. Some fixes are not built in, like starting a standby server. Allow principal lambda.alarms.cloudwatch.amazonaws.com; code calls start_instances.
Interview card: How can a CloudWatch alarm run your own code? · Download PNG

Lesson: How to Stop, Start, Reboot or Recover an EC2 Instance with a CloudWatch Alarm

EC2 and EBS Health Check Alarms in CloudWatch (Status Checks, BurstBalance, Queue Length)

Revision card: EC2 status checks. A server can show "running" and still be frozen. CPU alarms cannot see that. AWS tests each instance every minute. Each check is 0 (pass) or 1 (fail). Alarm: statistic Maximum, period 1 minute, threshold >= 1. Node.js server runs out of memory → StatusCheckFailed_Instance = 1 → reboot alarm fires.
Revision card: EC2 status checks · Download PNG

Lesson: EC2 and EBS Health Check Alarms in CloudWatch (Status Checks, BurstBalance, Queue Length)

Revision card: Attached EBS status check. If a disk cannot read or write, the app hangs while CPU looks fine. StatusCheckFailed_AttachedEBS is 1 when an attached EBS volume cannot do I/O. Nitro instances only (t3, m5, c5…). Alarm: Maximum, 60 s, 10 out of 10, >= 1, notify SNS. Recover is not supported for this metric. Fix: stop then start the instance to move it to a new host, or replace the volume.
Revision card: Attached EBS status check · Download PNG

Lesson: EC2 and EBS Health Check Alarms in CloudWatch (Status Checks, BurstBalance, Queue Length)

Revision card: EBS BurstBalance. A small gp2 disk can become very slow after heavy use, with no CPU warning. BurstBalance = % of burst credits left on gp2, st1 or sc1, like mobile data left in your pack. gp3 has none. Alarm: AWS/EBS BurstBalance, Average, 5 min, lower than 20, 3 of 3. 100 GiB gp2: burst 3,000 IOPS, baseline 300. At 0% it drops to 300. Fix: modify to gp3.
Revision card: EBS BurstBalance · Download PNG

Lesson: EC2 and EBS Health Check Alarms in CloudWatch (Status Checks, BurstBalance, Queue Length)

Revision card: EBS VolumeQueueLength. Slow disks make every query slow, but CPU stays low, so CPU alarms stay silent. VolumeQueueLength = requests waiting for the disk, like a queue at a bank counter. Alarm: AWS/EBS VolumeQueueLength, Average, 5 min, greater than 10, 3 of 3. Tune to your app. MySQL import: queue grows from 1 to 40, queries go from 50 ms to 2 s.
Revision card: EBS VolumeQueueLength · Download PNG

Lesson: EC2 and EBS Health Check Alarms in CloudWatch (Status Checks, BurstBalance, Queue Length)

Comparison: StatusCheckFailed_System vs StatusCheckFailed_Instance. StatusCheckFailed_System: Check of the AWS host: power, network, hardware. StatusCheckFailed_Instance: Check of your OS: does it answer network tests?
Comparison: StatusCheckFailed_System vs StatusCheckFailed_Instance · Download PNG

Lesson: EC2 and EBS Health Check Alarms in CloudWatch (Status Checks, BurstBalance, Queue Length)

Comparison: gp2 volume vs gp3 volume. gp2 volume: General Purpose SSD whose speed grows with size. gp3 volume: General Purpose SSD with a fixed baseline.
Comparison: gp2 volume vs gp3 volume · Download PNG

Lesson: EC2 and EBS Health Check Alarms in CloudWatch (Status Checks, BurstBalance, Queue Length)

Comparison: EBS volume status vs StatusCheckFailed_AttachedEBS. EBS volume status: Health state of one volume: ok, warning, impaired. StatusCheckFailed_AttachedEBS: EC2 metric: 1 when an attached volume cannot do I/O.
Comparison: EBS volume status vs StatusCheckFailed_AttachedEBS · Download PNG

Lesson: EC2 and EBS Health Check Alarms in CloudWatch (Status Checks, BurstBalance, Queue Length)

Comparison: VolumeQueueLength vs BurstBalance. VolumeQueueLength: EBS metric: requests waiting for the disk. BurstBalance: EBS metric: % of burst credits left.
Comparison: VolumeQueueLength vs BurstBalance · Download PNG

Lesson: EC2 and EBS Health Check Alarms in CloudWatch (Status Checks, BurstBalance, Queue Length)

Interview card: System status check vs instance status check: what is the difference?. System = AWS host (power, network, hardware). Instance = your OS (memory, kernel, network config). The fix is different: AWS hardware needs a move, your OS needs a restart or repair. StatusCheckFailed_System → recover action. StatusCheckFailed_Instance → reboot action.
Interview card: System status check vs instance status check: what is the difference? · Download PNG

Lesson: EC2 and EBS Health Check Alarms in CloudWatch (Status Checks, BurstBalance, Queue Length)

Interview card: Which statistic do you use for a status check alarm, and why?. Maximum, with threshold greater than or equal to 1. The metric is 0 or 1. Average could hide one failed minute. Period 60 s, 2 out of 2 for recover; 3 out of 3 for reboot.
Interview card: Which statistic do you use for a status check alarm, and why? · Download PNG

Lesson: EC2 and EBS Health Check Alarms in CloudWatch (Status Checks, BurstBalance, Queue Length)

Interview card: Why is BurstBalance empty for a gp3 volume?. gp3 has no burst bucket. It gives a fixed baseline you can raise. No credits means no sudden slowdown after heavy use. gp3 baseline: 3,000 IOPS and 125 MiB/s at any size. gp2 100 GiB: 300 IOPS baseline.
Interview card: Why is BurstBalance empty for a gp3 volume? · Download PNG

Lesson: EC2 and EBS Health Check Alarms in CloudWatch (Status Checks, BurstBalance, Queue Length)

Interview card: The app is slow but CPU is low. Which EBS metrics do you check?. VolumeQueueLength (requests waiting) and BurstBalance (credits left on gp2). A disk that cannot keep up makes every request wait, while CPU sits idle. Queue 40 and BurstBalance 0% on gp2 → change to gp3 with Modify volume, no downtime.
Interview card: The app is slow but CPU is low. Which EBS metrics do you check? · Download PNG

Lesson: EC2 and EBS Health Check Alarms in CloudWatch (Status Checks, BurstBalance, Queue Length)

How to Send Logs from Multiple EC2 Instances to CloudWatch Logs (Agent, SSM, Logs Insights)

Revision card: Log group, stream and retention. Five servers, one error: without one place for logs you SSH into all five. Log event = one line. Log stream = lines from one source. Log group = folder of streams. Retention = days to keep. Use one stream per instance and set retention; the default is Never expire. Group /app/nginx/access holds streams i-0aaa, i-0bbb, i-0ccc. Retention 30 days.
Revision card: Log group, stream and retention · Download PNG

Lesson: How to Send Logs from Multiple EC2 Instances to CloudWatch Logs (Agent, SSM, Logs Insights)

Revision card: IAM role for the CloudWatch agent. The agent must prove it may write logs. Access keys on servers can leak. An EC2 role gives short-lived keys automatically. CloudWatchAgentServerPolicy allows sending metrics and logs. IAM › Create role › EC2 › add CloudWatchAgentServerPolicy and AmazonSSMManagedInstanceCore. Role EC2-CloudWatchAgent-Role attached to web1 → agent writes to /app/nginx/access.
Revision card: IAM role for the CloudWatch agent · Download PNG

Lesson: How to Send Logs from Multiple EC2 Instances to CloudWatch Logs (Agent, SSM, Logs Insights)

Revision card: CloudWatch agent config. EC2 cannot see memory, disk space or log files. The agent runs inside the server and sends them. A JSON file lists metrics (mem, disk) and log files with their log group, stream name and retention. Run the wizard once, or write the JSON, then load it with fetch-config. Check with -a status → "running". Logs appear in a minute.
Revision card: CloudWatch agent config · Download PNG

Lesson: How to Send Logs from Multiple EC2 Instances to CloudWatch Logs (Agent, SSM, Logs Insights)

Revision card: CloudWatch Logs Insights. Scrolling streams of 5 servers is slow. One query should search them all. Logs Insights is a small query language over one or more log groups. Pick log group and time range, write fields / filter / stats, click Run query. filter @message like / 50[0-9] / shows every 5xx line from every server.
Revision card: CloudWatch Logs Insights · Download PNG

Lesson: How to Send Logs from Multiple EC2 Instances to CloudWatch Logs (Agent, SSM, Logs Insights)

Comparison: Manual agent install vs SSM Run Command install. Manual agent install: SSH into a server, install and configure the CloudWatch agent by hand. SSM Run Command install: Systems Manager runs the install and config on many servers at once.
Comparison: Manual agent install vs SSM Run Command install · Download PNG

Lesson: How to Send Logs from Multiple EC2 Instances to CloudWatch Logs (Agent, SSM, Logs Insights)

Comparison: Config wizard vs JSON config file. Config wizard: A program that asks questions and writes the agent config. JSON config file: The agent config written or edited by hand.
Comparison: Config wizard vs JSON config file · Download PNG

Lesson: How to Send Logs from Multiple EC2 Instances to CloudWatch Logs (Agent, SSM, Logs Insights)

Comparison: Log group vs Log stream. Log group: A folder of streams of the same kind, with one retention. Log stream: All lines from one source, such as one instance.
Comparison: Log group vs Log stream · Download PNG

Lesson: How to Send Logs from Multiple EC2 Instances to CloudWatch Logs (Agent, SSM, Logs Insights)

Comparison: Logs Insights vs Metric filter. Logs Insights: A query language you run over log groups. Metric filter: A rule that turns matching log lines into a metric.
Comparison: Logs Insights vs Metric filter · Download PNG

Lesson: How to Send Logs from Multiple EC2 Instances to CloudWatch Logs (Agent, SSM, Logs Insights)

Interview card: Which IAM policy does the CloudWatch agent need on EC2?. CloudWatchAgentServerPolicy on an EC2 instance role. A role gives short-lived keys; access keys stored on servers can leak. Add AmazonSSMManagedInstanceCore too if Systems Manager will install the agent.
Interview card: Which IAM policy does the CloudWatch agent need on EC2? · Download PNG

Lesson: How to Send Logs from Multiple EC2 Instances to CloudWatch Logs (Agent, SSM, Logs Insights)

Interview card: Logs come from 10 servers. How do you know which server wrote a line?. Set log_stream_name to {instance_id}, so each server writes its own stream. A customer complaint needs the exact server, even after Auto Scaling removed it. In Logs Insights read @logStream, or count with stats count(*) by @logStream.
Interview card: Logs come from 10 servers. How do you know which server wrote a line? · Download PNG

Lesson: How to Send Logs from Multiple EC2 Instances to CloudWatch Logs (Agent, SSM, Logs Insights)

Interview card: How do you install the CloudWatch agent on 100 servers?. Systems Manager Run Command, targeted by a tag, with the config in Parameter Store. No SSH, no port 22, and every server gets the same config. AWS-ConfigureAWSPackage (install AmazonCloudWatchAgent), then AmazonCloudWatch-ManageAgent (configure, ssm).
Interview card: How do you install the CloudWatch agent on 100 servers? · Download PNG

Lesson: How to Send Logs from Multiple EC2 Instances to CloudWatch Logs (Agent, SSM, Logs Insights)

Interview card: What is the default retention of a CloudWatch log group?. Never expire. Logs stay until you delete them. Stored logs are billed every month, so the bill keeps growing. Set 30 days for access logs, 90+ for audit logs.
Interview card: What is the default retention of a CloudWatch log group? · Download PNG

Lesson: How to Send Logs from Multiple EC2 Instances to CloudWatch Logs (Agent, SSM, Logs Insights)

How to Create a CloudWatch Dashboard for Multiple EC2 Instances

Revision card: CloudWatch dashboard and widgets. On sale night nobody wants to open 10 console pages to ask "are we fine?". A dashboard is one page you design. A widget is one box: line graph, number, gauge, alarm status, logs table, text. CloudWatch › Dashboards › Create → Add widget → choose type → Save. shop-prod: web CPU line, Requests/min number, 5xx %, alarm lights, latest 5xx logs.
Revision card: CloudWatch dashboard and widgets · Download PNG

Lesson: How to Create a CloudWatch Dashboard for Multiple EC2 Instances

Revision card: Dashboard metric math. "12 errors" means little without knowing the traffic. Metric math makes a new line from other metrics with a formula. m1 = HTTPCode_Target_5XX_Count (Sum), m2 = RequestCount (Sum), Add math → expression. 12 errors in 3,000 requests → 0.4% of requests failed.
Revision card: Dashboard metric math · Download PNG

Lesson: How to Create a CloudWatch Dashboard for Multiple EC2 Instances

Revision card: SEARCH for many instances. Auto Scaling adds and removes servers. Ticking each one on a graph never keeps up. A SEARCH expression finds every metric that matches, each time the graph loads. In the graph Source tab, write the SEARCH with namespace, metric, statistic and period. 3 servers at 9 PM, 6 at 10 PM: all 6 lines appear by themselves.
Revision card: SEARCH for many instances · Download PNG

Lesson: How to Create a CloudWatch Dashboard for Multiple EC2 Instances

Revision card: How to share a CloudWatch dashboard. A manager or client should see graphs without getting AWS console access. Share by email (user sets a password, read-only) or publicly (anyone with the link). Dashboard › Actions › Share dashboard › username and password › add emails › Prepare for sharing. Client gets a link, sets a password and sees shop-prod with no console menu. Public only for non-sensitive data.
Revision card: How to share a CloudWatch dashboard · Download PNG

Lesson: How to Create a CloudWatch Dashboard for Multiple EC2 Instances

Comparison: Dashboard vs Alarm. Dashboard: A page of graphs and widgets you design. Alarm: A rule that watches one metric and acts.
Comparison: Dashboard vs Alarm · Download PNG

Lesson: How to Create a CloudWatch Dashboard for Multiple EC2 Instances

Comparison: Share by email vs Share publicly. Share by email: Dashboard shared with chosen email addresses. Share publicly: Dashboard open to anyone with the link.
Comparison: Share by email vs Share publicly · Download PNG

Lesson: How to Create a CloudWatch Dashboard for Multiple EC2 Instances

Comparison: Ticked metrics vs SEARCH expression. Ticked metrics: Each instance metric picked by hand on the graph. SEARCH expression: A query that finds all matching metrics each time.
Comparison: Ticked metrics vs SEARCH expression · Download PNG

Lesson: How to Create a CloudWatch Dashboard for Multiple EC2 Instances

Interview card: How do you show CPU of all Auto Scaling instances on one graph?. Use a SEARCH expression on AWS/EC2 CPUUtilization. Instances come and go; a fixed list goes out of date in an hour. Source tab: SEARCH with namespace, metric, statistic Average, period 300.
Interview card: How do you show CPU of all Auto Scaling instances on one graph? · Download PNG

Lesson: How to Create a CloudWatch Dashboard for Multiple EC2 Instances

Interview card: How do you share a CloudWatch dashboard with someone who has no AWS login?. Share with their email address. They set a password and get read-only access. Console access only to see graphs would give far too much power. Actions › Share dashboard › username and password. Public link only for non-sensitive data.
Interview card: How do you share a CloudWatch dashboard with someone who has no AWS login? · Download PNG

Lesson: How to Create a CloudWatch Dashboard for Multiple EC2 Instances

Interview card: Why keep CloudWatch dashboards as JSON?. The JSON describes every widget; put-dashboard creates the dashboard from it. Clicked dashboards live in one account and are easy to lose. Save dash.json in Git, then recreate in any account or Region in seconds.
Interview card: Why keep CloudWatch dashboards as JSON? · Download PNG

Lesson: How to Create a CloudWatch Dashboard for Multiple EC2 Instances

Interview card: How do you show the 5xx error rate as a percentage on a dashboard?. Metric math: 100 times 5xx count divided by request count. A raw count rises with traffic; a percentage shows real health. m1 = HTTPCode_Target_5XX_Count Sum, m2 = RequestCount Sum. 12 / 3,000 → 0.4%.
Interview card: How do you show the 5xx error rate as a percentage on a dashboard? · Download PNG

Lesson: How to Create a CloudWatch Dashboard for Multiple EC2 Instances

AWS chapter cards: revision, comparison and interview (1)

How to Access a Private EC2 with a Bastion Host and NAT Gateway

Revision card: What is a bastion host?. A private EC2 has no public IP. Your laptop cannot SSH to it directly. A bastion (jump server) is a small server in the public subnet. Its only job is to be the SSH door. SSH to the bastion, then from it to the private IP. Allow port 22 on the private server only from the bastion SG. Bastion public IP 13.2.1.9. App server private IP 10.0.16.7. Only the bastion can reach it.
Revision card: What is a bastion host? · Download PNG

Lesson: How to Access a Private EC2 with a Bastion Host and NAT Gateway

Revision card: SSH through a bastion with -J. Copying keypair.pem onto the bastion is risky. If the bastion is hacked, the key is stolen. -J (ProxyJump) makes SSH hop through the bastion. The key stays on your laptop. Load the key in the agent, then jump in one command. Bastion 13.2.1.9, app 10.0.16.7:
Revision card: SSH through a bastion with -J · Download PNG

Lesson: How to Access a Private EC2 with a Bastion Host and NAT Gateway

Revision card: What is a NAT gateway?. A private server still needs the internet to run yum install or get updates. A NAT gateway lets private servers go OUT to the internet. Nobody from outside can come IN. Create it in a PUBLIC subnet with an Elastic IP. Point the private route table to it. App 10.0.16.7 runs sudo yum install php -y. Traffic leaves through the NAT Elastic IP.
Revision card: What is a NAT gateway? · Download PNG

Lesson: How to Access a Private EC2 with a Bastion Host and NAT Gateway

Revision card: Private route table with NAT. A private subnet has only the local route. Packets to the internet have nowhere to go. A route table is a list: destination and target. 0.0.0.0/0 means "everything else". Add 0.0.0.0/0 with target NAT gateway. Never target the internet gateway here. Private route table:
Revision card: Private route table with NAT · Download PNG

Lesson: How to Access a Private EC2 with a Bastion Host and NAT Gateway

Comparison: Bastion host vs NAT gateway. Bastion host: A small public EC2 used as the SSH door to private servers. NAT gateway: A managed AWS service that gives private servers outbound internet.
Comparison: Bastion host vs NAT gateway · Download PNG

Lesson: How to Access a Private EC2 with a Bastion Host and NAT Gateway

Comparison: ssh -J (ProxyJump) vs ssh -A (agent forwarding). ssh -J (ProxyJump): SSH hops through the bastion to the private server in one command. ssh -A (agent forwarding): Your laptop's SSH agent is made usable on the bastion.
Comparison: ssh -J (ProxyJump) vs ssh -A (agent forwarding) · Download PNG

Lesson: How to Access a Private EC2 with a Bastion Host and NAT Gateway

Comparison: One NAT gateway vs One NAT gateway per AZ. One NAT gateway: A single NAT that all private subnets route to. One NAT gateway per AZ: Each AZ has its own NAT in its own public subnet.
Comparison: One NAT gateway vs One NAT gateway per AZ · Download PNG

Lesson: How to Access a Private EC2 with a Bastion Host and NAT Gateway

Interview card: How do you SSH to an EC2 in a private subnet?. Through a bastion host: a small public server that is the only SSH door into the VPC. The private server keeps no public IP, so it is not exposed to the internet. Allow 22 on the app SG only from the bastion SG, then jump with -J.
Interview card: How do you SSH to an EC2 in a private subnet? · Download PNG

Lesson: How to Access a Private EC2 with a Bastion Host and NAT Gateway

Interview card: Why should you not copy the .pem key onto the bastion?. The bastion faces the internet. It is the most attacked server in the VPC. If it is hacked, the key opens every private server. Keep the key on the laptop: ssh-add, then ssh -J. Agent forwarding -A is a weaker option.
Interview card: Why should you not copy the .pem key onto the bastion? · Download PNG

Lesson: How to Access a Private EC2 with a Bastion Host and NAT Gateway

Interview card: Why can a private EC2 not run yum install, and how do you fix it?. Its route table has only the local route, so it cannot reach package repos. It needs outbound internet but must stay unreachable from outside. Create a NAT gateway in a public subnet and route 0.0.0.0/0 to it.
Interview card: Why can a private EC2 not run yum install, and how do you fix it? · Download PNG

Lesson: How to Access a Private EC2 with a Bastion Host and NAT Gateway

Interview card: How do you make NAT highly available across AZs?. One NAT gateway per AZ, each in that AZ's public subnet. If the AZ with the only NAT fails, private servers in other AZs lose internet too. Give each private route table the NAT of its own AZ.
Interview card: How do you make NAT highly available across AZs? · Download PNG

Lesson: How to Access a Private EC2 with a Bastion Host and NAT Gateway

How to Add, Format and Mount an EBS Volume on EC2 (fstab)

Revision card: What is an EC2 server made of?. When CPU, RAM, disk or IP runs out, you must know which part to change. Three parts: the instance (CPU and RAM), an EBS volume (disk) and an ENI (network card with the IPs). See them in the instance details: Storage tab for EBS, Networking tab for ENI. t3.micro = 2 vCPU, 1 GiB RAM. Root EBS 8 GiB on Amazon Linux 2023.
Revision card: What is an EC2 server made of? · Download PNG

Lesson: How to Add, Format and Mount an EBS Volume on EC2 (fstab)

Revision card: EBS volume types and IOPS. The type sets speed and price. A wrong type makes the database slow or the bill high. IOPS = read/write operations per second. gp3/gp2 are general SSD, io2/io1 fast SSD, st1/sc1 cheap HDD. Pick the type while creating the volume. gp3 is the normal default. gp3 gives 3000 IOPS at any size. A busy MySQL may need io2 with 10000 IOPS.
Revision card: EBS volume types and IOPS · Download PNG

Lesson: How to Add, Format and Mount an EBS Volume on EC2 (fstab)

Revision card: Format and mount a new EBS volume. A new attached volume is raw. Linux cannot store files on it yet. Format = create a file system (xfs). Mount = join the disk to a folder like /data. Check it is empty with file -s, then format ONLY a new volume and mount. Mount the 10 GiB volume on /data:
Revision card: Format and mount a new EBS volume · Download PNG

Lesson: How to Add, Format and Mount an EBS Volume on EC2 (fstab)

Revision card: Permanent mount with /etc/fstab. A normal mount is gone after a reboot. /data becomes an empty folder. /etc/fstab is the list of disks Linux mounts at every boot. Use the UUID (from blkid) and nofail, then test with mount -a before rebooting. One fstab line:
Revision card: Permanent mount with /etc/fstab · Download PNG

Lesson: How to Add, Format and Mount an EBS Volume on EC2 (fstab)

Comparison: gp3 vs io2. gp3: General purpose SSD, the normal default EBS type. io2: Provisioned IOPS SSD for very busy databases.
Comparison: gp3 vs io2 · Download PNG

Lesson: How to Add, Format and Mount an EBS Volume on EC2 (fstab)

Interview card: How do you increase the root EBS volume of a running EC2?. Modify the volume size in the console, then grow the partition and file system in Linux. The disk is full; growing needs no downtime and no new volume. 8 › 16 GiB, then:
Interview card: How do you increase the root EBS volume of a running EC2? · Download PNG

Lesson: How to Add, Format and Mount an EBS Volume on EC2 (fstab)

Interview card: Can you attach an EBS volume to an EC2 in another AZ?. No. An EBS volume lives in one AZ and attaches only to instances in that AZ. The disk sits in that AZ's storage network for low latency. To move it: snapshot, then create a new volume from it in the other AZ.
Interview card: Can you attach an EBS volume to an EC2 in another AZ? · Download PNG

Lesson: How to Add, Format and Mount an EBS Volume on EC2 (fstab)

Interview card: Why use UUID and nofail in /etc/fstab?. UUID is the file system's fixed ID. nofail lets boot continue if the disk is missing. Device names like /dev/nvme1n1 can change; a missing disk without nofail can stop boot. Get the UUID with blkid, add the line, test with mount -a.
Interview card: Why use UUID and nofail in /etc/fstab? · Download PNG

Lesson: How to Add, Format and Mount an EBS Volume on EC2 (fstab)

Interview card: When must you NOT run mkfs on a volume?. Never on a volume that already has data, like a volume moved from another server. mkfs creates a new empty file system and wipes what was there. Check first: "data" means empty; "XFS filesystem" means just mount it.
Interview card: When must you NOT run mkfs on a volume? · Download PNG

Lesson: How to Add, Format and Mount an EBS Volume on EC2 (fstab)

Deploy a Website to AWS EC2 Using an AI Coding Agent

Revision card: What is an AI coding agent?. A real site has many files. Copy-paste from a chat into nano for each file is slow and error-prone. An AI coding agent works on your computer: it writes files, runs commands and can deploy them. Install it as an editor extension or desktop app, describe the site in a prompt, read and approve its steps. "Build a landing page for a 10-minute grocery app and deploy it to my EC2 at 13.2.1.9."
Revision card: What is an AI coding agent? · Download PNG

Lesson: Deploy a Website to AWS EC2 Using an AI Coding Agent

Revision card: Tokens and parameters in AI models. Model names and prices use these two words. Without them you cannot compare models. Parameters = numbers the model learned (its size). Tokens = small pieces of text it reads and writes. Bigger models need more RAM. Cloud models charge per token used. An 8B model has 8 billion parameters. "Hello world" is about 2-3 tokens.
Revision card: Tokens and parameters in AI models · Download PNG

Lesson: Deploy a Website to AWS EC2 Using an AI Coding Agent

Revision card: Launch EC2 ready for a website. The agent can deploy only if the server is reachable and the web ports are open. A web-ready EC2 has a key pair and a security group allowing SSH 22, HTTP 80 and HTTPS 443. Launch, tick the three rules, then give the agent the public IP and the key PATH. Prompt detail:
Revision card: Launch EC2 ready for a website · Download PNG

Lesson: Deploy a Website to AWS EC2 Using an AI Coding Agent

Revision card: Safety rules for AI agents. An agent runs real commands on real servers. One wrong approve can delete data or leak a key. Rules: give the key path not its contents, read each command before approving, no passwords in prompts. After practice, terminate test servers so they do not cost money. Agent asks to run rm -rf /var/www. Stop and check before you approve.
Revision card: Safety rules for AI agents · Download PNG

Lesson: Deploy a Website to AWS EC2 Using an AI Coding Agent

Comparison: AI chat in a browser vs AI coding agent. AI chat in a browser: A chat that answers with text and code to copy. AI coding agent: A tool on your computer that writes files and runs commands.
Comparison: AI chat in a browser vs AI coding agent · Download PNG

Lesson: Deploy a Website to AWS EC2 Using an AI Coding Agent

Comparison: Open-weight model on your PC vs Cloud AI model. Open-weight model on your PC: A model you download and run on your own computer. Cloud AI model: A model that runs on the AI company's servers.
Comparison: Open-weight model on your PC vs Cloud AI model · Download PNG

Lesson: Deploy a Website to AWS EC2 Using an AI Coding Agent

Comparison: Editor extension vs Desktop app. Editor extension: An AI agent added inside a code editor like VS Code. Desktop app: The AI company's own app installed on your computer.
Comparison: Editor extension vs Desktop app · Download PNG

Lesson: Deploy a Website to AWS EC2 Using an AI Coding Agent

Interview card: What is the difference between an AI chat and an AI coding agent?. A chat only answers with text. An agent writes files and runs commands on your computer. Projects have hundreds of files; copying each answer by hand is slow and misses files. Agent: one prompt builds the folder, previews it and deploys to EC2.
Interview card: What is the difference between an AI chat and an AI coding agent? · Download PNG

Lesson: Deploy a Website to AWS EC2 Using an AI Coding Agent

Interview card: What should you never put in a prompt to an AI agent?. Secrets: passwords, AWS access keys or the contents of a .pem file. Prompts may be stored or logged by the provider; a leaked key gives full access. Give only the path; the agent reads the key locally.
Interview card: What should you never put in a prompt to an AI agent? · Download PNG

Lesson: Deploy a Website to AWS EC2 Using an AI Coding Agent

Interview card: When would you run an open-weight model on your own computer?. When code must stay private or you want no per-token bill. Nothing leaves your machine, but you need enough RAM or GPU. An 8B model needs about 8 GB RAM; big cloud models stay smarter.
Interview card: When would you run an open-weight model on your own computer? · Download PNG

Lesson: Deploy a Website to AWS EC2 Using an AI Coding Agent

Amazon RDS Multi-AZ vs Read Replicas Explained

Revision card: What is Amazon RDS?. Running MySQL on your own EC2 means you do backups, patching and failover yourself. RDS is a managed database service. AWS runs the server; you use the database. RDS › Create database › pick engine, size, subnet group. Connect with the endpoint. App connects to:
Revision card: What is Amazon RDS? · Download PNG

Lesson: Amazon RDS Multi-AZ vs Read Replicas Explained

Revision card: RDS Multi-AZ. If the one database server or its AZ fails, the whole app stops. Multi-AZ keeps a standby copy in another AZ, updated synchronously. It takes no traffic. Tick Multi-AZ when creating or modifying the DB. Failover is automatic; the endpoint stays the same. Primary in ap-south-1a fails. Standby in 1b takes over in about 1-2 minutes.
Revision card: RDS Multi-AZ · Download PNG

Lesson: Amazon RDS Multi-AZ vs Read Replicas Explained

Revision card: RDS read replica. Most apps read far more than they write. One server gets slow under many SELECTs. A read replica is a read-only copy, updated asynchronously. It has its own endpoint. Actions › Create read replica. Send SELECTs to the replica, writes to the primary. Product page reads go to the replica; orders INSERT goes to the primary.
Revision card: RDS read replica · Download PNG

Lesson: Amazon RDS Multi-AZ vs Read Replicas Explained

Revision card: RDS endpoint and subnet group. An IP can change after failover. Apps need one name that always works. Endpoint = DNS name of the database. DB subnet group = private subnets in 2+ AZs where RDS may live. Create a subnet group with two private subnets, then pick it while creating the DB. Subnet group: 10.0.32.0/20 (1a) and 10.0.48.0/20 (1b).
Revision card: RDS endpoint and subnet group · Download PNG

Lesson: Amazon RDS Multi-AZ vs Read Replicas Explained

Interview card: Multi-AZ vs read replica: which one gives high availability?. Multi-AZ. Its standby takes over automatically if the primary fails. A read replica is for scaling reads; it is async and is not auto failover. Production: Multi-AZ for safety + 1-2 replicas for heavy SELECT traffic.
Interview card: Multi-AZ vs read replica: which one gives high availability? · Download PNG

Lesson: Amazon RDS Multi-AZ vs Read Replicas Explained

Interview card: Why choose RDS over MySQL installed on EC2?. RDS gives automated backups, patching, Multi-AZ and easy replicas. On EC2 you do all of that yourself, and mistakes lose data. Choose EC2 only when you need OS access or an unsupported setup.
Interview card: Why choose RDS over MySQL installed on EC2? · Download PNG

Lesson: Amazon RDS Multi-AZ vs Read Replicas Explained

Interview card: What happens to the endpoint during a Multi-AZ failover?. The endpoint name stays the same; its DNS now points to the new primary. Apps need no config change; they just reconnect. Use the endpoint, never the IP, in the app config.
Interview card: What happens to the endpoint during a Multi-AZ failover? · Download PNG

Lesson: Amazon RDS Multi-AZ vs Read Replicas Explained

Interview card: Should an RDS database be publicly accessible?. No. Put it in private subnets with Public access = No. A public database is scanned and attacked on port 3306. DB SG allows 3306 only from the app server SG.
Interview card: Should an RDS database be publicly accessible? · Download PNG

Lesson: Amazon RDS Multi-AZ vs Read Replicas Explained

What Is Auto Scaling in AWS? Min, Max and Desired Explained

Revision card: What is a launch template?. Auto Scaling adds servers at 2 AM with nobody around. It must know exactly what to launch. A launch template is the recipe: AMI, instance type, key pair, security group, storage and user data. EC2 › Launch templates › Create. Subnets are not here; you pick them in the group. AMI ami-0web1, t3.micro, web-sg, 8 GiB gp3.
Revision card: What is a launch template? · Download PNG

Lesson: What Is Auto Scaling in AWS? Min, Max and Desired Explained

Revision card: Min, desired and max in Auto Scaling. Too few servers crash on a sale day; too many waste money at night. Desired = servers to run now. Min = lowest desired can go. Max = highest desired can go. Set them in the Auto Scaling group. Policies change desired between min and max. min 1, desired 2, max 4. Sale: desired 2 › 3 › 4, never 5.
Revision card: Min, desired and max in Auto Scaling · Download PNG

Lesson: What Is Auto Scaling in AWS? Min, Max and Desired Explained

Revision card: How a CPU alarm scales the group. Traffic rises without warning. Servers must be added automatically. A CloudWatch alarm on average CPU calls the group's scaling policy. The policy changes desired. High alarm: add 1 instance. Low alarm: remove 1. New servers join the target group by themselves. Average CPU 78% › alarm › desired 2 to 3.
Revision card: How a CPU alarm scales the group · Download PNG

Lesson: What Is Auto Scaling in AWS? Min, Max and Desired Explained

Revision card: What is a golden AMI?. A new server should serve traffic in seconds, not after 10 minutes of installing. A golden AMI is an image of a tested server with Nginx, PHP and your code already in it. Build and test one server, then Actions › Image and templates › Create image. Use it in the template. App 2.0 ready: new AMI ami-0web2 › template version 2.
Revision card: What is a golden AMI? · Download PNG

Lesson: What Is Auto Scaling in AWS? Min, Max and Desired Explained

Comparison: Scale out vs Scale in. Scale out: The group adds servers by raising desired. Scale in: The group removes servers by lowering desired.
Comparison: Scale out vs Scale in · Download PNG

Lesson: What Is Auto Scaling in AWS? Min, Max and Desired Explained

Interview card: What is an Auto Scaling group?. A group that keeps the right number of EC2 servers running across AZs. It adds servers under load, removes them when quiet, and replaces unhealthy ones. Launch template + subnets + min/desired/max + target group.
Interview card: What is an Auto Scaling group? · Download PNG

Lesson: What Is Auto Scaling in AWS? Min, Max and Desired Explained

Interview card: What does an Auto Scaling group do when a server fails a health check?. It terminates the unhealthy server and launches a new one. Running count must always equal desired. Use ELB health checks so a dead website, not only a dead VM, is replaced.
Interview card: What does an Auto Scaling group do when a server fails a health check? · Download PNG

Lesson: What Is Auto Scaling in AWS? Min, Max and Desired Explained

Interview card: What is user data in a launch template?. A script that runs once at the first boot of each new server. It finishes setup on its own, like starting Nginx or pulling code. Add it under Advanced details:
Interview card: What is user data in a launch template? · Download PNG

Lesson: What Is Auto Scaling in AWS? Min, Max and Desired Explained

Interview card: What happens when load keeps rising but desired equals max?. Nothing more is launched. The group stops at max. Max protects your bill from runaway scaling. Raise max if real traffic needs it.
Interview card: What happens when load keeps rising but desired equals max? · Download PNG

Lesson: What Is Auto Scaling in AWS? Min, Max and Desired Explained

AWS Elastic IP, AMI and EBS Snapshots Explained

Revision card: What is an Elastic IP?. A normal public IP changes on every stop and start. Apps and DNS records using it break. An Elastic IP is a static public IPv4 that belongs to your account, in one Region. EC2 › Elastic IPs › Allocate, then Associate it with the server. Server stops and starts: IP stays 13.2.1.9. DNS needs no edit.
Revision card: What is an Elastic IP? · Download PNG

Lesson: AWS Elastic IP, AMI and EBS Snapshots Explained

Revision card: Public IPv4 charges. An unused IP still costs money every hour. AWS charges for every public IPv4, in use or not, from allocate to release. After the lab: Disassociate, then Release the Elastic IP. $0.005 per hour × 720 hours = about $3.60 per month per IP.
Revision card: Public IPv4 charges · Download PNG

Lesson: AWS Elastic IP, AMI and EBS Snapshots Explained

Revision card: Create an AMI and restore a site. If a server is terminated, everything installed on it is gone. An AMI is a full image of a server: OS, software and files, ready to launch again. Actions › Image and templates › Create image. Wait for "available". Launch from My AMIs. Nginx enabled with systemctl enable comes back by itself after launch.
Revision card: Create an AMI and restore a site · Download PNG

Lesson: AWS Elastic IP, AMI and EBS Snapshots Explained

Revision card: Why EBS snapshots are incremental. Copying the full disk every day would be slow and expensive. A snapshot is a backup of one EBS volume in S3. After the first, each saves only changed blocks. Volume › Actions › Create snapshot. To clean up: deregister the AMI, then delete its snapshots. Day 1: 8 GiB copied. Day 2: only 200 MiB changed, so only 200 MiB stored.
Revision card: Why EBS snapshots are incremental · Download PNG

Lesson: AWS Elastic IP, AMI and EBS Snapshots Explained

Comparison: systemctl enable vs service start. systemctl enable: Sets a service to start at every boot. service start: Starts a service now, one time.
Comparison: systemctl enable vs service start · Download PNG

Lesson: AWS Elastic IP, AMI and EBS Snapshots Explained

Interview card: Why use an Elastic IP for a web server?. It is a static public IP that survives stop and start. Apps, DNS records and firewall rules that use the IP keep working. Allocate and associate; move it to a new server in seconds.
Interview card: Why use an Elastic IP for a web server? · Download PNG

Lesson: AWS Elastic IP, AMI and EBS Snapshots Explained

Interview card: How do you change an instance type with low downtime?. Make an AMI, launch a bigger server from it, then move the Elastic IP. Changing type in place needs a stop and start, so the site goes down. t3.micro › AMI › t3.large › reassociate EIP: seconds of downtime.
Interview card: How do you change an instance type with low downtime? · Download PNG

Lesson: AWS Elastic IP, AMI and EBS Snapshots Explained

Interview card: Why run systemctl enable before creating an AMI?. enable starts the service at every boot. service start only starts it now. A server launched from the AMI boots fresh; without enable, Nginx stays off. Run it once on the source server:
Interview card: Why run systemctl enable before creating an AMI? · Download PNG

Lesson: AWS Elastic IP, AMI and EBS Snapshots Explained

Interview card: How do you clean up an AMI so you stop paying?. Deregister the AMI, then delete its EBS snapshots. Deregister alone keeps the snapshots, and they are billed. Check Snapshots for the AMI ID in the description.
Interview card: How do you clean up an AMI so you stop paying? · Download PNG

Lesson: AWS Elastic IP, AMI and EBS Snapshots Explained

AWS Regions and Availability Zones Explained

Revision card: AWS global infrastructure. Apps must be close to users, survive a building failure and sometimes stay inside one country. Six blocks: Regions, Availability Zones, Local Zones, Wavelength Zones, edge locations and Outposts. Choose a Region first, then an AZ, when you launch a server. Mumbai Region (ap-south-1) has 3 AZs. CloudFront has 750+ edge locations.
Revision card: AWS global infrastructure · Download PNG

Lesson: AWS Regions and Availability Zones Explained

Revision card: Region and AZ codes. City names repeat and change. Code needs short fixed names. A Region code is area-direction-number. An AZ code adds a letter. Read the code at the top right of the console and in every ARN. Mumbai = ap-south-1; its AZs = ap-south-1a, 1b, 1c. Hyderabad = ap-south-2.
Revision card: Region and AZ codes · Download PNG

Lesson: AWS Regions and Availability Zones Explained

Revision card: Edge locations and CDN. Files from a far Region load slowly. Distance adds waiting time (latency). An edge location is a small AWS site that keeps copies of your files. Many together = CDN (CloudFront). Put CloudFront in front of the site. Users get files from the nearest edge. Site in us-east-1, user in Pune: image comes from the Mumbai edge in 20 ms, not 250 ms.
Revision card: Edge locations and CDN · Download PNG

Lesson: AWS Regions and Availability Zones Explained

Revision card: Opt-in Regions. Some new Regions are hidden at first. You cannot launch there until you enable them. Default Regions are on for every account. Opt-in Regions (mostly after 2019) need enabling. Account › AWS Regions › select the Region › Enable. Wait a few minutes. Hyderabad ap-south-2 is opt-in; Mumbai ap-south-1 is default.
Revision card: Opt-in Regions · Download PNG

Lesson: AWS Regions and Availability Zones Explained

Comparison: Default Region vs Opt-in Region. Default Region: A Region turned on for every account. Opt-in Region: A Region you must enable first.
Comparison: Default Region vs Opt-in Region · Download PNG

Lesson: AWS Regions and Availability Zones Explained

Comparison: Data center vs Availability Zone. Data center: One building full of servers with power and cooling. Availability Zone: One or more data centers with separate power and network.
Comparison: Data center vs Availability Zone · Download PNG

Lesson: AWS Regions and Availability Zones Explained

Interview card: What is the difference between a Region and an Availability Zone?. A Region is a geographic area. An AZ is one or more data centers inside it. AZs fail separately, so servers in two AZs survive one AZ going down. Mumbai Region ap-south-1 has AZs 1a, 1b, 1c.
Interview card: What is the difference between a Region and an Availability Zone? · Download PNG

Lesson: AWS Regions and Availability Zones Explained

Interview card: How do you choose an AWS Region?. By user location, data laws, service availability and price. Closer means lower latency; some data must stay in the country. Users in India and data must stay in India: ap-south-1 Mumbai.
Interview card: How do you choose an AWS Region? · Download PNG

Lesson: AWS Regions and Availability Zones Explained

Interview card: Why should production run in at least two AZs?. One AZ can go down from power, flood or network problems. The second AZ keeps serving users while the first is down. Web servers in 1a and 1b behind one load balancer.
Interview card: Why should production run in at least two AZs? · Download PNG

Lesson: AWS Regions and Availability Zones Explained

Interview card: What is a CDN and how does CloudFront speed up a site?. A CDN is a network of edge locations that cache copies of files near users. Less distance means lower latency and less load on the main server. Check in DevTools: the response header shows a cache hit.
Interview card: What is a CDN and how does CloudFront speed up a site? · Download PNG

Lesson: AWS Regions and Availability Zones Explained

AWS chapter cards: revision, comparison and interview (2)

How to Create Public and Private Subnets in AWS VPC

Revision card: Carving /20 subnets in a VPC. Subnets must not overlap. You need a quick way to find where each one starts. A /20 has 4096 IPs, so in a /16 VPC the third number steps by 16. Start at 10.0.0.0/20 and add 16 to the third number each time. Put each subnet in one AZ. VPC 10.0.0.0/16:
Revision card: Carving /20 subnets in a VPC · Download PNG

Lesson: How to Create Public and Private Subnets in AWS VPC

Revision card: EC2 tenancy. Some companies must not share physical hardware with other customers, for rules or licences. Tenancy = who shares the physical server. Default (shared), dedicated instance, or Dedicated Host. Pick it in the VPC or under Advanced details at launch. Keep default unless a rule needs more. Bank with per-socket licences: Dedicated Host. Normal website: default.
Revision card: EC2 tenancy · Download PNG

Lesson: How to Create Public and Private Subnets in AWS VPC

Comparison: Dedicated instance vs Dedicated Host. Dedicated instance: An EC2 on hardware used only by your account. Dedicated Host: A whole physical server that you rent and see.
Comparison: Dedicated instance vs Dedicated Host · Download PNG

Lesson: How to Create Public and Private Subnets in AWS VPC

Interview card: How many usable IPs are in a /24 subnet in AWS?. 251. A /24 has 256 IPs and AWS keeps 5 in every subnet. AWS uses them for network, VPC router, DNS, future use and broadcast. 10.0.1.0/24: reserved .0 .1 .2 .3 .255.
Interview card: How many usable IPs are in a /24 subnet in AWS? · Download PNG

Lesson: How to Create Public and Private Subnets in AWS VPC

Interview card: An EC2 has a public IP but you still cannot reach it. Why?. Its subnet route table has no 0.0.0.0/0 route to an internet gateway. A public IP alone does nothing without a path to the internet. Attach an IGW to the VPC and add the route; also allow the port in the SG.
Interview card: An EC2 has a public IP but you still cannot reach it. Why? · Download PNG

Lesson: How to Create Public and Private Subnets in AWS VPC

Interview card: Why does AWS refuse overlapping subnets?. Two subnets with the same IPs would make routing ambiguous. A packet to 10.0.16.5 must belong to exactly one subnet. 10.0.0.0/20 covers up to 10.0.15.255; next starts 10.0.16.0/20.
Interview card: Why does AWS refuse overlapping subnets? · Download PNG

Lesson: How to Create Public and Private Subnets in AWS VPC

Interview card: Can one subnet span two Availability Zones?. No. A subnet lives in exactly one AZ. For high availability you need subnets in two AZs and servers in both. public-1a 10.0.0.0/20, public-1b 10.0.16.0/20.
Interview card: Can one subnet span two Availability Zones? · Download PNG

Lesson: How to Create Public and Private Subnets in AWS VPC

How to Build a 3-Tier Architecture in AWS Step by Step (VPC, ALB, Auto Scaling, RDS)

Revision card: Chained security groups in 3-tier. Server IPs change with Auto Scaling. Rules based on IPs break. Each tier's SG allows traffic only from the SG of the tier in front of it. Set the Source of each rule to a security group, not an IP. Five links:
Revision card: Chained security groups in 3-tier · Download PNG

Lesson: How to Build a 3-Tier Architecture in AWS Step by Step (VPC, ALB, Auto Scaling, RDS)

Revision card: Immutable servers with AMIs. Fixing servers by hand makes each one a little different. Bugs appear on some servers only. Immutable = never change a running server. Build a new AMI and replace the servers. Dev server › test › create AMI › new launch template version › instance refresh. App v2: ami-0app2 in template v2; the group replaces all servers.
Revision card: Immutable servers with AMIs · Download PNG

Lesson: How to Build a 3-Tier Architecture in AWS Step by Step (VPC, ALB, Auto Scaling, RDS)

Revision card: Warmup, grace period and instance refresh. A new server needs time to boot. Judging it too early kills healthy servers. Grace period: health checks wait. Warmup: its metrics are ignored for scaling. Refresh: replaces servers in rolling steps. Set them in the Auto Scaling group; start a refresh from the Instance refresh tab. Grace 300 s, warmup 120 s, refresh with minimum healthy 90%.
Revision card: Warmup, grace period and instance refresh · Download PNG

Lesson: How to Build a 3-Tier Architecture in AWS Step by Step (VPC, ALB, Auto Scaling, RDS)

Comparison: Internet-facing ALB vs Internal ALB. Internet-facing ALB: A load balancer with public IPs in public subnets. Internal ALB: A load balancer with only private IPs in private subnets.
Comparison: Internet-facing ALB vs Internal ALB · Download PNG

Lesson: How to Build a 3-Tier Architecture in AWS Step by Step (VPC, ALB, Auto Scaling, RDS)

Interview card: Why use a security group as the source instead of an IP?. A SG source allows any server that has that SG, whatever its IP. Auto Scaling keeps changing IPs; IP rules would break or be too wide. db-sg allows 3306 from app-sg only.
Interview card: Why use a security group as the source instead of an IP? · Download PNG

Lesson: How to Build a 3-Tier Architecture in AWS Step by Step (VPC, ALB, Auto Scaling, RDS)

Interview card: What do 502, 503 and 504 from an ALB mean?. 502: target sent a bad reply. 503: no healthy targets. 504: target too slow. The code tells you where to look first. 503 › check target group health; 502 › app logs; 504 › slow DB query.
Interview card: What do 502, 503 and 504 from an ALB mean? · Download PNG

Lesson: How to Build a 3-Tier Architecture in AWS Step by Step (VPC, ALB, Auto Scaling, RDS)

Interview card: Where should a 3-tier app keep its database password?. In AWS Secrets Manager, read by the app at runtime through its IAM role. Passwords in code end up on GitHub and get stolen in minutes. Secret prod/db read with GetSecretValue.
Interview card: Where should a 3-tier app keep its database password? · Download PNG

Lesson: How to Build a 3-Tier Architecture in AWS Step by Step (VPC, ALB, Auto Scaling, RDS)

Interview card: What is the difference between high availability and fault tolerance?. HA: the app recovers quickly with a short break. Fault tolerant: users see no break at all. Fault tolerance needs more spare capacity, so it costs more. RDS Multi-AZ failover 1-2 min = HA. 2 AZs each able to carry full load = fault tolerant.
Interview card: What is the difference between high availability and fault tolerance? · Download PNG

Lesson: How to Build a 3-Tier Architecture in AWS Step by Step (VPC, ALB, Auto Scaling, RDS)

How to Build a 3-Tier Architecture in AWS with VPC, NAT Gateway and RDS

Revision card: Why split an app into 3 tiers?. One server with web, code and database is easy to hack and hard to scale. Web tier (public), app tier (private) and database tier (private), each in its own subnet. Only the web tier faces the internet. Each tier talks only to the next one. Nginx 10.0.0.10 › PHP app 10.0.16.7 › RDS MySQL in 10.0.32.0/20.
Revision card: Why split an app into 3 tiers? · Download PNG

Lesson: How to Build a 3-Tier Architecture in AWS with VPC, NAT Gateway and RDS

Revision card: Nginx proxy_pass from web to app. Users cannot reach the private app server. The public web server must forward requests. proxy_pass makes Nginx send the request to another server and return its answer. Add it in the location block, run nginx -t, then reload. Forward to the app server:
Revision card: Nginx proxy_pass from web to app · Download PNG

Lesson: How to Build a 3-Tier Architecture in AWS with VPC, NAT Gateway and RDS

Revision card: S3 gateway endpoint. Private servers reaching S3 through NAT pay NAT data charges on every GB. A gateway endpoint is a free route from the VPC to S3 inside AWS, with no NAT. VPC › Endpoints › Create › S3 › Gateway, and tick the private route tables. Route added:
Revision card: S3 gateway endpoint · Download PNG

Lesson: How to Build a 3-Tier Architecture in AWS with VPC, NAT Gateway and RDS

Revision card: IaaS, PaaS and SaaS. Each model decides how much work you do and how much the provider does. IaaS: you get servers. PaaS: you get a ready platform. SaaS: you get a finished app. Pick by control needed: more control = IaaS, less work = SaaS. EC2 = IaaS. RDS = PaaS. Gmail = SaaS.
Revision card: IaaS, PaaS and SaaS · Download PNG

Lesson: How to Build a 3-Tier Architecture in AWS with VPC, NAT Gateway and RDS

Comparison: IaaS vs PaaS. IaaS: You rent servers, network and disks. PaaS: You get a ready platform to run apps or databases.
Comparison: IaaS vs PaaS · Download PNG

Lesson: How to Build a 3-Tier Architecture in AWS with VPC, NAT Gateway and RDS

Interview card: Why is the database tier in a private subnet?. Only the app tier needs it; the internet never should. A public database is scanned and attacked within hours. RDS Public access = No, db-sg allows 3306 from app-sg.
Interview card: Why is the database tier in a private subnet? · Download PNG

Lesson: How to Build a 3-Tier Architecture in AWS with VPC, NAT Gateway and RDS

Interview card: How do you reduce NAT gateway cost?. Use gateway endpoints for S3 and DynamoDB, and delete NAT in labs when done. NAT charges per hour and per GB processed. S3 backups of 500 GB via endpoint = no NAT data charge.
Interview card: How do you reduce NAT gateway cost? · Download PNG

Lesson: How to Build a 3-Tier Architecture in AWS with VPC, NAT Gateway and RDS

Interview card: How does a user reach an app server in a private subnet?. Through the public web tier, which forwards with a reverse proxy or a load balancer. The app server stays hidden; only the web server is exposed. Nginx on 10.0.0.10:
Interview card: How does a user reach an app server in a private subnet? · Download PNG

Lesson: How to Build a 3-Tier Architecture in AWS with VPC, NAT Gateway and RDS

Interview card: When do you use EBS and when S3?. EBS is a disk for one EC2. S3 is object storage reached over HTTPS from anywhere. EBS fits OS and databases; S3 fits images, backups and static files. MySQL data on gp3; user photos in s3://shop-images.
Interview card: When do you use EBS and when S3? · Download PNG

Lesson: How to Build a 3-Tier Architecture in AWS with VPC, NAT Gateway and RDS

How to Set Up a CloudWatch CPU Alarm with SNS in AWS

Revision card: Target group of a load balancer. The load balancer must know which servers can take traffic. A target group is the list of servers (targets), with a port and a health check. EC2 › Target groups › Create › register instances on port 80. web-tg: 3 servers on port 80, health path /.
Revision card: Target group of a load balancer · Download PNG

Lesson: How to Set Up a CloudWatch CPU Alarm with SNS in AWS

Revision card: Health check math. Sending users to a dead server shows them errors. The LB pings each target every interval. N fails in a row = unhealthy; N passes = healthy. Time to mark unhealthy = interval × unhealthy threshold. Interval 30 s × threshold 2 = 60 s to remove a dead server.
Revision card: Health check math · Download PNG

Lesson: How to Set Up a CloudWatch CPU Alarm with SNS in AWS

Revision card: Path-based routing on an ALB. One site can have parts on different servers, like the main site and the API. A listener rule checks the URL path and sends the request to a matching target group. Listener › Add rule › Path is /api/* › forward to api-tg. Rules:
Revision card: Path-based routing on an ALB · Download PNG

Lesson: How to Set Up a CloudWatch CPU Alarm with SNS in AWS

Revision card: Sticky sessions. Round robin can send a logged-in user to another server where the login is unknown. Sticky sessions use a cookie so the same user goes to the same server. Target group › Attributes › Stickiness › On, with a duration. Cookie AWSALB keeps user Asha on server 2 for 1 day.
Revision card: Sticky sessions · Download PNG

Lesson: How to Set Up a CloudWatch CPU Alarm with SNS in AWS

Comparison: Round robin vs Sticky sessions. Round robin: The LB sends each request to the next server in turn. Sticky sessions: The LB sends a user back to the same server using a cookie.
Comparison: Round robin vs Sticky sessions · Download PNG

Lesson: How to Set Up a CloudWatch CPU Alarm with SNS in AWS

Interview card: Why not just use two DNS A records instead of a load balancer?. DNS does not check health and caches answers, so users still hit a dead server. A load balancer checks targets every few seconds and skips dead ones. Point the domain with an Alias record to the ALB DNS name.
Interview card: Why not just use two DNS A records instead of a load balancer? · Download PNG

Lesson: How to Set Up a CloudWatch CPU Alarm with SNS in AWS

Interview card: How long does an ALB take to stop sending traffic to a failed server?. Interval × unhealthy threshold. Shorter means faster removal but more false alarms. 10 s × 2 = 20 s; 30 s × 5 = 150 s.
Interview card: How long does an ALB take to stop sending traffic to a failed server? · Download PNG

Lesson: How to Set Up a CloudWatch CPU Alarm with SNS in AWS

Interview card: Why do users get logged out behind a load balancer, and how do you fix it?. Round robin sends the next request to another server that has no session. Sessions stored in one server's memory are not shared. Quick fix: sticky sessions. Better: store sessions in a shared DB or cache.
Interview card: Why do users get logged out behind a load balancer, and how do you fix it? · Download PNG

Lesson: How to Set Up a CloudWatch CPU Alarm with SNS in AWS

Interview card: How does a CloudWatch alarm send an email?. The alarm publishes to an SNS topic; SNS sends it to email subscribers. SNS fans out one message to many people and services. Topic ops-alerts, subscriber ops@example.com (confirm the email first).
Interview card: How does a CloudWatch alarm send an email? · Download PNG

Lesson: How to Set Up a CloudWatch CPU Alarm with SNS in AWS

How to Connect a Domain Name to AWS EC2

Revision card: How DNS works. People remember names, not IPs like 13.2.1.9. DNS is the internet's phone book: it turns a domain name into an IP address. Buy a domain at a registrar, then add records in its DNS settings. Check the answer:
Revision card: How DNS works · Download PNG

Lesson: How to Connect a Domain Name to AWS EC2

Revision card: Add an A record for EC2. Your domain must point to the server before the site opens by name. An A record maps a name to an IPv4 address. @ means the root domain. DNS settings › Add record › Type A › Host @ › Value = EC2 public IP. Record:
Revision card: Add an A record for EC2 · Download PNG

Lesson: How to Connect a Domain Name to AWS EC2

Revision card: Why DNS changes take time: TTL. After you change an IP, some users still reach the old server. TTL = seconds that resolvers may keep the old answer in cache. Lower the TTL before a planned change; use an Elastic IP so the IP never changes. TTL 3600 = up to 1 hour of old answers after a change.
Revision card: Why DNS changes take time: TTL · Download PNG

Lesson: How to Connect a Domain Name to AWS EC2

Revision card: Virtual hosting in Nginx. Paying for one server per small site wastes money. Virtual hosting serves many sites from one server, chosen by the name the browser asks for. One server block per site, each with its server_name and root. Block for a subdomain:
Revision card: Virtual hosting in Nginx · Download PNG

Lesson: How to Connect a Domain Name to AWS EC2

Comparison: A record vs CNAME record. A record: Maps a name to an IPv4 address. CNAME record: Maps a name to another name.
Comparison: A record vs CNAME record · Download PNG

Lesson: How to Connect a Domain Name to AWS EC2

Comparison: Domain vs Subdomain. Domain: The name you buy from a registrar, like example.com. Subdomain: A name in front of your domain, like blog.example.com.
Comparison: Domain vs Subdomain · Download PNG

Lesson: How to Connect a Domain Name to AWS EC2

Interview card: What happens when you type a domain name in the browser?. The browser asks DNS for the IP, then connects to that IP on port 80 or 443. Servers are found by IP; names are for humans. example.com › 13.2.1.9 › GET / on port 443.
Interview card: What happens when you type a domain name in the browser? · Download PNG

Lesson: How to Connect a Domain Name to AWS EC2

Interview card: A record vs CNAME: when do you use each?. A points a name to an IP. CNAME points a name to another name. CNAME follows the target if its IP changes. @ A 13.2.1.9; www CNAME example.com.
Interview card: A record vs CNAME: when do you use each? · Download PNG

Lesson: How to Connect a Domain Name to AWS EC2

Interview card: Your site stopped opening by name after a stop and start. Why?. The public IP changed, but the A record still has the old IP. Dynamic public IPs are released on stop. Use an Elastic IP and put it in the A record once.
Interview card: Your site stopped opening by name after a stop and start. Why? · Download PNG

Lesson: How to Connect a Domain Name to AWS EC2

Interview card: Does capitalisation matter in a URL?. Not in the domain; often yes in the path on Linux servers. DNS ignores case, but Linux file names are case-sensitive. EXAMPLE.com works; /About.html ≠ /about.html.
Interview card: Does capitalisation matter in a URL? · Download PNG

Lesson: How to Connect a Domain Name to AWS EC2

How to Host a Website on AWS EC2 with Apache

Revision card: What is a web server?. A browser asks for a page. Some program must answer with the file. A web server is software that listens on port 80/443 and sends web pages. Apache and Nginx are the common ones. Install, start and enable it, then put pages in its document root. Apache on Amazon Linux:
Revision card: What is a web server? · Download PNG

Lesson: How to Host a Website on AWS EC2 with Apache

Revision card: Start and enable Apache. Installing does not run it. A stopped web server shows "connection refused". start runs it now, status shows if it runs, enable starts it at every boot. Run start, then enable, then check status says active (running). Two commands:
Revision card: Start and enable Apache · Download PNG

Lesson: How to Host a Website on AWS EC2 with Apache

Revision card: Your first page in /var/www/html. Apache serves files from one folder. A page outside it is not shown. /var/www/html is Apache's document root. index.html there is the home page. Create the file with sudo, then open the public IP. about.html in that folder opens at:
Revision card: Your first page in /var/www/html · Download PNG

Lesson: How to Host a Website on AWS EC2 with Apache

Revision card: Open port 80 and debug with curl. Apache can run fine but the browser still times out. The security group blocks port 80 unless you add an inbound rule. curl tests from inside. Add HTTP 80 from 0.0.0.0/0. If curl localhost works but browser fails, check the SG. Inbound rule:
Revision card: Open port 80 and debug with curl · Download PNG

Lesson: How to Host a Website on AWS EC2 with Apache

Interview card: What is the difference between a static and a dynamic website?. Static sends the same files to everyone. Dynamic builds the page per request with code and a database. It decides what you must install on the server. Portfolio in HTML = static; shop with login = dynamic (PHP + MySQL).
Interview card: What is the difference between a static and a dynamic website? · Download PNG

Lesson: How to Host a Website on AWS EC2 with Apache

Interview card: Apache will not start. What do you check?. The status message, the config syntax and whether port 80 is already used. Usually Nginx is already on port 80 or a typo is in the config. Commands:
Interview card: Apache will not start. What do you check? · Download PNG

Lesson: How to Host a Website on AWS EC2 with Apache

Interview card: curl localhost works but the browser times out. Why?. The security group does not allow port 80 from the internet. curl inside the server never crosses the SG. Add inbound HTTP 80 from 0.0.0.0/0.
Interview card: curl localhost works but the browser times out. Why? · Download PNG

Lesson: How to Host a Website on AWS EC2 with Apache

Interview card: What are development, test and production environments?. Dev: where you build. Test: where you check. Production: what real users use. Mistakes stay away from real users until tested. dev.example.com › test.example.com › example.com.
Interview card: What are development, test and production environments? · Download PNG

Lesson: How to Host a Website on AWS EC2 with Apache

How to Host a GitHub Website on AWS EC2 with Nginx

Revision card: GitHub repository basics. Most projects you host come from GitHub. You must read a repo before using it. A repository is a project folder on GitHub. The language bar shows if it is static (HTML, CSS) or needs a backend. Check the language bar and the LICENSE before hosting. HTML 60%, CSS 30%, JS 10% = static, Nginx alone can host it.
Revision card: GitHub repository basics · Download PNG

Lesson: How to Host a GitHub Website on AWS EC2 with Nginx

Revision card: Fix UNPROTECTED PRIVATE KEY FILE. SSH refuses a key that other users can read. The .pem file must be readable only by you. 400 = owner read only. Linux/Mac: chmod 400. Windows: remove other users in file Properties › Security. Fix:
Revision card: Fix UNPROTECTED PRIVATE KEY FILE · Download PNG

Lesson: How to Host a GitHub Website on AWS EC2 with Nginx

Revision card: Get a repo onto the server with wget. Downloading to your laptop and uploading again is slow. wget downloads a URL straight onto the server. unzip extracts it. Copy the Download ZIP link, wget it in quotes, unzip, then point Nginx root to the folder. Commands:
Revision card: Get a repo onto the server with wget · Download PNG

Lesson: How to Host a GitHub Website on AWS EC2 with Nginx

Revision card: Set the Nginx root folder. The site shows the Nginx test page until Nginx knows where your files are. root is the folder Nginx serves. It must contain index.html. cd into the folder with index.html, run pwd, paste that path as root, nginx -t, reload. In nginx.conf:
Revision card: Set the Nginx root folder · Download PNG

Lesson: How to Host a GitHub Website on AWS EC2 with Nginx

Comparison: Public repository vs Private repository. Public repository: A GitHub repo anyone can view and download. Private repository: A GitHub repo only invited people can see.
Comparison: Public repository vs Private repository · Download PNG

Lesson: How to Host a GitHub Website on AWS EC2 with Nginx

Comparison: Download ZIP + scp vs wget on the server. Download ZIP + scp: Download to your laptop, then upload to EC2. wget on the server: Download straight from GitHub onto EC2.
Comparison: Download ZIP + scp vs wget on the server · Download PNG

Lesson: How to Host a GitHub Website on AWS EC2 with Nginx

Interview card: How do you tell if a GitHub project can be hosted on Nginx alone?. Look at the language bar: only HTML, CSS and JavaScript means static. PHP, Python or Node needs a runtime and maybe a database. HTML 70% CSS 30% › Nginx root. PHP 80% › LEMP stack.
Interview card: How do you tell if a GitHub project can be hosted on Nginx alone? · Download PNG

Lesson: How to Host a GitHub Website on AWS EC2 with Nginx

Interview card: Why run pwd before rm -rf *?. rm -rf * deletes everything in the CURRENT folder with no undo. In the wrong folder it can wipe the website or the system. pwd shows /usr/share/nginx/html › then delete.
Interview card: Why run pwd before rm -rf *? · Download PNG

Lesson: How to Host a GitHub Website on AWS EC2 with Nginx

Interview card: How does a phishing login page steal passwords?. It copies a real login page on a look-alike domain and saves what you type. The page looks identical, so people trust it. Check the domain and use MFA: faceb00k-login.com is not facebook.com.
Interview card: How does a phishing login page steal passwords? · Download PNG

Lesson: How to Host a GitHub Website on AWS EC2 with Nginx

Host a Node.js Express App on AWS EC2 with PM2 and Nginx

Revision card: What is package.json?. A Node app needs many libraries. The server must know which ones to install. package.json lists the app name, version and dependencies. npm install reads it. Run npm install in the app folder. It creates node_modules and package-lock.json. Dependency line:
Revision card: What is package.json? · Download PNG

Lesson: Host a Node.js Express App on AWS EC2 with PM2 and Nginx

Revision card: A small Express app. Node needs a web framework to answer URLs easily. Express is that framework. Each route maps a URL to a function. Write index.js, then test with node index.js on port 3000. A JSON route:
Revision card: A small Express app · Download PNG

Lesson: Host a Node.js Express App on AWS EC2 with PM2 and Nginx

Revision card: Keep Node running with PM2. node index.js stops when you close SSH or the server reboots. PM2 is a process manager. It runs the app in the background and restarts it if it crashes. Start the app, then pm2 startup and pm2 save so it comes back after reboot. Start:
Revision card: Keep Node running with PM2 · Download PNG

Lesson: Host a Node.js Express App on AWS EC2 with PM2 and Nginx

Revision card: Nginx in front of Node on port 3000. Users expect port 80, and opening 3000 to the internet is unsafe. Nginx listens on 80 and proxy_passes to Node on 127.0.0.1:3000. Add the location, nginx -t, reload, then remove the port 3000 SG rule. Location:
Revision card: Nginx in front of Node on port 3000 · Download PNG

Lesson: Host a Node.js Express App on AWS EC2 with PM2 and Nginx

Comparison: node index.js vs pm2 start index.js. node index.js: Runs the app in your terminal. pm2 start index.js: Runs the app as a managed background process.
Comparison: node index.js vs pm2 start index.js · Download PNG

Lesson: Host a Node.js Express App on AWS EC2 with PM2 and Nginx

Interview card: Why use PM2 instead of node index.js in production?. PM2 keeps the app running in the background, restarts it on crash and on reboot. node index.js dies when SSH closes. Commands:
Interview card: Why use PM2 instead of node index.js in production? · Download PNG

Lesson: Host a Node.js Express App on AWS EC2 with PM2 and Nginx

Interview card: Nginx shows 502 Bad Gateway for a Node app. What do you check?. Whether the Node app is running and listening on the port in proxy_pass. 502 means Nginx could not get a reply from the backend. Check:
Interview card: Nginx shows 502 Bad Gateway for a Node app. What do you check? · Download PNG

Lesson: Host a Node.js Express App on AWS EC2 with PM2 and Nginx

Interview card: What does EADDRINUSE mean when starting Node?. The port is already used by another process, often an old copy of the app. Two programs cannot listen on the same port. Find and stop it:
Interview card: What does EADDRINUSE mean when starting Node? · Download PNG

Lesson: Host a Node.js Express App on AWS EC2 with PM2 and Nginx

Interview card: Why commit package-lock.json but not node_modules?. The lock file pins exact versions; node_modules can be rebuilt with npm install. node_modules is huge and OS-specific. .gitignore line:
Interview card: Why commit package-lock.json but not node_modules? · Download PNG

Lesson: Host a Node.js Express App on AWS EC2 with PM2 and Nginx

AWS chapter cards: revision, comparison and interview (3)

Host a Python Flask App on AWS EC2 with Gunicorn and Nginx

Revision card: Python virtual environment. Installing libraries with sudo pip mixes them with the system Python and can break yum. A virtual environment (venv) is a private folder of Python libraries for one app. Create it, activate it, then pip install from requirements.txt. Setup:
Revision card: Python virtual environment · Download PNG

Lesson: Host a Python Flask App on AWS EC2 with Gunicorn and Nginx

Revision card: Run Flask with gunicorn. The Flask development server is slow, single-user and stops when SSH closes. gunicorn is a production server for Python apps. app:app means file app.py, object app. Bind it to 127.0.0.1 so only Nginx can reach it, and run it in the background. Command:
Revision card: Run Flask with gunicorn · Download PNG

Lesson: Host a Python Flask App on AWS EC2 with Gunicorn and Nginx

Revision card: Nginx as a reverse proxy for Flask. gunicorn should not face the internet, and users expect port 80. A reverse proxy receives requests on 80 and passes them to the app on 5000. Add proxy_pass, nginx -t, reload, then remove the port 5000 SG rule. Location:
Revision card: Nginx as a reverse proxy for Flask · Download PNG

Lesson: Host a Python Flask App on AWS EC2 with Gunicorn and Nginx

Revision card: A systemd service for gunicorn. After a reboot, a gunicorn started by hand is gone and the site shows 502. A systemd service is a small file that tells Linux how to start, stop and restart a program. Create /etc/systemd/system/flask.service, then enable --now. Commands:
Revision card: A systemd service for gunicorn · Download PNG

Lesson: Host a Python Flask App on AWS EC2 with Gunicorn and Nginx

Comparison: Website vs API. Website: Pages made for people to read in a browser. API: Data made for other programs to use.
Comparison: Website vs API · Download PNG

Lesson: Host a Python Flask App on AWS EC2 with Gunicorn and Nginx

Comparison: Flask dev server vs gunicorn. Flask dev server: The built-in server you start with flask run. gunicorn: A production WSGI server that runs Flask with many workers.
Comparison: Flask dev server vs gunicorn · Download PNG

Lesson: Host a Python Flask App on AWS EC2 with Gunicorn and Nginx

Interview card: Why is sudo pip install a mistake?. It writes into the system Python that yum and AWS tools depend on. A wrong version can break system commands. Use a venv instead:
Interview card: Why is sudo pip install a mistake? · Download PNG

Lesson: Host a Python Flask App on AWS EC2 with Gunicorn and Nginx

Interview card: What does app:app mean in gunicorn?. Module app (file app.py) : object app (the Flask instance). gunicorn must know which file and which object to run. main.py with server = Flask(__name__) › main:server.
Interview card: What does app:app mean in gunicorn? · Download PNG

Lesson: Host a Python Flask App on AWS EC2 with Gunicorn and Nginx

Interview card: Why bind gunicorn to 127.0.0.1?. So only programs on the same server, like Nginx, can reach it. 0.0.0.0 would expose the app port to the internet. Bind and close port 5000 in the SG.
Interview card: Why bind gunicorn to 127.0.0.1? · Download PNG

Lesson: Host a Python Flask App on AWS EC2 with Gunicorn and Nginx

Interview card: How do you reload gunicorn after a code change?. Send HUP to the master process, or restart its systemd service. Workers restart with the new code without dropping the port. Commands:
Interview card: How do you reload gunicorn after a code change? · Download PNG

Lesson: Host a Python Flask App on AWS EC2 with Gunicorn and Nginx

How to Add Images and Videos to an HTML Website on EC2

Revision card: HTTP status codes. When a page fails, the code tells you whose fault it is. A 3-digit answer from the server. 2xx OK, 3xx redirect, 4xx client error, 5xx server error. See it in DevTools › Network, or with curl -I. 200 page found, 404 file missing, 403 no permission, 500 code crashed.
Revision card: HTTP status codes · Download PNG

Lesson: How to Add Images and Videos to an HTML Website on EC2

Revision card: How folders become URLs in Apache. You must know where to save a file so it opens at the URL you want. Everything after the IP is a path inside /var/www/html. Create the folder, put index.html in it, open the folder name. File /var/www/html/shop/index.html opens at:
Revision card: How folders become URLs in Apache · Download PNG

Lesson: How to Add Images and Videos to an HTML Website on EC2

Revision card: Add an image with &lt;img&gt;. Text-only pages look empty. Images must be on the server or at a reachable URL. The img tag shows a picture from src. width sets its size. Download it to the server with sudo wget, or upload with scp, then reference the file name. Tag:
Revision card: Add an image with &lt;img&gt; · Download PNG

Lesson: How to Add Images and Videos to an HTML Website on EC2

Revision card: Show a video on your page. Videos explain faster than text. You can host your own or embed YouTube. plays a file from your server. An iframe embeds a YouTube player. Own file: upload demo.mp4. YouTube: Share › Embed › copy the iframe. Own video:
Revision card: Show a video on your page · Download PNG

Lesson: How to Add Images and Videos to an HTML Website on EC2

Comparison: 401 Unauthorized vs 403 Forbidden. 401 Unauthorized: The server needs you to log in first. 403 Forbidden: The server knows the request but refuses it.
Comparison: 401 Unauthorized vs 403 Forbidden · Download PNG

Lesson: How to Add Images and Videos to an HTML Website on EC2

Comparison: Own video file vs YouTube embed. Own video file: An mp4 on your server played with . YouTube embed: A YouTube player placed with an iframe.
Comparison: Own video file vs YouTube embed · Download PNG

Lesson: How to Add Images and Videos to an HTML Website on EC2

Interview card: What is the difference between 403 and 404?. 404: the file does not exist. 403: it exists (or the folder does) but access is denied. It tells you to fix a path or a permission. Folder with no index.html and listing off = 403.
Interview card: What is the difference between 403 and 404? · Download PNG

Lesson: How to Add Images and Videos to an HTML Website on EC2

Interview card: An image does not show. How do you debug it?. Check the src in View Page Source and the request in DevTools › Network. Usually a wrong name, wrong case or missing file gives 404. src="Cat.JPG" but file is cat.jpg › 404.
Interview card: An image does not show. How do you debug it? · Download PNG

Lesson: How to Add Images and Videos to an HTML Website on EC2

Interview card: 301 vs 302 redirect: when do you use each?. 301 = moved permanently. 302 = moved temporarily. Browsers and Google remember 301 and update links; 302 keeps the old URL. http › https = 301; maintenance page = 302.
Interview card: 301 vs 302 redirect: when do you use each? · Download PNG

Lesson: How to Add Images and Videos to an HTML Website on EC2

What Is Amazon EC2 and How Does It Work

Revision card: What is an ENI?. IPs must live somewhere. Knowing where explains what changes on stop and start. An ENI (Elastic Network Interface) is the virtual network card. It holds the private IP and the public IP. See it in the instance Networking tab. The private IP stays on stop; the dynamic public IP goes. eni-0ab12: private 172.31.5.20, public 13.2.1.9.
Revision card: What is an ENI? · Download PNG

Lesson: What Is Amazon EC2 and How Does It Work

Revision card: EC2 instance states. Each state decides what you pay and what you lose. pending › running › stopping › stopped, and shutting-down › terminated. Stop to pause (EBS kept, still billed for disk). Terminate to delete for good. Stopped 8 GiB gp3 still costs about $0.64 per month.
Revision card: EC2 instance states · Download PNG

Lesson: What Is Amazon EC2 and How Does It Work

Revision card: Build the ssh command. Most login errors come from a wrong key path, user or IP. ssh -i KEY USER@IP. Amazon Linux user is ec2-user; Ubuntu is ubuntu. Open the terminal in the key folder, chmod 400 on Mac/Linux, then connect. Full command:
Revision card: Build the ssh command · Download PNG

Lesson: What Is Amazon EC2 and How Does It Work

Revision card: EC2 status checks. Running does not mean ready. SSH can fail until checks pass. System check = AWS hardware. Instance check = your OS. Newer types add an EBS check. Wait for 2/2 (or 3/3) checks passed before you log in. Status: 3/3 checks passed.
Revision card: EC2 status checks · Download PNG

Lesson: What Is Amazon EC2 and How Does It Work

Comparison: SSH client with .pem vs EC2 Instance Connect. SSH client with .pem: A terminal on your laptop using your private key. EC2 Instance Connect: A browser terminal from the EC2 console.
Comparison: SSH client with .pem vs EC2 Instance Connect · Download PNG

Lesson: What Is Amazon EC2 and How Does It Work

Interview card: What happens to an EC2 on stop vs terminate?. Stop: compute released, EBS kept, can start again. Terminate: deleted, root EBS deleted by default. Stop to save compute cost; terminate when the server is no longer needed. After start: same private IP, new public IP unless Elastic IP.
Interview card: What happens to an EC2 on stop vs terminate? · Download PNG

Lesson: What Is Amazon EC2 and How Does It Work

Interview card: Name common SSH errors to EC2 and their fixes.. Timeout = SG port 22 or wrong IP. Permission denied = wrong user or key. Bad permissions = chmod 400. The message points to the layer: network, auth or file. ssh -v shows where it stops.
Interview card: Name common SSH errors to EC2 and their fixes. · Download PNG

Lesson: What Is Amazon EC2 and How Does It Work

Interview card: What is a key pair and who keeps which part?. A public key on the server and a private key (.pem) with you. Only the matching private key can log in; no password is sent. Public key sits in ~/.ssh/authorized_keys on EC2.
Interview card: What is a key pair and who keeps which part? · Download PNG

Lesson: What Is Amazon EC2 and How Does It Work

Interview card: How do you back up an EC2 before stopping or terminating it?. Create an AMI or EBS snapshots; automate with Data Lifecycle Manager or AWS Backup. Terminate deletes the root disk; there is no undo. Daily snapshot at 02:00, keep 7.
Interview card: How do you back up an EC2 before stopping or terminating it? · Download PNG

Lesson: What Is Amazon EC2 and How Does It Work

How to Install LAMP and LEMP Stack on Ubuntu (EC2)

Revision card: Fix Apache downloading .php on Ubuntu. Opening index.php downloads the file instead of running it. Apache must hand .php files to php-fpm. Two modules and one config do that. Enable them, then restart Apache and clear the browser cache. Commands (PHP 8.3):
Revision card: Fix Apache downloading .php on Ubuntu · Download PNG

Lesson: How to Install LAMP and LEMP Stack on Ubuntu (EC2)

Revision card: Nginx PHP location block. Nginx does not run PHP by itself; .php shows as text or downloads. A location block sends .php to the php-fpm socket. The socket name has the PHP version. Uncomment the block, fix the version, nginx -t, reload. Socket line:
Revision card: Nginx PHP location block · Download PNG

Lesson: How to Install LAMP and LEMP Stack on Ubuntu (EC2)

Revision card: The apt lock error. Right after boot, apt install fails with "Could not get lock". Ubuntu runs automatic updates first. Only one apt can run at a time. Wait a few minutes and retry. Do not delete lock files. Error:
Revision card: The apt lock error · Download PNG

Lesson: How to Install LAMP and LEMP Stack on Ubuntu (EC2)

Revision card: First steps in MySQL on Ubuntu. The app needs a password to log in to MySQL. On Ubuntu, root logs in with sudo mysql (no password). ALTER USER sets one. Set it, exit, then log in with -p. Typing is hidden; that is normal. SQL:
Revision card: First steps in MySQL on Ubuntu · Download PNG

Lesson: How to Install LAMP and LEMP Stack on Ubuntu (EC2)

Interview card: A .php page downloads instead of running. What is wrong?. The web server is not passing .php to php-fpm. Without the handler, Apache or Nginx sends the file as-is. Apache: a2enmod proxy_fcgi + a2enconf php8.3-fpm. Nginx: php location block.
Interview card: A .php page downloads instead of running. What is wrong? · Download PNG

Lesson: How to Install LAMP and LEMP Stack on Ubuntu (EC2)

Interview card: What changes when you set up LAMP on Ubuntu instead of Amazon Linux?. apt-get instead of yum, apache2 instead of httpd, and a versioned php8.x-fpm service. Package and service names differ by distribution. Ubuntu:
Interview card: What changes when you set up LAMP on Ubuntu instead of Amazon Linux? · Download PNG

Lesson: How to Install LAMP and LEMP Stack on Ubuntu (EC2)

Interview card: A service fails to start. What is your first habit?. Read the last lines of the status output, then the journal. The real error is usually in the bottom lines. Commands:
Interview card: A service fails to start. What is your first habit? · Download PNG

Lesson: How to Install LAMP and LEMP Stack on Ubuntu (EC2)

Interview card: Why do real setups keep MySQL on its own server?. Security, separate scaling and safety of data if the web server breaks. A hacked web server should not expose the database directly. Web on EC2, data on RDS in a private subnet.
Interview card: Why do real setups keep MySQL on its own server? · Download PNG

Lesson: How to Install LAMP and LEMP Stack on Ubuntu (EC2)

How to Install LAMP Stack on Amazon Linux (EC2)

Revision card: What is the LAMP stack?. A dynamic site needs a web server, a language and a database working together. LAMP = Linux, Apache, MariaDB/MySQL, PHP. LEMP swaps Apache for Nginx (Engine-x). Install all three on Amazon Linux in one line, then start them. One line:
Revision card: What is the LAMP stack? · Download PNG

Lesson: How to Install LAMP Stack on Amazon Linux (EC2)

Revision card: Why the browser cannot run PHP. PHP code in the browser would show your passwords and logic. PHP runs on the server. Apache passes .php to php-fpm, which returns plain HTML. Start php-fpm with Apache. View Page Source shows HTML, never PHP. arrives in the browser as:
Revision card: Why the browser cannot run PHP · Download PNG

Lesson: How to Install LAMP Stack on Amazon Linux (EC2)

Revision card: Test PHP with phpinfo(). Before building an app, prove PHP works. phpinfo() prints a page with the PHP version and loaded modules. Create info.php, open it, then delete it (it reveals server details). File /var/www/html/info.php:
Revision card: Test PHP with phpinfo() · Download PNG

Lesson: How to Install LAMP Stack on Amazon Linux (EC2)

Revision card: Automate setup with lamp.sh. Typing the same install on every server is slow and you forget steps. A shell script is a file of commands that runs top to bottom. -y answers yes. Write it, make it executable, run it. Inside lamp.sh:
Revision card: Automate setup with lamp.sh · Download PNG

Lesson: How to Install LAMP Stack on Amazon Linux (EC2)

Interview card: What does each part of LAMP do?. Linux runs everything, Apache serves pages, MariaDB stores data, PHP builds pages. Each layer can be swapped, like Nginx for Apache (LEMP). Login page: Apache › PHP › SELECT from MariaDB › HTML.
Interview card: What does each part of LAMP do? · Download PNG

Lesson: How to Install LAMP Stack on Amazon Linux (EC2)

Interview card: PHP code shows as text in the browser. Why?. PHP or php-fpm is not installed or not connected to the web server. Without it, the server returns the file contents. Install, then restart both:
Interview card: PHP code shows as text in the browser. Why? · Download PNG

Lesson: How to Install LAMP Stack on Amazon Linux (EC2)

Interview card: Apache fails with "Address already in use". Why?. Another program, usually Nginx, already listens on port 80. Only one program can own a port. Find and stop it:
Interview card: Apache fails with "Address already in use". Why? · Download PNG

Lesson: How to Install LAMP Stack on Amazon Linux (EC2)

Interview card: Why does Amazon Linux use MariaDB for MySQL?. MariaDB is an open-source fork of MySQL that ships in its repos. It speaks the same SQL and commands, so apps work unchanged. Package:
Interview card: Why does Amazon Linux use MariaDB for MySQL? · Download PNG

Lesson: How to Install LAMP Stack on Amazon Linux (EC2)

Install WordPress on Amazon Linux 2023 with Nginx

Revision card: What is a CMS like WordPress?. Non-coders must add posts and pages without editing HTML. A CMS (content management system) is a ready app with an admin panel to manage content. Install it on LEMP, then manage everything at /wp-admin. Blog, shop or college site: posts, Media Library and themes.
Revision card: What is a CMS like WordPress? · Download PNG

Lesson: Install WordPress on Amazon Linux 2023 with Nginx

Revision card: Nginx server block for WordPress. Without the right block, Nginx shows 404 or downloads PHP. root = WordPress folder, index index.php, and try_files sends pretty URLs to index.php. Edit the block, nginx -t, reload. Key line:
Revision card: Nginx server block for WordPress · Download PNG

Lesson: Install WordPress on Amazon Linux 2023 with Nginx

Revision card: WordPress database and user. Using root for the app is risky; a leak gives full database access. Create one database and one user with rights only on it. Run the SQL, then give these details on the first installer screen. SQL:
Revision card: WordPress database and user · Download PNG

Lesson: Install WordPress on Amazon Linux 2023 with Nginx

Revision card: WordPress file permissions. Uploads and plugin installs fail if PHP cannot write; 777 lets anyone write. Owner = the php-fpm user. Folders 755, files 644. Never 777. chown the folder, then set 755/644 with find. Folders:
Revision card: WordPress file permissions · Download PNG

Lesson: Install WordPress on Amazon Linux 2023 with Nginx

Comparison: CMS vs Framework. CMS: A ready app with an admin panel for content. Framework: A toolkit of code to build your own app.
Comparison: CMS vs Framework · Download PNG

Lesson: Install WordPress on Amazon Linux 2023 with Nginx

Interview card: What is the difference between a CMS and a framework?. A CMS is a finished app you configure; a framework is a toolkit to write your own app. CMS is fast for content sites; frameworks fit custom logic. WordPress = CMS. Laravel or Flask = framework.
Interview card: What is the difference between a CMS and a framework? · Download PNG

Lesson: Install WordPress on Amazon Linux 2023 with Nginx

Interview card: Why never set WordPress folders to 777?. 777 lets every user and process write and run files. One hacked plugin could then change any file. Right way: owner = php-fpm user, 755 folders, 644 files.
Interview card: Why never set WordPress folders to 777? · Download PNG

Lesson: Install WordPress on Amazon Linux 2023 with Nginx

Interview card: Why does WordPress break when the EC2 public IP changes?. WordPress saves the site URL with the old IP in its database. Links and CSS still point to the old IP. Use an Elastic IP or a domain from the start.
Interview card: Why does WordPress break when the EC2 public IP changes? · Download PNG

Lesson: Install WordPress on Amazon Linux 2023 with Nginx

Interview card: What does try_files do in the WordPress Nginx config?. It serves a real file if it exists, otherwise passes the request to index.php. WordPress pretty links like /about/ are not real folders. Line:
Interview card: What does try_files do in the WordPress Nginx config? · Download PNG

Lesson: Install WordPress on Amazon Linux 2023 with Nginx

Linux chmod Command Explained: File Permissions 755, 644, 400

Revision card: Read ls -l permissions. Permission errors are solved only when you can read who may do what. 10 characters: type, then rwx for owner (u), group (g) and others (o). Run ls -l and split after the first character into 3 groups of 3. -rw-r--r-- = file; owner rw, group r, others r.
Revision card: Read ls -l permissions · Download PNG

Lesson: Linux chmod Command Explained: File Permissions 755, 644, 400

Revision card: Numeric chmod. One number sets all permissions at once. r = 4, w = 2, x = 1. Add them per digit: owner, group, others. Work out each digit from the need, then run chmod. Owner rwx, group rx, others r: 7, 5, 4.
Revision card: Numeric chmod · Download PNG

Lesson: Linux chmod Command Explained: File Permissions 755, 644, 400

Revision card: r, w, x on a folder. Folder permissions work differently from file permissions. r = list names, w = create or delete inside, x = enter (cd) and reach files. Deleting a file needs w on its PARENT folder, not on the file. chmod 700 private: only the owner can list, enter and change.
Revision card: r, w, x on a folder · Download PNG

Lesson: Linux chmod Command Explained: File Permissions 755, 644, 400

Revision card: The sticky bit on /tmp. /tmp is writable by all, so anyone could delete others' files. The sticky bit lets only a file's owner delete it, even in a shared folder. It shows as t at the end. Set it with 1 in front. ls -ld /tmp:
Revision card: The sticky bit on /tmp · Download PNG

Lesson: Linux chmod Command Explained: File Permissions 755, 644, 400

Comparison: Symbolic chmod vs Numeric chmod. Symbolic chmod: Letters and signs like u+x or g-w. Numeric chmod: Three digits like 755 built from r=4 w=2 x=1.
Comparison: Symbolic chmod vs Numeric chmod · Download PNG

Lesson: Linux chmod Command Explained: File Permissions 755, 644, 400

Interview card: What does chmod 644 mean, and where do you use it?. Owner read and write (6), group read (4), others read (4). Everyone can read, only the owner can edit. Web pages and config files. Scripts 755, keys 400.
Interview card: What does chmod 644 mean, and where do you use it? · Download PNG

Lesson: Linux chmod Command Explained: File Permissions 755, 644, 400

Interview card: Why is chmod 777 a bad habit?. Everyone can read, change and run the file. Any user or hacked process can plant code in it. Give only what is needed: 755 for a script.
Interview card: Why is chmod 777 a bad habit? · Download PNG

Lesson: Linux chmod Command Explained: File Permissions 755, 644, 400

Interview card: Can you delete a file you have no permission on?. Yes, if you have w and x on its parent folder (and no sticky bit). Deleting changes the folder's list, not the file. /tmp has the sticky bit, so only the owner can delete there.
Interview card: Can you delete a file you have no permission on? · Download PNG

Lesson: Linux chmod Command Explained: File Permissions 755, 644, 400

Interview card: Why can ec2-user use sudo but a new user cannot?. ec2-user is in the wheel group, which sudoers allows. New users get no admin rights by default. Add to wheel:
Interview card: Why can ec2-user use sudo but a new user cannot? · Download PNG

Lesson: Linux chmod Command Explained: File Permissions 755, 644, 400

Linux cp Command with Examples (Copy Files and Folders)

Revision card: cp: copy files. Before editing a config, you need a backup copy. cp SOURCE DESTINATION copies what (source) to where (destination). Use -i to be asked before an overwrite; . means the current folder. Backup:
Revision card: cp: copy files · Download PNG

Lesson: Linux cp Command with Examples (Copy Files and Folders)

Revision card: Copy folders with cp -r. cp alone refuses folders: "omitting directory". -r (recursive) copies the folder and everything inside it. If the destination exists, the folder goes INSIDE it. Copy a site:
Revision card: Copy folders with cp -r · Download PNG

Lesson: Linux cp Command with Examples (Copy Files and Folders)

Revision card: Wildcards * and ?. Typing 50 file names by hand is slow. * matches any number of characters. ? matches exactly one. Use a naming pattern so one wildcard picks the right files. *.txt = all txt; file?.txt = file1 to file9 only.
Revision card: Wildcards * and ? · Download PNG

Lesson: Linux cp Command with Examples (Copy Files and Folders)

Revision card: Make test files with {1..50}. Practising wildcards needs many files fast. Brace expansion makes the shell write a list for you. Put a range in braces after touch. 50 files in one go:
Revision card: Make test files with {1..50} · Download PNG

Lesson: Linux cp Command with Examples (Copy Files and Folders)

Comparison: * wildcard vs ? wildcard. * wildcard: Matches any number of characters, even none. ? wildcard: Matches exactly one character.
Comparison: * wildcard vs ? wildcard · Download PNG

Lesson: Linux cp Command with Examples (Copy Files and Folders)

Interview card: Why does cp fail on a folder, and how do you fix it?. cp copies files only; folders need -r (recursive). Without -r it says "omitting directory". Fix:
Interview card: Why does cp fail on a folder, and how do you fix it? · Download PNG

Lesson: Linux cp Command with Examples (Copy Files and Folders)

Interview card: How do you stop cp from silently overwriting files?. Use -i to be asked, or -n to never overwrite. Plain cp replaces the destination without warning. Ask first:
Interview card: How do you stop cp from silently overwriting files? · Download PNG

Lesson: Linux cp Command with Examples (Copy Files and Folders)

Interview card: How do you copy only file11 to file19 with a wildcard?. Use file1? : it matches file1 followed by exactly one character. file1* would also match file1 and file100. Command:
Interview card: How do you copy only file11 to file19 with a wildcard? · Download PNG

Lesson: Linux cp Command with Examples (Copy Files and Folders)

AWS chapter cards: revision, comparison and interview (4)

Linux Directory Commands: pwd, ls, cd, mkdir for Beginners

Revision card: The Linux tree. Every file has one address. Without the tree you get lost on a server. Everything starts at / (root). Folders branch from it, like /home/ec2-user. pwd shows where you are; ls shows what is here. After login, pwd prints:
Revision card: The Linux tree · Download PNG

Lesson: Linux Directory Commands: pwd, ls, cd, mkdir for Beginners

Revision card: Move around with cd. Commands work on the current folder, so you must reach the right one. cd folder goes in. cd .. goes up one. cd alone goes home. cd - goes back. Chain ups with slashes: cd ../.. goes up two levels. From /home/ec2-user/a/b:
Revision card: Move around with cd · Download PNG

Lesson: Linux Directory Commands: pwd, ls, cd, mkdir for Beginners

Revision card: Absolute vs relative paths. The same file can be named two ways. Knowing both saves typing and mistakes. Absolute starts at / and works anywhere. Relative starts from where you are. ~ means your home. Use absolute in scripts, relative for quick work. Same folder:
Revision card: Absolute vs relative paths · Download PNG

Lesson: Linux Directory Commands: pwd, ls, cd, mkdir for Beginners

Revision card: mkdir -p: nested folders. mkdir a/b/c fails if a does not exist. -p creates every missing parent in one go and never errors if it exists. Combine with braces for many folders at once. Calendar tree:
Revision card: mkdir -p: nested folders · Download PNG

Lesson: Linux Directory Commands: pwd, ls, cd, mkdir for Beginners

Comparison: cd .. vs cd -. cd ..: Goes to the parent folder, one level up. cd -: Goes back to the folder you were in before.
Comparison: cd .. vs cd - · Download PNG

Lesson: Linux Directory Commands: pwd, ls, cd, mkdir for Beginners

Interview card: What is the difference between an absolute and a relative path?. Absolute starts at /; relative starts from the current folder. Absolute works from anywhere, so scripts use it. /var/www/html vs ../html.
Interview card: What is the difference between an absolute and a relative path? · Download PNG

Lesson: Linux Directory Commands: pwd, ls, cd, mkdir for Beginners

Interview card: What do cd, cd - and cd .. do?. cd alone: home. cd -: previous folder. cd ..: one level up. They save typing long paths. /etc › cd /var/log › cd - › back in /etc.
Interview card: What do cd, cd - and cd .. do? · Download PNG

Lesson: Linux Directory Commands: pwd, ls, cd, mkdir for Beginners

Interview card: How do you work with folder names that have spaces?. Put the name in quotes or escape each space with \. Otherwise the shell sees two separate names. Both work:
Interview card: How do you work with folder names that have spaces? · Download PNG

Lesson: Linux Directory Commands: pwd, ls, cd, mkdir for Beginners

Linux File Commands: touch, cat, nano and vi Tutorial

Revision card: touch: create files and timestamps. You often need an empty file to start, or to mark a time. touch makes an empty file if missing; if it exists, it updates its time. Give one or many names; braces make lists. Three files:
Revision card: touch: create files and timestamps · Download PNG

Lesson: Linux File Commands: touch, cat, nano and vi Tutorial

Revision card: cat with &gt; and &gt;&gt;. Small files can be written and read without an editor. cat file reads. > writes (replaces). >> appends at the end. Ctrl+D finishes. Use >> when you must keep old lines. Write then add:
Revision card: cat with &gt; and &gt;&gt; · Download PNG

Lesson: Linux File Commands: touch, cat, nano and vi Tutorial

Revision card: Edit with nano. Config files need a simple editor on the server. nano shows its shortcuts at the bottom. ^ means Ctrl. Ctrl+O then Enter saves; Ctrl+X exits. Use sudo for system files. Open:
Revision card: Edit with nano · Download PNG

Lesson: Linux File Commands: touch, cat, nano and vi Tutorial

Revision card: vi modes. vi is on every Linux server, even when nano is not. Normal mode for commands, insert mode for typing. i, a, o enter insert; Esc leaves it. Esc, then :wq saves and quits; :q! quits without saving. Quick edit:
Revision card: vi modes · Download PNG

Lesson: Linux File Commands: touch, cat, nano and vi Tutorial

Comparison: nano vs vi. nano: A simple editor with shortcuts shown at the bottom. vi: A modal editor present on every Linux.
Comparison: nano vs vi · Download PNG

Lesson: Linux File Commands: touch, cat, nano and vi Tutorial

Interview card: What does touch do to an existing file?. It updates its access and modify times; the content stays. Build tools and backups use times to decide what changed. stat before and after shows the new time.
Interview card: What does touch do to an existing file? · Download PNG

Lesson: Linux File Commands: touch, cat, nano and vi Tutorial

Interview card: What is the difference between > and >>?. > replaces the file content. >> adds to the end. A wrong > can wipe a config or log. Append a line:
Interview card: What is the difference between > and >>? · Download PNG

Lesson: Linux File Commands: touch, cat, nano and vi Tutorial

Interview card: How do you exit vi without saving?. Press Esc, then type :q! and Enter. Esc returns to normal mode where commands work. Save and exit instead: :wq.
Interview card: How do you exit vi without saving? · Download PNG

Lesson: Linux File Commands: touch, cat, nano and vi Tutorial

Linux grep and find Commands with Examples

Revision card: Find text with grep. Logs have thousands of lines. Reading them all is impossible. grep prints only lines that contain a word. -i ignores case, -n shows line numbers, -r searches folders. grep WORD FILE, with sudo for protected logs. Who logged in:
Revision card: Find text with grep · Download PNG

Lesson: Linux grep and find Commands with Examples

Revision card: The pipe |. One command rarely gives exactly what you need. | sends the output of one command as input to the next. Chain small tools: list, filter, count. Count users with bash:
Revision card: The pipe | · Download PNG

Lesson: Linux grep and find Commands with Examples

Revision card: Find files with find. You know a file name but not where it is. find searches folders by name, type or permission. find WHERE -name PATTERN; add sudo to avoid Permission denied. All conf files:
Revision card: Find files with find · Download PNG

Lesson: Linux grep and find Commands with Examples

Revision card: /etc/passwd and /etc/shadow. You must know where Linux keeps users and passwords. /etc/passwd lists users (anyone can read). /etc/shadow holds password hashes (root only). Read passwd with cat; shadow needs sudo. A passwd line:
Revision card: /etc/passwd and /etc/shadow · Download PNG

Lesson: Linux grep and find Commands with Examples

Comparison: grep vs find. grep: Searches for text inside files. find: Searches for files by name, type or permission.
Comparison: grep vs find · Download PNG

Lesson: Linux grep and find Commands with Examples

Interview card: What does the pipe | do? Give an example.. It sends one command's output into the next command. Small tools combine into powerful one-liners. Count failed logins:
Interview card: What does the pipe | do? Give an example. · Download PNG

Lesson: Linux grep and find Commands with Examples

Interview card: find vs grep: what does each search?. find searches file NAMES and attributes. grep searches TEXT inside files. One finds where a file is; the other finds what is in it. find /etc -name "*.conf" vs grep -rn "listen" /etc/nginx.
Interview card: find vs grep: what does each search? · Download PNG

Lesson: Linux grep and find Commands with Examples

Interview card: Why can normal users read /etc/passwd but not /etc/shadow?. passwd has public info; shadow has password hashes. Hashes could be cracked offline if anyone could read them. ls -l /etc/shadow shows ---------- root.
Interview card: Why can normal users read /etc/passwd but not /etc/shadow? · Download PNG

Lesson: Linux grep and find Commands with Examples

What Is Linux? History, Kernel and Basic File Commands

Revision card: What an operating system does. Apps cannot talk to hardware directly; something must share CPU, RAM and disk. The OS manages hardware for apps. Its core is the kernel; the shell takes your commands. You type in the shell; the kernel does the work. ls › shell › kernel reads the disk › names on screen.
Revision card: What an operating system does · Download PNG

Lesson: What Is Linux? History, Kernel and Basic File Commands

Revision card: Three timestamps with stat. When something breaks, you ask: when was this file last read or changed? Access = last read. Modify = content changed. Change = content or permissions/owner changed. Run stat on the file and read the three lines. After chmod, only Change moves:
Revision card: Three timestamps with stat · Download PNG

Lesson: What Is Linux? History, Kernel and Basic File Commands

Revision card: What is cloud?. Buying servers takes weeks and money up front, even for a 3-day sale. Cloud = renting computing over the internet and paying only for what you use. Launch servers in minutes, delete them when done. Sale: 10 → 50 servers for 3 days, back to 10 after.
Revision card: What is cloud? · Download PNG

Lesson: What Is Linux? History, Kernel and Basic File Commands

Revision card: More cat: join, number, tac. Quick file checks are faster without an editor. cat a b joins files. cat -n numbers lines. tac prints lines in reverse. Join two files into a new one with >. Join:
Revision card: More cat: join, number, tac · Download PNG

Lesson: What Is Linux? History, Kernel and Basic File Commands

Interview card: Linux is a kernel, not a full OS. What does that mean?. Linux is the core that manages hardware; GNU tools + kernel make the OS. Distributions package them: Amazon Linux, Ubuntu, RHEL. uname -r shows the kernel version.
Interview card: Linux is a kernel, not a full OS. What does that mean? · Download PNG

Lesson: What Is Linux? History, Kernel and Basic File Commands

Interview card: Capex vs Opex: why does cloud help a 3-day sale?. Capex buys servers up front; Opex pays per use. Bought servers sit idle after the sale; cloud servers are deleted. 40 extra servers × 3 days in cloud vs buying 40 for years.
Interview card: Capex vs Opex: why does cloud help a 3-day sale? · Download PNG

Lesson: What Is Linux? History, Kernel and Basic File Commands

Interview card: Why can you not set a file's Change time with touch?. The kernel sets Change itself whenever metadata changes. It is a trustworthy record for investigations. touch -d sets Modify; Change still shows now.
Interview card: Why can you not set a file's Change time with touch? · Download PNG

Lesson: What Is Linux? History, Kernel and Basic File Commands

Linux mv and rm Commands: Move, Rename and Delete Files

Revision card: mv: move and rename. Files end up in the wrong place or with the wrong name. mv is cut-paste. If the destination is a new name in the same folder, it renames. Folders need no -r with mv. Use -i to avoid silent overwrites. Rename and move:
Revision card: mv: move and rename · Download PNG

Lesson: Linux mv and rm Commands: Move, Rename and Delete Files

Revision card: Delete with rm, rm -r, rmdir. Linux has no recycle bin. A wrong rm is permanent. rm deletes files. rm -r deletes folders with content. rmdir deletes only empty folders. Use rm -i to confirm each file; run pwd first. Safe delete:
Revision card: Delete with rm, rm -r, rmdir · Download PNG

Lesson: Linux mv and rm Commands: Move, Rename and Delete Files

Revision card: Hidden files and ls -a. Important settings like .bashrc and .ssh do not show with ls. A name starting with a dot is hidden. . is this folder, .. is the parent. ls -a shows everything; ls -la shows details too. In home:
Revision card: Hidden files and ls -a · Download PNG

Lesson: Linux mv and rm Commands: Move, Rename and Delete Files

Revision card: File or folder? Read ls -l. Names and colours can lie: a folder can be named photo.jpg. The first character of ls -l tells the type: - file, d directory, l link. Check before cp -r or rm -r. Output:
Revision card: File or folder? Read ls -l · Download PNG

Lesson: Linux mv and rm Commands: Move, Rename and Delete Files

Interview card: Why does mv not need -r for folders when cp does?. On the same disk, mv only changes the name entry; nothing is copied. cp must copy every file inside, so it must be told to recurse. mv site /tmp/ vs cp -r site /tmp/.
Interview card: Why does mv not need -r for folders when cp does? · Download PNG

Lesson: Linux mv and rm Commands: Move, Rename and Delete Files

Interview card: How do you copy only what is inside a folder, not the folder?. Use folder/* (or folder/. with -r) as the source. folder alone copies the folder itself. Command:
Interview card: How do you copy only what is inside a folder, not the folder? · Download PNG

Lesson: Linux mv and rm Commands: Move, Rename and Delete Files

Interview card: rm -r vs rmdir: when do you use each?. rmdir deletes only empty folders; rm -r deletes folders with everything inside. rmdir is a safe check: it fails if anything is left. rmdir old › "Directory not empty".
Interview card: rm -r vs rmdir: when do you use each? · Download PNG

Lesson: Linux mv and rm Commands: Move, Rename and Delete Files

Linux User Management: useradd, passwd and sudo Access

Revision card: Create a user with useradd. Each person on a server should have their own login. useradd creates the user, a home folder and a group of the same name. passwd sets the password. Create, set a password, check with id. Commands:
Revision card: Create a user with useradd · Download PNG

Lesson: Linux User Management: useradd, passwd and sudo Access

Revision card: Switch user with su. You need to test what another user can do. su NAME switches user. su - NAME also loads their home and environment. Type their password; exit returns you. Switch:
Revision card: Switch user with su · Download PNG

Lesson: Linux User Management: useradd, passwd and sudo Access

Revision card: Give sudo with the wheel group. A new user sees "ravi is not in the sudoers file". On Amazon Linux, members of the wheel group may use sudo. Add with usermod -aG; remove with gpasswd -d. It counts from the next login. Give and take:
Revision card: Give sudo with the wheel group · Download PNG

Lesson: Linux User Management: useradd, passwd and sudo Access

Revision card: Read /etc/passwd fields. You need to see a user's ID, home and shell quickly. 7 fields split by colons: name, x, UID, GID, comment, home, shell. grep the user name; UID 0 is root, 1000+ are normal users. Line:
Revision card: Read /etc/passwd fields · Download PNG

Lesson: Linux User Management: useradd, passwd and sudo Access

Interview card: A new user gets "not in the sudoers file". How do you fix it?. Add the user to the wheel group (Amazon Linux) or sudo group (Ubuntu). Only members of those groups may run sudo. Then log out and in again:
Interview card: A new user gets "not in the sudoers file". How do you fix it? · Download PNG

Lesson: Linux User Management: useradd, passwd and sudo Access

Interview card: userdel vs userdel -r: what is left behind?. userdel removes the account but keeps /home/name. -r removes the home and mail too. Leftover files can be owned by a recycled UID later. Clean removal:
Interview card: userdel vs userdel -r: what is left behind? · Download PNG

Lesson: Linux User Management: useradd, passwd and sudo Access

Interview card: Why do group changes work only after the next login?. Groups are loaded into your session at login. The running shell still has the old group list. Check with id; log out and in, or use newgrp.
Interview card: Why do group changes work only after the next login? · Download PNG

Lesson: Linux User Management: useradd, passwd and sudo Access

Linux Users, Groups and sudo for Beginners

Revision card: Owner and group in ls -l. Permissions mean nothing until you know who the owner and group are. Every file has one owner (u) and one group (g); everyone else is others (o). Change with chown and chgrp (needs sudo). ls -l:
Revision card: Owner and group in ls -l · Download PNG

Lesson: Linux Users, Groups and sudo for Beginners

Revision card: Share files with a group. A team must edit the same files without using one shared login. Create a group, add users, give the folder to the group with write permission. groupadd, usermod -aG, chgrp, chmod g+w. Setup:
Revision card: Share files with a group · Download PNG

Lesson: Linux Users, Groups and sudo for Beginners

Revision card: whoami, who and w. On a shared server you must know who you are and who else is in. whoami = your user. who = logged-in users. w = users plus what they are running. Run all three after su to see the difference. After sudo su:
Revision card: whoami, who and w · Download PNG

Lesson: Linux Users, Groups and sudo for Beginners

Revision card: Run a script: the x bit. A new script gives "Permission denied" when you run it. Files are not executable by default. chmod +x adds the x (execute) bit. Add the bit, run with ./ ; stop an endless loop with Ctrl+C. Commands:
Revision card: Run a script: the x bit · Download PNG

Lesson: Linux Users, Groups and sudo for Beginners

Interview card: Why should a team not share one ec2-user login?. Nobody can tell who did what, and removing one person means changing the key for all. Separate users give accountability and least privilege. One user per person, sudo only for admins.
Interview card: Why should a team not share one ec2-user login? · Download PNG

Lesson: Linux Users, Groups and sudo for Beginners

Interview card: Why do new files show 664 instead of 644?. The umask for normal users is 002, so the group keeps write. Each user has a private group, so group write is still safe. umask shows it:
Interview card: Why do new files show 664 instead of 644? · Download PNG

Lesson: Linux Users, Groups and sudo for Beginners

Interview card: When should you use sudo, and when not?. Use it for system changes: installs, /etc, services. Not for your own files. Files made with sudo become root-owned and you cannot edit them later. sudo touch a.txt › owner root.
Interview card: When should you use sudo, and when not? · Download PNG

Lesson: Linux Users, Groups and sudo for Beginners

Networking Basics for Cloud: IP Address, Client and Server Explained

Revision card: Client and server. Every website, app and API works the same basic way. A client sends a request; a server sends a response. Each needs an IP address so packets know where to go. Browser › GET / › server 13.2.1.9 › HTML page.
Revision card: Client and server · Download PNG

Lesson: Networking Basics for Cloud: IP Address, Client and Server Explained

Revision card: IPv4 addresses. Machines find each other by number, not by name. IPv4 = 4 parts, each 0 to 255, about 4.29 billion in total. IPv6 is the much larger new version. Count like an odometer: after 255 the next part goes up. Next after 0.0.0.255:
Revision card: IPv4 addresses · Download PNG

Lesson: Networking Basics for Cloud: IP Address, Client and Server Explained

Revision card: Static vs dynamic IP. Users must find a server at the same address every day. Dynamic IP can change on reconnect. Static IP stays fixed. Servers get static IPs (on AWS: Elastic IP); laptops are fine with dynamic. Home Wi-Fi: 192.168.1.5 today, .7 tomorrow.
Revision card: Static vs dynamic IP · Download PNG

Lesson: Networking Basics for Cloud: IP Address, Client and Server Explained

Revision card: Gateway and a packet's journey. Your laptop cannot reach the internet on its own. The gateway (usually your router) is the door out of your network. Packets for other networks go to the gateway, which forwards them on. Laptop 192.168.1.5 › gateway 192.168.1.1 › ISP › server.
Revision card: Gateway and a packet's journey · Download PNG

Lesson: Networking Basics for Cloud: IP Address, Client and Server Explained

Comparison: Static IP vs Dynamic IP. Static IP: An address fixed for one machine. Dynamic IP: An address given for a while by DHCP.
Comparison: Static IP vs Dynamic IP · Download PNG

Lesson: Networking Basics for Cloud: IP Address, Client and Server Explained

Comparison: IPv4 vs IPv6. IPv4: 32-bit address written as 4 numbers. IPv6: 128-bit address written in hex groups.
Comparison: IPv4 vs IPv6 · Download PNG

Lesson: Networking Basics for Cloud: IP Address, Client and Server Explained

Interview card: Why does every machine need an IP address?. Packets are delivered by IP, like letters by postal address. Without it, replies have nowhere to return. Server 13.2.1.9 replies to laptop 49.36.10.4.
Interview card: Why does every machine need an IP address? · Download PNG

Lesson: Networking Basics for Cloud: IP Address, Client and Server Explained

Interview card: Why is IPv4 running out, and what replaces it?. IPv4 has only about 4.29 billion addresses for many more devices. IPv6 replaces it. IPv6 uses 128 bits, enough for every device. IPv6 example:
Interview card: Why is IPv4 running out, and what replaces it? · Download PNG

Lesson: Networking Basics for Cloud: IP Address, Client and Server Explained

Interview card: What is a default gateway?. The router your machine sends packets to when the destination is outside its network. Without it you reach only local machines. Check:
Interview card: What is a default gateway? · Download PNG

Lesson: Networking Basics for Cloud: IP Address, Client and Server Explained

AWS chapter cards: revision, comparison and interview (5)

Nginx Configuration Tutorial: Change Port, Root Folder and Index Page

Revision card: Inside nginx.conf. Every Nginx change starts in one settings file. /etc/nginx/nginx.conf holds server { } blocks. Each line ends with ; and blocks use braces. Back it up, edit, test with nginx -t, then reload. Three key lines:
Revision card: Inside nginx.conf · Download PNG

Lesson: Nginx Configuration Tutorial: Change Port, Root Folder and Index Page

Revision card: Test and apply: nginx -t and reload. One missing ; stops Nginx and takes every site down. nginx -t checks the syntax without touching the running server. reload applies with no downtime. Always run -t first; reload only after "syntax is ok". Commands:
Revision card: Test and apply: nginx -t and reload · Download PNG

Lesson: Nginx Configuration Tutorial: Change Port, Root Folder and Index Page

Revision card: Fix Marathi text with charset utf-8. Marathi or Hindi text shows as strange letters like म. The browser guessed the wrong encoding. UTF-8 covers every language. Add charset to the server block (or a meta tag in the page), then reload. Line:
Revision card: Fix Marathi text with charset utf-8 · Download PNG

Lesson: Nginx Configuration Tutorial: Change Port, Root Folder and Index Page

Revision card: Apache config on Ubuntu. Ubuntu splits Apache settings into several files, unlike Amazon Linux. apache2.conf = main, ports.conf = Listen ports, sites-available/000-default.conf = the site folder. Change port in ports.conf AND the VirtualHost, then restart apache2. Port 8080:
Revision card: Apache config on Ubuntu · Download PNG

Lesson: Nginx Configuration Tutorial: Change Port, Root Folder and Index Page

Interview card: How do you change the port Nginx listens on?. Edit listen in the server block, test, reload, and open the port in the SG. Nginx and the firewall must agree. listen 8080; then open http://13.2.1.9:8080.
Interview card: How do you change the port Nginx listens on? · Download PNG

Lesson: Nginx Configuration Tutorial: Change Port, Root Folder and Index Page

Interview card: Can Apache and Nginx run on the same server?. Yes, if they listen on different ports. Two programs cannot share one port. Nginx 80, Apache 8080.
Interview card: Can Apache and Nginx run on the same server? · Download PNG

Lesson: Nginx Configuration Tutorial: Change Port, Root Folder and Index Page

Interview card: Why does the browser refuse some ports?. Browsers block ports used by other protocols, like 25 (mail) or 6000. It stops web pages from attacking other services. Use 80, 443, 8080 or 8000 for web.
Interview card: Why does the browser refuse some ports? · Download PNG

Lesson: Nginx Configuration Tutorial: Change Port, Root Folder and Index Page

How to Set Up Passwordless SSH Between Linux Servers

Revision card: Disk usage: du -sh and df -h. A full disk stops logs, uploads and databases. df -h shows free space on the whole disk. du -sh shows the size of one file or folder. df to see if the disk is full, du to find what filled it. Biggest log folder:
Revision card: Disk usage: du -sh and df -h · Download PNG

Lesson: How to Set Up Passwordless SSH Between Linux Servers

Revision card: Passwordless SSH with ssh-keygen. Scripts and admins must hop between servers without typing passwords or copying .pem files. ssh-keygen makes a key pair. The public key goes into authorized_keys on the target. Generate on A, append id_rsa.pub to B's ~/.ssh/authorized_keys, chmod 700 .ssh and 600 the file. From A:
Revision card: Passwordless SSH with ssh-keygen · Download PNG

Lesson: How to Set Up Passwordless SSH Between Linux Servers

Revision card: Sort with ls -lt and ls -ltr. You want the newest log or the file you just changed. -t sorts by time (newest first). -r reverses, so the newest is at the bottom. Use -ltr in long folders so the newest is near your prompt. Newest logs:
Revision card: Sort with ls -lt and ls -ltr · Download PNG

Lesson: How to Set Up Passwordless SSH Between Linux Servers

Revision card: Ports to know by number. Security groups and errors talk in port numbers. A port is a door number on a server for one service. Open only the ports you need in the SG. Common ports:
Revision card: Ports to know by number · Download PNG

Lesson: How to Set Up Passwordless SSH Between Linux Servers

Interview card: The disk is full. How do you find what filled it?. df -h confirms which disk; du -sh on folders finds the big one. Drill down folder by folder. Commands:
Interview card: The disk is full. How do you find what filled it? · Download PNG

Lesson: How to Set Up Passwordless SSH Between Linux Servers

Interview card: Why is passwordless SSH trust one way?. Only the server holding your public key trusts your private key. B trusting A says nothing about A trusting B. 4 servers all ways = 4 × 3 = 12 paths.
Interview card: Why is passwordless SSH trust one way? · Download PNG

Lesson: How to Set Up Passwordless SSH Between Linux Servers

Interview card: Passwordless SSH still asks for a password. What do you check?. Permissions: ~/.ssh must be 700 and authorized_keys 600, owned by the user. SSH ignores keys in files others can write. Fix:
Interview card: Passwordless SSH still asks for a password. What do you check? · Download PNG

Lesson: How to Set Up Passwordless SSH Between Linux Servers

Interview card: How do you move an EC2 to another Region?. Create an AMI, copy it to the new Region, launch from it there. AMIs are regional; a copy makes it available in the target. ap-south-1 › Copy AMI › us-east-1 › Launch.
Interview card: How do you move an EC2 to another Region? · Download PNG

Lesson: How to Set Up Passwordless SSH Between Linux Servers

How to Create a Registration Form in PHP and MySQL

Revision card: GET vs POST in forms. A sign-up form sends passwords. They must not appear in the URL. GET puts data in the URL. POST sends it in the request body. Use method="post" on forms that send or change data. Form:
Revision card: GET vs POST in forms · Download PNG

Lesson: How to Create a Registration Form in PHP and MySQL

Revision card: $_POST in PHP. PHP must read what the user typed in the form. $_POST is an array of submitted values, keyed by each input's name. Give every input a name, then read $_POST['name']. Input and PHP:
Revision card: $_POST in PHP · Download PNG

Lesson: How to Create a Registration Form in PHP and MySQL

Revision card: Prepared statements. Gluing user input into SQL lets attackers run their own SQL (SQL injection). A prepared statement sends SQL with ? placeholders, and the values separately. prepare, bind_param, execute. SQL:
Revision card: Prepared statements · Download PNG

Lesson: How to Create a Registration Form in PHP and MySQL

Revision card: Store passwords with password_hash. If the database leaks, plain passwords are stolen at once. password_hash makes a one-way hash. password_verify checks a login against it. Hash on sign-up, verify on login. Never store the plain text. PHP:
Revision card: Store passwords with password_hash · Download PNG

Lesson: How to Create a Registration Form in PHP and MySQL

Comparison: GET vs POST. GET: Asks the server for something; data rides in the URL. POST: Sends data to the server in the request body.
Comparison: GET vs POST · Download PNG

Lesson: How to Create a Registration Form in PHP and MySQL

Interview card: Why should a login form use POST, not GET?. GET puts the password in the URL, browser history and server logs. POST sends it in the body, and with HTTPS it is encrypted. GET leak: /login.php?pass=Secret123.
Interview card: Why should a login form use POST, not GET? · Download PNG

Lesson: How to Create a Registration Form in PHP and MySQL

Interview card: What is SQL injection and how do you prevent it?. Input that changes your SQL, like ' OR 1=1 --. It can log in without a password or dump the table. Use prepared statements with ? placeholders.
Interview card: What is SQL injection and how do you prevent it? · Download PNG

Lesson: How to Create a Registration Form in PHP and MySQL

Interview card: Why hash passwords instead of encrypting them?. A hash cannot be reversed; encryption can be decrypted with the key. Even you never need to read the password, only check it. PHP:
Interview card: Why hash passwords instead of encrypting them? · Download PNG

Lesson: How to Create a Registration Form in PHP and MySQL

Interview card: A form submits but nothing is saved. What do you check?. action and method, input names, DB credentials, php-mysqlnd, and the PHP error log. Each link in the chain can fail silently. Log:
Interview card: A form submits but nothing is saved. What do you check? · Download PNG

Lesson: How to Create a Registration Form in PHP and MySQL

Public vs Private IP Address Explained

Revision card: Public vs private IP. There are not enough IPv4 addresses for every device to have a public one. Public IPs work on the internet. Private IPs work only inside a network and are reused everywhere. Your router uses NAT: many private devices share one public IP. Laptop 192.168.1.5 goes out as router 49.36.10.4.
Revision card: Public vs private IP · Download PNG

Lesson: Public vs Private IP Address Explained

Revision card: Private IP ranges. VPCs and home networks must use addresses that never clash with the internet. RFC 1918 reserves three private ranges. Pick one for your VPC CIDR; 10.0.0.0/16 is common. The three:
Revision card: Private IP ranges · Download PNG

Lesson: Public vs Private IP Address Explained

Revision card: Loopback: 127.0.0.1. You need to test a server from itself without any network. 127.0.0.1 (localhost) always means "this machine". curl localhost on the server checks the web server, skipping SGs. Test:
Revision card: Loopback: 127.0.0.1 · Download PNG

Lesson: Public vs Private IP Address Explained

Revision card: IP classes and CIDR. Networks need a way to say which part of an IP is the network. Old classes: A /8, B /16, C /24. CIDR lets any prefix like /20. Hosts = 2^(32 - prefix). /24 = 256 IPs; /20 = 4096.
Revision card: IP classes and CIDR · Download PNG

Lesson: Public vs Private IP Address Explained

Comparison: Public IP vs Private IP. Public IP: A unique address on the internet. Private IP: An address that works only inside one network.
Comparison: Public IP vs Private IP · Download PNG

Lesson: Public vs Private IP Address Explained

Interview card: How do many home devices share one public IP?. The router does NAT: it swaps private IPs for its public IP and tracks each connection. This is why IPv4 has not run out yet. 3 phones + laptop › one IP 49.36.10.4.
Interview card: How do many home devices share one public IP? · Download PNG

Lesson: Public vs Private IP Address Explained

Interview card: What is 127.0.0.1?. The loopback address: it always means this same machine. Traffic never leaves the computer, so it tests services alone. curl localhost on EC2 bypasses the SG.
Interview card: What is 127.0.0.1? · Download PNG

Lesson: Public vs Private IP Address Explained

Interview card: How many hosts fit in a /26 network?. 64 addresses: 2^(32-26). Usable is fewer: 62 normally, 59 in an AWS subnet. 10.0.0.0/26 = 10.0.0.0 to 10.0.0.63.
Interview card: How many hosts fit in a /26 network? · Download PNG

Lesson: Public vs Private IP Address Explained

Interview card: Is free public Wi-Fi safe for logging in?. Only on HTTPS sites; HTTP traffic can be read by others on the network. HTTPS encrypts between you and the site. Check the lock icon and https:// before typing a password.
Interview card: Is free public Wi-Fi safe for logging in? · Download PNG

Lesson: Public vs Private IP Address Explained

How to Recover Data from a Broken EC2 Instance

Revision card: Recover data by swapping the root volume. A server will not boot, but its data must be saved. EBS volumes can be detached and attached to another server in the same AZ. Easier: stop, detach, attach to a helper as a second disk, mount, copy. On the helper:
Revision card: Recover data by swapping the root volume · Download PNG

Lesson: How to Recover Data from a Broken EC2 Instance

Revision card: Delete on termination. Terminating a server can delete its disk too. A setting per volume: root is Yes by default, extra data volumes are No. Check the instance Storage tab before terminate. Root vol: Yes (deleted). /data vol: No (kept, state Available).
Revision card: Delete on termination · Download PNG

Lesson: How to Recover Data from a Broken EC2 Instance

Revision card: From a snapshot: two roads. You cannot launch a server directly from a snapshot. A snapshot is a backup of one volume. Make a volume from it, or make an AMI from it. Snapshot › Actions › Create volume (any AZ) or Create image. Restore data in 1b: snap-0ab › new vol in ap-south-1b.
Revision card: From a snapshot: two roads · Download PNG

Lesson: How to Recover Data from a Broken EC2 Instance

Interview card: Can you launch an EC2 directly from a snapshot?. No. Create an AMI from the snapshot, or a volume from it. A snapshot is one disk; an AMI adds boot and launch settings. Snapshot › Create image from snapshot › Launch.
Interview card: Can you launch an EC2 directly from a snapshot? · Download PNG

Lesson: How to Recover Data from a Broken EC2 Instance

Interview card: A server will not boot. How do you get its data?. Stop it, detach the root volume, attach it to a helper in the same AZ, mount, copy. EBS is independent of the instance. Helper:
Interview card: A server will not boot. How do you get its data? · Download PNG

Lesson: How to Recover Data from a Broken EC2 Instance

Interview card: What do In-use and Available mean for an EBS volume?. In-use = attached to an instance. Available = detached, ready to attach. Available volumes still cost money. Delete leftover Available volumes after labs.
Interview card: What do In-use and Available mean for an EBS volume? · Download PNG

Lesson: How to Recover Data from a Broken EC2 Instance

AWS IAM User, Root User and MFA: Launch Your First EC2 Instance

Revision card: Root user vs IAM user. Root can do everything, including closing the account. A leak is a disaster. Root = the email that created the account. IAM users = named logins with chosen permissions. Use root once to make an admin IAM user, add MFA, then lock root away. Sign in as IAM user with account ID 123456789012.
Revision card: Root user vs IAM user · Download PNG

Lesson: AWS IAM User, Root User and MFA: Launch Your First EC2 Instance

Revision card: Least privilege. Extra permissions turn small mistakes into big outages. Give each person only what their job needs, nothing more. Use IAM groups with policies; one user per person. Tester: EC2 read-only. Admin: AdministratorAccess.
Revision card: Least privilege · Download PNG

Lesson: AWS IAM User, Root User and MFA: Launch Your First EC2 Instance

Revision card: MFA on AWS. A stolen password alone should not open your account. MFA = a second proof: a passkey, security key or authenticator app code. Security credentials › Assign MFA device. Do it for root first. Login: password + 6-digit code 482913.
Revision card: MFA on AWS · Download PNG

Lesson: AWS IAM User, Root User and MFA: Launch Your First EC2 Instance

Revision card: Set a budget alert. AWS bills later. A forgotten server can surprise you at month end. A budget emails you when spend crosses a limit. Billing › Budgets › Create › monthly cost budget. Budget $5, alert at 80% = $4.
Revision card: Set a budget alert · Download PNG

Lesson: AWS IAM User, Root User and MFA: Launch Your First EC2 Instance

Comparison: Root user vs IAM user. Root user: The email login that created the AWS account. IAM user: A named login created inside the account.
Comparison: Root user vs IAM user · Download PNG

Lesson: AWS IAM User, Root User and MFA: Launch Your First EC2 Instance

Interview card: Why should you not use the root user every day?. Root has unlimited power and cannot be restricted by IAM policies. A leak or mistake can delete everything or close the account. Daily work: admin IAM user with MFA.
Interview card: Why should you not use the root user every day? · Download PNG

Lesson: AWS IAM User, Root User and MFA: Launch Your First EC2 Instance

Interview card: Why must 1000 employees never share one login?. No accountability: you cannot tell who did what. Removing one person means changing the password for all. One IAM user each; CloudTrail shows who did it.
Interview card: Why must 1000 employees never share one login? · Download PNG

Lesson: AWS IAM User, Root User and MFA: Launch Your First EC2 Instance

Interview card: You lost your MFA device. How do you get back in?. Use another registered MFA device, or the root recovery with email and phone. AWS verifies you through the account email and phone. Register 2 MFA devices for root to avoid this.
Interview card: You lost your MFA device. How do you get back in? · Download PNG

Lesson: AWS IAM User, Root User and MFA: Launch Your First EC2 Instance

Interview card: How do you avoid a surprise AWS bill?. Set a budget alert and delete or stop resources after use. AWS bills after use, so you learn of costs late. Monthly budget $5 with email at 80%.
Interview card: How do you avoid a surprise AWS bill? · Download PNG

Lesson: AWS IAM User, Root User and MFA: Launch Your First EC2 Instance

ALB vs NLB vs Gateway Load Balancer in AWS

Revision card: Route 53 routing policies. Users all over the world should reach the best Region for them. A routing policy decides which answer DNS gives: latency, geolocation, geoproximity, weighted, IP-based. One load balancer per Region; Route 53 records point to each. Weighted: 90% old version, 10% new.
Revision card: Route 53 routing policies · Download PNG

Lesson: ALB vs NLB vs Gateway Load Balancer in AWS

Revision card: The OSI layers. "Layer 4" and "layer 7" decide which load balancer you choose. 7 layers: 7 Application, 6 Presentation, 5 Session, 4 Transport, 3 Network, 2 Data link, 1 Physical. Map each tool to its layer. HTTP = 7, TCP/UDP = 4, IP = 3.
Revision card: The OSI layers · Download PNG

Lesson: ALB vs NLB vs Gateway Load Balancer in AWS

Revision card: The four load balancer types. Picking the wrong type costs money or breaks the app. ALB (layer 7, HTTP), NLB (layer 4, TCP/UDP), Gateway LB (firewalls), Classic (old). Web apps: ALB. Games and very high speed: NLB. Security appliances: GWLB. /api to api-tg needs ALB path rules.
Revision card: The four load balancer types · Download PNG

Lesson: ALB vs NLB vs Gateway Load Balancer in AWS

Interview card: Latency vs geolocation routing in Route 53?. Latency picks the fastest Region; geolocation picks by the user's country. Speed vs rules like data laws or language. India users › Mumbai by geolocation even if Singapore is faster.
Interview card: Latency vs geolocation routing in Route 53? · Download PNG

Lesson: ALB vs NLB vs Gateway Load Balancer in AWS

Interview card: How do you send 10% of users to a new version with DNS?. Route 53 weighted records: 90 to old, 10 to new. Test a release on few users before all. Weights 90 and 10 on two records with the same name.
Interview card: How do you send 10% of users to a new version with DNS? · Download PNG

Lesson: ALB vs NLB vs Gateway Load Balancer in AWS

Interview card: What does a layer 7 load balancer see that layer 4 does not?. URL paths, hosts, headers and cookies. So it can route /api and /images to different servers. Layer 4 sees only IPs and ports.
Interview card: What does a layer 7 load balancer see that layer 4 does not? · Download PNG

Lesson: ALB vs NLB vs Gateway Load Balancer in AWS

How to Use scp to Copy Files to EC2 (Upload and Download)

Revision card: Copy files with scp. wget only downloads from URLs. Your own files are on your laptop. scp copies files over SSH, encrypted. The colon marks the server side. Run it on the laptop, not inside SSH: scp -i KEY SOURCE DEST. Upload:
Revision card: Copy files with scp · Download PNG

Lesson: How to Use scp to Copy Files to EC2 (Upload and Download)

Revision card: Download from the server. Backups and logs must come back to your laptop. Swap source and destination: server first, local path last. . means the current laptop folder. Download:
Revision card: Download from the server · Download PNG

Lesson: How to Use scp to Copy Files to EC2 (Upload and Download)

Revision card: Upload a site as a zip. Copying 500 small files one by one is slow. Zip the folder, upload one file, unzip on the server. Unzip in /var/www/html; if you get html/html, move files up. On the server:
Revision card: Upload a site as a zip · Download PNG

Lesson: How to Use scp to Copy Files to EC2 (Upload and Download)

Revision card: Back up a live website. Before changes, you need a way back. A backup is a dated zip of the web folder, copied off the server. zip on the server, then scp it to your laptop. Zip:
Revision card: Back up a live website · Download PNG

Lesson: How to Use scp to Copy Files to EC2 (Upload and Download)

Comparison: wget vs scp. wget: Downloads a file from a URL onto the server. scp: Copies files between your laptop and a server over SSH.
Comparison: wget vs scp · Download PNG

Lesson: How to Use scp to Copy Files to EC2 (Upload and Download)

Interview card: What does the colon mean in an scp command?. It marks the remote side: user@host:path. Without it scp makes a local file named after the host. Right:
Interview card: What does the colon mean in an scp command? · Download PNG

Lesson: How to Use scp to Copy Files to EC2 (Upload and Download)

Interview card: Why run scp on the laptop, not inside SSH?. The laptop file lives on the laptop; the server cannot see it. Inside SSH, paths point to the server. Open a second terminal on the laptop for scp.
Interview card: Why run scp on the laptop, not inside SSH? · Download PNG

Lesson: How to Use scp to Copy Files to EC2 (Upload and Download)

Interview card: A PDF with spaces in its name gives 404. Why?. Spaces become %20 in URLs, and typos creep in. Use names without spaces: lowercase and hyphens. "My Notes.pdf" › my-notes.pdf.
Interview card: A PDF with spaces in its name gives 404. Why? · Download PNG

Lesson: How to Use scp to Copy Files to EC2 (Upload and Download)

Interview card: How do you upload a whole folder with scp?. Use scp -r, or zip it first and send one file. One zip is faster than hundreds of small files. Folder:
Interview card: How do you upload a whole folder with scp? · Download PNG

Lesson: How to Use scp to Copy Files to EC2 (Upload and Download)

Security Group vs NACL in AWS

Revision card: What a VPC costs. Students fear VPC charges and avoid practising. VPC, subnets, route tables, IGW, SGs and NACLs are free. NAT gateways and public IPv4 cost money. Delete NAT gateways and release IPs after labs. NAT ≈ $0.045 per hour ≈ $32 per month.
Revision card: What a VPC costs · Download PNG

Lesson: Security Group vs NACL in AWS

Revision card: NACL rules and order. A NACL can block a whole subnet; one wrong rule cuts off servers. Rules are checked from the lowest number up; the first match wins. * denies the rest. Number in gaps (100, 200) so you can insert rules later. Rules:
Revision card: NACL rules and order · Download PNG

Lesson: Security Group vs NACL in AWS

Revision card: Ephemeral ports. A NACL that allows port 80 in can still break the site. Replies go back to a random high port on the client (1024-65535). NACLs are stateless. Allow outbound 1024-65535 in the NACL. Request to :80 from :51234; reply goes to :51234.
Revision card: Ephemeral ports · Download PNG

Lesson: Security Group vs NACL in AWS

Interview card: Trace a request from the internet to a web server in a VPC.. IGW › route table › NACL (subnet) › security group (instance) › Nginx. Each layer can block; debug in this order. Timeout? Check route, NACL, SG, then nginx status.
Interview card: Trace a request from the internet to a web server in a VPC. · Download PNG

Lesson: Security Group vs NACL in AWS

Interview card: Why build a custom VPC instead of using the default VPC?. The default VPC has only public subnets; a custom VPC lets you add private ones. Databases and app servers should be private. Custom 10.0.0.0/16: 1 public, 2 private subnets.
Interview card: Why build a custom VPC instead of using the default VPC? · Download PNG

Lesson: Security Group vs NACL in AWS

Interview card: A NACL has 100 ALLOW 80 and 90 DENY 80. Is port 80 open?. No. Rule 90 is checked first and matches, so it denies. NACLs use the lowest matching number. Delete 90 or renumber.
Interview card: A NACL has 100 ALLOW 80 and 90 DENY 80. Is port 80 open? · Download PNG

Lesson: Security Group vs NACL in AWS

AWS chapter cards: revision, comparison and interview (6)

SQL ALTER TABLE Command with Examples

Revision card: Change a table with ALTER TABLE. Apps grow: you need a new column or a bigger one without losing data. ALTER TABLE changes structure: ADD, MODIFY, DROP, RENAME COLUMN, RENAME TO. Write the table name, the action and the column definition. Add phone:
Revision card: Change a table with ALTER TABLE · Download PNG

Lesson: SQL ALTER TABLE Command with Examples

Revision card: Safe update mode. UPDATE without WHERE changes every row in one go. Safe mode blocks UPDATE and DELETE that have no key in WHERE (ERROR 1175). Check with SELECT @@SQL_SAFE_UPDATES; turn on with 1. Turn on:
Revision card: Safe update mode · Download PNG

Lesson: SQL ALTER TABLE Command with Examples

Revision card: NOT NULL and DEFAULT. Empty required fields, like a missing email, break the app later. NOT NULL forbids empty values (ERROR 1364). DEFAULT fills a value when none is given. Set them in CREATE or with MODIFY COLUMN. Column:
Revision card: NOT NULL and DEFAULT · Download PNG

Lesson: SQL ALTER TABLE Command with Examples

Revision card: AUTO_INCREMENT ids. Every row needs a unique id, and typing them by hand causes duplicates. AUTO_INCREMENT gives the next number automatically. Failed inserts leave gaps. Use it on the primary key; skip the id in INSERT. Definition:
Revision card: AUTO_INCREMENT ids · Download PNG

Lesson: SQL ALTER TABLE Command with Examples

Interview card: Why store a phone number as VARCHAR, not INT?. INT drops leading zeros and + signs, and its max is about 2.1 billion. You never do maths on phone numbers. +91 09876543210 fits VARCHAR(15).
Interview card: Why store a phone number as VARCHAR, not INT? · Download PNG

Lesson: SQL ALTER TABLE Command with Examples

Interview card: Why do AUTO_INCREMENT ids have gaps?. Failed inserts and deletes use up numbers that are never reused. Ids must be unique, not continuous. Insert 3 fails with ERROR 1062; the next row gets 4.
Interview card: Why do AUTO_INCREMENT ids have gaps? · Download PNG

Lesson: SQL ALTER TABLE Command with Examples

Interview card: What is ERROR 1175 and how do you handle it?. Safe update mode blocked an UPDATE/DELETE without a key in WHERE. It protects against changing every row by mistake. Add a key condition:
Interview card: What is ERROR 1175 and how do you handle it? · Download PNG

Lesson: SQL ALTER TABLE Command with Examples

How to Create a Database and Table in MariaDB

Revision card: Database, table, row, column. Apps need data stored in a clear, searchable shape. A database holds tables. A table has columns (fields) and rows (records). CREATE DATABASE, USE, then CREATE TABLE. Start:
Revision card: Database, table, row, column · Download PNG

Lesson: How to Create a Database and Table in MariaDB

Revision card: SQL data types. The wrong type loses data, like a phone number losing its leading 0. INT whole numbers, VARCHAR text, DATE, TIME, FLOAT decimals, BOOLEAN true/false. Pick by how the value is used, not how it looks. Phone is text:
Revision card: SQL data types · Download PNG

Lesson: How to Create a Database and Table in MariaDB

Revision card: CREATE TABLE and DESC. Data needs a table with named, typed columns first. CREATE TABLE defines columns. DESC shows the structure. End with ;. Multi-line is fine; -> means continue. Table:
Revision card: CREATE TABLE and DESC · Download PNG

Lesson: How to Create a Database and Table in MariaDB

Revision card: CRUD in SQL. Every app does four things with data. Create = INSERT, Read = SELECT, Update = UPDATE, Delete = DELETE. Always use WHERE with UPDATE and DELETE. Insert many:
Revision card: CRUD in SQL · Download PNG

Lesson: How to Create a Database and Table in MariaDB

Comparison: INT vs VARCHAR. INT: A whole number you can do maths with. VARCHAR: Text up to a set length.
Comparison: INT vs VARCHAR · Download PNG

Lesson: How to Create a Database and Table in MariaDB

Interview card: What is CRUD?. Create, Read, Update, Delete: INSERT, SELECT, UPDATE, DELETE. Every data app is built from these four. Sign-up = INSERT; profile = SELECT; edit = UPDATE; close = DELETE.
Interview card: What is CRUD? · Download PNG

Lesson: How to Create a Database and Table in MariaDB

Interview card: Why avoid SELECT * in apps?. It fetches every column, even big or secret ones. Naming columns is faster and safer if the table changes. Better:
Interview card: Why avoid SELECT * in apps? · Download PNG

Lesson: How to Create a Database and Table in MariaDB

Interview card: MariaDB says "Can't connect through socket". What does it mean?. The MariaDB server is not running. The client looks for the server's socket file and finds none. Fix:
Interview card: MariaDB says "Can't connect through socket". What does it mean? · Download PNG

Lesson: How to Create a Database and Table in MariaDB

SQL Database Design and Foreign Keys with Examples

Revision card: What is database design?. A bad design gives repeated data, wrong counts and slow queries. Deciding which tables exist and which column goes where. Walk the user journey; many values per row means a new table. Flipkart: users, products, orders, order_items.
Revision card: What is database design? · Download PNG

Lesson: SQL Database Design and Foreign Keys with Examples

Revision card: Why a likes table, not a counter. A like_count column cannot tell who liked, and lets one user like twice. A likes table stores one row per user per reel. Count with COUNT(*); add UNIQUE(user_id, reel_id). Count:
Revision card: Why a likes table, not a counter · Download PNG

Lesson: SQL Database Design and Foreign Keys with Examples

Revision card: Foreign keys. Orders for users who do not exist (orphan rows) corrupt reports. A foreign key makes a child column point to a parent's primary key. Add FOREIGN KEY ... REFERENCES. DESC shows MUL on the column. In orders:
Revision card: Foreign keys · Download PNG

Lesson: SQL Database Design and Foreign Keys with Examples

Revision card: Soft delete. Deleting a user breaks their old orders and loses history. Soft delete marks a row inactive instead of removing it. Add is_active; queries filter on it. Deactivate:
Revision card: Soft delete · Download PNG

Lesson: SQL Database Design and Foreign Keys with Examples

Comparison: Hard delete vs Soft delete. Hard delete: DELETE removes the row for good. Soft delete: An is_active flag marks the row as gone.
Comparison: Hard delete vs Soft delete · Download PNG

Lesson: SQL Database Design and Foreign Keys with Examples

Interview card: What is a foreign key and what does it prevent?. A column that must match a primary key in another table. It prevents orphan rows like orders for deleted users. orders.user_id REFERENCES users.id.
Interview card: What is a foreign key and what does it prevent? · Download PNG

Lesson: SQL Database Design and Foreign Keys with Examples

Interview card: What are ERROR 1452 and ERROR 1451?. 1452: inserting a child with no parent. 1451: deleting a parent that has children. Both are the foreign key protecting your data. Order for user_id 99 that does not exist › 1452.
Interview card: What are ERROR 1452 and ERROR 1451? · Download PNG

Lesson: SQL Database Design and Foreign Keys with Examples

Interview card: Why are user actions like "liked" not columns in the users table?. One user does many actions; each needs its own row in its own table. Columns hold one value per row. likes(user_id, reel_id), orders(user_id, total).
Interview card: Why are user actions like "liked" not columns in the users table? · Download PNG

Lesson: SQL Database Design and Foreign Keys with Examples

SQL SELECT Query Examples for Beginners

Revision card: Filter rows with WHERE. Tables have millions of rows; you want only the matching ones. WHERE keeps rows that pass a test: =, <>, , IN, BETWEEN, LIKE, IS NULL. Join tests with AND / OR; % in LIKE means any text. Query:
Revision card: Filter rows with WHERE · Download PNG

Lesson: SQL SELECT Query Examples for Beginners

Revision card: ORDER BY, LIMIT and OFFSET. You need the top 10 or page 2 of results. ORDER BY sorts (ASC default, DESC). LIMIT caps rows. OFFSET skips rows. Sort first, then limit. Top 3 salaries:
Revision card: ORDER BY, LIMIT and OFFSET · Download PNG

Lesson: SQL SELECT Query Examples for Beginners

Revision card: Aggregate functions. Reports need totals and averages, not raw rows. MAX, MIN, SUM, AVG and COUNT turn many rows into one number. Use DECIMAL(10,2) for money so sums are exact. Average salary:
Revision card: Aggregate functions · Download PNG

Lesson: SQL SELECT Query Examples for Beginners

Revision card: GROUP BY and HAVING. You want one total per city or department. GROUP BY makes groups; HAVING filters groups after aggregation. WHERE filters rows before grouping; HAVING after. Cities with more than 5 staff:
Revision card: GROUP BY and HAVING · Download PNG

Lesson: SQL SELECT Query Examples for Beginners

Comparison: WHERE vs HAVING. WHERE: Filters single rows. HAVING: Filters groups made by GROUP BY.
Comparison: WHERE vs HAVING · Download PNG

Lesson: SQL SELECT Query Examples for Beginners

Interview card: WHERE vs HAVING: what is the difference?. WHERE filters rows before grouping; HAVING filters groups after. Aggregates like COUNT(*) exist only after grouping. WHERE salary > 0 … GROUP BY city HAVING COUNT(*) > 5.
Interview card: WHERE vs HAVING: what is the difference? · Download PNG

Lesson: SQL SELECT Query Examples for Beginners

Interview card: How do you find the second-highest salary?. Find the max below the overall max with a subquery. It handles ties at the top correctly. Query:
Interview card: How do you find the second-highest salary? · Download PNG

Lesson: SQL SELECT Query Examples for Beginners

Interview card: Does BETWEEN include both ends?. Yes. BETWEEN 10 AND 20 includes 10 and 20. Off-by-one errors come from assuming it does not. Same as:
Interview card: Does BETWEEN include both ends? · Download PNG

Lesson: SQL SELECT Query Examples for Beginners

Install Apache on Ubuntu EC2: Change Port and Web Folder

Revision card: apt-get on Ubuntu. Ubuntu does not use yum. Installs fail if the package list is old. apt-get is Ubuntu's package manager. update refreshes the list of packages. Always update first, then install with -y. Commands:
Revision card: apt-get on Ubuntu · Download PNG

Lesson: Install Apache on Ubuntu EC2: Change Port and Web Folder

Revision card: Ubuntu login user: ubuntu. Using ec2-user on Ubuntu gives Permission denied (publickey). Each AMI has its own default user. Ubuntu's is ubuntu. Use it in ssh; check key, IP and SG if it still fails. Login:
Revision card: Ubuntu login user: ubuntu · Download PNG

Lesson: Install Apache on Ubuntu EC2: Change Port and Web Folder

Revision card: Apache httpd.conf settings. Changing Apache's folder, port or first page needs its settings file. DocumentRoot = folder, Listen = port, DirectoryIndex = first page. Edit /etc/httpd/conf/httpd.conf, restart httpd, open the port in the SG. Lines:
Revision card: Apache httpd.conf settings · Download PNG

Lesson: Install Apache on Ubuntu EC2: Change Port and Web Folder

Revision card: Root disk and extra disks. The 8 GB root disk fills fast with logs and uploads. The root disk holds the OS. Extra EBS disks hold data and can be moved. lsblk lists disks; df -h shows how full they are. lsblk:
Revision card: Root disk and extra disks · Download PNG

Lesson: Install Apache on Ubuntu EC2: Change Port and Web Folder

Interview card: What causes Permission denied (publickey)?. Wrong user, wrong key, wrong key permissions, or wrong server. The server rejected the key you offered. Ubuntu needs ubuntu@, not ec2-user@.
Interview card: What causes Permission denied (publickey)? · Download PNG

Lesson: Install Apache on Ubuntu EC2: Change Port and Web Folder

Interview card: Why run apt-get update before installing?. It refreshes the list of available packages and versions. An old list points to files that no longer exist (404 fetch errors). Commands:
Interview card: Why run apt-get update before installing? · Download PNG

Lesson: Install Apache on Ubuntu EC2: Change Port and Web Folder

Interview card: Why use one key pair per app?. A leaked key then opens only one app's servers. It limits damage and makes rotating keys easy. shop.pem for shop servers, blog.pem for blog.
Interview card: Why use one key pair per app? · Download PNG

Lesson: Install Apache on Ubuntu EC2: Change Port and Web Folder

What Is AWS VPC and How to Calculate CIDR IP Ranges

Revision card: Virtual server and hypervisor. One big physical server is wasted if it runs only one small app. A hypervisor splits one host into many virtual servers, each with its own OS. Every EC2 instance is a virtual server on an AWS host. One host with 96 vCPU runs many t3.micro instances.
Revision card: Virtual server and hypervisor · Download PNG

Lesson: What Is AWS VPC and How to Calculate CIDR IP Ranges

Revision card: CIDR: fixed and free bits. You must know how many IPs a VPC or subnet gets before creating it. /N = N fixed bits out of 32. Free bits = 32 - N. IPs = 2^(32-N). VPC sizes go from /16 (largest) to /28 (smallest). /22 = 2^10 = 1024 IPs: 10.0.0.0 to 10.0.3.255.
Revision card: CIDR: fixed and free bits · Download PNG

Lesson: What Is AWS VPC and How to Calculate CIDR IP Ranges

Interview card: What is a VPC, and can it span Regions?. Your own private network in AWS. It lives in one Region and spans its AZs. It isolates your servers from other customers. VPC 10.0.0.0/16 in ap-south-1, subnets in 1a and 1b.
Interview card: What is a VPC, and can it span Regions? · Download PNG

Lesson: What Is AWS VPC and How to Calculate CIDR IP Ranges

Interview card: How many IPs are in 10.0.0.0/20, and what is the last one?. 4096 IPs: 2^(32-20). Last is 10.0.15.255. 12 free bits = 16 blocks of 256 in the third number. Next subnet starts at 10.0.16.0.
Interview card: How many IPs are in 10.0.0.0/20, and what is the last one? · Download PNG

Lesson: What Is AWS VPC and How to Calculate CIDR IP Ranges

Interview card: What are the smallest and largest VPC CIDR sizes?. Largest /16 (65,536 IPs), smallest /28 (16 IPs). AWS limits sizes to keep routing manageable. Choose /16 for room to grow.
Interview card: What are the smallest and largest VPC CIDR sizes? · Download PNG

Lesson: What Is AWS VPC and How to Calculate CIDR IP Ranges

What Is VPC Peering in AWS and How to Set It Up

Revision card: What is VPC peering?. Two VPCs cannot talk by default, even in the same account. A peering connection links two VPCs privately over AWS's network. Request, accept (within 7 days), add routes on both sides, allow in SGs. Route in VPC A:
Revision card: What is VPC peering? · Download PNG

Lesson: What Is VPC Peering in AWS and How to Set It Up

Revision card: Peering rule: no overlapping CIDRs. If both VPCs use 10.0.0.0/16, a packet to 10.0.1.5 has two possible homes. Peering is refused when the CIDRs overlap. Plan unique CIDRs per VPC from day one. OK pair:
Revision card: Peering rule: no overlapping CIDRs · Download PNG

Lesson: What Is VPC Peering in AWS and How to Set It Up

Revision card: Peering is not transitive. People assume A–B and B–C means A can reach C. Each pair needs its own peering. Traffic never passes through a middle VPC. Create A–C too, or use a Transit Gateway for many VPCs. 3 VPCs fully connected = 3 peerings.
Revision card: Peering is not transitive · Download PNG

Lesson: What Is VPC Peering in AWS and How to Set It Up

Comparison: VPC peering vs Transit Gateway. VPC peering: A direct private link between two VPCs. Transit Gateway: A central hub that many VPCs attach to.
Comparison: VPC peering vs Transit Gateway · Download PNG

Lesson: What Is VPC Peering in AWS and How to Set It Up

Interview card: A is peered with B, B with C. Can A reach C?. No. VPC peering is not transitive. Traffic cannot pass through B. Add A–C peering or use Transit Gateway.
Interview card: A is peered with B, B with C. Can A reach C? · Download PNG

Lesson: What Is VPC Peering in AWS and How to Set It Up

Interview card: Peering is active but ping fails. What do you check?. Routes on BOTH sides and SG rules allowing the other CIDR. Peering only connects; routes and SGs decide traffic. A: 10.1.0.0/16 › pcx; B: 10.0.0.0/16 › pcx; SG allow ICMP.
Interview card: Peering is active but ping fails. What do you check? · Download PNG

Lesson: What Is VPC Peering in AWS and How to Set It Up

Interview card: Why accept only peering requests you expect?. Accepting connects a stranger's network to yours. With routes added, they could reach your servers. Check requester account ID and CIDR first.
Interview card: Why accept only peering requests you expect? · Download PNG

Lesson: What Is VPC Peering in AWS and How to Set It Up

How to Fix WordPress After the Server IP Changes

Revision card: Back up with mysqldump. Posts and users live in the database, not in files. Losing it loses the site. mysqldump writes the database as SQL statements into a .sql file. Dump with >, copy it off the server with scp. Dump:
Revision card: Back up with mysqldump · Download PNG

Lesson: How to Fix WordPress After the Server IP Changes

Revision card: Restore a database. A backup is useful only if you can restore it. Create the empty database, then feed the .sql file with <. ERROR 1049 means the database does not exist yet: create it first. Restore:
Revision card: Restore a database · Download PNG

Lesson: How to Fix WordPress After the Server IP Changes

Revision card: Change the site address: wp search-replace. After an IP change, WordPress still links to the old address. WP-CLI search-replace updates every URL safely, including serialized settings. Set siteurl and home, then run search-replace. Command:
Revision card: Change the site address: wp search-replace · Download PNG

Lesson: How to Fix WordPress After the Server IP Changes

Revision card: Theme install and Connection Information. Installing a theme asks for FTP details you do not have. WordPress asks when PHP cannot write to its folder. The real fix is ownership. Give the folder to the php-fpm user; no FTP needed. Fix:
Revision card: Theme install and Connection Information · Download PNG

Lesson: How to Fix WordPress After the Server IP Changes

Comparison: mysqldump > file vs mysql < file. mysqldump > file: Writes the database out as an SQL file. mysql < file: Reads an SQL file into a database.
Comparison: mysqldump > file vs mysql < file · Download PNG

Lesson: How to Fix WordPress After the Server IP Changes

Interview card: Why does WordPress break after a stop and start?. The public IP changed, and the old IP is saved in siteurl and home. All links and CSS point to the old IP. Prevent with an Elastic IP or domain; fix with wp search-replace.
Interview card: Why does WordPress break after a stop and start? · Download PNG

Lesson: How to Fix WordPress After the Server IP Changes

Interview card: Why not just find-and-replace the IP in the .sql dump?. Serialized settings store string lengths; a new length breaks them. Widgets and theme settings vanish. Use WP-CLI, which fixes lengths.
Interview card: Why not just find-and-replace the IP in the .sql dump? · Download PNG

Lesson: How to Fix WordPress After the Server IP Changes

Interview card: Why is SFTP safer than FTP?. SFTP runs over SSH and encrypts everything; FTP sends passwords in plain text. Anyone on the path can read FTP logins. SFTP uses port 22 and your key.
Interview card: Why is SFTP safer than FTP? · Download PNG

Lesson: How to Fix WordPress After the Server IP Changes

Interview card: How do you back up a WordPress site fully?. Dump the database and zip the WordPress folder, then copy both off the server. Posts are in the DB; themes and uploads are files. mysqldump + zip -r + scp.
Interview card: How do you back up a WordPress site fully? · Download PNG

Lesson: How to Fix WordPress After the Server IP Changes

Amazon S3 cards: revision, comparison and interview

What Is Amazon S3? S3 vs EBS vs EFS, Storage Classes and Pricing Explained

Revision card: What is Amazon S3?. S3 is object storage. You keep files in buckets and reach them over HTTPS. No disk to size. You pay only for what you store and request. Any number of servers can read the same object at once. Upload a photo with the CLI.
Revision card: What is Amazon S3? · Download PNG

Lesson: What Is Amazon S3? S3 vs EBS vs EFS, Storage Classes and Pricing Explained

Revision card: Bucket, object, key and prefix. Bucket = the container. Its name is unique across all AWS accounts. Object = the file plus metadata. Key = its full name. Folders are not real. "products/2026/" is a prefix in the key. Key here: products/2026/shoe.jpg
Revision card: Bucket, object, key and prefix · Download PNG

Lesson: What Is Amazon S3? S3 vs EBS vs EFS, Storage Classes and Pricing Explained

Revision card: Durability vs availability. Durability: will my data still exist? S3 gives 11 nines. Availability: can I read it right now? Standard is 99.99%. One Zone-IA keeps one AZ, so availability is 99.5%. Lost data is a durability problem. A short outage is availability.
Revision card: Durability vs availability · Download PNG

Lesson: What Is Amazon S3? S3 vs EBS vs EFS, Storage Classes and Pricing Explained

Revision card: S3 storage classes and cost. Standard about $0.023 per GB-month: hot data. Standard-IA $0.0125, 30-day minimum: read monthly. Glacier Instant $0.004 (90 days). Deep Archive $0.00099 (180 days). Not sure? Intelligent-Tiering moves objects for you.
Revision card: S3 storage classes and cost · Download PNG

Lesson: What Is Amazon S3? S3 vs EBS vs EFS, Storage Classes and Pricing Explained

Comparison: EBS volume vs S3 bucket. EBS volume: A block disk attached to one EC2 instance in one AZ. S3 bucket: Object storage reached over HTTPS by any number of clients.
Comparison: EBS volume vs S3 bucket · Download PNG

Lesson: What Is Amazon S3? S3 vs EBS vs EFS, Storage Classes and Pricing Explained

Comparison: S3 Standard vs S3 Standard-IA. S3 Standard: About $0.023 per GB-month, no minimum days, no retrieval fee. S3 Standard-IA: About $0.0125 per GB-month, 30-day minimum, per-GB retrieval fee.
Comparison: S3 Standard vs S3 Standard-IA · Download PNG

Lesson: What Is Amazon S3? S3 vs EBS vs EFS, Storage Classes and Pricing Explained

Interview card: S3, EBS or EFS for user photos?. S3: any number of servers read them, no size limit, cheapest per GB. EBS is one instance in one AZ. EFS is a shared file system, about 13x Standard S3 price. Use EBS for the OS and databases, EFS for shared POSIX files.
Interview card: S3, EBS or EFS for user photos? · Download PNG

Lesson: What Is Amazon S3? S3 vs EBS vs EFS, Storage Classes and Pricing Explained

Interview card: How big can an S3 object be?. Single PUT up to 5 GB. Console upload up to 160 GB. Bigger needs multipart: parts 5 MB to 5 GB, up to 10,000 parts. The maximum object size is now about 50 TB.
Interview card: How big can an S3 object be? · Download PNG

Lesson: What Is Amazon S3? S3 vs EBS vs EFS, Storage Classes and Pricing Explained

How to Access S3 from a Private EC2 Instance with a VPC Gateway Endpoint (No NAT)

Revision card: S3 gateway endpoint. S3 lives outside your VPC. A private EC2 needs a path. NAT works but charges per GB. A gateway endpoint is free. It adds a prefix-list route in the route tables you pick. Same Region only. S3 and DynamoDB only.
Revision card: S3 gateway endpoint · Download PNG

Lesson: How to Access S3 from a Private EC2 Instance with a VPC Gateway Endpoint (No NAT)

Revision card: S3 endpoint policy. The endpoint can carry a policy, like a filter on the pipe. Allow only your buckets so data cannot go to someone else's bucket. Remember the OS repo bucket if dnf uses S3. Other bucket through it: AccessDenied.
Revision card: S3 endpoint policy · Download PNG

Lesson: How to Access S3 from a Private EC2 Instance with a VPC Gateway Endpoint (No NAT)

Comparison: NAT gateway vs S3 gateway endpoint. NAT gateway: Managed outbound internet for private subnets, billed per hour and per GB. S3 gateway endpoint: A route to S3 inside AWS for the VPC, no charge.
Comparison: NAT gateway vs S3 gateway endpoint · Download PNG

Lesson: How to Access S3 from a Private EC2 Instance with a VPC Gateway Endpoint (No NAT)

Comparison: Gateway endpoint vs Interface endpoint. Gateway endpoint: A route table entry for S3 or DynamoDB in the same Region. Interface endpoint: An ENI with private IPs in your subnets (PrivateLink).
Comparison: Gateway endpoint vs Interface endpoint · Download PNG

Lesson: How to Access S3 from a Private EC2 Instance with a VPC Gateway Endpoint (No NAT)

Interview card: Private EC2 sends lots of data to S3. NAT or endpoint?. Gateway endpoint: free and private, same Region. NAT costs per hour and per GB. 2 TB is about $92 in processing alone. Interface endpoint only when on-premises must reach S3 privately.
Interview card: Private EC2 sends lots of data to S3. NAT or endpoint? · Download PNG

Lesson: How to Access S3 from a Private EC2 Instance with a VPC Gateway Endpoint (No NAT)

S3 Bucket Policy Examples: Block Public Access, ACLs, Pre-Signed URLs and Encryption

Revision card: Block Public Access. Four switches that refuse public ACLs and public policies. On by default for new buckets. Set it at the account too. Turn it off only for a bucket that must be public. It stops the "public for a test" leak.
Revision card: Block Public Access · Download PNG

Lesson: S3 Bucket Policy Examples: Block Public Access, ACLs, Pre-Signed URLs and Encryption

Revision card: IAM policy vs bucket policy. IAM policy: what this user or role can do. Bucket policy: who can use this bucket. It has a Principal. Cross-account and HTTPS-only rules go in the bucket policy. An explicit Deny anywhere wins.
Revision card: IAM policy vs bucket policy · Download PNG

Lesson: S3 Bucket Policy Examples: Block Public Access, ACLs, Pre-Signed URLs and Encryption

Revision card: Pre-signed URL. A normal S3 URL plus a signature. Bucket stays private. One action, one key, limited time. Up to 7 days with IAM user keys; less with a role. Make a 15-minute link.
Revision card: Pre-signed URL · Download PNG

Lesson: S3 Bucket Policy Examples: Block Public Access, ACLs, Pre-Signed URLs and Encryption

Revision card: SSE-S3 vs SSE-KMS. Every new object is encrypted with SSE-S3 by default. SSE-KMS uses a KMS key you control. Readers need kms:Decrypt too. Each use is in CloudTrail. Upload with KMS.
Revision card: SSE-S3 vs SSE-KMS · Download PNG

Lesson: S3 Bucket Policy Examples: Block Public Access, ACLs, Pre-Signed URLs and Encryption

Comparison: SSE-S3 vs SSE-KMS. SSE-S3: S3 manages the keys fully; default for new objects. SSE-KMS: Uses an AWS KMS key that you can control with a key policy.
Comparison: SSE-S3 vs SSE-KMS · Download PNG

Lesson: S3 Bucket Policy Examples: Block Public Access, ACLs, Pre-Signed URLs and Encryption

Comparison: ACLs disabled (bucket owner enforced) vs ACLs enabled (bucket owner preferred). ACLs disabled (bucket owner enforced): Every object belongs to the bucket owner; access only by policies. ACLs enabled (bucket owner preferred): Objects uploaded with bucket-owner-full-control belong to you; ACLs still work.
Comparison: ACLs disabled (bucket owner enforced) vs ACLs enabled (bucket owner preferred) · Download PNG

Lesson: S3 Bucket Policy Examples: Block Public Access, ACLs, Pre-Signed URLs and Encryption

Interview card: How do you force HTTPS on a bucket?. Bucket policy with Effect Deny for all principals and actions. Condition: aws:SecureTransport equals false. Cover both the bucket ARN and bucket/*.
Interview card: How do you force HTTPS on a bucket? · Download PNG

Lesson: S3 Bucket Policy Examples: Block Public Access, ACLs, Pre-Signed URLs and Encryption

Interview card: When would you enable ACLs on a bucket?. Almost never. Default is ACLs disabled, bucket owner enforced. Only for a legacy cross-account writer that still sends ACLs. Then choose Bucket owner preferred so you still own the objects.
Interview card: When would you enable ACLs on a bucket? · Download PNG

Lesson: S3 Bucket Policy Examples: Block Public Access, ACLs, Pre-Signed URLs and Encryption

How to Host a Static Website on S3 with CloudFront, HTTPS (ACM) and Route 53

Revision card: S3 static website. Static sites are just files. S3 serves files. Enable hosting, index.html, error.html. Website endpoint is HTTP only and needs public read. Endpoint format in Mumbai.
Revision card: S3 static website · Download PNG

Lesson: How to Host a Static Website on S3 with CloudFront, HTTPS (ACM) and Route 53

Revision card: CloudFront with OAC. CloudFront caches your site at edge locations and adds HTTPS. OAC lets only your distribution read the bucket. Use the S3 REST endpoint as origin, not the website one. Bucket stays private with Block Public Access on.
Revision card: CloudFront with OAC · Download PNG

Lesson: How to Host a Static Website on S3 with CloudFront, HTTPS (ACM) and Route 53

Revision card: ACM HTTPS and Route 53 alias. Request the CloudFront certificate in us-east-1. Validate by DNS; ACM renews it for free. Route 53 alias A record points the domain to CloudFront. Alias works at the root domain where CNAME cannot.
Revision card: ACM HTTPS and Route 53 alias · Download PNG

Lesson: How to Host a Static Website on S3 with CloudFront, HTTPS (ACM) and Route 53

Comparison: S3 website endpoint vs CloudFront + OAC. S3 website endpoint: The bucket serves the site itself from one Region. CloudFront + OAC: A CDN serves the site from edge caches and reads a private bucket.
Comparison: S3 website endpoint vs CloudFront + OAC · Download PNG

Lesson: How to Host a Static Website on S3 with CloudFront, HTTPS (ACM) and Route 53

Comparison: Route 53 alias record vs CNAME record. Route 53 alias record: An AWS extension that points a name to an AWS resource. CNAME record: A standard DNS pointer from one name to another.
Comparison: Route 53 alias record vs CNAME record · Download PNG

Lesson: How to Host a Static Website on S3 with CloudFront, HTTPS (ACM) and Route 53

Interview card: How do you serve a private bucket over HTTPS on your domain?. CloudFront with OAC, origin = S3 REST endpoint. ACM certificate in us-east-1, added as the alternate domain. Route 53 alias A record to the distribution.
Interview card: How do you serve a private bucket over HTTPS on your domain? · Download PNG

Lesson: How to Host a Static Website on S3 with CloudFront, HTTPS (ACM) and Route 53

S3 Versioning, Lifecycle Rules and Replication (SRR and CRR) Explained

Revision card: S3 versioning. Every overwrite keeps the old version. A plain delete adds a delete marker; GET gives 404. Delete the marker and the object is back. Can be suspended, never turned off.
Revision card: S3 versioning · Download PNG

Lesson: S3 Versioning, Lifecycle Rules and Replication (SRR and CRR) Explained

Revision card: S3 lifecycle rules. Transitions move data to cheaper classes after N days. Expirations delete data after N days. Also expire noncurrent versions and abort old multipart uploads. logs/: 30 d IA, 90 d Glacier, 365 d delete.
Revision card: S3 lifecycle rules · Download PNG

Lesson: S3 Versioning, Lifecycle Rules and Replication (SRR and CRR) Explained

Revision card: S3 replication SRR and CRR. SRR copies to a bucket in the same Region; CRR to another Region. Versioning must be on in both buckets. Only new objects copy. Use Batch Replication for old ones. CRR = disaster recovery in another Region.
Revision card: S3 replication SRR and CRR · Download PNG

Lesson: S3 Versioning, Lifecycle Rules and Replication (SRR and CRR) Explained

Comparison: SRR vs CRR. SRR: Replicates new objects to a bucket in the same Region. CRR: Replicates new objects to a bucket in another Region.
Comparison: SRR vs CRR · Download PNG

Lesson: S3 Versioning, Lifecycle Rules and Replication (SRR and CRR) Explained

Comparison: Versioning enabled vs Versioning suspended. Versioning enabled: Each PUT creates a new version ID; old ones stay. Versioning suspended: New writes get version ID null; existing versions stay.
Comparison: Versioning enabled vs Versioning suspended · Download PNG

Lesson: S3 Versioning, Lifecycle Rules and Replication (SRR and CRR) Explained

Interview card: Someone deleted files from a versioned bucket. Recover?. A plain delete only added delete markers. List DeleteMarkers and delete those marker versions. The previous versions become current again.
Interview card: Someone deleted files from a versioned bucket. Recover? · Download PNG

Lesson: S3 Versioning, Lifecycle Rules and Replication (SRR and CRR) Explained

Interview card: CRR is on, but old files are missing in the target. Why?. Replication only copies objects created after the rule. Run S3 Batch Replication for existing objects. Check versioning is on in both buckets and the role can write.
Interview card: CRR is on, but old files are missing in the target. Why? · Download PNG

Lesson: S3 Versioning, Lifecycle Rules and Replication (SRR and CRR) Explained

Project: Build a Reels Video Upload App with Amazon S3, EC2 and RDS MySQL

Revision card: Reels app: S3 + RDS. Video bytes go to S3. User, caption, size and the key go to MySQL. EC2 uses an IAM role. No access keys on disk. Store the key, build the URL when reading.
Revision card: Reels app: S3 + RDS · Download PNG

Lesson: Project: Build a Reels Video Upload App with Amazon S3, EC2 and RDS MySQL

Revision card: Direct upload with pre-signed PUT. The app signs a 5-minute PUT URL for one key. The browser sends the video straight to S3. The app HEADs the object, then inserts the row. Add a CORS rule for PUT on the bucket.
Revision card: Direct upload with pre-signed PUT · Download PNG

Lesson: Project: Build a Reels Video Upload App with Amazon S3, EC2 and RDS MySQL

Revision card: Cron backups to S3. Nightly mysqldump, gzip, aws s3 cp. Sync logs to backups/logs/. Lifecycle on backups/ keeps cost low. Run at 2:30 AM.
Revision card: Cron backups to S3 · Download PNG

Lesson: Project: Build a Reels Video Upload App with Amazon S3, EC2 and RDS MySQL

Revision card: S3 event notifications. S3 can tell you when an object is created. Targets: SNS, SQS, Lambda or EventBridge. Filter by prefix reels/ and suffix .mp4. Use it for alerts or thumbnails, no polling.
Revision card: S3 event notifications · Download PNG

Lesson: Project: Build a Reels Video Upload App with Amazon S3, EC2 and RDS MySQL

Comparison: Upload via server (SDK PutObject) vs Direct pre-signed PUT. Upload via server (SDK PutObject): Browser sends to EC2, then EC2 sends to S3. Direct pre-signed PUT: App signs a URL; browser sends straight to S3.
Comparison: Upload via server (SDK PutObject) vs Direct pre-signed PUT · Download PNG

Lesson: Project: Build a Reels Video Upload App with Amazon S3, EC2 and RDS MySQL

Comparison: Pre-signed GET vs CloudFront + OAC. Pre-signed GET: A time-limited link per object from S3 directly. CloudFront + OAC: Edge-cached URL from a CDN reading a private bucket.
Comparison: Pre-signed GET vs CloudFront + OAC · Download PNG

Lesson: Project: Build a Reels Video Upload App with Amazon S3, EC2 and RDS MySQL

Interview card: Why not store videos as BLOBs in MySQL?. Huge rows slow backups, replicas and queries. Database storage costs far more than S3. Keep bytes in S3, key and details in MySQL.
Interview card: Why not store videos as BLOBs in MySQL? · Download PNG

Lesson: Project: Build a Reels Video Upload App with Amazon S3, EC2 and RDS MySQL

Interview card: How does the app on EC2 call S3 without keys?. Attach an IAM role through the instance profile. The SDK gets temporary credentials from instance metadata. Check with sts get-caller-identity.
Interview card: How does the app on EC2 call S3 without keys? · Download PNG

Lesson: Project: Build a Reels Video Upload App with Amazon S3, EC2 and RDS MySQL

Amazon CloudFront cards: revision, comparison and interview

What Is Amazon CloudFront and Why Use It? Edge Locations and Caching Explained

Revision card: What is Amazon CloudFront?. CloudFront is AWS's CDN. It keeps copies of your files near viewers. Your real server is the origin: S3, ALB, EC2 or any HTTP server. 750+ POPs and 15 regional edge caches worldwide. You get a domain like d111abcd.cloudfront.net.
Revision card: What is Amazon CloudFront? · Download PNG

Lesson: What Is Amazon CloudFront and Why Use It? Edge Locations and Caching Explained

Revision card: Cache hit vs miss. HIT: the edge has the file and answers in milliseconds. MISS: the edge asks the regional edge cache, then the origin. The X-Cache header tells you which happened. Check it with curl.
Revision card: Cache hit vs miss · Download PNG

Lesson: What Is Amazon CloudFront and Why Use It? Edge Locations and Caching Explained

Revision card: CloudFront price classes. All: every edge, best speed. 200: adds most of Asia (incl. India), Middle East, Africa. 100: only North America, Europe, Israel. Cheapest. Indian users? Pick 200 or All.
Revision card: CloudFront price classes · Download PNG

Lesson: What Is Amazon CloudFront and Why Use It? Edge Locations and Caching Explained

Comparison: Edge location (POP) vs Regional edge cache. Edge location (POP): Where viewers connect first; hundreds worldwide. Regional edge cache: Bigger mid-tier cache between POPs and the origin.
Comparison: Edge location (POP) vs Regional edge cache · Download PNG

Lesson: What Is Amazon CloudFront and Why Use It? Edge Locations and Caching Explained

Comparison: Price Class 100 vs Price Class 200. Price Class 100: North America, Europe and Israel only. Price Class 200: Adds most of Asia including India, Middle East and Africa.
Comparison: Price Class 100 vs Price Class 200 · Download PNG

Lesson: What Is Amazon CloudFront and Why Use It? Edge Locations and Caching Explained

Interview card: Why put CloudFront in front of an app in Mumbai?. Far users get files from a nearby edge, not from Mumbai. Even uncached APIs gain: TLS ends near the user. Plus free Shield Standard and optional WAF.
Interview card: Why put CloudFront in front of an app in Mumbai? · Download PNG

Lesson: What Is Amazon CloudFront and Why Use It? Edge Locations and Caching Explained

CloudFront Origins Explained: S3, ALB, EC2 and Custom Origins

Revision card: CloudFront origin types. S3 REST endpoint with OAC: private files. S3 website endpoint: redirects, public bucket, HTTP only. ALB or EC2: dynamic apps. Custom: any HTTP server. One distribution can have many origins.
Revision card: CloudFront origin types · Download PNG

Lesson: CloudFront Origins Explained: S3, ALB, EC2 and Custom Origins

Revision card: Lock an ALB origin. SG: allow only the CloudFront origin-facing prefix list. Add a secret custom header on the origin. ALB rule forwards only if the header matches; else 403. Or use VPC origins for a fully private ALB.
Revision card: Lock an ALB origin · Download PNG

Lesson: CloudFront Origins Explained: S3, ALB, EC2 and Custom Origins

Revision card: Origin groups for failover. A primary and a secondary origin. Fails over on chosen codes like 500, 503, 404 or timeouts. Works for GET, HEAD and OPTIONS. Lower the connection timeout so failover is fast.
Revision card: Origin groups for failover · Download PNG

Lesson: CloudFront Origins Explained: S3, ALB, EC2 and Custom Origins

Comparison: S3 REST endpoint origin vs S3 website endpoint origin. S3 REST endpoint origin: bucket.s3.region.amazonaws.com read through OAC. S3 website endpoint origin: bucket.s3-website.region.amazonaws.com, a public website.
Comparison: S3 REST endpoint origin vs S3 website endpoint origin · Download PNG

Lesson: CloudFront Origins Explained: S3, ALB, EC2 and Custom Origins

Comparison: S3 origin vs ALB origin. S3 origin: Stores files; served as they are. ALB origin: Spreads requests over app servers that build each response.
Comparison: S3 origin vs ALB origin · Download PNG

Lesson: CloudFront Origins Explained: S3, ALB, EC2 and Custom Origins

Interview card: How do you stop users bypassing CloudFront?. S3: OAC and Block Public Access. ALB: CloudFront prefix list in the SG plus a secret header rule. Or VPC origins with no public IP.
Interview card: How do you stop users bypassing CloudFront? · Download PNG

Lesson: CloudFront Origins Explained: S3, ALB, EC2 and Custom Origins

CloudFront Cache Behaviors, TTL and Invalidation Step by Step

Revision card: Cache behaviors and order. A behavior = path pattern + origin + cache settings. Checked top to bottom; first match wins. Default (*) is always last. Put specific patterns above general ones.
Revision card: Cache behaviors and order · Download PNG

Lesson: CloudFront Cache Behaviors, TTL and Invalidation Step by Step

Revision card: Min, default and max TTL. Origin sends Cache-Control max-age. Min and max TTL clamp that value. Default TTL is used when the origin sends nothing. CachingOptimized: 1 s, 1 day, 1 year.
Revision card: Min, default and max TTL · Download PNG

Lesson: CloudFront Cache Behaviors, TTL and Invalidation Step by Step

Revision card: Invalidation vs versioned names. Invalidation drops paths from every edge. First 1,000 paths a month free, then $0.005 each. Versioned names (app.3f9a.js) need no invalidation. Invalidate index.html after deploy.
Revision card: Invalidation vs versioned names · Download PNG

Lesson: CloudFront Cache Behaviors, TTL and Invalidation Step by Step

Comparison: Cache policy vs Origin request policy. Cache policy: Sets TTLs and the cache key. Origin request policy: Adds headers, cookies or query strings sent to the origin on a miss.
Comparison: Cache policy vs Origin request policy · Download PNG

Lesson: CloudFront Cache Behaviors, TTL and Invalidation Step by Step

Comparison: Invalidation vs Versioned file names. Invalidation: Tell CloudFront to drop paths from all edges. Versioned file names: Give each new build new file names.
Comparison: Invalidation vs Versioned file names · Download PNG

Lesson: CloudFront Cache Behaviors, TTL and Invalidation Step by Step

Interview card: Your CloudFront hit ratio is low. What do you check?. The cache key: extra cookies, headers or query strings. TTLs and the origin Cache-Control headers. Move values the origin needs to an origin request policy.
Interview card: Your CloudFront hit ratio is low. What do you check? · Download PNG

Lesson: CloudFront Cache Behaviors, TTL and Invalidation Step by Step

CloudFront Security: OAC vs OAI, Signed URLs and Signed Cookies

Revision card: OAC bucket policy. Principal: Service cloudfront.amazonaws.com. Condition: AWS:SourceArn = your distribution ARN. OAC supports SSE-KMS and all Regions; OAI is legacy. Bucket stays private; direct S3 URL gives 403.
Revision card: OAC bucket policy · Download PNG

Lesson: CloudFront Security: OAC vs OAI, Signed URLs and Signed Cookies

Revision card: CloudFront signed URLs. Behavior: Restrict viewer access + key group. App signs with the private key; CloudFront checks with the public key. Expired or tampered link: 403. Node signer package.
Revision card: CloudFront signed URLs · Download PNG

Lesson: CloudFront Security: OAC vs OAI, Signed URLs and Signed Cookies

Revision card: Geo restriction and WAF. Geo restriction: allow or block countries. AWS WAF: managed rules and rate limits at the edge. Shield Standard: free DDoS protection. Blocked viewers get 403.
Revision card: Geo restriction and WAF · Download PNG

Lesson: CloudFront Security: OAC vs OAI, Signed URLs and Signed Cookies

Comparison: OAC vs OAI. OAC: Origin Access Control: CloudFront signs S3 requests with SigV4. OAI: Origin Access Identity: a special CloudFront user.
Comparison: OAC vs OAI · Download PNG

Lesson: CloudFront Security: OAC vs OAI, Signed URLs and Signed Cookies

Comparison: Signed URL vs Signed cookies. Signed URL: Signature in the query string of one URL. Signed cookies: Three CloudFront-* cookies sent with every request.
Comparison: Signed URL vs Signed cookies · Download PNG

Lesson: CloudFront Security: OAC vs OAI, Signed URLs and Signed Cookies

Comparison: CloudFront signed URL vs S3 pre-signed URL. CloudFront signed URL: Signed with your key group private key; checked at the edge. S3 pre-signed URL: Signed with IAM credentials; checked by S3.
Comparison: CloudFront signed URL vs S3 pre-signed URL · Download PNG

Lesson: CloudFront Security: OAC vs OAI, Signed URLs and Signed Cookies

Interview card: Signed URL vs signed cookies?. Signed URL: one file, e.g. one MP4 download. Signed cookies: many files, e.g. HLS segments. Both use a key group and expire.
Interview card: Signed URL vs signed cookies? · Download PNG

Lesson: CloudFront Security: OAC vs OAI, Signed URLs and Signed Cookies

CloudFront HTTPS, TLS and Custom Domains with ACM

Revision card: Two HTTPS legs. Leg 1: viewer to edge (your ACM cert). Leg 2: edge to origin (origin protocol policy). Set Redirect HTTP to HTTPS and origin HTTPS only. A padlock proves only leg 1.
Revision card: Two HTTPS legs · Download PNG

Lesson: CloudFront HTTPS, TLS and Custom Domains with ACM

Revision card: ACM cert in us-east-1. CloudFront is global; its control plane is in N. Virginia. It reads ACM certificates only from us-east-1. An ALB origin uses a cert in its own Region. ACM public certs are free and auto-renew.
Revision card: ACM cert in us-east-1 · Download PNG

Lesson: CloudFront HTTPS, TLS and Custom Domains with ACM

Revision card: TLS policy and SNI. Recommended security policy: TLSv1.2_2021. SNI is free and works with all modern browsers. Dedicated IP SSL costs $600 a month. Verify with curl.
Revision card: TLS policy and SNI · Download PNG

Lesson: CloudFront HTTPS, TLS and Custom Domains with ACM

Comparison: Redirect HTTP to HTTPS vs HTTPS only. Redirect HTTP to HTTPS: HTTP requests get a 301 to the https URL. HTTPS only: HTTP requests get 403.
Comparison: Redirect HTTP to HTTPS vs HTTPS only · Download PNG

Lesson: CloudFront HTTPS, TLS and Custom Domains with ACM

Comparison: SNI vs Dedicated IP SSL. SNI: Browser sends the hostname in the TLS hello. Dedicated IP SSL: Your cert on dedicated IPs at every edge.
Comparison: SNI vs Dedicated IP SSL · Download PNG

Lesson: CloudFront HTTPS, TLS and Custom Domains with ACM

Interview card: Your ACM cert does not show in CloudFront. Why?. It was requested outside us-east-1. Request it again in N. Virginia. Also check it is Issued and covers the alternate domain.
Interview card: Your ACM cert does not show in CloudFront. Why? · Download PNG

Lesson: CloudFront HTTPS, TLS and Custom Domains with ACM

Project: Build a Course Video Platform with CloudFront and S3 (Source Code)

Revision card: Course platform design. Private S3 + OAC: no direct access. /thumbs/* and /free/* open; /videos/* signed. App checks the purchase, then signs a 10-minute URL. Video bytes never pass through the app.
Revision card: Course platform design · Download PNG

Lesson: Project: Build a Course Video Platform with CloudFront and S3 (Source Code)

Revision card: Admin upload with pre-signed PUT. App returns an S3 pre-signed PUT URL. Browser uploads the video straight to S3. Bucket CORS must allow PUT from the app. Same key replaced? Invalidate it.
Revision card: Admin upload with pre-signed PUT · Download PNG

Lesson: Project: Build a Course Video Platform with CloudFront and S3 (Source Code)

Revision card: Keep the signing key safe. Private key in SSM Parameter Store SecureString. EC2 role allows ssm:GetParameter on that one name. Only the public key goes to CloudFront. Store it once.
Revision card: Keep the signing key safe · Download PNG

Lesson: Project: Build a Course Video Platform with CloudFront and S3 (Source Code)

Comparison: Free preview (/free/*) vs Paid lesson (/videos/*). Free preview (/free/*): Unrestricted behavior; plain CloudFront URL. Paid lesson (/videos/*): Restricted behavior with a key group.
Comparison: Free preview (/free/*) vs Paid lesson (/videos/*) · Download PNG

Lesson: Project: Build a Course Video Platform with CloudFront and S3 (Source Code)

Interview card: How do you stop paid video links being shared?. Private bucket with OAC; restricted behavior with a key group. Sign short URLs only after a purchase check. A shared link expires in minutes and returns 403.
Interview card: How do you stop paid video links being shared? · Download PNG

Lesson: Project: Build a Course Video Platform with CloudFront and S3 (Source Code)

Lambda, API Gateway and DynamoDB cards

Revision, X vs Y and interview cards for AWS Lambda, API Gateway and DynamoDB.

What Is AWS Lambda? Serverless Explained with Examples

Revision card: What is AWS Lambda?. A bakery open all night with no customers still pays rent. Always-on servers waste money the same way. Lambda runs your code only when an event happens. You pay for requests and duration, not idle hours. Write a small function, set a runtime and role, then add a trigger (S3, API Gateway, schedule…). Photo uploaded to S3 → Lambda makes a thumbnail in seconds → idle again.
Revision card: What is AWS Lambda? · Download PNG · Open card page

Lesson: What Is AWS Lambda? Serverless Explained with Examples

Revision card: Function, trigger and event. Three words sound the same in class. Clear names stop confusion in the console. Function = your code. Trigger = what starts it. Event = the JSON payload it receives. Open any function → Configuration → Triggers. Test with a sample event JSON. API Gateway POST /orders → Lambda gets method, path and body in the event.
Revision card: Function, trigger and event · Download PNG · Open card page

Lesson: What Is AWS Lambda? Serverless Explained with Examples

Revision card: Lambda vs EC2 vs containers. Teams pick the wrong compute and fight bills or limits later. EC2 = you manage a server. Containers = package + orchestrate. Lambda = upload code, AWS runs it. Use Lambda for short event work. Use EC2/containers for long jobs, GPUs or special OS needs. 15-minute video encode → EC2 or ECS. Resize one image on upload → Lambda.
Revision card: Lambda vs EC2 vs containers · Download PNG · Open card page

Lesson: What Is AWS Lambda? Serverless Explained with Examples

Revision card: Lambda limits and free tier. Surprises at the limit waste a demo day. Know the hard caps early. Timeout max 15 minutes. Memory 128 MB–10,240 MB. Zip upload 50 MB; unzipped package 250 MB. Free tier: about 1 million requests and 400,000 GB-seconds per month. 256 MB × 1 s = 0.25 GB-s per invoke. Lab traffic usually stays free.
Revision card: Lambda limits and free tier · Download PNG · Open card page

Lesson: What Is AWS Lambda? Serverless Explained with Examples

Comparison: AWS Lambda vs Amazon EC2. AWS Lambda: You upload code; AWS runs and scales it. Amazon EC2: You pick, patch and size a virtual server.
Comparison: AWS Lambda vs Amazon EC2 · Download PNG · Open card page

Lesson: What Is AWS Lambda? Serverless Explained with Examples

Comparison: AWS Lambda vs Containers (ECS/EKS). AWS Lambda: Zip or image of a function. Containers (ECS/EKS): Image of a full app process you orchestrate.
Comparison: AWS Lambda vs Containers (ECS/EKS) · Download PNG · Open card page

Lesson: What Is AWS Lambda? Serverless Explained with Examples

Interview card: What does serverless mean if servers still exist?. Servers still run your code, but AWS owns patching, scaling and capacity. You focus on functions and events, not OS updates at 2 AM. Example: Lambda scales with S3 uploads; you never SSH to add boxes.
Interview card: What does serverless mean if servers still exist? · Download PNG · Open card page

Lesson: What Is AWS Lambda? Serverless Explained with Examples

Interview card: When would you choose EC2 over Lambda?. Long-running work past 15 minutes, GPUs, custom kernels or sticky local state. Lambda hard timeout and package limits make those workloads a poor fit. Train an ML model for hours on a GPU instance; use Lambda only for the API that starts the job.
Interview card: When would you choose EC2 over Lambda? · Download PNG · Open card page

Lesson: What Is AWS Lambda? Serverless Explained with Examples

Interview card: What is a Lambda execution role?. An IAM role the function assumes so it can call AWS APIs. Without it, even CloudWatch Logs writes fail. Least privilege to only needed actions. Attach AWSLambdaBasicExecutionRole first; add S3/DynamoDB policies only if needed.
Interview card: What is a Lambda execution role? · Download PNG · Open card page

Lesson: What Is AWS Lambda? Serverless Explained with Examples

Interview card: How is Lambda billed?. Per request plus GB-seconds: memory setting × duration. Idle time is not billed like EC2. Cold starts still count as duration. Raise memory if CPU-bound; wall time often drops and can cost less.
Interview card: How is Lambda billed? · Download PNG · Open card page

Lesson: What Is AWS Lambda? Serverless Explained with Examples

Create Your First AWS Lambda Function Step by Step

Revision card: Create a function in the console. Reading docs is not enough. One working function builds confidence. Author from scratch: name, runtime, architecture, execution role. Lambda › Create function › Author from scratch › create › Deploy after edits. hello-lab returns {"ok": true}. Click Test with a blank {}.
Revision card: Create a function in the console · Download PNG · Open card page

Lesson: Create Your First AWS Lambda Function Step by Step

Revision card: One idea, many runtimes. Teams speak different languages. The same event shape works across them. Python, Node.js, Java, .NET and Go are common managed runtimes. One function = one runtime. Clone the lab in a second runtime; keep the handler contract the same. Python uses def handler(event, context). Node uses exports.handler = async (event) => ….
Revision card: One idea, many runtimes · Download PNG · Open card page

Lesson: Create Your First AWS Lambda Function Step by Step

Revision card: Test events and CloudWatch Logs. Broken JSON in production is painful. Test first with a saved event. Test events are sample JSON. print/console.log goes to CloudWatch Logs. Test tab → create event → invoke. Then Monitor › View CloudWatch logs. Log line "order=42" appears in the latest stream within seconds.
Revision card: Test events and CloudWatch Logs · Download PNG · Open card page

Lesson: Create Your First AWS Lambda Function Step by Step

Revision card: Env vars, memory and timeout. Hard-coded table names break when you move from lab to prod. Environment variables hold non-secret config. Memory also buys CPU. Timeout stops runaway work. Configuration › Environment variables; General configuration for memory/timeout. Timeout 3 s fails a 5 s call. Set 10 s for the API lab.
Revision card: Env vars, memory and timeout · Download PNG · Open card page

Lesson: Create Your First AWS Lambda Function Step by Step

Interview card: What are the two main handler arguments?. event (payload) and context (metadata: request id, remaining time). Business data lives in event; timeouts and logging use context. context.get_remaining_time_in_millis() helps abort early.
Interview card: What are the two main handler arguments? · Download PNG · Open card page

Lesson: Create Your First AWS Lambda Function Step by Step

Interview card: Why must you click Deploy after editing code?. The console editor saves a draft; invokes run the last deployed version. Skipping Deploy makes tests look "stuck" on old code. Edit → Deploy → Test. Same habit for aliases later.
Interview card: Why must you click Deploy after editing code? · Download PNG · Open card page

Lesson: Create Your First AWS Lambda Function Step by Step

Interview card: Why prefer an IAM role over access keys in Lambda?. Roles give temporary credentials; keys in code or env can leak. Rotation and least privilege are easier with roles. Never commit AKIA… keys; attach policies to the execution role.
Interview card: Why prefer an IAM role over access keys in Lambda? · Download PNG · Open card page

Lesson: Create Your First AWS Lambda Function Step by Step

Interview card: Does raising memory only buy RAM?. No — Lambda allocates more CPU as memory rises. CPU-bound handlers often finish faster at higher memory. Benchmark 256 vs 1024 MB; pick the cheaper GB-s result.
Interview card: Does raising memory only buy RAM? · Download PNG · Open card page

Lesson: Create Your First AWS Lambda Function Step by Step

AWS Lambda Triggers: S3, EventBridge, SQS and SNS Explained

Revision card: S3 ObjectCreated trigger. Manual thumbnail jobs miss uploads. Events never sleep. S3 can invoke Lambda on ObjectCreated for a prefix or suffix. Add trigger → S3 → bucket → event type → prefix images/ suffix .jpg. Upload hero.jpg → Lambda writes thumbs/hero.jpg.
Revision card: S3 ObjectCreated trigger · Download PNG · Open card page

Lesson: AWS Lambda Triggers: S3, EventBridge, SQS and SNS Explained

Revision card: EventBridge schedules. Cron on one EC2 dies with the instance. Cloud schedules stay. EventBridge Scheduler (or rules) invokes Lambda on a cron or rate. Create schedule → cron 0 21 * * ? * Asia/Calcutta → target Lambda. Nightly stop-dev Lambda runs at 9 PM India time.
Revision card: EventBridge schedules · Download PNG · Open card page

Lesson: AWS Lambda Triggers: S3, EventBridge, SQS and SNS Explained

Revision card: SQS and SNS with Lambda. Bursty producers need a buffer. Many listeners need fan-out. SQS queues work; SNS topics notify many subscribers including Lambda. Event source mapping for SQS. SNS subscription protocol Lambda. Order service publishes to SNS → Lambda email + Lambda analytics both run.
Revision card: SQS and SNS with Lambda · Download PNG · Open card page

Lesson: AWS Lambda Triggers: S3, EventBridge, SQS and SNS Explained

Revision card: Cold starts, layers, retries. First invoke after idle feels slow. Shared libs bloat every zip. Cold start = new environment. Layers share libraries. Async invokes retry on failure. Keep packages small; put heavy deps in a layer; design handlers idempotent. S3 trigger fails twice then can go to a DLQ you configure.
Revision card: Cold starts, layers, retries · Download PNG · Open card page

Lesson: AWS Lambda Triggers: S3, EventBridge, SQS and SNS Explained

Comparison: Synchronous invoke vs Asynchronous invoke. Synchronous invoke: Caller waits for the response. Asynchronous invoke: Event is queued; Lambda runs later.
Comparison: Synchronous invoke vs Asynchronous invoke · Download PNG · Open card page

Lesson: AWS Lambda Triggers: S3, EventBridge, SQS and SNS Explained

Comparison: Amazon SQS vs Amazon SNS. Amazon SQS: Queue: buffer work for consumers. Amazon SNS: Topic: fan-out one message to many.
Comparison: Amazon SQS vs Amazon SNS · Download PNG · Open card page

Lesson: AWS Lambda Triggers: S3, EventBridge, SQS and SNS Explained

Interview card: Why avoid writing back to the same S3 prefix you listen on?. Your write can create another ObjectCreated event and recurse. Bills and throttling explode until you stop the trigger. Read images/; write thumbs/ or another bucket.
Interview card: Why avoid writing back to the same S3 prefix you listen on? · Download PNG · Open card page

Lesson: AWS Lambda Triggers: S3, EventBridge, SQS and SNS Explained

Interview card: What is a cold start?. First invoke on a fresh environment loads runtime and your package. Later warm invokes reuse the environment and are faster. Shrink deps; provisioned concurrency only when latency SLAs need it.
Interview card: What is a cold start? · Download PNG · Open card page

Lesson: AWS Lambda Triggers: S3, EventBridge, SQS and SNS Explained

Interview card: SQS vs SNS for Lambda — when each?. SQS buffers and retries per consumer. SNS fans out one message to many. Use SQS when work must be processed with backlog. Use SNS for notify-many. Checkout → SQS → worker Lambda. Order placed → SNS → email + stock Lambdas.
Interview card: SQS vs SNS for Lambda — when each? · Download PNG · Open card page

Lesson: AWS Lambda Triggers: S3, EventBridge, SQS and SNS Explained

Interview card: Why must async handlers be idempotent?. Retries can deliver the same event more than once. Re-applying the same work must be safe. Key writes by event id; skip if already processed.
Interview card: Why must async handlers be idempotent? · Download PNG · Open card page

Lesson: AWS Lambda Triggers: S3, EventBridge, SQS and SNS Explained

What Is Amazon API Gateway? REST vs HTTP vs WebSocket

Revision card: Why API Gateway in front of Lambda. Browsers should not hold AWS credentials or invent routing. API Gateway is the HTTPS front door: routes, auth, throttle, stages. Create an HTTP API, add a route, integrate Lambda, copy the invoke URL. fetch(API+"/hello") from a static site hits Gateway, then Lambda.
Revision card: Why API Gateway in front of Lambda · Download PNG · Open card page

Lesson: What Is Amazon API Gateway? REST vs HTTP vs WebSocket

Revision card: HTTP API vs REST API. Two product names confuse new teams. Pick for features and price. HTTP APIs are cheaper/simpler for Lambda proxies. REST APIs add API keys, WAF, private APIs. Default new serverless JSON API → HTTP API unless you need REST-only features. Student notes lab uses HTTP API. Partner API with keys uses REST.
Revision card: HTTP API vs REST API · Download PNG · Open card page

Lesson: What Is Amazon API Gateway? REST vs HTTP vs WebSocket

Revision card: When to use WebSocket APIs. Chat and live boards need push, not one-shot request/response. WebSocket APIs keep a connection; Gateway routes $connect, $disconnect, messages. Create WebSocket API → integrate Lambda on routes → manage connection ids. Teacher pushes a quiz update to all open student connections.
Revision card: When to use WebSocket APIs · Download PNG · Open card page

Lesson: What Is Amazon API Gateway? REST vs HTTP vs WebSocket

Revision card: Routes, methods and stages. Dev and prod must not share one URL by accident. Route = method + path. Stage = named deployment (dev/prod) with settings. Add GET /notes and POST /notes; deploy to $default or prod. prod stage URL goes to students; dev stays private.
Revision card: Routes, methods and stages · Download PNG · Open card page

Lesson: What Is Amazon API Gateway? REST vs HTTP vs WebSocket

Comparison: HTTP API vs REST API. HTTP API: Cheaper, simpler Lambda/HTTP proxy. REST API: More API management features.
Comparison: HTTP API vs REST API · Download PNG · Open card page

Lesson: What Is Amazon API Gateway? REST vs HTTP vs WebSocket

Comparison: REST/HTTP API vs WebSocket API. REST/HTTP API: One request, one response. WebSocket API: Long-lived push connection.
Comparison: REST/HTTP API vs WebSocket API · Download PNG · Open card page

Lesson: What Is Amazon API Gateway? REST vs HTTP vs WebSocket

Interview card: Why not call Lambda Function URLs from a public SPA forever?. You lose rich routing, usage plans and central auth patterns. API Gateway (or CloudFront+auth) is the usual public front door. Use Function URLs for simple private tools; public apps prefer Gateway.
Interview card: Why not call Lambda Function URLs from a public SPA forever? · Download PNG · Open card page

Lesson: What Is Amazon API Gateway? REST vs HTTP vs WebSocket

Interview card: What is Lambda proxy integration?. Gateway passes the HTTP request to Lambda; you return statusCode, headers, body. One pattern for almost all serverless REST/HTTP handlers. return {statusCode:200, headers:{…}, body: JSON.stringify(x)}.
Interview card: What is Lambda proxy integration? · Download PNG · Open card page

Lesson: What Is Amazon API Gateway? REST vs HTTP vs WebSocket

Interview card: When do you pick HTTP API over REST?. Lambda/HTTP proxy, CORS, JWT — without API keys/WAF/private API needs. Lower price and simpler config for most student and startup APIs. Need API keys + usage plans → REST instead.
Interview card: When do you pick HTTP API over REST? · Download PNG · Open card page

Lesson: What Is Amazon API Gateway? REST vs HTTP vs WebSocket

Interview card: What is an API stage?. A named snapshot/deployment of the API with its own URL and settings. Lets you separate dev traffic from prod. Deploy to prod only after testing on dev.
Interview card: What is an API stage? · Download PNG · Open card page

Lesson: What Is Amazon API Gateway? REST vs HTTP vs WebSocket

Build a REST API with API Gateway and Lambda Step by Step

Revision card: Why browsers need CORS. curl works; the browser blocks. Students think the API is down. Same-Origin Policy. Cross-origin calls need Access-Control-Allow-* headers. Enable CORS on the HTTP API; return Allow-Origin in Lambda too for proxy. UI on CloudFront, API on execute-api → both origins differ → CORS required.
Revision card: Why browsers need CORS · Download PNG · Open card page

Lesson: Build a REST API with API Gateway and Lambda Step by Step

Revision card: Path and query parameters. Hard-coded ids do not scale. Routes must carry resource ids. Path params: /notes/{id}. Query: /notes?limit=10. Both appear in the event. Define {id} in the route; read event.pathParameters.id in Lambda. DELETE /notes/abc-123 deletes that item.
Revision card: Path and query parameters · Download PNG · Open card page

Lesson: Build a REST API with API Gateway and Lambda Step by Step

Revision card: API keys, plans and throttle. Public anonymous floods burn free tier. Partners need quotas. REST APIs: API keys + usage plans set quota and throttle (req/s). Create key → usage plan → attach stage → require key on methods → redeploy. Partner gets 10 req/s and 100k/day; excess returns 429.
Revision card: API keys, plans and throttle · Download PNG · Open card page

Lesson: Build a REST API with API Gateway and Lambda Step by Step

Revision card: Custom domain with ACM. execute-api URLs look temporary on a résumé project. Custom domain + ACM certificate gives https://api.yourdomain.com. Regional API: cert in the same region. Map domain to the stage. Students hit api.school.com/notes instead of long execute-api URLs.
Revision card: Custom domain with ACM · Download PNG · Open card page

Lesson: Build a REST API with API Gateway and Lambda Step by Step

Comparison: CORS vs API authorization. CORS: Browser cross-origin access. API authorization: Who is allowed to call the API.
Comparison: CORS vs API authorization · Download PNG · Open card page

Lesson: Build a REST API with API Gateway and Lambda Step by Step

Comparison: Throttle vs Quota. Throttle: Short rate limit (requests per second). Quota: Longer budget (e.g. per day).
Comparison: Throttle vs Quota · Download PNG · Open card page

Lesson: Build a REST API with API Gateway and Lambda Step by Step

Interview card: What is a CORS preflight?. Browser OPTIONS request before some cross-origin calls. Server must answer Allow-Methods and Allow-Headers. If OPTIONS fails, the real POST never leaves the browser.
Interview card: What is a CORS preflight? · Download PNG · Open card page

Lesson: Build a REST API with API Gateway and Lambda Step by Step

Interview card: Throttle vs quota?. Throttle = short rate (req/s burst). Quota = longer budget (e.g. per day). Both protect backends and your bill. 10 req/s throttle, 50,000/day quota on a student plan.
Interview card: Throttle vs quota? · Download PNG · Open card page

Lesson: Build a REST API with API Gateway and Lambda Step by Step

Interview card: After changing method settings on REST, what next?. Redeploy the API to the stage or clients still see old config. Settings are not live until deployed. Actions › Deploy API › choose stage.
Interview card: After changing method settings on REST, what next? · Download PNG · Open card page

Lesson: Build a REST API with API Gateway and Lambda Step by Step

Interview card: What must a proxy Lambda return?. statusCode, headers, body (usually a JSON string). Gateway maps that object to a real HTTP response. Forgot to JSON.stringify body → client sees a bad payload.
Interview card: What must a proxy Lambda return? · Download PNG · Open card page

Lesson: Build a REST API with API Gateway and Lambda Step by Step

What Is Amazon DynamoDB? NoSQL vs RDS MySQL

Revision card: What is DynamoDB?. Serverless APIs need a database that scales with spikes, not a server you babysit. DynamoDB is a managed NoSQL key-value/document database. Create a table with a partition key; put and get items by key. notes table PK noteId → GetItem returns one note in milliseconds.
Revision card: What is DynamoDB? · Download PNG · Open card page

Lesson: What Is Amazon DynamoDB? NoSQL vs RDS MySQL

Revision card: Partition key and sort key. Bad keys create hot partitions and slow queries. PK spreads data. SK orders items that share a PK for range queries. Design from access patterns first: what will you Query? userId + createdAt lets you list one user's notes newest first.
Revision card: Partition key and sort key · Download PNG · Open card page

Lesson: What Is Amazon DynamoDB? NoSQL vs RDS MySQL

Revision card: On-demand vs provisioned. Guessing capacity wrong either throttles or wastes money. On-demand pays per request. Provisioned reserves RCUs/WCUs. Labs and spiky apps: on-demand. Steady 24/7 known load: provisioned. Hackathon traffic unknown → on-demand. Nightly batch with flat load → provisioned.
Revision card: On-demand vs provisioned · Download PNG · Open card page

Lesson: What Is Amazon DynamoDB? NoSQL vs RDS MySQL

Revision card: DynamoDB vs RDS MySQL. Using the wrong database fights you in every feature. DynamoDB: keyed access, huge scale, no joins. RDS: SQL, relations, ad-hoc reports. Clear Get/Query patterns → DynamoDB. Heavy joins/reports → RDS. Session store and notes by id → DynamoDB. Accounting ledger with joins → RDS.
Revision card: DynamoDB vs RDS MySQL · Download PNG · Open card page

Lesson: What Is Amazon DynamoDB? NoSQL vs RDS MySQL

Comparison: DynamoDB vs RDS MySQL. DynamoDB: NoSQL key-value / document. RDS MySQL: Relational SQL tables.
Comparison: DynamoDB vs RDS MySQL · Download PNG · Open card page

Lesson: What Is Amazon DynamoDB? NoSQL vs RDS MySQL

Comparison: On-demand vs Provisioned. On-demand: Pay per read/write request unit. Provisioned: Reserve RCUs and WCUs.
Comparison: On-demand vs Provisioned · Download PNG · Open card page

Lesson: What Is Amazon DynamoDB? NoSQL vs RDS MySQL

Interview card: What causes a hot partition?. Too many reads/writes on one partition key value. Low-cardinality keys (e.g. status=ACTIVE) concentrate load. Use high-cardinality keys; shard write-heavy keys if needed.
Interview card: What causes a hot partition? · Download PNG · Open card page

Lesson: What Is Amazon DynamoDB? NoSQL vs RDS MySQL

Interview card: What is the DynamoDB item size limit?. About 400 KB per item. Large blobs belong in S3 with a pointer in DynamoDB. Store note text in DDB; store PDF attachments in S3.
Interview card: What is the DynamoDB item size limit? · Download PNG · Open card page

Lesson: What Is Amazon DynamoDB? NoSQL vs RDS MySQL

Interview card: Does DynamoDB support SQL joins?. No. Model data for your access patterns instead. Duplicate or single-table design replaces many joins. Need ad-hoc joins daily → consider RDS.
Interview card: Does DynamoDB support SQL joins? · Download PNG · Open card page

Lesson: What Is Amazon DynamoDB? NoSQL vs RDS MySQL

Interview card: When is DynamoDB the better default?. Known key patterns, serverless scale, simple items. Pairs naturally with Lambda and API Gateway. User notes by userId, shopping cart by cartId.
Interview card: When is DynamoDB the better default? · Download PNG · Open card page

Lesson: What Is Amazon DynamoDB? NoSQL vs RDS MySQL

DynamoDB CRUD, Query, Scan, GSI and TTL Step by Step

Revision card: Put, Get, Update, Delete. APIs need create/read/update/delete without a SQL server. PutItem, GetItem, UpdateItem, DeleteItem use the primary key. IAM allow those actions on table ARN; call from Lambda with SDK. POST creates noteId; GET returns it; DELETE removes it.
Revision card: Put, Get, Update, Delete · Download PNG · Open card page

Lesson: DynamoDB CRUD, Query, Scan, GSI and TTL Step by Step

Revision card: Query vs Scan. Scan feels easy and becomes a bill shock. Query uses PK (and optional SK). Scan reads the table; you pay for examined items. Always design a key that lets you Query. Use Scan only for tiny labs or rare admin jobs. List notes for user 7 → Query PK=7. Scan whole table → expensive.
Revision card: Query vs Scan · Download PNG · Open card page

Lesson: DynamoDB CRUD, Query, Scan, GSI and TTL Step by Step

Revision card: GSI and LSI. A second access pattern appears after launch. GSI = new PK/SK for Queries. LSI = same PK, different SK; created with the table. Add GSI email-index; Query by email without Scan. Find user by email for login → GSI on email.
Revision card: GSI and LSI · Download PNG · Open card page

Lesson: DynamoDB CRUD, Query, Scan, GSI and TTL Step by Step

Revision card: TTL, Streams and backups. Old sessions and change feeds need automation, not cron on EC2. TTL expires items by epoch seconds. Streams feed Lambda on changes. PITR backups. Enable TTL on attribute expiresAt; enable Streams → new Lambda. Magic-link tokens vanish after 15 minutes via TTL.
Revision card: TTL, Streams and backups · Download PNG · Open card page

Lesson: DynamoDB CRUD, Query, Scan, GSI and TTL Step by Step

Comparison: Query vs Scan. Query: Items for one partition key (optional sort range). Scan: Potentially the whole table.
Comparison: Query vs Scan · Download PNG · Open card page

Lesson: DynamoDB CRUD, Query, Scan, GSI and TTL Step by Step

Comparison: GSI vs LSI. GSI: New partition key (and optional sort key). LSI: Same partition key, different sort key.
Comparison: GSI vs LSI · Download PNG · Open card page

Lesson: DynamoDB CRUD, Query, Scan, GSI and TTL Step by Step

Comparison: PutItem vs UpdateItem. PutItem: Writes a full item (replaces if same key). UpdateItem: Changes only the attributes you name.
Comparison: PutItem vs UpdateItem · Download PNG · Open card page

Lesson: DynamoDB CRUD, Query, Scan, GSI and TTL Step by Step

Comparison: TTL expiry vs DeleteItem. TTL expiry: DynamoDB removes expired items in the background. DeleteItem: Your code deletes immediately by key.
Comparison: TTL expiry vs DeleteItem · Download PNG · Open card page

Lesson: DynamoDB CRUD, Query, Scan, GSI and TTL Step by Step

Interview card: Why can Scan cost more than Query?. You pay for items examined, not only items returned. Filters run after read, so they do not save RCU the way keys do. 10 GB table Scan to find 3 rows still reads ~10 GB.
Interview card: Why can Scan cost more than Query? · Download PNG · Open card page

Lesson: DynamoDB CRUD, Query, Scan, GSI and TTL Step by Step

Interview card: What problem does a GSI solve?. Querying by an attribute that is not the table's primary key. Avoids Scan for a second access pattern. Orders by orderId; GSI by customerId+createdAt for "my orders".
Interview card: What problem does a GSI solve? · Download PNG · Open card page

Lesson: DynamoDB CRUD, Query, Scan, GSI and TTL Step by Step

Interview card: How does DynamoDB TTL work?. Number attribute with Unix epoch seconds; expired items are deleted later in the background. Not a precise alarm clock — deletion is eventually done. Set expiresAt = now+900 for 15-minute tokens.
Interview card: How does DynamoDB TTL work? · Download PNG · Open card page

Lesson: DynamoDB CRUD, Query, Scan, GSI and TTL Step by Step

Interview card: What are DynamoDB Streams used for?. Change data capture: Lambda reacts to inserts/updates/deletes. Fan out search index updates, audit logs, or sync. New note → Stream → Lambda writes to OpenSearch.
Interview card: What are DynamoDB Streams used for? · Download PNG · Open card page

Lesson: DynamoDB CRUD, Query, Scan, GSI and TTL Step by Step

Project: Build a Serverless App with Lambda, API Gateway and DynamoDB (Source Code)

Revision card: Serverless notes architecture. Pieces must fit: UI, API, compute, data. S3+CloudFront UI → API Gateway → Lambda → DynamoDB. Draw the boxes first; then create table, role, function, API, CDN. Browser lists notes via GET /notes; never talks to DynamoDB directly.
Revision card: Serverless notes architecture · Download PNG · Open card page

Lesson: Project: Build a Serverless App with Lambda, API Gateway and DynamoDB (Source Code)

Revision card: Least-privilege IAM for the lab. AdministratorAccess on a student role is a foot-gun. Basic logging policy + inline DynamoDB actions on one table ARN. PutItem GetItem DeleteItem Scan (lab list) only on yourname-notes. Wrong table name in policy → AccessDenied in CloudWatch.
Revision card: Least-privilege IAM for the lab · Download PNG · Open card page

Lesson: Project: Build a Serverless App with Lambda, API Gateway and DynamoDB (Source Code)

Revision card: Wire API, CORS and API_BASE. UI and API are different origins. One wrong URL breaks the demo. HTTP API routes + CORS; set const API_BASE in app.js (no trailing slash). GET/POST /notes, DELETE /notes/{id}; paste invoke URL into app.js. Add note in UI → Network 201 → list refreshes.
Revision card: Wire API, CORS and API_BASE · Download PNG · Open card page

Lesson: Project: Build a Serverless App with Lambda, API Gateway and DynamoDB (Source Code)

Revision card: Always clean up lab resources. Forgotten CloudFront and tables still cost or clutter. Delete CDN, empty S3, delete API, Lambda, table, IAM role. Disable CloudFront first (waits), then delete; confirm Cost Explorer. Bill near zero after cleanup — free tier covered the lab.
Revision card: Always clean up lab resources · Download PNG · Open card page

Lesson: Project: Build a Serverless App with Lambda, API Gateway and DynamoDB (Source Code)

Comparison: S3 + CloudFront UI vs EC2-hosted UI. S3 + CloudFront UI: Static files; no OS to patch for the UI. EC2-hosted UI: You manage a web server OS.
Comparison: S3 + CloudFront UI vs EC2-hosted UI · Download PNG · Open card page

Lesson: Project: Build a Serverless App with Lambda, API Gateway and DynamoDB (Source Code)

Comparison: API Gateway HTTP API vs Lambda Function URL. API Gateway HTTP API: Routes, stages, JWT authorizers, CORS config. Lambda Function URL: Direct HTTPS endpoint on one function.
Comparison: API Gateway HTTP API vs Lambda Function URL · Download PNG · Open card page

Lesson: Project: Build a Serverless App with Lambda, API Gateway and DynamoDB (Source Code)

Interview card: Why is Scan OK in the lab list but not for production user lists?. Lab has few items; production must Query by user key. Scan cost and latency grow with table size. Add userId PK (or GSI) before real users arrive.
Interview card: Why is Scan OK in the lab list but not for production user lists? · Download PNG · Open card page

Lesson: Project: Build a Serverless App with Lambda, API Gateway and DynamoDB (Source Code)

Interview card: How would you add login next?. Amazon Cognito user pool + JWT authorizer on the HTTP API. Store userId on each note; Query that user's items only. UI gets tokens from Cognito; API verifies JWT.
Interview card: How would you add login next? · Download PNG · Open card page

Lesson: Project: Build a Serverless App with Lambda, API Gateway and DynamoDB (Source Code)

Interview card: Why CloudFront OAC with a private S3 bucket?. Bucket stays private; only CloudFront can read objects. Users get HTTPS and caching without public bucket ACLs. Attach the bucket policy CloudFront shows when you create OAC.
Interview card: Why CloudFront OAC with a private S3 bucket? · Download PNG · Open card page

Lesson: Project: Build a Serverless App with Lambda, API Gateway and DynamoDB (Source Code)

Interview card: Name the four AWS pieces in the notes app.. S3+CloudFront (UI), API Gateway (HTTP), Lambda (logic), DynamoDB (data). No EC2 required for the lab path. Draw it in interviews — shows you see the whole path.
Interview card: Name the four AWS pieces in the notes app. · Download PNG · Open card page

Lesson: Project: Build a Serverless App with Lambda, API Gateway and DynamoDB (Source Code)

Serverless project cards

Revision, X vs Y and interview cards for the 10 serverless project labs.

Project: Build a URL Shortener with Lambda, API Gateway and DynamoDB (Source Code)

Revision card: What is a URL shortener?. Instagram bios and Flipkart share links cannot paste a huge URL. People need a tiny code that opens the long page. A URL shortener stores a long URL behind a short code (like Ab12XyZ). Visiting the short link redirects to the long URL and can count clicks. Build it with API Gateway (HTTPS), Lambda (logic), and DynamoDB (shortCode → longUrl, clicks). No always-on EC2. POST {"url":"https://ravindrabagale.com/aws/"} returns shortCode Ab12XyZ. GET /Ab12XyZ returns HTTP 302 to that long URL.
Revision card: What is a URL shortener? · Download PNG · Open card page

Lesson: Project: Build a URL Shortener with Lambda, API Gateway and DynamoDB (Source Code)

Revision card: URL shortener architecture. Pieces must fit: front door, compute, and keyed storage for millions of codes. HTTP API routes → one Lambda → DynamoDB table with partition key shortCode (String). Attributes: longUrl, clicks. Create table on-demand, IAM role with Put/Get/UpdateItem, paste handler, add POST /shorten and GET /{code}, set TABLE_NAME and BASE_URL. curl POST /shorten then curl -I /CODE shows Location: https://ravindrabagale.com/aws/ and clicks becomes 1.
Revision card: URL shortener architecture · Download PNG · Open card page

Lesson: Project: Build a URL Shortener with Lambda, API Gateway and DynamoDB (Source Code)

Revision card: Why 302 and ADD clicks?. Returning 200 with the URL in JSON forces every client to invent redirect logic. Browsers already follow Location. HTTP 302 Found with a Location header is the classic shortener response. ADD on clicks is an atomic DynamoDB increment under concurrent hits. In Lambda: GetItem by shortCode → UpdateItem ADD clicks :1 → return statusCode 302 and headers Location = longUrl. Two phones open /Ab12XyZ at once; both redirect and clicks becomes 2, not a lost update.
Revision card: Why 302 and ADD clicks? · Download PNG · Open card page

Lesson: Project: Build a URL Shortener with Lambda, API Gateway and DynamoDB (Source Code)

Revision card: Clean up the shortener lab. Forgotten HTTP APIs and DynamoDB tables clutter the account and can surprise you on the bill. Delete in order: API Gateway HTTP API, Lambda function, DynamoDB table, IAM role (and inline policy). API Gateway console › delete API; Lambda › delete; DynamoDB › delete table; IAM › delete role. Confirm Billing free-tier noise only. After cleanup, curl to the old invoke URL fails; Cost Explorer shows near-zero for the lab.
Revision card: Clean up the shortener lab · Download PNG · Open card page

Lesson: Project: Build a URL Shortener with Lambda, API Gateway and DynamoDB (Source Code)

Comparison: JSON 200 with URL vs HTTP 302 redirect. JSON 200 with URL: Client reads JSON and navigates itself. HTTP 302 redirect: Browser follows Location automatically.
Comparison: JSON 200 with URL vs HTTP 302 redirect · Download PNG · Open card page

Lesson: Project: Build a URL Shortener with Lambda, API Gateway and DynamoDB (Source Code)

Interview card: Why return 302 instead of 200 with the long URL?. Browsers automatically follow the Location header. That is what users expect from a short link. A JSON 200 forces every client (browser, WhatsApp preview, curl scripts) to special-case your API. Lambda returns statusCode 302 and headers Location = longUrl from DynamoDB GetItem.
Interview card: Why return 302 instead of 200 with the long URL? · Download PNG · Open card page

Lesson: Project: Build a URL Shortener with Lambda, API Gateway and DynamoDB (Source Code)

Interview card: Why ADD clicks instead of read-modify-write?. Two redirects at once can both read clicks=5 and both write 6 — one click lost. UpdateItem ADD is atomic on the server for that attribute. UpdateExpression SET … ADD clicks :one with :one = 1 on every redirect.
Interview card: Why ADD clicks instead of read-modify-write? · Download PNG · Open card page

Lesson: Project: Build a URL Shortener with Lambda, API Gateway and DynamoDB (Source Code)

Interview card: GetItem or Scan to resolve a short code?. Always GetItem by partition key shortCode. Scan would read the whole table. Shortener traffic is a classic single-key lookup pattern. PK shortCode String; GetItem Key={shortCode: code} in under 10 ms typically.
Interview card: GetItem or Scan to resolve a short code? · Download PNG · Open card page

Lesson: Project: Build a URL Shortener with Lambda, API Gateway and DynamoDB (Source Code)

Project: Build a Contact Form API with Lambda, DynamoDB and SNS (Source Code)

Revision card: Contact form API with SNS. Every business site has a Contact Us box. Email-only forms lose messages; you want a saved row plus an alert. API Gateway accepts POST. Lambda writes the message to DynamoDB and publishes to an SNS topic that emails you. Create table (PK messageId), SNS topic + email subscription, Lambda with PutItem + sns:Publish, HTTP API POST /contact. curl POST {"name":"Ravi","email":"a@b.com","msg":"Hi"} → 201, DynamoDB row, and an email in your inbox.
Revision card: Contact form API with SNS · Download PNG · Open card page

Lesson: Project: Build a Contact Form API with Lambda, DynamoDB and SNS (Source Code)

Revision card: Why SNS for the alert?. Hard-coding SMTP in Lambda means passwords, ports, and spam filters. You only need “email me when someone writes”. Amazon SNS is a pub/sub service. Subscribe your email to a topic; Lambda publishes once; SNS delivers. Create topic → Create subscription Email → confirm the link → put TOPIC_ARN in Lambda env → sns:Publish in IAM. One publish can later also SMS or hit another Lambda without changing the contact handler.
Revision card: Why SNS for the alert? · Download PNG · Open card page

Lesson: Project: Build a Contact Form API with Lambda, DynamoDB and SNS (Source Code)

Revision card: Save first, then notify. If email fails and you never saved the message, the lead is gone forever. Write PutItem to DynamoDB first (messageId, name, email, msg, createdAt). Then Publish to SNS. Return 201 with the id. Handler: uuid messageId → put_item → sns.publish Subject Contact body → return JSON. SNS outage still leaves the row in DynamoDB so you can follow up from the table view.
Revision card: Save first, then notify · Download PNG · Open card page

Lesson: Project: Build a Contact Form API with Lambda, DynamoDB and SNS (Source Code)

Comparison: DynamoDB then SNS vs SNS only. DynamoDB then SNS: Message saved even if email fails. SNS only: If publish fails, the lead may be gone.
Comparison: DynamoDB then SNS vs SNS only · Download PNG · Open card page

Lesson: Project: Build a Contact Form API with Lambda, DynamoDB and SNS (Source Code)

Interview card: Save to DynamoDB before SNS or after?. Save first. If publish fails you still have the lead. Notify-only with no store loses messages during email outages. PutItem then sns.publish; log publish errors but still return 201 with messageId.
Interview card: Save to DynamoDB before SNS or after? · Download PNG · Open card page

Lesson: Project: Build a Contact Form API with Lambda, DynamoDB and SNS (Source Code)

Interview card: Why SNS instead of SMTP from Lambda?. No mail server credentials in the function; SNS handles delivery to subscribed emails. Later you can add SMS or another Lambda subscriber without rewriting the form handler. Topic ARN in env; IAM sns:Publish on that ARN only.
Interview card: Why SNS instead of SMTP from Lambda? · Download PNG · Open card page

Lesson: Project: Build a Contact Form API with Lambda, DynamoDB and SNS (Source Code)

Project: Build an Async Order API with SQS, Lambda and DynamoDB (Source Code)

Revision card: Why an async order API?. If checkout waits for inventory, fraud checks, and email, the shopper stares at a spinner and retries. Async intake: API accepts the order fast (HTTP 202), puts a message on SQS, and a worker Lambda writes DynamoDB later. Build SQS queue + DynamoDB PK orderId + intake Lambda (SendMessage) + worker Lambda (SQS trigger) + POST /orders. curl POST {"sku":"TEE-RED","qty":2} returns 202 in ~50 ms; ~2 s later DynamoDB shows status accepted.
Revision card: Why an async order API? · Download PNG · Open card page

Lesson: Project: Build an Async Order API with SQS, Lambda and DynamoDB (Source Code)

Revision card: SQS as a buffer. A sudden flash sale can drown a single Lambda concurrency limit. Work must wait safely. Amazon SQS is a managed queue. Producers SendMessage; consumers receive later. Standard queue is fine for this lab. Create queue yourname-orders, grant intake sqs:SendMessage, grant worker consume + PutItem, add event source mapping batch size 5. If the worker is slow, messages pile in ApproximateNumberOfMessages; the API still returns 202.
Revision card: SQS as a buffer · Download PNG · Open card page

Lesson: Project: Build an Async Order API with SQS, Lambda and DynamoDB (Source Code)

Revision card: HTTP 202 vs 201. Status codes tell clients what “success” means. Wrong codes confuse frontend retries. 201 Created = resource finished. 202 Accepted = request accepted for processing that is not done yet. Intake Lambda returns statusCode 202 and a body with orderId; worker creates the DynamoDB row asynchronously. Mobile app shows “Order received” immediately from 202, then polls GET /orders/{id} when you add it later.
Revision card: HTTP 202 vs 201 · Download PNG · Open card page

Lesson: Project: Build an Async Order API with SQS, Lambda and DynamoDB (Source Code)

Comparison: Sync API to DynamoDB vs Async API via SQS. Sync API to DynamoDB: Caller waits until the row is written. Async API via SQS: Caller gets 202; worker writes later.
Comparison: Sync API to DynamoDB vs Async API via SQS · Download PNG · Open card page

Lesson: Project: Build an Async Order API with SQS, Lambda and DynamoDB (Source Code)

Interview card: When do you return 202 Accepted?. When the server accepted work that will finish asynchronously. 201 would claim the order resource is fully created already. Intake SendMessage to SQS → 202 + orderId; worker writes DynamoDB afterward.
Interview card: When do you return 202 Accepted? · Download PNG · Open card page

Lesson: Project: Build an Async Order API with SQS, Lambda and DynamoDB (Source Code)

Interview card: What happens when the worker keeps failing?. After visibility timeout the message reappears. After maxReceiveCount it can go to a dead-letter queue (DLQ). DLQ protects the main queue from poison messages and keeps a copy for debugging. Attach redrive policy maxReceiveCount=3 to an SQS DLQ on yourname-orders.
Interview card: What happens when the worker keeps failing? · Download PNG · Open card page

Lesson: Project: Build an Async Order API with SQS, Lambda and DynamoDB (Source Code)

Interview card: Standard SQS or FIFO for this lab?. Standard is enough when strict ordering and deduplication are not required. FIFO adds ordering per message group and exactly-once processing features at lower throughput. Checkout intake lab uses Standard; use FIFO when order-of-events per customer must be strict.
Interview card: Standard SQS or FIFO for this lab? · Download PNG · Open card page

Lesson: Project: Build an Async Order API with SQS, Lambda and DynamoDB (Source Code)

Project: Build an Image Thumbnail Pipeline with S3, Lambda and DynamoDB (Source Code)

Revision card: Image thumbnail pipeline. A 5 MB course photo should not download full size for every gallery card. You need a small thumb once. Upload to S3 → ObjectCreated invokes Lambda → resize → put thumb under thumbs/ → PutItem metadata in DynamoDB. Bucket yourname-imgs, table PK imageId, Lambda with S3 Get/Put + PutItem, S3 event on uploads/ prefix, optional Pillow layer. Upload uploads/demo.jpg → object thumbs/demo.jpg appears and DynamoDB has imageId, thumbKey, bytes.
Revision card: Image thumbnail pipeline · Download PNG · Open card page

Lesson: Project: Build an Image Thumbnail Pipeline with S3, Lambda and DynamoDB (Source Code)

Revision card: Avoid recursive S3 events. If Lambda writes a thumb into the same prefix it listens on, every write fires another invoke forever. Guard: only process keys under uploads/ (or skip any key starting with thumbs/). Write thumbs elsewhere. Event notification prefix uploads/. In code: if key.startswith("thumbs/"): return. Dest prefix THUMB_PREFIX=thumbs/. One upload creates exactly one thumb and one DynamoDB row — CloudWatch shows a single invoke.
Revision card: Avoid recursive S3 events · Download PNG · Open card page

Lesson: Project: Build an Image Thumbnail Pipeline with S3, Lambda and DynamoDB (Source Code)

Revision card: Pillow layer vs stub. Python zip uploads cannot easily ship native image libraries. Labs still need a wiring test. A Lambda layer can attach Pillow for real resize. Without it, a stub copies the object so S3+DynamoDB wiring still verifies. Layers › Add a community Pillow layer for Python 3.12 in ap-south-1, or leave stub path on. Memory 512 MB, timeout 30 s. With Pillow, a 2000 px JPG becomes ~200 px wide under thumbs/; without Pillow, thumb bytes ≈ original but flow works.
Revision card: Pillow layer vs stub · Download PNG · Open card page

Lesson: Project: Build an Image Thumbnail Pipeline with S3, Lambda and DynamoDB (Source Code)

Comparison: S3 ObjectCreated trigger vs API Gateway HTTP API. S3 ObjectCreated trigger: Upload creates an event automatically. API Gateway HTTP API: Client must call an HTTPS route.
Comparison: S3 ObjectCreated trigger vs API Gateway HTTP API · Download PNG · Open card page

Lesson: Project: Build an Image Thumbnail Pipeline with S3, Lambda and DynamoDB (Source Code)

Comparison: Same bucket + thumbs/ prefix vs Separate thumb bucket. Same bucket + thumbs/ prefix: Must skip thumbs/ in code or event prefix. Separate thumb bucket: Natural isolation of originals vs thumbs.
Comparison: Same bucket + thumbs/ prefix vs Separate thumb bucket · Download PNG · Open card page

Lesson: Project: Build an Image Thumbnail Pipeline with S3, Lambda and DynamoDB (Source Code)

Interview card: Why skip keys under thumbs/?. Writing the thumb into a watched prefix would invoke Lambda again (recursion). Bills and throttles explode until you delete the notification. Listen on uploads/ only, or if key.startswith("thumbs/"): return before resize.
Interview card: Why skip keys under thumbs/? · Download PNG · Open card page

Lesson: Project: Build an Image Thumbnail Pipeline with S3, Lambda and DynamoDB (Source Code)

Interview card: How do you add Pillow to Lambda?. Attach a Lambda layer that contains the Pillow wheel for your runtime and architecture. Zip size limits and native binaries make layers the usual path (or a container image). Function › Layers › Add layer › community Pillow for Python 3.12 x86_64 in ap-south-1.
Interview card: How do you add Pillow to Lambda? · Download PNG · Open card page

Lesson: Project: Build an Image Thumbnail Pipeline with S3, Lambda and DynamoDB (Source Code)

Project: Build an OTP Notifier with Lambda, SNS and DynamoDB (Source Code)

Revision card: OTP notifier with SNS. UPI and banking apps send a one-time password for a minute of trust. You must expire it and not store it in plain text. POST /otp/request creates a 6-digit code, stores sha256(dest:otp) + expiresAt in DynamoDB, publishes via SNS. POST /otp/verify checks the hash. Table PK dest, SNS email topic (prefer email in class), Lambda Put/Get + Publish, routes request and verify. curl request to you@example.com → email has 6 digits → curl verify returns {"ok":true}.
Revision card: OTP notifier with SNS · Download PNG · Open card page

Lesson: Project: Build an OTP Notifier with Lambda, SNS and DynamoDB (Source Code)

Revision card: Hash and expire OTPs. A DynamoDB leak of raw OTPs lets attackers log in. Forever-valid codes are worse. Store only a hash (e.g. sha256 of dest + otp). Store expiresAt as Unix epoch seconds. Reject after expiry. Generate secrets.token_hex / random 6 digits → hashlib.sha256 → PutItem → never log the raw otp. After 5 minutes verify returns false even with the correct old digits.
Revision card: Hash and expire OTPs · Download PNG · Open card page

Lesson: Project: Build an OTP Notifier with Lambda, SNS and DynamoDB (Source Code)

Revision card: SNS email vs SMS cost. SMS is billed per message and often starts in an SNS SMS sandbox. A class lab can burn money by accident. For learning the flow, subscribe your email to an SNS topic and keep SMS_MODE off. Production SMS needs spend limits and sandbox exit. Create topic → email subscription → confirm → TOPIC_ARN in env. Do not set SMS_MODE=1 unless you accept SMS charges. Ten students each request one OTP → ten emails, no SMS line on the bill.
Revision card: SNS email vs SMS cost · Download PNG · Open card page

Lesson: Project: Build an OTP Notifier with Lambda, SNS and DynamoDB (Source Code)

Comparison: SNS email OTP vs SNS SMS OTP. SNS email OTP: Free-tier friendly; confirm subscription once. SNS SMS OTP: Per-message cost; SMS sandbox hurdles.
Comparison: SNS email OTP vs SNS SMS OTP · Download PNG · Open card page

Lesson: Project: Build an OTP Notifier with Lambda, SNS and DynamoDB (Source Code)

Interview card: Why store a hash of the OTP?. A database leak must not reveal usable login codes. Hashes are one-way; verification re-hashes the user input and compares. sha256(f"{dest}:{otp}") stored with expiresAt; never log the raw digits.
Interview card: Why store a hash of the OTP? · Download PNG · Open card page

Lesson: Project: Build an OTP Notifier with Lambda, SNS and DynamoDB (Source Code)

Interview card: Why prefer SNS email in the class lab?. SMS costs per message and often needs leaving the SMS sandbox. Email subscriptions teach the same publish/subscribe flow without surprise charges. Keep SMS_MODE unset; confirm email on the topic before requesting OTPs.
Interview card: Why prefer SNS email in the class lab? · Download PNG · Open card page

Lesson: Project: Build an OTP Notifier with Lambda, SNS and DynamoDB (Source Code)

Project: Build Order Fan-Out with SNS, SQS, Lambda and DynamoDB (Source Code)

Revision card: Order fan-out with SNS+SQS. One Swiggy-style order must notify email and inventory at the same time without coupling those teams. API → Lambda → SNS topic → two SQS subscriptions (email-q, inventory-q) → each queue has its own Lambda → DynamoDB writes. Create topic, two queues, subscribe each queue to the topic, two worker roles, intake Publish, POST /orders. One POST creates two DynamoDB trails (email-sent row and inventory-reserved row) from separate workers.
Revision card: Order fan-out with SNS+SQS · Download PNG · Open card page

Lesson: Project: Build Order Fan-Out with SNS, SQS, Lambda and DynamoDB (Source Code)

Revision card: Why SNS then SQS?. Calling two Lambdas from the API ties failures together and blocks the client on both. SNS fans out one message to many subscribers. SQS buffers each consumer so a slow email worker does not block inventory. Subscribe queue ARNs to the topic (SNS → SQS). Grant SNS permission to SendMessage. Workers use event source mappings. Pause the email worker; inventory still drains its queue. Restart email; backlog clears.
Revision card: Why SNS then SQS? · Download PNG · Open card page

Lesson: Project: Build Order Fan-Out with SNS, SQS, Lambda and DynamoDB (Source Code)

Revision card: Failure isolation. If email code throws, inventory must still update. Shared one-Lambda fan-out does not isolate well. Separate queues and Lambdas isolate failures. Each queue can have its own DLQ and retry count. Set maxReceiveCount 3 → DLQ on each queue. Idempotent PutItem keyed by orderId+worker type. Poison email message lands in email-DLQ; inventory table still shows reserved for that orderId.
Revision card: Failure isolation · Download PNG · Open card page

Lesson: Project: Build Order Fan-Out with SNS, SQS, Lambda and DynamoDB (Source Code)

Comparison: Amazon SNS vs Amazon SQS. Amazon SNS: Topic broadcasts one event to many subscribers. Amazon SQS: Queue buffers work for one consumer group.
Comparison: Amazon SNS vs Amazon SQS · Download PNG · Open card page

Lesson: Project: Build Order Fan-Out with SNS, SQS, Lambda and DynamoDB (Source Code)

Interview card: Why not invoke two Lambdas from the API?. The client waits on both; one failure can fail the whole request; scaling couples the workers. SNS+SQS decouples producers from consumers and isolates failures per queue. API Publish once to SNS; email-q and inventory-q each trigger their Lambda.
Interview card: Why not invoke two Lambdas from the API? · Download PNG · Open card page

Lesson: Project: Build Order Fan-Out with SNS, SQS, Lambda and DynamoDB (Source Code)

Interview card: How do you isolate email vs inventory failures?. Separate SQS queues, Lambdas, IAM roles, and optional DLQs. A poison email message does not block inventory drains. maxReceiveCount to email-DLQ; inventory queue continues independently.
Interview card: How do you isolate email vs inventory failures? · Download PNG · Open card page

Lesson: Project: Build Order Fan-Out with SNS, SQS, Lambda and DynamoDB (Source Code)

Project: Build a Scheduled Cleanup Job with EventBridge, Lambda and DynamoDB (Source Code)

Revision card: Scheduled cleanup job. Apps delete old sessions and temp rows at night. A forever while-loop on one EC2 dies with the instance. EventBridge schedule (cron or rate) invokes Lambda. Lambda finds old DynamoDB items and deletes or archives them. Table with createdAt or expiresAt, Lambda role DeleteItem/Scan or Query, rule cron(0 21 * * ? *) Asia/Calcutta → target Lambda. Seed 3 old rows; wait for the rule (or run Test); rows disappear; then disable the rule before you leave.
Revision card: Scheduled cleanup job · Download PNG · Open card page

Lesson: Project: Build a Scheduled Cleanup Job with EventBridge, Lambda and DynamoDB (Source Code)

Revision card: Why EventBridge Scheduler?. OS cron on a student laptop is off when the laptop sleeps. Cloud schedules stay on. Amazon EventBridge Scheduler (or rules) invokes targets on a cron or rate expression in a timezone you choose. Create schedule → cron 0 21 * * ? * → timezone Asia/Calcutta → flexible window off → target your Lambda ARN. CloudWatch Logs for the function show a nightly START RequestId around 21:00 IST.
Revision card: Why EventBridge Scheduler? · Download PNG · Open card page

Lesson: Project: Build a Scheduled Cleanup Job with EventBridge, Lambda and DynamoDB (Source Code)

Revision card: Scan caution on cleanup. Deleting “old” rows often starts with a Scan, which reads the whole table and costs as it grows. Lab Scan with a filter on createdAt is OK for tiny seed data. Production should Query a GSI on expiry or use DynamoDB TTL. Prefer TTL attribute expiresAt for pure expiry. For “archive then delete”, Query a date GSI in pages of 100. 100-item lab cleanup finishes in one Scan page; a 10 GB table would need a better key design first.
Revision card: Scan caution on cleanup · Download PNG · Open card page

Lesson: Project: Build a Scheduled Cleanup Job with EventBridge, Lambda and DynamoDB (Source Code)

Comparison: DynamoDB TTL vs EventBridge + Lambda delete. DynamoDB TTL: DynamoDB deletes expired items in the background. EventBridge + Lambda delete: Your Lambda runs on a schedule and deletes/archives.
Comparison: DynamoDB TTL vs EventBridge + Lambda delete · Download PNG · Open card page

Lesson: Project: Build a Scheduled Cleanup Job with EventBridge, Lambda and DynamoDB (Source Code)

Interview card: Why EventBridge instead of a loop on EC2?. EC2 cron dies when the instance stops; you pay idle hours; patching is on you. EventBridge invokes Lambda only when the schedule fires — serverless ops. cron(0 21 * * ? *) Asia/Calcutta → Lambda cleanup target.
Interview card: Why EventBridge instead of a loop on EC2? · Download PNG · Open card page

Lesson: Project: Build a Scheduled Cleanup Job with EventBridge, Lambda and DynamoDB (Source Code)

Interview card: When is DynamoDB TTL better than a cleanup Lambda?. When you only need eventual delete by an expiresAt epoch and no extra archive logic. TTL is free background deletion; not a precise alarm clock. Session tokens: set expiresAt=now+900 and enable TTL on that attribute.
Interview card: When is DynamoDB TTL better than a cleanup Lambda? · Download PNG · Open card page

Lesson: Project: Build a Scheduled Cleanup Job with EventBridge, Lambda and DynamoDB (Source Code)

Project: Build a WebSocket Chat Room with API Gateway, Lambda and DynamoDB (Source Code)

Revision card: WebSocket chat room. WhatsApp Web and live support need push. Refreshing HTTP every second wastes battery and still feels laggy. API Gateway WebSocket API keeps a connection. Routes $connect, $disconnect, and sendMessage hit Lambda. DynamoDB stores connectionIds and messages. Create WebSocket API, three routes to Lambda, table PK connectionId, tiny HTML client with new WebSocket(wssURL). Two browser tabs connect; one sends hello; both see the message via Management API PostToConnection.
Revision card: WebSocket chat room · Download PNG · Open card page

Lesson: Project: Build a WebSocket Chat Room with API Gateway, Lambda and DynamoDB (Source Code)

Revision card: $connect, $disconnect, message. HTTP has one request shape. WebSockets need lifecycle hooks plus your app messages. $connect runs when a client opens the socket — save connectionId. $disconnect removes it. A custom route (e.g. sendMessage) broadcasts. In console: routes $connect, $disconnect, sendMessage → same or separate Lambdas. Deploy stage prod. Copy wss:// invoke URL. On connect, PutItem {connectionId}. On message, Scan/Query connections and post_to_connection each id.
Revision card: $connect, $disconnect, message · Download PNG · Open card page

Lesson: Project: Build a WebSocket Chat Room with API Gateway, Lambda and DynamoDB (Source Code)

Revision card: Handle GoneException. Clients leave without a clean $disconnect (closed laptop). Stale connectionIds break broadcasts. PostToConnection on a dead id raises GoneException (410). Delete that connectionId and continue. try/except around post_to_connection; on GoneException delete the DynamoDB row for that connectionId. Broadcast to 5 ids where 1 is stale → 4 get the chat line; stale row is removed automatically.
Revision card: Handle GoneException · Download PNG · Open card page

Lesson: Project: Build a WebSocket Chat Room with API Gateway, Lambda and DynamoDB (Source Code)

Comparison: HTTP API vs WebSocket API. HTTP API: One request, one response. WebSocket API: Long-lived push connection.
Comparison: HTTP API vs WebSocket API · Download PNG · Open card page

Lesson: Project: Build a WebSocket Chat Room with API Gateway, Lambda and DynamoDB (Source Code)

Interview card: WebSocket vs HTTP polling for chat?. WebSocket keeps a push channel; polling hammers the API and still adds latency. API Gateway WebSocket routes lifecycle and messages to Lambda. wss://…/prod clients; PostToConnection pushes to stored connectionIds.
Interview card: WebSocket vs HTTP polling for chat? · Download PNG · Open card page

Lesson: Project: Build a WebSocket Chat Room with API Gateway, Lambda and DynamoDB (Source Code)

Interview card: What is GoneException in WebSocket APIs?. PostToConnection to a closed client returns 410 Gone. Delete that connectionId from DynamoDB and continue broadcasting to others. except ClientError/GoneException: delete_item(Key=connectionId).
Interview card: What is GoneException in WebSocket APIs? · Download PNG · Open card page

Lesson: Project: Build a WebSocket Chat Room with API Gateway, Lambda and DynamoDB (Source Code)

Project: Build Upload Receipt Emails with S3, Lambda, SES and DynamoDB (Source Code)

Revision card: Upload receipt email. After you upload a document to Drive-style storage, you expect a mail saying it landed. Same idea on S3. S3 ObjectCreated → Lambda → SES SendEmail (or SNS email fallback) → DynamoDB receipt row (objectKey, when, to). Bucket + event → Lambda with ses:SendEmail or sns:Publish + PutItem. Verify SES identity or use SNS topic in sandbox. Upload docs/lab.pdf → email “Received docs/lab.pdf” and DynamoDB item with the key.
Revision card: Upload receipt email · Download PNG · Open card page

Lesson: Project: Build Upload Receipt Emails with S3, Lambda, SES and DynamoDB (Source Code)

Revision card: SES vs SNS fallback. SES sandbox only mails verified identities. Students often cannot leave sandbox in one lab session. Amazon SES is built for email. If sandbox blocks you, publish to an SNS email topic instead so the flow still teaches. Try verify email in SES. If stuck, set USE_SNS=1 and TOPIC_ARN. IAM allows the path you use. Same upload triggers a receipt either from SES or SNS depending on the env flag — DynamoDB still logs one row.
Revision card: SES vs SNS fallback · Download PNG · Open card page

Lesson: Project: Build Upload Receipt Emails with S3, Lambda, SES and DynamoDB (Source Code)

Revision card: Idempotent receipts. S3 can retry the same ObjectCreated event. Double email confuses users. Idempotent = doing the same work twice is safe. Key the DynamoDB receipt by object versionId or etag; skip if already sent. PutItem with condition attribute_not_exists(receiptId) or GetItem first; only then SendEmail. Two deliveries of the same event → one email, one DynamoDB row.
Revision card: Idempotent receipts · Download PNG · Open card page

Lesson: Project: Build Upload Receipt Emails with S3, Lambda, SES and DynamoDB (Source Code)

Comparison: Amazon SES vs Amazon SNS email. Amazon SES: Purpose-built email sending and templates. Amazon SNS email: Simple pub/sub notify including email subscribers.
Comparison: Amazon SES vs Amazon SNS email · Download PNG · Open card page

Lesson: Project: Build Upload Receipt Emails with S3, Lambda, SES and DynamoDB (Source Code)

Interview card: Why SES instead of SMTP on EC2?. Managed email sending, reputation tooling, and IAM auth — no mail server to patch. Sandbox limits early mistakes; production raises sending limits deliberately. ses:SendEmail from Lambda with a verified identity in ap-south-1.
Interview card: Why SES instead of SMTP on EC2? · Download PNG · Open card page

Lesson: Project: Build Upload Receipt Emails with S3, Lambda, SES and DynamoDB (Source Code)

Interview card: How do you avoid double receipt emails?. S3 may deliver the same event more than once; handlers must be idempotent. Key receipts by object etag/versionId; skip SendEmail if the row exists. PutItem ConditionExpression attribute_not_exists(receiptId) before SES.
Interview card: How do you avoid double receipt emails? · Download PNG · Open card page

Lesson: Project: Build Upload Receipt Emails with S3, Lambda, SES and DynamoDB (Source Code)

Project: Build an Order Workflow with Step Functions, Lambda, DynamoDB and SNS (Source Code)

Revision card: Order workflow with Step Functions. Flipkart-style flow paid → packed → shipped needs ordered steps, retries, and a clear status — not one giant Lambda. AWS Step Functions runs a state machine. Each Task state invokes a Lambda; DynamoDB holds status; SNS alerts on shipped. Write ASL JSON (zip), create state machine, three Lambdas (markPaid, markPacked, markShipped), start execution with orderId. StartExecution {"orderId":"O-42"} → DynamoDB status moves paid→packed→shipped and you get an SNS email.
Revision card: Order workflow with Step Functions · Download PNG · Open card page

Lesson: Project: Build an Order Workflow with Step Functions, Lambda, DynamoDB and SNS (Source Code)

Revision card: Why not one fat Lambda?. One function that sleeps between steps wastes duration billing and mixes failures. Timeouts hit the whole flow. Step Functions orchestrates: visual history, per-state retries, wait states, and parallel branches without blocking billing the same way. Define Task → Task → Task in ASL. Add Retry on transient errors. Keep each Lambda under a few seconds. Packed Lambda fails once → Step Functions retries that state only; paid stays recorded.
Revision card: Why not one fat Lambda? · Download PNG · Open card page

Lesson: Project: Build an Order Workflow with Step Functions, Lambda, DynamoDB and SNS (Source Code)

Revision card: Standard vs Express workflows. Two Step Functions types confuse billing and how long a flow may run. Standard: up to 1 year, exactly-once, full execution history — great for business orders. Express: high event rate, at-least-once, cheaper short flows. For paid→packed→shipped lab choose Standard. Express fits IoT-scale streams under 5 minutes. Console executions list shows each state timestamp for O-42 — interview-friendly evidence.
Revision card: Standard vs Express workflows · Download PNG · Open card page

Lesson: Project: Build an Order Workflow with Step Functions, Lambda, DynamoDB and SNS (Source Code)

Comparison: EventBridge schedule vs Step Functions. EventBridge schedule: Fire a target on cron/rate. Step Functions: Ordered multi-step state machine with retries.
Comparison: EventBridge schedule vs Step Functions · Download PNG · Open card page

Lesson: Project: Build an Order Workflow with Step Functions, Lambda, DynamoDB and SNS (Source Code)

Comparison: Standard workflow vs Express workflow. Standard workflow: Up to 1 year; full execution history; exactly-once. Express workflow: Short high-rate; limited history; at-least-once.
Comparison: Standard workflow vs Express workflow · Download PNG · Open card page

Lesson: Project: Build an Order Workflow with Step Functions, Lambda, DynamoDB and SNS (Source Code)

Interview card: Why not one Lambda for paid→packed→shipped?. Timeouts, retries, and billing couple unrelated steps; debugging one failure is harder. Step Functions gives per-state retries and a visual execution history. Three Task Lambdas in ASL; StartExecution with orderId.
Interview card: Why not one Lambda for paid→packed→shipped? · Download PNG · Open card page

Lesson: Project: Build an Order Workflow with Step Functions, Lambda, DynamoDB and SNS (Source Code)

Interview card: Standard or Express for an order workflow?. Standard fits long-running business workflows with exactly-once and full history. Express fits high-volume short flows with at-least-once semantics. Choose Standard for paid→packed→shipped lab executions you inspect in the console.
Interview card: Standard or Express for an order workflow? · Download PNG · Open card page

Lesson: Project: Build an Order Workflow with Step Functions, Lambda, DynamoDB and SNS (Source Code)

High-traffic AWS cards

Revision, X vs Y and interview cards for the 11 high-traffic AWS chapters (ECS, EKS, EFS, Aurora, IAM, SageMaker, Bedrock).

What Is Amazon ECS and Fargate? Run Docker Without Servers

Revision card: What is Amazon ECS?. Flipkart sale traffic needs many identical app boxes, not one fat EC2 that is hard to replace. Amazon ECS (Elastic Container Service) starts, stops and restarts Docker containers on AWS. Fargate is the launch type where you do not manage EC2 hosts. Define a task definition (image, CPU, memory, ports), put a service in a cluster, set desired count. A Fargate service with desired count 2 keeps two nginx tasks healthy behind a public IP or ALB.
Revision card: What is Amazon ECS? · Download PNG · Open card page

Lesson: What Is Amazon ECS and Fargate? Run Docker Without Servers

Revision card: Cluster, task, service. Wrong words in an interview sound like you never ran containers on AWS. Cluster = home for services. Task definition = recipe. Task = one running copy. Service = keep N tasks healthy. Create cluster → register task definition → create service with desired count and launch type Fargate. Kill one task; the service starts a replacement so count stays at N.
Revision card: Cluster, task, service · Download PNG · Open card page

Lesson: What Is Amazon ECS and Fargate? Run Docker Without Servers

Revision card: ECS vs Lambda vs EKS. Picking Kubernetes when you only need a Docker web API wastes weeks of ops. Lambda: short event work (≤15 min). ECS: long-running containers and familiar Docker. EKS: full Kubernetes API when you already live in k8s. Start student labs on ECS Fargate. Move to EKS only when the job needs kubectl/Helm. A Node API that must stay warm for hours belongs on ECS, not on a 15-minute Lambda.
Revision card: ECS vs Lambda vs EKS · Download PNG · Open card page

Lesson: What Is Amazon ECS and Fargate? Run Docker Without Servers

Comparison: Fargate launch type vs EC2 launch type. Fargate launch type: AWS runs capacity; you pick vCPU/memory per task. EC2 launch type: You manage EC2/ASG/AMI for the cluster capacity.
Comparison: Fargate launch type vs EC2 launch type · Download PNG · Open card page

Lesson: What Is Amazon ECS and Fargate? Run Docker Without Servers

Comparison: Amazon ECS vs AWS Lambda. Amazon ECS: Long-running containers, custom processes, sidecars. AWS Lambda: Short event-driven invokes, 15 min max.
Comparison: Amazon ECS vs AWS Lambda · Download PNG · Open card page

Lesson: What Is Amazon ECS and Fargate? Run Docker Without Servers

Interview card: What is Fargate in ECS?. A launch type where AWS runs the capacity; you do not manage EC2 for those tasks. You still define CPU/memory in the task definition and pay while tasks run. Create service with Launch type Fargate; no ASG to patch for the lab.
Interview card: What is Fargate in ECS? · Download PNG · Open card page

Lesson: What Is Amazon ECS and Fargate? Run Docker Without Servers

Interview card: Task vs service in ECS?. A task is one running copy of a task definition. A service keeps N tasks healthy and replaces failures. Long-running APIs use a service; one-off batch may run a standalone task. desiredCount=2 on a service → two tasks; stop one → ECS starts another.
Interview card: Task vs service in ECS? · Download PNG · Open card page

Lesson: What Is Amazon ECS and Fargate? Run Docker Without Servers

Deploy a Docker Container on ECS Fargate Step by Step

Revision card: Push an image to ECR. ECS needs an image URL AWS can pull. A laptop-only Docker image is not enough. Amazon ECR is a private container registry in your account. Tag and push with docker, then point the task definition at the URI. Create repo → aws ecr get-login-password | docker login → docker tag → docker push in ap-south-1. Task definition image = 123.dkr.ecr.ap-south-1.amazonaws.com/yourname-nginx:latest.
Revision card: Push an image to ECR · Download PNG · Open card page

Lesson: Deploy a Docker Container on ECS Fargate Step by Step

Revision card: Fargate service click path. Without a service, a one-off task dies and nothing brings it back. Cluster + Fargate task definition + service with desired count 1 and a public IP (lab) or ALB (prod pattern). Console: create cluster → task definition (0.25 vCPU / 0.5 GB) → service Fargate → assign public IP for the lab. Browser opens the public IP on port 80 and shows the nginx welcome page.
Revision card: Fargate service click path · Download PNG · Open card page

Lesson: Deploy a Docker Container on ECS Fargate Step by Step

Revision card: Clean up ECS so you stop paying. Forgotten Fargate tasks and ALBs keep billing after the lab. Scale desired count to 0 or delete the service, then delete cluster extras, unused task definitions, and the ECR images you do not need. Update service desired 0 → delete service → delete cluster → delete ECR repo (optional) the same day. Cost Explorer shows near-zero Fargate after cleanup; no running tasks in the cluster.
Revision card: Clean up ECS so you stop paying · Download PNG · Open card page

Lesson: Deploy a Docker Container on ECS Fargate Step by Step

Interview card: Why ECR instead of only Docker Hub?. ECR is private in your account, integrates with IAM, and sits next to ECS in-region. Pull permissions are IAM roles, not a Hub password baked into hosts. Push to ap-south-1 ECR; task definition uses that URI.
Interview card: Why ECR instead of only Docker Hub? · Download PNG · Open card page

Lesson: Deploy a Docker Container on ECS Fargate Step by Step

Interview card: How do you stop Fargate charges after a lab?. Set desired count to 0 or delete the service; remove ALB/NAT if you created them. Idle desired count >0 still runs tasks and bills vCPU/memory. UpdateService desiredCount=0 the same day; confirm no running tasks.
Interview card: How do you stop Fargate charges after a lab? · Download PNG · Open card page

Lesson: Deploy a Docker Container on ECS Fargate Step by Step

What Is Amazon EKS? Kubernetes on AWS Explained

Revision card: What is Amazon EKS?. Big teams want one API (kubectl) to deploy and heal pods across clouds. That API is Kubernetes. Amazon EKS runs the managed Kubernetes control plane (API server, etcd, scheduler). You add worker nodes (EC2 or Fargate) where pods run. Create an EKS cluster, join a node group or Fargate profile, kubectl apply a Deployment. kubectl get nodes shows Ready workers; pods schedule onto them.
Revision card: What is Amazon EKS? · Download PNG · Open card page

Lesson: What Is Amazon EKS? Kubernetes on AWS Explained

Revision card: EKS cost warning. Students create EKS “to learn k8s” and leave the cluster up for days. EKS charges a flat hourly control-plane fee even with zero pods. Workers and load balancers add more. Delete lab clusters the same day. Prefer ECS Fargate for cheap Docker labs. An empty EKS cluster overnight still appears as EKS hours on the bill.
Revision card: EKS cost warning · Download PNG · Open card page

Lesson: What Is Amazon EKS? Kubernetes on AWS Explained

Revision card: When to choose EKS. LinkedIn buzz is not a design reason. Complexity needs a job or multi-cloud need. Choose EKS when you already use Helm/operators or need the Kubernetes API. Otherwise ECS is the simpler AWS-native default. Ask: do we need kubectl portability? If no, ship on ECS Fargate first. A single Docker API for a course project rarely needs EKS.
Revision card: When to choose EKS · Download PNG · Open card page

Lesson: What Is Amazon EKS? Kubernetes on AWS Explained

Comparison: Amazon ECS vs Amazon EKS. Amazon ECS: AWS tasks and services — no kubectl required. Amazon EKS: Full Kubernetes API (kubectl, Helm, operators).
Comparison: Amazon ECS vs Amazon EKS · Download PNG · Open card page

Lesson: What Is Amazon EKS? Kubernetes on AWS Explained

Interview card: What does EKS manage for you?. The Kubernetes control plane: API server, etcd, scheduler — multi-AZ by AWS. You still manage worker capacity, networking, and many add-on upgrades. Create EKS cluster; AWS runs control plane; you attach node groups or Fargate profiles.
Interview card: What does EKS manage for you? · Download PNG · Open card page

Lesson: What Is Amazon EKS? Kubernetes on AWS Explained

Interview card: EKS vs ECS — one-line answer?. EKS exposes the Kubernetes API; ECS uses AWS tasks/services without requiring kubectl. Pick ECS for simpler AWS-native containers; EKS when you need Helm/operators/multi-cloud k8s skills. Student Docker lab → ECS Fargate; platform team already on k8s → EKS.
Interview card: EKS vs ECS — one-line answer? · Download PNG · Open card page

Lesson: What Is Amazon EKS? Kubernetes on AWS Explained

Interview card: What is IRSA?. IAM Roles for Service Accounts — pods get IAM permissions without node instance keys. Avoids putting long-lived keys in pods and narrows blast radius per service account. Annotate a Kubernetes service account with an IAM role ARN trusted via OIDC.
Interview card: What is IRSA? · Download PNG · Open card page

Lesson: What Is Amazon EKS? Kubernetes on AWS Explained

What Is Amazon EFS? Shared File Storage vs EBS vs S3

Revision card: What is Amazon EFS?. Two EC2 web servers must see the same uploaded files. EBS attaches to one instance; S3 is object storage, not a classic file path. Amazon EFS is a managed NFS file system many EC2s (and some containers) can mount at once across AZs in a region. Create file system → mount targets in subnets → security group NFS 2049 → mount helper on Amazon Linux. echo hi > /mnt/efs/hello.txt on instance A; cat shows the same file on instance B.
Revision card: What is Amazon EFS? · Download PNG · Open card page

Lesson: What Is Amazon EFS? Shared File Storage vs EBS vs S3

Revision card: When EFS wins vs EBS/S3. Wrong storage type breaks sharing or costs a fortune for the wrong access pattern. EBS: one instance block disk. EFS: shared POSIX files. S3: durable objects via API/SDK, not a drop-in /var/www. Shared CMS uploads, lift-and-shift NFS apps → EFS. Boot disks → EBS. Backups/static assets → S3. WordPress content directory on EFS across two web EC2s; AMI root still on EBS.
Revision card: When EFS wins vs EBS/S3 · Download PNG · Open card page

Lesson: What Is Amazon EFS? Shared File Storage vs EBS vs S3

Revision card: EFS performance modes. Default settings are fine for labs; production needs the right throughput mode. General Purpose is the usual latency-sensitive default. Max I/O is for highly parallel scale. Throughput can be bursting or provisioned/elastic depending on config era. For class labs keep General Purpose and clean up the file system after the mount test. A student mount of a tiny hello.txt does not need Max I/O or provisioned TB.
Revision card: EFS performance modes · Download PNG · Open card page

Lesson: What Is Amazon EFS? Shared File Storage vs EBS vs S3

Comparison: Amazon EFS vs Amazon EBS. Amazon EFS: NFS file system many instances can mount across AZs. Amazon EBS: Block volume typically attached to one instance.
Comparison: Amazon EFS vs Amazon EBS · Download PNG · Open card page

Lesson: What Is Amazon EFS? Shared File Storage vs EBS vs S3

Comparison: Amazon EFS vs Amazon S3. Amazon EFS: POSIX file paths over NFS. Amazon S3: Object API (SDK/CLI/HTTP), not a drop-in filesystem.
Comparison: Amazon EFS vs Amazon S3 · Download PNG · Open card page

Lesson: What Is Amazon EFS? Shared File Storage vs EBS vs S3

Interview card: Can multiple EC2s mount one EFS?. Yes — that is the point of EFS (NFS shared file system across AZs in the region). EBS volumes attach to one instance (with multi-attach only for special io2 cases). Create mount targets in each subnet/AZ; mount the same fs-id on every web EC2.
Interview card: Can multiple EC2s mount one EFS? · Download PNG · Open card page

Lesson: What Is Amazon EFS? Shared File Storage vs EBS vs S3

Interview card: Why not S3 for /var/www files?. S3 is object storage via API; many legacy apps expect POSIX file paths and locking. EFS gives NFS paths; S3 shines for durable objects, static websites, and data lakes. Shared CMS uploads → EFS; static assets/CDN → S3 (+ CloudFront).
Interview card: Why not S3 for /var/www files? · Download PNG · Open card page

Lesson: What Is Amazon EFS? Shared File Storage vs EBS vs S3

Mount Amazon EFS on EC2 Step by Step

Revision card: NFS security group for EFS. Mount hangs forever when port 2049 is blocked between EC2 and mount targets. Allow inbound NFS (TCP 2049) on the EFS mount-target security group from the EC2 security group (not 0.0.0.0/0 in real apps). EC2 SG egress OK; EFS SG inbound 2049 source = EC2 SG id in the same VPC. sudo mount -t efs -o tls fs-xxxx:/ /mnt/efs succeeds instead of timing out.
Revision card: NFS security group for EFS · Download PNG · Open card page

Lesson: Mount Amazon EFS on EC2 Step by Step

Revision card: Mount helper and fstab. A manual mount is lost after reboot unless you persist it. Amazon Linux EFS mount helper uses amazon-efs-utils. fstab keeps the mount across reboots. yum/dnf install amazon-efs-utils → mkdir /mnt/efs → mount -t efs -o tls fs-id:/ /mnt/efs → add fstab line with _netdev. After reboot, df -h still shows /mnt/efs and the shared hello.txt.
Revision card: Mount helper and fstab · Download PNG · Open card page

Lesson: Mount Amazon EFS on EC2 Step by Step

Revision card: Unmount and delete EFS. EFS storage and mount targets keep costing if you only stop the EC2. Unmount on every instance, delete mount targets, then delete the file system. Terminate lab EC2 if you created one. umount /mnt/efs → console delete file system (mount targets first if required) → terminate EC2. EFS console list is empty for the lab FS; Cost Explorer quiet after a day.
Revision card: Unmount and delete EFS · Download PNG · Open card page

Lesson: Mount Amazon EFS on EC2 Step by Step

Interview card: Which port must EFS security groups allow?. NFS TCP 2049 between EC2 and EFS mount targets. Opening 2049 to the world is unsafe; source the EC2 security group id. EFS SG inbound 2049 from sg-ec2; then mount -t efs succeeds.
Interview card: Which port must EFS security groups allow? · Download PNG · Open card page

Lesson: Mount Amazon EFS on EC2 Step by Step

Interview card: Why add EFS to fstab?. So the mount returns after reboot without a manual remount. Use _netdev so the system waits for network before mounting NFS. fstab line with efs/_netdev and tls options via amazon-efs-utils guidance.
Interview card: Why add EFS to fstab? · Download PNG · Open card page

Lesson: Mount Amazon EFS on EC2 Step by Step

What Is Amazon Aurora? vs RDS MySQL and PostgreSQL

Revision card: What is Amazon Aurora?. Teams want MySQL/PostgreSQL compatibility with cloud-native storage that grows and replicas that stay fast. Amazon Aurora is a managed relational engine compatible with MySQL or PostgreSQL, with a distributed storage layer that auto-grows. Pick Aurora MySQL-Compatible or PostgreSQL-Compatible when creating the cluster; apps use nearly the same drivers. mysql client connects to the cluster endpoint and runs SELECT 1 like RDS MySQL.
Revision card: What is Amazon Aurora? · Download PNG · Open card page

Lesson: What Is Amazon Aurora? vs RDS MySQL and PostgreSQL

Revision card: Aurora vs RDS MySQL/PG. Aurora costs more per hour than small RDS — you need a reason. Aurora shines on storage growth, replica lag, and failover design. Plain RDS MySQL/PG is simpler and often cheaper for small apps. Choose Aurora when read scale and fast failover matter; choose RDS for tiny labs and steady small DBs. A blog with 1 GB data may stay on RDS; a read-heavy catalog may move to Aurora replicas.
Revision card: Aurora vs RDS MySQL/PG · Download PNG · Open card page

Lesson: What Is Amazon Aurora? vs RDS MySQL and PostgreSQL

Revision card: Aurora Serverless v2. Dev databases that sit idle all night waste fixed instance hours. Aurora Serverless v2 scales capacity in ACU units with the load within min/max you set. Create Aurora Serverless v2 with a low minimum ACU for labs; raise max only if needed. Idle evening traffic drops ACUs toward the minimum instead of a full always-on instance size.
Revision card: Aurora Serverless v2 · Download PNG · Open card page

Lesson: What Is Amazon Aurora? vs RDS MySQL and PostgreSQL

Comparison: Amazon Aurora vs RDS MySQL / PostgreSQL. Amazon Aurora: Cloud-native storage auto-grows; strong replica/failover story. RDS MySQL / PostgreSQL: Classic managed engine on instance storage model.
Comparison: Amazon Aurora vs RDS MySQL / PostgreSQL · Download PNG · Open card page

Lesson: What Is Amazon Aurora? vs RDS MySQL and PostgreSQL

Interview card: Is Aurora “just RDS MySQL”?. Aurora is MySQL- or PostgreSQL-compatible with a different storage architecture. Storage auto-grows and replica/failover behaviour differs from classic RDS engines. Apps use similar drivers against the cluster endpoint; pick Aurora MySQL or Aurora PostgreSQL engine.
Interview card: Is Aurora “just RDS MySQL”? · Download PNG · Open card page

Lesson: What Is Amazon Aurora? vs RDS MySQL and PostgreSQL

Interview card: When is Aurora worth the cost?. When you need cloud-native storage growth, fast replicas, and strong failover for MySQL/PG workloads. Tiny quiet databases often stay cheaper on RDS MySQL/PostgreSQL. Read-heavy catalog with Aurora replicas; student 1 GB blog on RDS.
Interview card: When is Aurora worth the cost? · Download PNG · Open card page

Lesson: What Is Amazon Aurora? vs RDS MySQL and PostgreSQL

Create an Amazon Aurora Database Step by Step

Revision card: Create Aurora cluster step by step. Clicking Production defaults in a student account burns money fast. In ap-south-1 create an Aurora MySQL cluster with Dev/Test template, small class, strong master password, and note the endpoints. RDS console → Create database → Aurora MySQL → Dev/Test → set master user/password → create. Copy cluster endpoint. Describe-db-clusters shows available; endpoint hostname ends with rds.amazonaws.com.
Revision card: Create Aurora cluster step by step · Download PNG · Open card page

Lesson: Create an Amazon Aurora Database Step by Step

Revision card: Connect and run a query. A cluster that nobody queries teaches nothing — and security groups often block you. Allow the client SG or CloudShell path to port 3306/5432. Use mysql/psql against the cluster endpoint with SSL as required. From EC2 or notes: mysql -h CLUSTER_ENDPOINT -u admin -p → CREATE DATABASE lab; SELECT 1; Query returns 1; a lab table insert is visible on a reconnect.
Revision card: Connect and run a query · Download PNG · Open card page

Lesson: Create an Amazon Aurora Database Step by Step

Revision card: Delete Aurora so billing stops. Aurora instances and storage keep costing after you close the laptop. Delete the DB instance(s) and the cluster. Skip final snapshot for a pure lab if policy allows; never leave Dev/Test clusters for weeks. Actions → Delete cluster/instances → confirm. Verify RDS console list is empty for the lab. Next-day Cost Explorer shows no ongoing Aurora instance hours for that id.
Revision card: Delete Aurora so billing stops · Download PNG · Open card page

Lesson: Create an Amazon Aurora Database Step by Step

Comparison: Aurora provisioned vs Aurora Serverless v2. Aurora provisioned: Fixed instance class you choose. Aurora Serverless v2: Scales in ACU within min/max.
Comparison: Aurora provisioned vs Aurora Serverless v2 · Download PNG · Open card page

Lesson: Create an Amazon Aurora Database Step by Step

Interview card: Why Dev/Test template in the lab?. Production defaults pick larger instances and extras that burn student budgets. Dev/Test keeps size and features appropriate for learning and quick delete. Create database → Aurora → Dev/Test → delete the same day after SELECT 1.
Interview card: Why Dev/Test template in the lab? · Download PNG · Open card page

Lesson: Create an Amazon Aurora Database Step by Step

Interview card: Cluster endpoint vs instance endpoint?. Cluster endpoint points at the current writer; instance endpoints target a specific instance. Apps usually use the cluster endpoint so failover moves the writer automatically. mysql -h cluster-endpoint … for writes; optional reader endpoint for read scale.
Interview card: Cluster endpoint vs instance endpoint? · Download PNG · Open card page

Lesson: Create an Amazon Aurora Database Step by Step

AWS IAM Users, Roles, Policies and Least Privilege Explained

Revision card: IAM users, roles, policies. Root login for daily work and shared access keys are classic interview red flags. IAM controls who can do what in AWS. Users are people/services with long-lived creds; roles are assumable identities; policies are JSON Allow/Deny documents. Prefer IAM Identity Center or roles for humans; attach least-privilege policies; enable MFA on privileged users. An EC2 app reads S3 via an instance role — no access keys in the AMI.
Revision card: IAM users, roles, policies · Download PNG · Open card page

Lesson: AWS IAM Users, Roles, Policies and Least Privilege Explained

Revision card: Least privilege. AdministratorAccess on every role turns one leak into a full account breach. Least privilege means Allow only the actions and resource ARNs needed — prefer customer-managed policies over broad AWS managed when you can. Start with s3:GetObject on one bucket ARN, test, then add only what fails. Lambda that only reads one bucket cannot DeleteBucket even if compromised code tries.
Revision card: Least privilege · Download PNG · Open card page

Lesson: AWS IAM Users, Roles, Policies and Least Privilege Explained

Revision card: Trust policy vs permissions. People mix “who may assume this role” with “what the role can do”. Trust policy (role only): who can AssumeRole (EC2, Lambda, account…). Permissions policy: Allow/Deny API actions on resources. EC2 role trust Principal Service ec2.amazonaws.com; permissions allow s3:GetObject on lab bucket. Lambda cannot assume an EC2-only trust; you create a separate Lambda execution role.
Revision card: Trust policy vs permissions · Download PNG · Open card page

Lesson: AWS IAM Users, Roles, Policies and Least Privilege Explained

Comparison: IAM user vs IAM role. IAM user: Long-lived password/access keys for that identity. IAM role: Temporary credentials via AssumeRole.
Comparison: IAM user vs IAM role · Download PNG · Open card page

Lesson: AWS IAM Users, Roles, Policies and Least Privilege Explained

Interview card: Why not use root daily?. Root has unrestricted power; a phish or leaked password owns the account. Use an admin IAM user/role with MFA for daily admin; lock root away. Enable MFA on root; create IAM admin; never make access keys for root.
Interview card: Why not use root daily? · Download PNG · Open card page

Lesson: AWS IAM Users, Roles, Policies and Least Privilege Explained

Interview card: Roles vs long-lived access keys on EC2?. Roles deliver temporary credentials via instance metadata; keys get committed and leaked. Rotate pain disappears for instance workloads when you use roles. Attach instance profile; AWS CLI works without aws configure keys.
Interview card: Roles vs long-lived access keys on EC2? · Download PNG · Open card page

Lesson: AWS IAM Users, Roles, Policies and Least Privilege Explained

Create an IAM Role and Policy for EC2 and Lambda Step by Step

Revision card: Write a least-privilege S3 read policy. AmazonS3FullAccess on a demo role teaches the wrong habit. A customer-managed policy with s3:GetObject (and ListBucket if needed) on one bucket ARN is enough for a read lab. IAM → Policies → Create → JSON with Version 2012-10-17 and Resource arn:aws:s3:::lab-bucket/*. Policy simulator or CLI get-object succeeds; delete-object is denied.
Revision card: Write a least-privilege S3 read policy · Download PNG · Open card page

Lesson: Create an IAM Role and Policy for EC2 and Lambda Step by Step

Revision card: Attach role to EC2. Putting AKIA keys on the instance is how keys leak into GitHub. Create an EC2 instance profile/role with your S3 read policy; attach to the instance; use the instance metadata credentials automatically via AWS CLI. IAM role trusted by ec2.amazonaws.com → attach policy → Modify IAM role on the instance (or launch with it). On the instance: aws s3 cp s3://lab-bucket/hi.txt - works with no keys configured.
Revision card: Attach role to EC2 · Download PNG · Open card page

Lesson: Create an IAM Role and Policy for EC2 and Lambda Step by Step

Revision card: Lambda execution role. Lambda also needs a role — and basic CloudWatch Logs permissions or you see no logs. Create a Lambda execution role trusted by lambda.amazonaws.com; attach AWSLambdaBasicExecutionRole plus your S3 read policy. Function › Configuration › Permissions › use the new role; test an S3 GetObject handler. Test event succeeds; CloudWatch log stream shows START/END without AccessDenied on logs.
Revision card: Lambda execution role · Download PNG · Open card page

Lesson: Create an IAM Role and Policy for EC2 and Lambda Step by Step

Comparison: AWS managed policy vs Customer managed policy. AWS managed policy: AWS maintains broad reusable policies. Customer managed policy: You write/reuse tight JSON for your ARNs.
Comparison: AWS managed policy vs Customer managed policy · Download PNG · Open card page

Lesson: Create an IAM Role and Policy for EC2 and Lambda Step by Step

Interview card: How do you prove least privilege worked?. Try the allowed action and a denied one; use policy simulator or real CLI calls. Evidence beats “we attached AmazonS3FullAccess”. aws s3 cp get succeeds; aws s3 rm returns AccessDenied on the same role.
Interview card: How do you prove least privilege worked? · Download PNG · Open card page

Lesson: Create an IAM Role and Policy for EC2 and Lambda Step by Step

Interview card: Why does Lambda need BasicExecutionRole too?. Without logs permissions the function may run but you cannot debug in CloudWatch. BasicExecutionRole allows creating log streams for the function. Attach AWSLambdaBasicExecutionRole plus your tight S3 policy on the execution role.
Interview card: Why does Lambda need BasicExecutionRole too? · Download PNG · Open card page

Lesson: Create an IAM Role and Policy for EC2 and Lambda Step by Step

What Is Amazon SageMaker? Machine Learning on AWS Explained

Revision card: What is Amazon SageMaker?. Banks and apps need notebooks, training on bigger machines, then a fast score API — without hand-building GPU clusters. Amazon SageMaker is a managed toolkit to build, train and deploy machine learning models on AWS. Explore in Studio/notebooks → run a training job → deploy an endpoint or use batch transform. A training job writes model.tar.gz style artifacts to S3; an endpoint serves HTTPS predictions.
Revision card: What is Amazon SageMaker? · Download PNG · Open card page

Lesson: What Is Amazon SageMaker? Machine Learning on AWS Explained

Revision card: SageMaker bill traps. Notebooks and endpoints bill while InService — easy to forget overnight. Stop or delete notebook instances and endpoints after demos. Start with tiny data and small instance types. Before any lab: set a budget alert; prefer auto-shutdown; never leave ml.g* GPUs running “just in case”. Cost Explorer shows endpoint hours drop to zero after delete; no surprise morning bill.
Revision card: SageMaker bill traps · Download PNG · Open card page

Lesson: What Is Amazon SageMaker? Machine Learning on AWS Explained

Revision card: SageMaker vs Bedrock. Teams ask for “AI on AWS” without knowing if they train or just call a model. SageMaker: you train/customize on your labelled data. Bedrock: call managed foundation models via API without training the base model. Fraud score on your rows → SageMaker. Chat/summarise with Claude/Llama-class models → Bedrock. Many apps use both: Bedrock for text, SageMaker for a custom classifier.
Revision card: SageMaker vs Bedrock · Download PNG · Open card page

Lesson: What Is Amazon SageMaker? Machine Learning on AWS Explained

Comparison: Amazon SageMaker vs Amazon Bedrock. Amazon SageMaker: You build/train/deploy models on your data. Amazon Bedrock: Call managed foundation models via API.
Comparison: Amazon SageMaker vs Amazon Bedrock · Download PNG · Open card page

Lesson: What Is Amazon SageMaker? Machine Learning on AWS Explained

Comparison: SageMaker real-time endpoint vs SageMaker batch transform. SageMaker real-time endpoint: Bills while the endpoint stays InService. SageMaker batch transform: Pays for the transform job duration only.
Comparison: SageMaker real-time endpoint vs SageMaker batch transform · Download PNG · Open card page

Lesson: What Is Amazon SageMaker? Machine Learning on AWS Explained

Interview card: Three pillars of SageMaker?. Build (notebooks/Studio), train (training jobs), deploy (endpoints or batch). Interviewers expect this map before feature-name soup. Notebook explore → Training job → Endpoint InService (then delete after demo).
Interview card: Three pillars of SageMaker? · Download PNG · Open card page

Lesson: What Is Amazon SageMaker? Machine Learning on AWS Explained

Interview card: Real-time endpoint vs batch transform?. Endpoint = always-on HTTPS model for live traffic (bills while InService). Batch transform = score a dataset offline and stop paying when the job ends. Chatty API scores → endpoint; nightly score 1M rows → batch transform.
Interview card: Real-time endpoint vs batch transform? · Download PNG · Open card page

Lesson: What Is Amazon SageMaker? Machine Learning on AWS Explained

What Is Amazon Bedrock? Generative AI APIs on AWS Explained

Revision card: What is Amazon Bedrock?. Support bots need summarise and reply drafts in a weekend — not years to train a giant model. Amazon Bedrock lets apps call foundation models (Claude, Llama, Titan and more) through AWS APIs and IAM. Enable model access in console → call bedrock-runtime with an IAM role that allows InvokeModel on specific model IDs. A short prompt returns a completion; you store the result in DynamoDB or S3 if needed.
Revision card: What is Amazon Bedrock? · Download PNG · Open card page

Lesson: What Is Amazon Bedrock? Generative AI APIs on AWS Explained

Revision card: Tokens and cost discipline. Long prompts, long answers, and unbounded test loops create surprise bills. You usually pay per input token and per output token. Keep max_tokens small in labs; set AWS Budgets. Enable one cheap model, budget alert (e.g. $5), never put Bedrock in an infinite loop. Ten short test calls stay cheap; a loop of 100k-token dumps does not.
Revision card: Tokens and cost discipline · Download PNG · Open card page

Lesson: What Is Amazon Bedrock? Generative AI APIs on AWS Explained

Revision card: Guardrails and IAM. Prompts can leak PII; wildcard model access is too broad. Bedrock Guardrails filter topics/PII patterns. IAM should allow InvokeModel only on the model ARNs you need. Attach a policy with bedrock:InvokeModel on one model ARN; add a Guardrail in console for the app use case. A denied model ID fails closed; a Guardrail blocks a disallowed topic before it reaches users.
Revision card: Guardrails and IAM · Download PNG · Open card page

Lesson: What Is Amazon Bedrock? Generative AI APIs on AWS Explained

Comparison: Bedrock token pricing vs SageMaker instance hours. Bedrock token pricing: Pay per input/output tokens of each call. SageMaker instance hours: Pay for notebook/training/endpoint instance time.
Comparison: Bedrock token pricing vs SageMaker instance hours · Download PNG · Open card page

Lesson: What Is Amazon Bedrock? Generative AI APIs on AWS Explained

Interview card: Bedrock or SageMaker for a chatbot?. If a managed foundation model API is enough, Bedrock. If you must train a custom model on your labels, SageMaker. Chat/summarise is the classic Bedrock fit. InvokeModel on Claude/Llama-class models via Bedrock; keep tokens bounded.
Interview card: Bedrock or SageMaker for a chatbot? · Download PNG · Open card page

Lesson: What Is Amazon Bedrock? Generative AI APIs on AWS Explained

Interview card: Why can InvokeModel fail with access errors?. Model access may be off in the account/region, or IAM lacks bedrock:InvokeModel on that model ARN. Regions differ; always verify model availability where you call. Console Model access enable + IAM Allow InvokeModel on specific model ID.
Interview card: Why can InvokeModel fail with access errors? · Download PNG · Open card page

Lesson: What Is Amazon Bedrock? Generative AI APIs on AWS Explained

IAM deep-dive cards

Revision, X vs Y and interview cards for the 9 IAM deep-dive chapters (roles, STS, Identity Center, AD, admin, policies).

What Is an AWS IAM Role and When to Use It

Revision card: What is an IAM role?. At Infosys Pune a visitor gets a time-bound pass for one floor — not a lifelong office badge. Compute needs the same pattern. An IAM role is an identity with no long-lived password or access key. A caller assumes it and STS returns temporary credentials. Create the role, attach a permissions policy, set a trust policy for who may assume, then let EC2/Lambda/CLI assume it. An EC2 instance profile role lets the instance call S3 with rotating keys from the metadata service — no keys on disk.
Revision card: What is an IAM role? · Download PNG · Open card page

Lesson: What Is an AWS IAM Role and When to Use It

Revision card: Trust vs permissions policy. Mixing “who may wear the jacket” with “what the jacket allows” causes AccessDenied you cannot debug. Trust policy (resource-based on the role) lists who may AssumeRole. Permissions policy lists Actions/Resources the session may call. Edit trust Principal (user/role/service ARN or account). Attach customer-managed permissions separately. Trust Principal = your IAM user; permissions allow s3:GetObject on one lab bucket only.
Revision card: Trust vs permissions policy · Download PNG · Open card page

Lesson: What Is an AWS IAM Role and When to Use It

Revision card: When to use a role. Long-lived access keys on EC2 or in GitHub are how student accounts get hijacked. Prefer roles for EC2, Lambda, cross-account access, and humans via Identity Center. Use IAM users sparingly for break-glass or old tools. Attach an instance profile / execution role / permission set instead of creating an access key. Lambda reads DynamoDB with its execution role; you never paste a secret key into the function code.
Revision card: When to use a role · Download PNG · Open card page

Lesson: What Is an AWS IAM Role and When to Use It

Comparison: IAM role vs IAM user. IAM role: No long-lived password/key; assumed for temporary STS credentials. IAM user: Named identity with password and/or long-lived access keys until deleted.
Comparison: IAM role vs IAM user · Download PNG · Open card page

Lesson: What Is an AWS IAM Role and When to Use It

Interview card: User vs role — what is the difference?. An IAM user is a named long-lived identity (password and/or access keys until you delete them). An IAM role has no long-lived password/key; you assume it for temporary STS credentials. Long-lived keys on disks and in Git history are a common breach path. Roles rotate automatically via STS and shrink blast radius when leaked. EC2 and Lambda use roles (instance profile / execution role). Humans increasingly use Identity Center, which also assumes roles under the hood.
Interview card: User vs role — what is the difference? · Download PNG · Open card page

Lesson: What Is an AWS IAM Role and When to Use It

Interview card: Trust policy vs permissions policy?. Trust policy answers who may call sts:AssumeRole on this role. Permissions policy answers what API actions the resulting session may perform on which resources. A perfect S3 permissions policy still fails if trust Principal does not include the caller. Wrong trust is a top lab AccessDenied cause. Example: trust Principal = arn:aws:iam::111:user/ravi; permissions Resource = arn:aws:s3:::lab-bucket/* with s3:GetObject.
Interview card: Trust policy vs permissions policy? · Download PNG · Open card page

Lesson: What Is an AWS IAM Role and When to Use It

AWS IAM Roles: 10 Practical Examples Step by Step

EC2 reads S3 with a role. Keys in ~/.aws/credentials on a server leak through Git and AMIs. Like a flat key copied by every tenant. An instance profile wraps a role. EC2 gets rotating keys from the metadata service. Create role → trust ec2.amazonaws.com → attach S3 read → Actions → Security → Modify IAM role. On the instance: aws sts get-caller-identity shows assumed-role/…/i-0abc.
Revision card: EC2 reads S3 with a role · Download PNG · Open card page
ECS: two roles. ECS needs to pull the image and your app needs DynamoDB. One role for both gives too much power. Execution role = ECS agent (ECR pull, logs). Task role = your code (DynamoDB, S3). Trust ecs-tasks.amazonaws.com in both. Set both ARNs in the task definition. CannotPullContainerError = execution role. AccessDenied from app = task role.
Revision card: ECS: two roles · Download PNG · Open card page
GitHub Actions with OIDC. Storing AWS keys in GitHub secrets means long-lived keys that anyone with repo admin can misuse. GitHub issues an OIDC token. AWS trusts it and returns short STS credentials. Add provider token.actions.githubusercontent.com → role with sub condition repo:org/repo:ref:refs/heads/main. Workflow: permissions id-token: write + aws-actions/configure-aws-credentials with role-to-assume.
Revision card: GitHub Actions with OIDC · Download PNG · Open card page
Why ExternalId in cross-account trust?. A secret-like value the vendor must send in sts:AssumeRole. Your trust policy checks it. It stops the confused deputy problem: another customer cannot trick the vendor into using your role. Condition StringEquals sts:ExternalId = "pune-acme-7731" in the trust policy.
Interview card: Why ExternalId in cross-account trust? · Download PNG · Open card page
What is a service-linked role?. A role created and owned by an AWS service, with a fixed trust and policy you cannot edit. The service needs exact rights to work. You cannot accidentally break it. Example: AWSServiceRoleForAutoScaling. Delete only after the service stops using it.
Interview card: What is a service-linked role? · Download PNG · Open card page
How does the SDK find role credentials?. A fixed search order: env vars → shared config/profile → web identity → container → EC2 metadata. Old AWS_ACCESS_KEY_ID in env silently beats the role. Many "wrong account" bugs come from this. Unset env keys, then run aws sts get-caller-identity to see who you really are.
Interview card: How does the SDK find role credentials? · Download PNG · Open card page
IAM role vs Access keys. Temporary STS keys that rotate by themselves. / Long-lived keys that stay valid until you delete them.
Comparison: IAM role vs Access keys · Download PNG · Open card page
Task role vs Execution role. Your container code calls AWS (DynamoDB, S3). / The ECS agent pulls the image and writes logs.
Comparison: Task role vs Execution role · Download PNG · Open card page

Lesson: AWS IAM Roles: 10 Practical Examples Step by Step

AWS STS Temporary Credentials and AssumeRole Explained

Revision card: What is AWS STS?. Zomato partners get a one-shift locker code — not the master key forever. APIs need short unlock codes too. AWS Security Token Service mints temporary security credentials. AssumeRole is the common API: wear this role for N seconds. Caller proves identity → STS checks role trust → returns AccessKeyId, SecretAccessKey, SessionToken, Expiration. After Expiration, S3 calls fail until you AssumeRole again — that expiry is the safety feature.
Revision card: What is AWS STS? · Download PNG · Open card page

Lesson: AWS STS Temporary Credentials and AssumeRole Explained

Revision card: The three STS pieces. Students export only key and secret and wonder why every call is InvalidClientTokenId. STS sessions need AccessKeyId, SecretAccessKey, and SessionToken together. The token proves the creds came from STS. Export AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and AWS_SESSION_TOKEN from the AssumeRole response. aws sts get-caller-identity with all three shows the assumed-role ARN, not your long-lived user alone.
Revision card: The three STS pieces · Download PNG · Open card page

Lesson: AWS STS Temporary Credentials and AssumeRole Explained

Revision card: Duration and session name. A 12-hour leaked lab session is worse than a 15-minute one. CloudTrail needs a name that is not “temp”. DurationSeconds is how long the temp creds live (role max and caller limits apply; labs often use 900). RoleSessionName appears in CloudTrail. Pass --duration-seconds 900 and a clear --role-session-name like ravindra-lab1 on AssumeRole. CloudTrail shows ravindra-lab1 assuming the role; after 15 minutes the same exported keys stop working.
Revision card: Duration and session name · Download PNG · Open card page

Lesson: AWS STS Temporary Credentials and AssumeRole Explained

Comparison: AssumeRole vs GetSessionToken. AssumeRole: Switches into a role (new identity ARN). GetSessionToken: Stays the same IAM user; often after MFA.
Comparison: AssumeRole vs GetSessionToken · Download PNG · Open card page

Lesson: AWS STS Temporary Credentials and AssumeRole Explained

Interview card: What does AssumeRole return?. AssumeRole returns AccessKeyId, SecretAccessKey, SessionToken, and Expiration. All three secret values must be used together until Expiration. Missing SessionToken makes API calls fail even if key and secret look valid. Expired sessions fail until you AssumeRole again. aws sts assume-role … then export the three fields and call aws sts get-caller-identity to see the assumed-role ARN.
Interview card: What does AssumeRole return? · Download PNG · Open card page

Lesson: AWS STS Temporary Credentials and AssumeRole Explained

Interview card: AssumeRole vs GetSessionToken?. AssumeRole switches you into a role (different identity). GetSessionToken usually upgrades the same IAM user (often after MFA) without changing to a role. Cross-account and EC2/Lambda patterns use AssumeRole. MFA-protected CLI as the same user often uses GetSessionToken. Trust policy must allow your principal for AssumeRole; GetSessionToken does not need a role trust policy.
Interview card: AssumeRole vs GetSessionToken? · Download PNG · Open card page

Lesson: AWS STS Temporary Credentials and AssumeRole Explained

Get Temporary AWS Credentials with STS Step by Step

Revision card: Lab: role with tight trust. A permissions policy that looks perfect still fails AssumeRole if trust Principal is wrong. Create a customer-managed S3-read policy for one lab bucket, a role whose trust Principal is your IAM user (or role), then attach the policy. IAM → create policy → create role (custom trust) → attach policy → note the role ARN. aws sts assume-role --role-arn … succeeds; a wrong account Principal returns AccessDenied.
Revision card: Lab: role with tight trust · Download PNG · Open card page

Lesson: Get Temporary AWS Credentials with STS Step by Step

Revision card: AssumeRole and prove access. Without a prove step, you do not know if the session is the role or still your admin user. Export the three STS values, call get-caller-identity, list the lab bucket (allow), then try a bucket outside the policy (deny). eval or export the credentials JSON fields, then aws s3 ls on the lab bucket and on an unrelated bucket. Caller identity ARN contains assumed-role; lab bucket lists; other bucket is AccessDenied.
Revision card: AssumeRole and prove access · Download PNG · Open card page

Lesson: Get Temporary AWS Credentials with STS Step by Step

Revision card: Clean up the STS lab. Forgotten roles and buckets clutter the account and confuse the next lab. Unset the temporary env vars, detach/delete the lab role and customer policy, empty and delete the lab bucket the same day. unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY AWS_SESSION_TOKEN; delete role; delete policy; delete bucket. get-caller-identity is your normal user again; IAM Roles list no longer shows the lab role.
Revision card: Clean up the STS lab · Download PNG · Open card page

Lesson: Get Temporary AWS Credentials with STS Step by Step

Interview card: Why set RoleSessionName and short duration?. RoleSessionName shows up in CloudTrail so you can audit which lab or person assumed the role. Short DurationSeconds (e.g. 900) shrinks the leak window. A vague name like “temp” and a 12-hour duration make incidents harder to trace and worse when a laptop is stolen. aws sts assume-role --role-session-name ravindra-lab1 --duration-seconds 900 …
Interview card: Why set RoleSessionName and short duration? · Download PNG · Open card page

Lesson: Get Temporary AWS Credentials with STS Step by Step

Interview card: AssumeRole AccessDenied but policy looks fine?. Check the role trust policy Principal and Conditions first. Permissions policy is evaluated after a successful assume. Also confirm your caller identity is allowed sts:AssumeRole and that ExternalId/MFA conditions match what you pass on the CLI. Fix Principal to your user/role ARN, retry assume-role, then test S3 with the session token.
Interview card: AssumeRole AccessDenied but policy looks fine? · Download PNG · Open card page

Lesson: Get Temporary AWS Credentials with STS Step by Step

What Is AWS IAM Identity Center (SSO) Explained

Revision card: What is IAM Identity Center?. Flipkart staff do not carry a separate metal key for every warehouse — one badge opens the doors their job needs. IAM Identity Center (successor to AWS SSO) gives workforce users one portal into one or many AWS accounts. Each tile is a permission set that becomes a temporary role. Enable Identity Center, create users/groups (or connect a directory), create permission sets, assign them to accounts, sign in at the portal URL. One login shows tiles for Account A ReadOnly and Account B PowerUser; each click starts an STS session.
Revision card: What is IAM Identity Center? · Download PNG · Open card page

Lesson: What Is AWS IAM Identity Center (SSO) Explained

Revision card: Portal, permission set, assignment. Interview answers fail when “permission set” is confused with “IAM user policy” or “group”. Permission set = reusable policy pack that materializes as a role in each assigned account. Assignment links user/group + permission set + account. Portal URL is the sign-in page. Create a ReadOnlyAccess permission set, assign your group to the lab account, open the portal bookmark. The portal lists your account with a ReadOnly tile; AWS access portal shows the role session start.
Revision card: Portal, permission set, assignment · Download PNG · Open card page

Lesson: What Is AWS IAM Identity Center (SSO) Explained

Revision card: Identity Center vs IAM users. Creating an IAM user per person per account does not scale and leaves long-lived keys behind. Identity Center: one human identity, temporary roles per account. IAM users: long-lived per-account identities (use sparingly). Compute still uses IAM roles, not Identity Center. Move humans to Identity Center permission sets; keep IAM users only for break-glass or legacy tools that cannot SSO. New hire gets one Identity Center user and group membership — not five IAM users across five accounts.
Revision card: Identity Center vs IAM users · Download PNG · Open card page

Lesson: What Is AWS IAM Identity Center (SSO) Explained

Comparison: IAM Identity Center vs IAM users. IAM Identity Center: One portal login; permission sets become temporary roles per account. IAM users: Long-lived per-account identities; access keys common.
Comparison: IAM Identity Center vs IAM users · Download PNG · Open card page

Lesson: What Is AWS IAM Identity Center (SSO) Explained

Interview card: Identity Center vs IAM user for humans?. Identity Center: one login, temporary roles via permission sets across accounts. IAM user: long-lived identity usually scoped to one account. Fleets of IAM users do not scale and encourage access keys. Prefer Identity Center for workforce access. Example: one IC user in group Developers with PowerUser on dev and ReadOnly on prod — not two IAM users with keys.
Interview card: Identity Center vs IAM user for humans? · Download PNG · Open card page

Lesson: What Is AWS IAM Identity Center (SSO) Explained

Interview card: What is a permission set?. A permission set is Identity Center’s reusable policy pack. When assigned to an account, it materializes as an IAM role with those policies for temporary sessions. It is not the same as an IAM group policy alone; assignment also needs a user/group and a target account to show a portal tile. Create ReadOnlyAccess permission set → assign to lab account → portal shows the tile → session uses the generated role.
Interview card: What is a permission set? · Download PNG · Open card page

Lesson: What Is AWS IAM Identity Center (SSO) Explained

Set Up AWS IAM Identity Center (SSO) Step by Step

Revision card: Enable Identity Center lab path. Students search “SSO” in the wrong region or account and think the product is missing. Enable IAM Identity Center in your org’s chosen Region (often the management account). Save the AWS access portal URL. Console → IAM Identity Center → enable → copy portal URL to your notes. Portal URL opens a sign-in page; Identity Center dashboard shows enabled.
Revision card: Enable Identity Center lab path · Download PNG · Open card page

Lesson: Set Up AWS IAM Identity Center (SSO) Step by Step

Revision card: User, permission set, assign. A permission set with no account assignment never appears as a portal tile. Create a user and group in the Identity Center directory, create a ReadOnly permission set, assign group + set to the lab account. Users → Groups → Permission sets → AWS accounts → assign users/groups. Sign in at the portal; the lab account shows a ReadOnly tile you can click.
Revision card: User, permission set, assign · Download PNG · Open card page

Lesson: Set Up AWS IAM Identity Center (SSO) Step by Step

Revision card: CLI with aws sso login. Pasting portal cookies into the CLI is not the supported path and breaks easily. Configure an SSO profile (start URL, region, account, role) then aws sso login to cache temporary credentials via STS. aws configure sso → browser login → aws sts get-caller-identity --profile your-sso-profile. Caller identity shows the permission-set role ARN; no long-lived access key was created for the human.
Revision card: CLI with aws sso login · Download PNG · Open card page

Lesson: Set Up AWS IAM Identity Center (SSO) Step by Step

Interview card: Why start with ReadOnly permission set?. Least privilege while you learn the portal and CLI flow. AdministratorAccess for everyone turns a click mistake into an outage. Daily work should stay on ReadOnly or job-scoped PowerUser. Broad admin belongs on break-glass only. Lab: attach AWS managed ReadOnlyAccess (or tighter customer managed) first; add PowerUser only for a group that needs it.
Interview card: Why start with ReadOnly permission set? · Download PNG · Open card page

Lesson: Set Up AWS IAM Identity Center (SSO) Step by Step

Interview card: What does aws sso login do?. It opens (or uses) the browser login to Identity Center and caches temporary credentials for a named SSO profile via STS — not a new long-lived access key. Without it, CLI calls with an SSO profile fail because no fresh session is cached. aws configure sso once, then aws sso login and aws sts get-caller-identity --profile … before lab commands.
Interview card: What does aws sso login do? · Download PNG · Open card page

Lesson: Set Up AWS IAM Identity Center (SSO) Step by Step

Connect Active Directory to AWS IAM Identity Center

Revision card: Active Directory and AWS. A Pune IT park company already has AD for laptops. A second password list only for AWS is how offboarding fails. Active Directory holds company users/groups. Identity Center can use its own Identity Store, or federate AD / Entra ID so hire/fire updates AWS access too. Pick an identity source in Identity Center: Identity Store (lab), or external IdP / AD integration for companies. Corporate AD groups map to Identity Center assignments so leaving the company removes AWS tiles.
Revision card: Active Directory and AWS · Download PNG · Open card page

Lesson: Connect Active Directory to AWS IAM Identity Center

Revision card: Managed AD vs Connector vs IdP. Students launch Managed Microsoft AD “to try SSO” and leave a billed directory running all month. AWS Managed Microsoft AD = AD as a service. AD Connector = proxy to existing on-prem AD. External IdP (e.g. Entra ID) often talks to Identity Center via SAML/OIDC. For class labs stay on Identity Center Identity Store. Use Managed AD only when you truly need AD and delete it after. Identity Store users can still learn SSO without any Managed AD charges.
Revision card: Managed AD vs Connector vs IdP · Download PNG · Open card page

Lesson: Connect Active Directory to AWS IAM Identity Center

Revision card: AD authenticates; permission sets authorize. Thinking “AD replaces IAM policies” leaves accounts either locked or wide open. AD (or Entra ID) proves who you are (authentication). Identity Center permission sets decide what you may do in AWS (authorization). Connect or federate the directory, then still create least-privilege permission sets and account assignments. Finance AD group gets Billing permission set only; Developers get PowerUser on the dev account only.
Revision card: AD authenticates; permission sets authorize · Download PNG · Open card page

Lesson: Connect Active Directory to AWS IAM Identity Center

Comparison: AD Connector vs AWS Managed Microsoft AD. AD Connector: Proxy to your existing on-prem Active Directory. AWS Managed Microsoft AD: AD delivered as an AWS-managed directory service.
Comparison: AD Connector vs AWS Managed Microsoft AD · Download PNG · Open card page

Lesson: Connect Active Directory to AWS IAM Identity Center

Interview card: AD Connector vs Managed Microsoft AD?. AD Connector proxies authentication to your existing on-prem AD. AWS Managed Microsoft AD is Active Directory delivered as an AWS-managed service (its own directory). Managed AD costs money even when idle. Students should not leave it running after a curiosity click. Class SSO learning: Identity Center Identity Store. Corporate already-on-AD: Connector or external IdP patterns — not “always Managed AD”.
Interview card: AD Connector vs Managed Microsoft AD? · Download PNG · Open card page

Lesson: Connect Active Directory to AWS IAM Identity Center

Interview card: Does AD replace permission sets?. No. AD (or Entra ID) authenticates who you are. Permission sets authorize what you may do in AWS after sign-in. Connecting AD without least-privilege permission sets can grant everyone broad AWS admin through a single group mistake. Map AD groups to tight permission sets per account (e.g. Developers → PowerUser on dev only).
Interview card: Does AD replace permission sets? · Download PNG · Open card page

Lesson: Connect Active Directory to AWS IAM Identity Center

AWS IAM Administrator Best Practices: Root, MFA and Break-Glass

Revision card: Root user: rare, MFA, no keys. Your flat’s main door key is not lent to the delivery person every day. Root is that main door for the AWS account. The root user is the account email+password. It bypasses almost every IAM deny. Enable MFA, never create root access keys, use root only for a short break-glass list. First hour on a new account: root MFA, confirm no root keys, set billing contacts, enable CloudTrail, create an admin path that is not daily root. Root sign-in shows MFA challenge; IAM credential report shows no root access keys.
Revision card: Root user: rare, MFA, no keys · Download PNG · Open card page

Lesson: AWS IAM Administrator Best Practices: Root, MFA and Break-Glass

Revision card: Break-glass admin path. When SSO is down, teams without a planned emergency admin either stay locked out or share root passwords on WhatsApp. Break-glass is a rare emergency admin role or user with MFA, tight monitoring, and a written procedure — not daily AdministratorAccess for everyone. Document who may use it, require MFA, alert on AssumeRole/console login, practice once, then keep it unused. CloudTrail shows a break-glass AssumeRole only during a drill; daily work stays on ReadOnly/PowerUser permission sets.
Revision card: Break-glass admin path · Download PNG · Open card page

Lesson: AWS IAM Administrator Best Practices: Root, MFA and Break-Glass

Revision card: Daily IAM admin habits. Least privilege without CloudTrail is guesswork after an incident. Prefer Identity Center for humans, roles for compute, MFA everywhere, permission boundaries when delegating, and CloudTrail in every account/region you use. Turn on organization CloudTrail (or at least multi-Region trail), review IAM Access Analyzer findings, remove unused keys. A new Lambda uses an execution role; humans use portal tiles; root stays locked with MFA.
Revision card: Daily IAM admin habits · Download PNG · Open card page

Lesson: AWS IAM Administrator Best Practices: Root, MFA and Break-Glass

Comparison: Root user vs Break-glass admin. Root user: Account owner email+password; bypasses almost all IAM denies. Break-glass admin: Planned emergency admin role/user with MFA and audit.
Comparison: Root user vs Break-glass admin · Download PNG · Open card page

Lesson: AWS IAM Administrator Best Practices: Root, MFA and Break-Glass

Interview card: Why not use root daily?. Root has unlimited power and bypasses almost every IAM deny. A phishing or malware hit on a daily root session can close the account, change billing, or wipe resources. Use MFA on root, never create root access keys, and reserve root for a short documented list (account settings, some billing changes). Daily admin via Identity Center or an IAM admin role with MFA; root stays in a sealed process.
Interview card: Why not use root daily? · Download PNG · Open card page

Lesson: AWS IAM Administrator Best Practices: Root, MFA and Break-Glass

Interview card: What is a break-glass admin?. A planned emergency access path (role or user) with MFA, monitoring, and a written procedure for when SSO or normal admin paths fail. Without it, outages push people to share root passwords. With it, you recover under CloudTrail instead of chaos. Practice once a quarter, alert on use, keep daily work on least-privilege permission sets.
Interview card: What is a break-glass admin? · Download PNG · Open card page

Lesson: AWS IAM Administrator Best Practices: Root, MFA and Break-Glass

AWS IAM Policies: JSON, Managed, Inline and Conditions Explained

Revision card: IAM policy JSON fields. Society notice: clubhouse Allow 6 a.m.–10 p.m. (Condition). IAM policies read the same way. Policy JSON: Version, Statement, Effect, Action, Resource, optional Condition. Use Version 2012-10-17 for modern conditions. Allow only the exact Actions and ARNs you need; add Condition for IP, MFA, time or tags. Allow s3:GetObject on arn:aws:s3:::lab-bucket/* — one bucket’s objects, not s3:*.
Revision card: IAM policy JSON fields · Download PNG · Open card page

Lesson: AWS IAM Policies: JSON, Managed, Inline and Conditions Explained

Revision card: Managed vs inline policies. Inline-only sprawl makes the same S3-read rule impossible to update in one place. AWS managed = AWS-maintained broad policies. Customer managed = your reusable JSON. Inline = glued to one user/role/group. Prefer customer-managed policies for labs and apps; use AWS managed carefully (often too broad); use inline sparingly. One customer-managed ReadLabBucket attached to two roles updates both when you edit the policy once.
Revision card: Managed vs inline policies · Download PNG · Open card page

Lesson: AWS IAM Policies: JSON, Managed, Inline and Conditions Explained

Revision card: Explicit Deny always wins. Students think “I attached AdministratorAccess so Deny cannot matter” — then SCP or explicit Deny blocks them. Default deny means no Allow. Explicit Deny overrides any Allow. Evaluation checks all applicable policies including SCPs and boundaries. Use explicit Deny to document “never from outside this IP” even if a future broad Allow appears. Allow s3:* plus Deny s3:DeleteObject still blocks deletes — Deny wins.
Revision card: Explicit Deny always wins · Download PNG · Open card page

Lesson: AWS IAM Policies: JSON, Managed, Inline and Conditions Explained

Comparison: Customer managed policy vs Inline policy. Customer managed policy: Reusable JSON attached to many users/roles/groups; edit once. Inline policy: Glued to one identity; copy-paste to reuse.
Comparison: Customer managed policy vs Inline policy · Download PNG · Open card page

Lesson: AWS IAM Policies: JSON, Managed, Inline and Conditions Explained

Interview card: Explicit Deny vs default deny?. Default deny: if nothing Allows the action, it is denied. Explicit Deny: a Deny statement overrides any Allow from other policies. SCPs, permission boundaries, and resource policies participate too — an Allow on the role is not the whole story. Allow s3:* plus Deny s3:DeleteBucket still blocks delete — Deny wins. Missing Allow alone is enough to deny ListBucket.
Interview card: Explicit Deny vs default deny? · Download PNG · Open card page

Lesson: AWS IAM Policies: JSON, Managed, Inline and Conditions Explained

Interview card: Managed vs inline — when to use which?. Customer managed: reusable, editable in one place — default for apps/labs. AWS managed: convenient but often broad. Inline: one identity only — use sparingly. Trust policies on roles are resource-based JSON on the role, separate from identity-based managed/inline permissions. Put ReadLabBucket as customer managed; attach to several roles; avoid copying the same inline JSON five times.
Interview card: Managed vs inline — when to use which? · Download PNG · Open card page

Lesson: AWS IAM Policies: JSON, Managed, Inline and Conditions Explained

Write an IAM Policy with Conditions Step by Step

Revision card: Write a policy with Condition. An Allow without Condition is true from a café Wi-Fi if the key leaks. Conditions shrink when it applies. Customer-managed policy: Allow s3:ListBucket/GetObject on one lab bucket only when aws:SourceIp matches your /32 (or Bool aws:MultiFactorAuthPresent true). IAM → create policy JSON with Condition block → attach to a lab role → AssumeRole and test. From your IP (or with MFA) list works; from CloudShell or without MFA you see AccessDenied if that was the Condition.
Revision card: Write a policy with Condition · Download PNG · Open card page

Lesson: Write an IAM Policy with Conditions Step by Step

Revision card: Prove allow and deny paths. Only testing the happy path hides a broken Condition that never denies. With the conditioned role: succeed on the lab bucket from the allowed context; fail from a disallowed context (other IP, no MFA, or wrong region). Run aws s3 ls twice — once meeting the Condition, once violating it — and watch CloudTrail if available. Same role ARN, two outcomes: Allow when Condition matches, AccessDenied when it does not.
Revision card: Prove allow and deny paths · Download PNG · Open card page

Lesson: Write an IAM Policy with Conditions Step by Step

Revision card: Clean up the Condition lab. Lab policies left attached to shared roles surprise the next student with random AccessDenied. Detach and delete the customer-managed policy, delete the lab role, empty and delete the lab bucket the same day in ap-south-1. IAM Policies → delete; Roles → delete; S3 → empty → delete bucket. IAM no longer lists the lab policy name; S3 console has no lab bucket.
Revision card: Clean up the Condition lab · Download PNG · Open card page

Lesson: Write an IAM Policy with Conditions Step by Step

Interview card: Why add Condition to an Allow?. Condition narrows when an Allow applies (IP, MFA, tags, region). Without it, a leaked key works from anywhere the network allows. Each statement needs the Condition that should apply; Boolean MFA values are strings "true"/"false" in IAM JSON. Lab: Allow s3:GetObject only if aws:SourceIp is your /32; prove AccessDenied from CloudShell.
Interview card: Why add Condition to an Allow? · Download PNG · Open card page

Lesson: Write an IAM Policy with Conditions Step by Step

Interview card: ListBucket and GetObject both need care?. ListBucket is on the bucket ARN; GetObject is on object ARNs. Put the right Resource on each statement and attach Condition to each (or carefully combine). Forgetting Condition on ListBucket can leak object keys even when GetObject is locked down. Two statements: ListBucket on arn:…:bucket/lab and GetObject on arn:…:bucket/lab/* — both with the same SourceIp Condition.
Interview card: ListBucket and GetObject both need care? · Download PNG · Open card page

Lesson: Write an IAM Policy with Conditions Step by Step

AWS CLI cards

Revision, X vs Y and interview cards for the AWS CLI chapters. Every card has a QR code to its lesson.

How to Install and Configure AWS CLI v2: Profiles, SSO and Regions

Install AWS CLI v2. Clicking in the console is slow and hard to repeat. Like cooking without a recipe. AWS CLI v2 is one tool that calls every AWS API from your terminal. Linux: download awscliv2.zip, unzip, sudo ./aws/install. Verify: version shows aws-cli/2.x.
Revision card: Install AWS CLI v2 · Download PNG · Open card page
Profiles and SSO. One laptop, many accounts: dev, test, prod. Mixing them is dangerous. A profile is a named set of credentials and region in ~/.aws/config. aws configure sso → aws sso login --profile dev. Check: aws sts get-caller-identity --profile dev.
Revision card: Profiles and SSO · Download PNG · Open card page
Access keys vs SSO profile. Long-lived keys saved in ~/.aws/credentials. / Short-lived keys from aws sso login.
Comparison: Access keys vs SSO profile · Download PNG · Open card page
Which credentials does the CLI use first?. A fixed order: command options, env vars, SSO/profile files, then container or EC2 role. Old env keys silently win and send you to the wrong account. Run aws configure list to see the source of each value.
Interview card: Which credentials does the CLI use first? · Download PNG · Open card page

Lesson: How to Install and Configure AWS CLI v2: Profiles, SSO and Regions

AWS CLI Output Formats, --query (JMESPath), Filters, Pagination and Waiters

Shape output with --query. Raw JSON is long. You need just one value for a script. --query uses JMESPath to pick fields on your machine. Add --output text for scripts, table for humans. Example: list running IDs only.
Revision card: Shape output with --query · Download PNG · Open card page
Pagination and waiters. Big lists come in pages. Scripts break if they continue too early. CLI auto-pages. aws ... wait blocks until a state is reached. Use --max-items and --starting-token for control. Use --filters to filter on the server side.
Revision card: Pagination and waiters · Download PNG · Open card page
json vs text. Full nested data. / Tab-separated values.
Comparison: json vs text · Download PNG · Open card page
--query vs --filters?. --filters runs on the AWS side; --query runs on your machine. Filters cut data sent; query shapes what you see. Use both: filter running, then query IDs.
Interview card: --query vs --filters? · Download PNG · Open card page

Lesson: AWS CLI Output Formats, --query (JMESPath), Filters, Pagination and Waiters

AWS CLI EC2 Commands with Examples

Launch EC2 from the CLI. You need the same server again and again. Clicks forget a setting. run-instances creates instances from AMI, type, key, SG and subnet. Get the AMI from SSM, add tags, then wait instance-running. Verify with describe-instances --query PublicIpAddress.
Revision card: Launch EC2 from the CLI · Download PNG · Open card page
Stop, start, terminate. Idle servers cost money every hour. stop keeps the disk; terminate deletes the instance. Find by tag: --filters Name=tag:Name,Values=web. Protect prod: modify-instance-attribute --disable-api-termination.
Revision card: Stop, start, terminate · Download PNG · Open card page
stop-instances vs terminate-instances. Turns the server off; disk stays. / Deletes the instance forever.
Comparison: stop-instances vs terminate-instances · Download PNG · Open card page
What does --dry-run do on EC2?. It checks permissions without making the change. Success shows DryRunOperation; no rights shows UnauthorizedOperation. Use before run-instances or terminate in scripts.
Interview card: What does --dry-run do on EC2? · Download PNG · Open card page

Lesson: AWS CLI EC2 Commands with Examples

AWS CLI S3 Commands: cp, sync and s3api Examples

S3 cp and sync. Uploading a site folder file by file is slow. cp copies what you name; sync copies only changed files. --delete removes files gone from source. Use --dryrun first. Verify: aws s3 ls s3://b --recursive --summarize.
Revision card: S3 cp and sync · Download PNG · Open card page
Secure S3 with s3api. Public buckets leak data. Deletes by mistake lose data. s3api exposes every API: versioning, encryption, public block. put-public-access-block with all four flags true. Share privately: aws s3 presign --expires-in 3600.
Revision card: Secure S3 with s3api · Download PNG · Open card page
aws s3 vs aws s3api. High-level file commands. / One command per S3 API.
Comparison: aws s3 vs aws s3api · Download PNG · Open card page
Why does aws s3 rb fail?. The bucket is not empty, or versions remain. rb --force empties current objects first. With versioning, delete-objects for all versions first.
Interview card: Why does aws s3 rb fail? · Download PNG · Open card page

Lesson: AWS CLI S3 Commands: cp, sync and s3api Examples

AWS CLI IAM Commands: Users, Groups, Roles and Policies

IAM users and groups. Shared logins hide who did what. One user per person; rights go on groups. create-policy from JSON → attach-group-policy. Test with simulate-principal-policy.
Revision card: IAM users and groups · Download PNG · Open card page
Role with a trust policy. Servers must not store access keys. create-role needs a trust policy that says who may assume it. EC2 needs an instance profile holding the role. Delete order: detach, remove, then delete.
Revision card: Role with a trust policy · Download PNG · Open card page
Managed policy vs Inline policy. A separate object you attach. / Lives inside one identity.
Comparison: Managed policy vs Inline policy · Download PNG · Open card page
How to test a policy safely?. simulate-principal-policy evaluates without doing the action. It returns allowed, explicitDeny or implicitDeny. Pass --action-names and --resource-arns.
Interview card: How to test a policy safely? · Download PNG · Open card page

Lesson: AWS CLI IAM Commands: Users, Groups, Roles and Policies

AWS CLI STS Commands: Assume Role and Session Tokens

assume-role from CLI. Admin rights for 15 minutes are safer than forever. assume-role returns AccessKeyId, Secret and SessionToken. Export all three, then get-caller-identity. Unset the three variables to go back.
Revision card: assume-role from CLI · Download PNG · Open card page
Role profiles. Exporting keys by hand is slow and they expire. role_arn + source_profile make the CLI assume and refresh. Add mfa_serial to ask for an MFA code. Use: aws s3 ls --profile prod-admin.
Revision card: Role profiles · Download PNG · Open card page
assume-role vs get-session-token. Keys for another role. / Keys for yourself with MFA.
Comparison: assume-role vs get-session-token · Download PNG · Open card page
ASIA vs AKIA key IDs?. ASIA = temporary STS keys. AKIA = long-lived user keys. Temporary keys need the SessionToken too. Missing token gives InvalidClientTokenId.
Interview card: ASIA vs AKIA key IDs? · Download PNG · Open card page

Lesson: AWS CLI STS Commands: Assume Role and Session Tokens

AWS CLI VPC Commands: Create a VPC, Subnets and Route Tables

Build a VPC by commands. Click-built networks are hard to repeat. create-vpc, create-subnet, IGW, route table, route. Public = route 0.0.0.0/0 to the internet gateway. Verify routes with describe-route-tables.
Revision card: Build a VPC by commands · Download PNG · Open card page
NAT and clean up. Private servers need updates but no inbound internet. NAT gateway in a public subnet with an Elastic IP. Private route 0.0.0.0/0 → NAT. Wait nat-gateway-available. Delete in reverse: NAT, EIP, SG, routes, IGW, subnets, VPC.
Revision card: NAT and clean up · Download PNG · Open card page
Security group vs Network ACL. Instance level, stateful. / Subnet level, stateless.
Comparison: Security group vs Network ACL · Download PNG · Open card page
Why does delete-vpc fail?. Something still lives in it: ENI, NAT, IGW, subnet or SG. Error is DependencyViolation. Delete children first, VPC last.
Interview card: Why does delete-vpc fail? · Download PNG · Open card page

Lesson: AWS CLI VPC Commands: Create a VPC, Subnets and Route Tables

AWS CLI EBS and AMI Commands: Volumes, Snapshots and Images

Create and attach EBS. Your server needs an extra disk for data. Like plugging in a pen drive. An EBS volume is a network disk in one Availability Zone. create-volume, wait volume-available, then attach-volume. Verify: State in-use, then mkfs and mount inside.
Revision card: Create and attach EBS · Download PNG · Open card page
Snapshots and AMIs. Disks fail. You also want ten copies of a perfect server. Snapshot = incremental disk backup. AMI = launch template of disks. create-image --no-reboot, then wait image-available. Cleanup: deregister AMI, then delete its snapshots.
Revision card: Snapshots and AMIs · Download PNG · Open card page
EBS snapshot vs AMI. Backup of one volume. / Snapshots plus launch settings.
Comparison: EBS snapshot vs AMI · Download PNG · Open card page
Can EBS attach across AZs?. No. Volume and instance must share one AZ. To move it, snapshot then create-volume in the new AZ. Snapshots are regional; copy-snapshot for other regions.
Interview card: Can EBS attach across AZs? · Download PNG · Open card page

Lesson: AWS CLI EBS and AMI Commands: Volumes, Snapshots and Images

AWS CLI ELB Commands: Create an Application Load Balancer

ALB target groups. The load balancer must know which servers are alive. A target group = targets + port + health check path. create-target-group, then register-targets. Verify with describe-target-health: healthy.
Revision card: ALB target groups · Download PNG · Open card page
ALB listeners and rules. Users need one DNS name for many servers. A listener waits on a port and forwards to a target group. Add create-rule with path-pattern /api/*. HTTPS: 443 with ACM cert, redirect 80 to 443.
Revision card: ALB listeners and rules · Download PNG · Open card page
ALB vs NLB. Layer 7, HTTP aware. / Layer 4, TCP and UDP.
Comparison: ALB vs NLB · Download PNG · Open card page
Why are ALB targets unhealthy?. The health check path fails or times out. describe-target-health shows Reason. Check SG allows the ALB SG and app listens on the port.
Interview card: Why are ALB targets unhealthy? · Download PNG · Open card page

Lesson: AWS CLI ELB Commands: Create an Application Load Balancer

AWS CLI Auto Scaling Commands: Launch Templates and Groups

Launch templates. Every new server must start the same way. A launch template stores AMI, type, SG and user data, with versions. Change safely with create-launch-template-version. Verify versions with describe-launch-template-versions.
Revision card: Launch templates · Download PNG · Open card page
Auto Scaling groups. If a server dies at night, a new one must start alone. The group keeps desired between min and max. Add a TargetTracking policy at CPU 50%. New version? start-instance-refresh.
Revision card: Auto Scaling groups · Download PNG · Open card page
Target tracking vs Step scaling. Keeps a metric near a target. / Adds steps per alarm range.
Comparison: Target tracking vs Step scaling · Download PNG · Open card page
EC2 vs ELB health checks?. EC2 checks only that the server is running. ELB checks the app path, so broken apps are replaced. Set a grace period so booting servers are not killed.
Interview card: EC2 vs ELB health checks? · Download PNG · Open card page

Lesson: AWS CLI Auto Scaling Commands: Launch Templates and Groups

AWS CLI RDS Commands: Create, Snapshot and Restore a Database

Create an RDS DB. You want MySQL without installing or patching it. RDS = managed DB. Needs a DB subnet group in private subnets. create-db-instance with --manage-master-user-password. wait db-instance-available, then read Endpoint.Address.
Revision card: Create an RDS DB · Download PNG · Open card page
RDS snapshots. Before a risky change you need a backup. Manual snapshots stay until you delete them. Restore always makes a new instance. Delete with --final-db-snapshot-identifier.
Revision card: RDS snapshots · Download PNG · Open card page
Multi-AZ vs Read replica. Standby copy in another AZ. / Readable copy of the DB.
Comparison: Multi-AZ vs Read replica · Download PNG · Open card page
Multi-AZ vs read replica?. Multi-AZ is a standby for automatic failover. A read replica serves read-only traffic. You can use both together in production.
Interview card: Multi-AZ vs read replica? · Download PNG · Open card page

Lesson: AWS CLI RDS Commands: Create, Snapshot and Restore a Database

AWS CLI DynamoDB Commands: Tables, Put, Get, Query and Scan

DynamoDB put / get. Apps read and write single items all day. Items use type letters: S string, N number. put-item, get-item by full key, update-item, delete-item. Use --condition-expression to avoid overwrites.
Revision card: DynamoDB put / get · Download PNG · Open card page
Query, not scan. Reading the whole table is slow and costly. Query uses the partition key and a sort key range. Scan reads all items, then filters. Need a new pattern? Add a GSI and query it.
Revision card: Query, not scan · Download PNG · Open card page
Query vs Scan. Reads one partition key. / Reads the whole table.
Comparison: Query vs Scan · Download PNG · Open card page
Partition vs sort key?. Partition key picks where data lives. Sort key orders items and allows ranges. Design keys from your access patterns.
Interview card: Partition vs sort key? · Download PNG · Open card page

Lesson: AWS CLI DynamoDB Commands: Tables, Put, Get, Query and Scan

AWS CLI Lambda Commands: Create, Invoke and Update Functions

Create a Lambda. You want code to run only when needed, with no server. Needs an execution role trusted by lambda.amazonaws.com. create-function with --zip-file fileb://fn.zip. invoke with --cli-binary-format raw-in-base64-out.
Revision card: Create a Lambda · Download PNG · Open card page
Versions and aliases. Testing must not change production. publish-version freezes code. An alias points to a version. Change settings with update-function-configuration. Watch logs with aws logs tail /aws/lambda/NAME.
Revision card: Versions and aliases · Download PNG · Open card page
RequestResponse vs Event. Waits for the result. / Returns 202 at once.
Comparison: RequestResponse vs Event · Download PNG · Open card page
Lambda version vs alias?. A version is frozen, numbered code. An alias is a movable pointer like prod. Roll back by pointing the alias to the old version.
Interview card: Lambda version vs alias? · Download PNG · Open card page

Lesson: AWS CLI Lambda Commands: Create, Invoke and Update Functions

AWS CLI API Gateway Commands: Create a REST and HTTP API

Quick HTTP API. You have a Lambda and want a public URL in a minute. create-api --target makes route, integration and stage. Then add-permission for apigateway.amazonaws.com. Verify: curl the execute-api URL.
Revision card: Quick HTTP API · Download PNG · Open card page
REST API deploy. You need API keys or usage plans. create-resource, put-method, put-integration. Nothing is live until create-deployment. Test with test-invoke-method.
Revision card: REST API deploy · Download PNG · Open card page
HTTP API vs REST API. Cheaper, lower latency. / Costs more, more features.
Comparison: HTTP API vs REST API · Download PNG · Open card page
Why 500 after create-api?. Usually the Lambda permission is missing. add-permission with principal apigateway.amazonaws.com. Check source-arn has your API id.
Interview card: Why 500 after create-api? · Download PNG · Open card page

Lesson: AWS CLI API Gateway Commands: Create a REST and HTTP API

AWS CLI CloudWatch Commands: Metrics, Alarms and Logs

CloudWatch alarms. You cannot watch graphs all day. Alarm = threshold + periods + SNS action. States: OK, ALARM, INSUFFICIENT_DATA. Test with set-alarm-state.
Revision card: CloudWatch alarms · Download PNG · Open card page
Logs tail and query. One error hides in millions of lines. Set retention; default never expires. Follow live with a filter. Logs Insights: start-query then get-query-results.
Revision card: Logs tail and query · Download PNG · Open card page
Metrics vs Logs. Numbers over time. / Text lines with time.
Comparison: Metrics vs Logs · Download PNG · Open card page
Why empty Datapoints?. Times must be UTC ISO 8601. Use date -u +%FT%TZ. Dimensions must match exactly.
Interview card: Why empty Datapoints? · Download PNG · Open card page

Lesson: AWS CLI CloudWatch Commands: Metrics, Alarms and Logs

AWS CLI SNS Commands: Create Topic, Subscribe and Publish

SNS publish. Post once, everyone in the group gets it. create-topic, then subscribe endpoints. Email stays pending until clicked. publish returns a MessageId.
Revision card: SNS publish · Download PNG · Open card page
SNS filter policy. Billing wants only payment events. Publish with message attributes. Set FilterPolicy on the subscription. Non-matching messages are skipped.
Revision card: SNS filter policy · Download PNG · Open card page
SNS vs SQS. Push to many subscribers. / Pull by one consumer.
Comparison: SNS vs SQS · Download PNG · Open card page
SNS to SQS not arriving?. Queue policy must allow sns.amazonaws.com. Condition aws:SourceArn = topic ARN. Check FilterPolicy is not dropping it.
Interview card: SNS to SQS not arriving? · Download PNG · Open card page

Lesson: AWS CLI SNS Commands: Create Topic, Subscribe and Publish

AWS CLI SQS Commands: Send, Receive and Delete Messages

SQS message cycle. Like a clinic token line. send, receive, then delete with ReceiptHandle. Undeleted messages return after visibility timeout. Use long polling to save money.
Revision card: SQS message cycle · Download PNG · Open card page
SQS dead-letter queue. A bad message should not block the line. RedrivePolicy with maxReceiveCount. Move messages back with start-message-move-task. purge-queue empties, queue stays.
Revision card: SQS dead-letter queue · Download PNG · Open card page
Standard queue vs FIFO queue. Best-effort order. / Strict order per group.
Comparison: Standard queue vs FIFO queue · Download PNG · Open card page
What is visibility timeout?. Time a received message stays hidden. Set it longer than processing time. Not deleted in time, it is delivered again.
Interview card: What is visibility timeout? · Download PNG · Open card page

Lesson: AWS CLI SQS Commands: Send, Receive and Delete Messages

AWS CLI Route 53 Commands: Hosted Zones and DNS Records

Route 53 UPSERT. Point www at your server IP. Write a change batch JSON. change-resource-record-sets then wait. Verify with test-dns-answer or dig.
Revision card: Route 53 UPSERT · Download PNG · Open card page
Route 53 alias. Apex cannot be a CNAME. Alias A points to ALB, CloudFront, S3. Needs the target HostedZoneId. Alias queries to AWS targets are free.
Revision card: Route 53 alias · Download PNG · Open card page
CNAME vs Alias A. Not allowed at example.com. / Works at example.com.
Comparison: CNAME vs Alias A · Download PNG · Open card page
CNAME vs alias?. CNAME maps a name to a name, not at apex. Alias is Route 53 only and works at apex. Alias to AWS resources is free to query.
Interview card: CNAME vs alias? · Download PNG · Open card page

Lesson: AWS CLI Route 53 Commands: Hosted Zones and DNS Records

AWS CLI ECS and ECR Commands: Push an Image and Run Containers

ECR push. ECS needs a private store for images. create-repository, then docker login. Tag with the repo URI and push. Verify with describe-images.
Revision card: ECR push · Download PNG · Open card page
ECS service. A website must always have 2 copies. register-task-definition = the recipe. create-service keeps desired count. update-service rolls out a new revision.
Revision card: ECS service · Download PNG · Open card page
run-task vs create-service. Once, then stops. / Always, keeps desired count.
Comparison: run-task vs create-service · Download PNG · Open card page
Execution role vs task role?. Execution role: ECS pulls images, writes logs. Task role: your app calls AWS. Mixing them up causes pull or AccessDenied errors.
Interview card: Execution role vs task role? · Download PNG · Open card page

Lesson: AWS CLI ECS and ECR Commands: Push an Image and Run Containers

AWS CLI EKS Commands: Create a Cluster and Connect kubectl

EKS cluster. AWS runs the office; you run the flats. Cluster role trusts eks.amazonaws.com. create-cluster, then wait cluster-active. Connect: update-kubeconfig, kubectl get svc.
Revision card: EKS cluster · Download PNG · Open card page
EKS node group. Pods need machines. Node role: worker, CNI, ECR read. create-nodegroup with scaling-config. Delete node groups before the cluster.
Revision card: EKS node group · Download PNG · Open card page
Managed node group vs Fargate profile. EC2 you can see. / No nodes to see.
Comparison: Managed node group vs Fargate profile · Download PNG · Open card page
kubectl Unauthorized?. Your IAM identity has no access entry. Check with sts get-caller-identity. create-access-entry + associate-access-policy.
Interview card: kubectl Unauthorized? · Download PNG · Open card page

Lesson: AWS CLI EKS Commands: Create a Cluster and Connect kubectl

AWS CLI CloudFormation Commands: Deploy, Update and Delete Stacks

CloudFormation deploy. A house plan you can build again. validate-template first. deploy creates or updates. Read outputs with describe-stacks.
Revision card: CloudFormation deploy · Download PNG · Open card page
CloudFormation change sets. See replacements before production. create-change-set, then wait. describe-change-set shows Action and Replacement. execute-change-set applies.
Revision card: CloudFormation change sets · Download PNG · Open card page
deploy vs change set. One command. / Create, review, execute.
Comparison: deploy vs change set · Download PNG · Open card page
ROLLBACK_COMPLETE stack?. It cannot be updated. Read describe-stack-events reasons. Fix, delete-stack, deploy again.
Interview card: ROLLBACK_COMPLETE stack? · Download PNG · Open card page

Lesson: AWS CLI CloudFormation Commands: Deploy, Update and Delete Stacks

AWS CLI Secrets Manager and SSM Parameter Store Commands

Secrets Manager. Passwords go in a locker, not code. create-secret from a file. get-secret-value reads it. rotate-secret with a Lambda.
Revision card: Secrets Manager · Download PNG · Open card page
SSM Parameter Store. Config per env in paths. SecureString is KMS-encrypted. Read a folder with decryption. start-session replaces SSH.
Revision card: SSM Parameter Store · Download PNG · Open card page
Secrets Manager vs Parameter Store. Paid per secret. / Standard is free.
Comparison: Secrets Manager vs Parameter Store · Download PNG · Open card page
Secrets Manager vs Parameter Store?. Secrets Manager: rotation, paid per secret. Parameter Store: free standard config. Both encrypt with KMS.
Interview card: Secrets Manager vs Parameter Store? · Download PNG · Open card page

Lesson: AWS CLI Secrets Manager and SSM Parameter Store Commands

AWS CLI KMS Commands: Create a Key, Encrypt and Decrypt

KMS encrypt. The watchman never hands out the master key. create-key and alias. encrypt up to 4 KB. decrypt finds the key itself.
Revision card: KMS encrypt · Download PNG · Open card page
KMS data keys. Big files need envelope encryption. generate-data-key: plain + encrypted. Encrypt locally, shred the plain key. Disable before schedule-key-deletion.
Revision card: KMS data keys · Download PNG · Open card page
kms encrypt vs Data key. Up to 4 KB. / Any size, local.
Comparison: kms encrypt vs Data key · Download PNG · Open card page
What is envelope encryption?. Data key encrypts data. KMS key encrypts the data key. Store the encrypted key with the data.
Interview card: What is envelope encryption? · Download PNG · Open card page

Lesson: AWS CLI KMS Commands: Create a Key, Encrypt and Decrypt

AWS CLI CloudFront Commands: Create a Distribution and Invalidate Cache

CloudFront distribution. Milk booths near every home. OAC keeps the bucket private. create-distribution, wait deployed. Bucket policy with AWS:SourceArn.
Revision card: CloudFront distribution · Download PNG · Open card page
CloudFront invalidate. Users still see the old file. create-invalidation for paths. Updates need ETag + --if-match. Disable, wait, then delete.
Revision card: CloudFront invalidate · Download PNG · Open card page
Invalidation vs Versioned names. Remove cached paths. / New name like app.v2.css.
Comparison: Invalidation vs Versioned names · Download PNG · Open card page
CloudFront PreconditionFailed?. Your ETag is old. Every update returns a new ETag. Fetch it right before update or delete.
Interview card: CloudFront PreconditionFailed? · Download PNG · Open card page

Lesson: AWS CLI CloudFront Commands: Create a Distribution and Invalidate Cache

AWS CLI Bash Scripting and Cheat Sheet: Automate AWS

Safe bash scripts. A recipe card for AWS. set -euo pipefail and AWS_PAGER="". Print account and region first. --query + --output text for values.
Revision card: Safe bash scripts · Download PNG · Open card page
Waiters, retries, dry run. sleep only guesses. aws SERVICE wait CONDITION. AWS_RETRY_MODE=adaptive. --dry-run or RUN=echo first.
Revision card: Waiters, retries, dry run · Download PNG · Open card page
aws wait vs sleep. Real resource state. / Nothing, just time.
Comparison: aws wait vs sleep · Download PNG · Open card page
Waiter vs sleep?. A waiter checks the real state. It fails clearly on timeout. sleep is too short or wastes time.
Interview card: Waiter vs sleep? · Download PNG · Open card page

Lesson: AWS CLI Bash Scripting and Cheat Sheet: Automate AWS

AWS SDK cards

Revision, X vs Y and interview cards for the AWS SDK chapters (Python, PHP, Node.js). Every card has a QR code to its lesson.

AWS SDK Setup for Python (boto3), PHP and Node.js: Credentials Chain Explained

SDK install. Python: one package. PHP: one Composer package. Node v3: only the clients you need. First call: who am I?
Revision card: SDK install · Download PNG · Open card page
Credentials chain. Code keys (avoid). Env vars beat the profile file. ~/.aws profile, then SSO. In the cloud: IAM role, no keys.
Revision card: Credentials chain · Download PNG · Open card page
Profile vs IAM role. Laptop, ~/.aws files. / EC2, ECS, Lambda.
Comparison: Profile vs IAM role · Download PNG · Open card page
Which credentials win?. The first source in the chain that has them. Env keys come before ~/.aws profiles. Roles are last, and best in the cloud.
Interview card: Which credentials win? · Download PNG · Open card page

Lesson: AWS SDK Setup for Python (boto3), PHP and Node.js: Credentials Chain Explained

AWS SDK Error Handling, Retries, Pagination and Waiters (Python, PHP, Node.js)

Catch by error code. Python: ClientError. PHP: AwsException. Node: err.name. Retry throttles and 5xx, fix 4xx.
Revision card: Catch by error code · Download PNG · Open card page
Paginators & waiters. Lists return pages + a token. boto3 get_paginator / PHP getPaginator. Node: for await paginateX(). Waiters poll until ready.
Revision card: Paginators & waiters · Download PNG · Open card page
standard vs adaptive. Backoff with jitter. / Backoff + client rate limit.
Comparison: standard vs adaptive · Download PNG · Open card page
What should you retry?. Throttling, timeouts, 5xx. Not AccessDenied or validation errors. Use standard or adaptive mode.
Interview card: What should you retry? · Download PNG · Open card page

Lesson: AWS SDK Error Handling, Retries, Pagination and Waiters (Python, PHP, Node.js)

AWS SDK S3 Examples: Upload, Download, Presigned URLs and Multipart (Python, PHP, Node.js)

S3 upload. Bucket outside us-east-1 needs LocationConstraint. Python upload_file does multipart. PHP putObject with SourceFile. Node PutObjectCommand / lib-storage Upload.
Revision card: S3 upload · Download PNG · Open card page
Presigned URLs. Private bucket, time-limited link. Signed locally, no API call. GET to share, PUT for browser uploads. Node: getSignedUrl.
Revision card: Presigned URLs · Download PNG · Open card page
PutObject vs Multipart. Up to 5 GB, one request. / Up to 5 TB, many parts.
Comparison: PutObject vs Multipart · Download PNG · Open card page
Presigned URL expired early?. Signed with temporary role credentials. URL dies when the session ends. Sign with a longer-lived role session.
Interview card: Presigned URL expired early? · Download PNG · Open card page

Lesson: AWS SDK S3 Examples: Upload, Download, Presigned URLs and Multipart (Python, PHP, Node.js)

AWS SDK EC2 Examples: Launch, List, Stop and Terminate Instances (Python, PHP, Node.js)

EC2 launch. AMI from public SSM parameter. RunInstances + TagSpecifications. Wait instance_running. Flatten Reservations[].Instances[].
Revision card: EC2 launch · Download PNG · Open card page
Stop, start, terminate. Filter by tag and state. DryRun checks permission. Stop keeps EBS; terminate deletes. Stopped still pays for disks.
Revision card: Stop, start, terminate · Download PNG · Open card page
Stop vs Terminate. EBS kept. / Instance deleted.
Comparison: Stop vs Terminate · Download PNG · Open card page
Why Reservations?. One RunInstances call = one reservation. It can hold many instances. Flatten before looping.
Interview card: Why Reservations? · Download PNG · Open card page

Lesson: AWS SDK EC2 Examples: Launch, List, Stop and Terminate Instances (Python, PHP, Node.js)

AWS SDK DynamoDB Examples: CRUD, Query, Batch and Conditional Writes (Python, PHP, Node.js)

DynamoDB CRUD. Key: partition + sort. boto3 Table resource, Decimal money. PHP Marshaler converts arrays. Node lib-dynamodb: plain JSON.
Revision card: DynamoDB CRUD · Download PNG · Open card page
Conditional writes. Only one booking may win. attribute_not_exists(pk). Lost race: ConditionalCheckFailed. Counters: ADD hits :one.
Revision card: Conditional writes · Download PNG · Open card page
Query vs Scan. One partition. / Whole table.
Comparison: Query vs Scan · Download PNG · Open card page
boto3 rejects my float?. DynamoDB numbers need Decimal. Use Decimal("3.40"), not 3.4. Store currency next to amount.
Interview card: boto3 rejects my float? · Download PNG · Open card page

Lesson: AWS SDK DynamoDB Examples: CRUD, Query, Batch and Conditional Writes (Python, PHP, Node.js)

AWS SDK Lambda: Invoke Functions and Write Handlers in Python, PHP and Node.js

Lambda handlers. Event in, JSON out. Python def handler(event, context). Node export const handler = async. PHP via Bref layer.
Revision card: Lambda handlers · Download PNG · Open card page
Lambda invoke. RequestResponse waits. Check FunctionError even on 200. Event returns 202. LogType Tail: last 4 KB.
Revision card: Lambda invoke · Download PNG · Open card page
RequestResponse vs Event. Yes, returns payload. / No, returns 202.
Comparison: RequestResponse vs Event · Download PNG · Open card page
Invoke 200 but failed?. Handler threw an error. FunctionError is set. Always check it in code.
Interview card: Invoke 200 but failed? · Download PNG · Open card page

Lesson: AWS SDK Lambda: Invoke Functions and Write Handlers in Python, PHP and Node.js

AWS SDK SQS Examples: Send, Receive, Delete Messages and DLQs (Python, PHP, Node.js)

SQS send. CreateQueue returns QueueUrl. Body up to 256 KB, send JSON. Batch: up to 10 per call. FIFO needs MessageGroupId.
Revision card: SQS send · Download PNG · Open card page
SQS receive. Long poll: WaitTimeSeconds 20. Message hides for visibility timeout. Delete with ReceiptHandle after work. maxReceiveCount → DLQ.
Revision card: SQS receive · Download PNG · Open card page
Standard vs FIFO. Queue with best-effort order. / Queue with strict order per group.
Comparison: Standard vs FIFO · Download PNG · Open card page
Same message processed twice?. Standard queues are at-least-once. Or visibility timeout too short. Make workers idempotent.
Interview card: Same message processed twice? · Download PNG · Open card page

Lesson: AWS SDK SQS Examples: Send, Receive, Delete Messages and DLQs (Python, PHP, Node.js)

AWS SDK SNS Examples: Topics, Subscriptions, Publish and Filters (Python, PHP, Node.js)

SNS publish. One publish, many subscribers. Email waits for confirmation. SQS needs a queue policy. SMS: E.164 phone number.
Revision card: SNS publish · Download PNG · Open card page
SNS filters. Publish with MessageAttributes. FilterPolicy on the subscription. String and numeric match. RawMessageDelivery drops the envelope.
Revision card: SNS filters · Download PNG · Open card page
SNS vs SQS. Pushes to many subscribers. / One consumer pulls.
Comparison: SNS vs SQS · Download PNG · Open card page
SNS to SQS not arriving?. Queue policy missing. Allow sns.amazonaws.com SendMessage. Check the filter policy too.
Interview card: SNS to SQS not arriving? · Download PNG · Open card page

Lesson: AWS SDK SNS Examples: Topics, Subscriptions, Publish and Filters (Python, PHP, Node.js)

AWS SDK SES Examples: Send Email, Templates and Attachments (Python, PHP, Node.js)

SES send. Use the sesv2 client. Verify sender or domain (DKIM). Simple: subject + text + HTML. Sandbox: verified recipients only.
Revision card: SES send · Download PNG · Open card page
SES templates. CreateEmailTemplate with {{name}}. TemplateData is a JSON string. Attachments need Raw MIME. Test with the mailbox simulator.
Revision card: SES templates · Download PNG · Open card page
Simple vs Raw. Subject + text/HTML body. / Full MIME bytes you build.
Comparison: Simple vs Raw · Download PNG · Open card page
SES MessageRejected?. Account is in the sandbox. Recipient not verified. Request production access.
Interview card: SES MessageRejected? · Download PNG · Open card page

Lesson: AWS SDK SES Examples: Send Email, Templates and Attachments (Python, PHP, Node.js)

AWS SDK Secrets Manager and SSM Parameter Store: Read Config Safely (Python, PHP, Node.js)

Secrets Manager. Store JSON in SecretString. GetSecretValue, then parse. PutSecretValue: old → AWSPREVIOUS. RotateSecret with a Lambda.
Revision card: Secrets Manager · Download PNG · Open card page
Parameter Store. Paths: /app/env/name. SecureString + WithDecryption. GetParametersByPath, paginate. Cache values for minutes.
Revision card: Parameter Store · Download PNG · Open card page
Secrets Manager vs Parameter Store. Encrypted store for secrets. / Key-value store for config.
Comparison: Secrets Manager vs Parameter Store · Download PNG · Open card page
Throttled reading secrets?. Reading on every request. Cache for 5 minutes. Lambda: use the extension.
Interview card: Throttled reading secrets? · Download PNG · Open card page

Lesson: AWS SDK Secrets Manager and SSM Parameter Store: Read Config Safely (Python, PHP, Node.js)

AWS SDK STS: Assume Role, Cross-Account Access and Temporary Credentials (Python, PHP, Node.js)

STS AssumeRole. GetCallerIdentity first. Returns key, secret, token, expiry. Pass all three to the client. RoleSessionName shows in CloudTrail.
Revision card: STS AssumeRole · Download PNG · Open card page
Auto-refresh roles. Profile: role_arn + source_profile. boto3 Session refreshes. Node: fromTemporaryCredentials. PHP: AssumeRoleCredentialProvider.
Revision card: Auto-refresh roles · Download PNG · Open card page
Access keys vs AssumeRole. Long-lived IAM user keys. / Temporary role keys.
Comparison: Access keys vs AssumeRole · Download PNG · Open card page
InvalidClientTokenId?. SessionToken not passed. Or credentials expired. Use a refreshing provider.
Interview card: InvalidClientTokenId? · Download PNG · Open card page

Lesson: AWS SDK STS: Assume Role, Cross-Account Access and Temporary Credentials (Python, PHP, Node.js)

AWS SDK CloudWatch Examples: Custom Metrics, Alarms and Logs Insights (Python, PHP, Node.js)

CloudWatch metrics. PutMetricData: namespace + name. Dimensions split by city. Up to 1000 values per call. Read with GetMetricData.
Revision card: CloudWatch metrics · Download PNG · Open card page
CloudWatch alarms. PutMetricAlarm on a threshold. States: OK, ALARM, INSUFFICIENT. Action: an SNS topic ARN. Logs Insights: StartQuery.
Revision card: CloudWatch alarms · Download PNG · Open card page
Metrics vs Logs. Numbers over time. / Text lines of events.
Comparison: Metrics vs Logs · Download PNG · Open card page
Alarm stuck in INSUFFICIENT_DATA?. Dimensions do not match exactly. Period longer than data rate. Set TreatMissingData.
Interview card: Alarm stuck in INSUFFICIENT_DATA? · Download PNG · Open card page

Lesson: AWS SDK CloudWatch Examples: Custom Metrics, Alarms and Logs Insights (Python, PHP, Node.js)

AWS SDK KMS Examples: Encrypt, Decrypt, Data Keys and Envelope Encryption (Python, PHP, Node.js)

KMS encrypt. Encrypt: up to 4 KB. Use an alias, not key id. Decrypt finds the key itself. Add EncryptionContext.
Revision card: KMS encrypt · Download PNG · Open card page
Envelope encryption. GenerateDataKey: plain + encrypted. Encrypt file locally (AES-GCM). Store only the encrypted key. Wipe the plain key after use.
Revision card: Envelope encryption · Download PNG · Open card page
Direct Encrypt vs Envelope. KMS encrypts your data. / KMS encrypts a data key.
Comparison: Direct Encrypt vs Envelope · Download PNG · Open card page
KMS InvalidCiphertextException?. EncryptionContext differs. Ciphertext changed in transit. Base64 decode before Decrypt.
Interview card: KMS InvalidCiphertextException? · Download PNG · Open card page

Lesson: AWS SDK KMS Examples: Encrypt, Decrypt, Data Keys and Envelope Encryption (Python, PHP, Node.js)

AWS SDK AI Examples: Rekognition Image Labels and Bedrock Text Generation (Python, PHP, Node.js)

Rekognition labels. DetectLabels with MinConfidence. Bytes up to 5 MB, or S3Object. DetectText: LINE and WORD. Empty moderation = safe.
Revision card: Rekognition labels · Download PNG · Open card page
Bedrock Converse. Client: bedrock-runtime. Enable model access first. Set maxTokens, log usage. ConverseStream for chat.
Revision card: Bedrock Converse · Download PNG · Open card page
Rekognition vs Bedrock. Ready-made vision API. / Foundation models API.
Comparison: Rekognition vs Bedrock · Download PNG · Open card page
Bedrock AccessDeniedException?. Model access not enabled. Wrong region for the model. IAM needs bedrock:InvokeModel.
Interview card: Bedrock AccessDeniedException? · Download PNG · Open card page

Lesson: AWS SDK AI Examples: Rekognition Image Labels and Bedrock Text Generation (Python, PHP, Node.js)

AWS SDK Step Functions and EventBridge: Start Workflows and Publish Events (Python, PHP, Node.js)

Step Functions. StartExecution returns executionArn. Unique name stops duplicates. DescribeExecution for status. Task token: SendTaskSuccess.
Revision card: Step Functions · Download PNG · Open card page
EventBridge events. PutEvents: up to 10 entries. Check FailedEntryCount. Rules match event patterns. Scheduler for cron jobs.
Revision card: EventBridge events · Download PNG · Open card page
Standard vs Express. Durable workflow with history. / Fast, high-volume workflow.
Comparison: Standard vs Express · Download PNG · Open card page
ExecutionAlreadyExists?. Same name, different input. Names are unique for 90 days. Add a suffix for new runs.
Interview card: ExecutionAlreadyExists? · Download PNG · Open card page

Lesson: AWS SDK Step Functions and EventBridge: Start Workflows and Publish Events (Python, PHP, Node.js)

Build and Test an AWS SDK App with Mocks (moto, aws-sdk-client-mock, MockHandler) and Best Practices

Mock AWS. Python: moto @mock_aws. Node.js: aws-sdk-client-mock. PHP: Aws\MockHandler. Pass clients into functions.
Revision card: Mock AWS · Download PNG · Open card page
SDK best practices. Create clients once, reuse. Roles, never hard-coded keys. Timeouts + adaptive retries. Log the RequestId.
Revision card: SDK best practices · Download PNG · Open card page
Mocks vs LocalStack. Fake responses in code. / Local AWS-like server.
Comparison: Mocks vs LocalStack · Download PNG · Open card page
Test called real AWS?. Client created before the mock. Use fake credentials in tests. Inject clients, do not import globals.
Interview card: Test called real AWS? · Download PNG · Open card page

Lesson: Build and Test an AWS SDK App with Mocks (moto, aws-sdk-client-mock, MockHandler) and Best Practices

Linux cards

Revision, X vs Y and interview cards for the Linux chapters. Every card has a QR code to its lesson.

What Is Linux? Kernel, Shell, Distributions and Userland Explained for Beginners

What is Linux. Runs most servers and phones. Kernel + shell + userland tools. Type commands in a terminal. Check your kernel version.
Revision card: What is Linux · Download PNG · Open card page
Linux distros. Same kernel, different packages. Ubuntu, RHEL, Amazon Linux. apt on Ubuntu, dnf on RHEL. Find your distro name.
Revision card: Linux distros · Download PNG · Open card page
Kernel vs Shell. Core that runs hardware. / Program that reads commands.
Comparison: Kernel vs Shell · Download PNG · Open card page
Ubuntu vs RHEL. Debian-based distro. / Red Hat enterprise distro.
Comparison: Ubuntu vs RHEL · Download PNG · Open card page
Kernel vs operating system?. Kernel talks to hardware. OS = kernel + tools + shell. Linux is the kernel only.
Interview card: Kernel vs operating system? · Download PNG · Open card page
What does a shell do?. Reads your commands. Asks the kernel to run them. Check your shell.
Interview card: What does a shell do? · Download PNG · Open card page
Why do companies use Linux?. Free, stable, secure. Runs most cloud servers. Easy to automate with scripts.
Interview card: Why do companies use Linux? · Download PNG · Open card page
What is userland?. Programs outside the kernel. ls, bash, systemd, libraries. They use system calls.
Interview card: What is userland? · Download PNG · Open card page

Lesson: What Is Linux? Kernel, Shell, Distributions and Userland Explained for Beginners

Linux Boot Process Step by Step: BIOS/UEFI, GRUB, Kernel, initramfs and systemd

Linux boot steps. Know where boot fails. UEFI, GRUB, kernel, initramfs. Then systemd starts services. See slow boot units.
Revision card: Linux boot steps · Download PNG · Open card page
systemd basics. Starts and watches services. PID 1, uses unit files. start, stop, enable, status. Read a service log.
Revision card: systemd basics · Download PNG · Open card page
BIOS vs UEFI. Old firmware. / Modern firmware.
Comparison: BIOS vs UEFI · Download PNG · Open card page
start vs enable. Runs the service now. / Runs it at every boot.
Comparison: start vs enable · Download PNG · Open card page
Server stuck at GRUB?. Wrong kernel or bad config. Pick an older kernel in menu. Rebuild the GRUB config.
Interview card: Server stuck at GRUB? · Download PNG · Open card page
Why initramfs?. Small temporary root FS. Loads drivers to find disk. Rebuild after driver change.
Interview card: Why initramfs? · Download PNG · Open card page
runlevel vs target?. Targets replace runlevels. multi-user = 3, graphical = 5. See the default target.
Interview card: runlevel vs target? · Download PNG · Open card page
Service fails at boot?. Check status first. Read logs for this boot. Fix, then enable it.
Interview card: Service fails at boot? · Download PNG · Open card page

Lesson: Linux Boot Process Step by Step: BIOS/UEFI, GRUB, Kernel, initramfs and systemd

Linux File System Hierarchy (FHS) Explained: /etc, /var, /usr, /proc and More

Key FHS folders. Find files on any server. /etc config, /var logs. /home users, /usr programs. Logs live here.
Revision card: Key FHS folders · Download PNG · Open card page
/proc and /dev. See live system info. /proc is made by the kernel. /dev holds device files. Check memory.
Revision card: /proc and /dev · Download PNG · Open card page
/etc vs /var. Config files. / Changing data.
Comparison: /etc vs /var · Download PNG · Open card page
/usr/bin vs /usr/sbin. Commands for everyone. / Admin commands.
Comparison: /usr/bin vs /usr/sbin · Download PNG · Open card page
/etc vs /var?. /etc holds config files. /var holds changing data. Logs grow in /var/log.
Interview card: /etc vs /var? · Download PNG · Open card page
/tmp vs /var/tmp?. /tmp may clear on reboot. /var/tmp survives reboot. Never keep data in /tmp.
Interview card: /tmp vs /var/tmp? · Download PNG · Open card page
Where to install your app?. /opt for third-party apps. /usr/local for own builds. Config in /etc/appname.
Interview card: Where to install your app? · Download PNG · Open card page
Disk full, which folder?. Check free space. Find the big folder. Often /var/log or /tmp.
Interview card: Disk full, which folder? · Download PNG · Open card page

Lesson: Linux File System Hierarchy (FHS) Explained: /etc, /var, /usr, /proc and More

Linux File and Directory Commands Cheat Sheet: ls, cd, cp, mv, rm, mkdir with Examples

File commands. Daily work on every server. ls, cd, cp, mv, rm, mkdir. Use -r for folders. Make nested folders.
Revision card: File commands · Download PNG · Open card page
Find files. Locate lost or big files. find searches by name, size. Add -type f and -mtime. Files over 100 MB.
Revision card: Find files · Download PNG · Open card page
cp vs mv. Copies a file. / Moves or renames.
Comparison: cp vs mv · Download PNG · Open card page
find vs locate. Walks the disk live. / Reads a saved index.
Comparison: find vs locate · Download PNG · Open card page
How to stay safe with rm?. rm has no recycle bin. Use ls first, then rm. Ask before each delete.
Interview card: How to stay safe with rm? · Download PNG · Open card page
cp vs mv?. cp makes a second copy. mv moves or renames. Keep times with -p.
Interview card: cp vs mv? · Download PNG · Open card page
How to see hidden files?. Names start with a dot. ls hides them by default. Use -a to show all.
Interview card: How to see hidden files? · Download PNG · Open card page
Absolute vs relative path?. Absolute starts with /. Relative starts from here. See where you are.
Interview card: Absolute vs relative path? · Download PNG · Open card page

Lesson: Linux File and Directory Commands Cheat Sheet: ls, cd, cp, mv, rm, mkdir with Examples

Hard Link vs Soft Link in Linux: ln, ln -s and Inodes Explained with Examples

What is an inode. Explains links and disk full. Stores file data, not name. A name points to an inode. Show inode numbers.
Revision card: What is an inode · Download PNG · Open card page
Make links. One file, many names. ln = hard, ln -s = soft. Soft link stores a path. Point current to a release.
Revision card: Make links · Download PNG · Open card page
Hard link vs Soft link. Same inode, new name. / Small file with a path.
Comparison: Hard link vs Soft link · Download PNG · Open card page
rm vs unlink. Removes many names. / Removes one name.
Comparison: rm vs unlink · Download PNG · Open card page
Why no hard link to a folder?. It could make loops. Tools like find would hang. Use a soft link instead.
Interview card: Why no hard link to a folder? · Download PNG · Open card page
Broken soft link?. Target was moved or deleted. ls shows it in red. Find broken links.
Interview card: Broken soft link? · Download PNG · Open card page
Disk has space but no write?. Inodes are used up. Too many tiny files. Check inode use.
Interview card: Disk has space but no write? · Download PNG · Open card page
Deleted file still uses space?. A process keeps it open. Space frees when it closes. Find such files.
Interview card: Deleted file still uses space? · Download PNG · Open card page

Lesson: Hard Link vs Soft Link in Linux: ln, ln -s and Inodes Explained with Examples

Vim Tutorial for Beginners to Advanced (plus nano): Modes, Commands, Search and Replace

Vim modes. Edit config on any server. Normal, Insert, Visual, Command. i to type, Esc to go back. Save and quit.
Revision card: Vim modes · Download PNG · Open card page
Vim editing. Fast edits without a mouse. dd delete, yy copy, p paste. u undo, /word to search. Replace in whole file.
Revision card: Vim editing · Download PNG · Open card page
Vim vs nano. Modal power editor. / Simple editor.
Comparison: Vim vs nano · Download PNG · Open card page
:wq vs :q!. Save and quit. / Quit without saving.
Comparison: :wq vs :q! · Download PNG · Open card page
How to exit Vim?. Press Esc first. :wq saves, :q! drops changes. Shortcut save and quit.
Interview card: How to exit Vim? · Download PNG · Open card page
Vim says swap file exists?. Last edit crashed, or is open. Recover, or delete the swap. Recover the file.
Interview card: Vim says swap file exists? · Download PNG · Open card page
Edited as user, need root?. Do not lose your changes. Write through sudo tee. Next time use sudoedit.
Interview card: Edited as user, need root? · Download PNG · Open card page
Vim or nano on a server?. Vim is on almost every server. nano is easier to start. Learn Vim basics anyway.
Interview card: Vim or nano on a server? · Download PNG · Open card page

Lesson: Vim Tutorial for Beginners to Advanced (plus nano): Modes, Commands, Search and Replace

Linux cat, less, head, tail, wc and tee Commands with Examples (View and Follow Files)

View files fast. Read files without opening an editor. cat small, less big, head/tail ends. Number lines or show hidden chars. Read the last 20 log lines.
Revision card: View files fast · Download PNG · Open card page
Follow live logs. See errors the moment they happen. tail -F keeps going after rotation. Save and see at once with tee. Follow and filter errors.
Revision card: Follow live logs · Download PNG · Open card page
cat vs less. Prints the whole file. / Shows one screen at a time.
Comparison: cat vs less · Download PNG · Open card page
head vs tail. First lines. / Last lines.
Comparison: head vs tail · Download PNG · Open card page
Why not cat a 5 GB log?. It floods the terminal. less loads only what you see. Open big logs at the end.
Interview card: Why not cat a 5 GB log? · Download PNG · Open card page
tail -f vs tail -F?. -f follows the open file. -F reopens after rotation. Use -F for app logs.
Interview card: tail -f vs tail -F? · Download PNG · Open card page
Why sudo echo > file fails?. Redirection runs as you. Let tee write as root. Write a root file.
Interview card: Why sudo echo > file fails? · Download PNG · Open card page
Count lines without the name?. Scripts need a pure number. Redirect input into wc. Number only.
Interview card: Count lines without the name? · Download PNG · Open card page

Lesson: Linux cat, less, head, tail, wc and tee Commands with Examples (View and Follow Files)

Linux cut, sort, uniq, tr, paste and diff Commands Explained with Examples

Text toolbox. Turn raw text into answers. cut columns, sort, uniq, tr. Always sort before uniq. Top 5 IPs in a log.
Revision card: Text toolbox · Download PNG · Open card page
Compare files. Know exactly what changed. diff lines, comm lists, cmp bytes. -u shows a readable patch. Review a config change.
Revision card: Compare files · Download PNG · Open card page
sort vs uniq. Orders lines. / Removes neighbour repeats.
Comparison: sort vs uniq · Download PNG · Open card page
diff vs comm. Any two files. / Two sorted lists.
Comparison: diff vs comm · Download PNG · Open card page
Why uniq misses duplicates?. uniq only checks neighbours. Sort first, then uniq. Count repeats.
Interview card: Why uniq misses duplicates? · Download PNG · Open card page
Why 100 sorts before 9?. Plain sort compares text. -n numbers, -h sizes. Biggest folders.
Interview card: Why 100 sorts before 9? · Download PNG · Open card page
Script fails with ^M?. Windows line ends (CRLF). Delete \r with tr. Fix the script.
Interview card: Script fails with ^M? · Download PNG · Open card page
cut breaks on many spaces?. cut counts each space. Squeeze first, or use awk. Column 2 of ps.
Interview card: cut breaks on many spaces? · Download PNG · Open card page

Lesson: Linux cut, sort, uniq, tr, paste and diff Commands Explained with Examples

Linux grep Command and Regular Expressions (Regex) Tutorial with Examples

grep in 4 steps. Find text in files and logs. -i case, -n line no, -v invert. -r whole folder, -l names only. Find a setting in a project.
Revision card: grep in 4 steps · Download PNG · Open card page
Regex cheat card. Match patterns, not just words. ^ start, $ end, . any, * repeat. -E for + ? | {n} and groups. Extract IPs only.
Revision card: Regex cheat card · Download PNG · Open card page
grep vs grep -E. Basic regex. / Extended regex.
Comparison: grep vs grep -E · Download PNG · Open card page
grep vs ripgrep (rg). On every Linux box. / Install it yourself.
Comparison: grep vs ripgrep (rg) · Download PNG · Open card page
grep finds itself in ps?. grep line has the word too. Use a bracket trick or pgrep. Clean process check.
Interview card: grep finds itself in ps? · Download PNG · Open card page
grep two words at once?. Basic grep treats | as text. Use -E for alternation. ERROR or FATAL.
Interview card: grep two words at once? · Download PNG · Open card page
Fast search in huge repos?. Skip folders you do not need. Use --include, -F or rg. Only Python files.
Interview card: Fast search in huge repos? · Download PNG · Open card page
See lines around an error?. One line hides the cause. -A after, -B before, -C both. 3 lines each side.
Interview card: See lines around an error? · Download PNG · Open card page

Lesson: Linux grep Command and Regular Expressions (Regex) Tutorial with Examples

Linux sed Command Tutorial: Find and Replace, Delete Lines and Edit Files In Place

sed find and replace. Edit text without opening files. s/old/new/g replaces all. -i edits in place; add .bak. Change a port safely.
Revision card: sed find and replace · Download PNG · Open card page
sed line commands. Pick, delete or add lines. Np print, d delete, a/i add. Use -n with p. Drop comments and blanks.
Revision card: sed line commands · Download PNG · Open card page
sed p vs sed d. Prints matching lines. / Deletes matching lines.
Comparison: sed p vs sed d · Download PNG · Open card page
sed vs sed -i. Prints to screen. / Changes the file.
Comparison: sed vs sed -i · Download PNG · Open card page
Is sed -i safe in prod?. It overwrites the file. Test without -i, keep .bak. Edit with backup.
Interview card: Is sed -i safe in prod? · Download PNG · Open card page
Replace paths with slashes?. / clashes with s///. Use another delimiter. Change a web root.
Interview card: Replace paths with slashes? · Download PNG · Open card page
sed -i fails on macOS?. BSD sed needs a suffix. Give an empty one. macOS form.
Interview card: sed -i fails on macOS? · Download PNG · Open card page
Make sed edits repeatable?. Runs twice may double edits. Match the full old value. Set a value exactly.
Interview card: Make sed edits repeatable? · Download PNG · Open card page

Lesson: Linux sed Command Tutorial: Find and Replace, Delete Lines and Edit Files In Place

Linux awk Command Tutorial for Beginners: Fields, Patterns, Sums and Reports

awk fields. Split lines into columns. $1 first, $NF last, -F sets sep. pattern {action} per line. Users and shells.
Revision card: awk fields · Download PNG · Open card page
awk reports. Totals and counts in one line. Arrays group by a key. END prints the results. Hits per IP.
Revision card: awk reports · Download PNG · Open card page
sed vs awk. Lines and text. / Fields and numbers.
Comparison: sed vs awk · Download PNG · Open card page
BEGIN vs END. Before the first line. / After the last line.
Comparison: BEGIN vs END · Download PNG · Open card page
awk or cut?. cut is simple and fast. awk handles spaces and maths. Sum a column.
Interview card: awk or cut? · Download PNG · Open card page
Pass a shell variable to awk?. $x inside quotes is not shell. Use -v to pass it. Threshold check.
Interview card: Pass a shell variable to awk? · Download PNG · Open card page
Skip the CSV header in awk?. Header is line 1. Use NR>1. Data rows only.
Interview card: Skip the CSV header in awk? · Download PNG · Open card page
Alert when disk > 80%?. df gives use% as text. +0 turns it into a number. Full mounts.
Interview card: Alert when disk > 80%? · Download PNG · Open card page

Lesson: Linux awk Command Tutorial for Beginners: Fields, Patterns, Sums and Reports

Linux find Command with xargs: Search Files by Name, Size, Time and Run Actions

find by anything. Locate files across folders. -name -type -size -mtime -user. Quote patterns; add 2>/dev/null. Big files on root disk.
Revision card: find by anything · Download PNG · Open card page
find + xargs. Act on thousands of files. -exec {} + or xargs batches. -print0 | xargs -0 is space safe. Clean old temp files.
Revision card: find + xargs · Download PNG · Open card page
find -exec vs xargs. Part of find. / Separate command in a pipe.
Comparison: find -exec vs xargs · Download PNG · Open card page
find vs locate. Walks the disk live. / Reads a daily database.
Comparison: find vs locate · Download PNG · Open card page
find says Permission denied?. You cannot read some folders. Use sudo or hide errors. Quiet search.
Interview card: find says Permission denied? · Download PNG · Open card page
Argument list too long?. * expanded to too many files. Let find or xargs batch. Delete safely.
Interview card: Argument list too long? · Download PNG · Open card page
xargs breaks on spaces?. It splits on blanks. Use NUL separators. Safe pipeline.
Interview card: xargs breaks on spaces? · Download PNG · Open card page
Disk full but no big files?. Deleted files held open, or inodes. Check lsof and df -i. Open deleted files.
Interview card: Disk full but no big files? · Download PNG · Open card page

Lesson: Linux find Command with xargs: Search Files by Name, Size, Time and Run Actions

Linux Users and Groups: useradd, usermod, userdel, passwd, groups and id Explained

Add a user right. Every person gets their own login. useradd -m makes the home folder. Set a password, force change. Create with bash and groups.
Revision card: Add a user right · Download PNG · Open card page
Groups in 4 steps. Share access by team, not person. groupadd creates, id checks. Always -aG, never -G alone. Add to docker group.
Revision card: Groups in 4 steps · Download PNG · Open card page
useradd vs adduser. Low-level, same on all distros. / Friendly script on Debian.
Comparison: useradd vs adduser · Download PNG · Open card page
usermod -G vs usermod -aG. Replaces all extra groups. / Adds to the existing groups.
Comparison: usermod -G vs usermod -aG · Download PNG · Open card page
passwd vs shadow?. passwd lists users, world readable. shadow holds hashes, root only. Look up a user.
Interview card: passwd vs shadow? · Download PNG · Open card page
Why -aG, not -G?. -G alone replaces all groups. -a appends to the list. Safe add.
Interview card: Why -aG, not -G? · Download PNG · Open card page
Added to group, still denied?. Groups load at login. Log out and in, or newgrp. Check current groups.
Interview card: Added to group, still denied? · Download PNG · Open card page
System user for a service?. No login, no home needed. Low UID, nologin shell. Create it.
Interview card: System user for a service? · Download PNG · Open card page

Lesson: Linux Users and Groups: useradd, usermod, userdel, passwd, groups and id Explained

Linux sudo, sudoers and visudo Tutorial (plus PAM Basics) with Examples

sudo safely. Admin work without the root password. sudo -l shows what you may run. Edit rules only with visudo. Check all files before logout.
Revision card: sudo safely · Download PNG · Open card page
PAM basics. One place for login rules. Stacks live in /etc/pam.d. faillock locks after bad tries. Unlock a user.
Revision card: PAM basics · Download PNG · Open card page
su vs sudo. Target user password. / Your own password.
Comparison: su vs sudo · Download PNG · Open card page
/etc/sudoers vs /etc/sudoers.d. One main file. / One file per team or rule.
Comparison: /etc/sudoers vs /etc/sudoers.d · Download PNG · Open card page
Why visudo, not vi?. It checks syntax before saving. A typo can lock out sudo. Check a drop-in.
Interview card: Why visudo, not vi? · Download PNG · Open card page
su vs sudo?. su needs the target password. sudo uses yours and logs each command. See your rights.
Interview card: su vs sudo? · Download PNG · Open card page
Is NOPASSWD safe?. Only for exact, narrow commands. Never NOPASSWD: ALL for people. Example rule.
Interview card: Is NOPASSWD safe? · Download PNG · Open card page
sudo echo > file fails?. The shell opens the file as you. Use sudo tee instead. Append as root.
Interview card: sudo echo > file fails? · Download PNG · Open card page

Lesson: Linux sudo, sudoers and visudo Tutorial (plus PAM Basics) with Examples

Linux File Permissions: chmod, chown, chgrp, umask, SUID, SGID and Sticky Bit Explained

chmod numbers. Control who reads, writes, runs. r=4 w=2 x=1, add them up. Folders need x to enter. Private SSH key.
Revision card: chmod numbers · Download PNG · Open card page
SUID SGID sticky. Extra bits for special jobs. SUID 4, SGID 2, sticky 1. SGID on team folders. Shared drop folder.
Revision card: SUID SGID sticky · Download PNG · Open card page
chmod 755 vs chmod u+x. Sets all bits at once. / Changes only named bits.
Comparison: chmod 755 vs chmod u+x · Download PNG · Open card page
SUID vs SGID. Run as the file owner. / New files take the folder group.
Comparison: SUID vs SGID · Download PNG · Open card page
755 vs 644?. 755 for folders and scripts. 644 for normal files. Fix a web tree.
Interview card: 755 vs 644? · Download PNG · Open card page
What does umask do?. It removes bits from new files. 022 gives 644 files, 755 dirs. Private by default.
Interview card: What does umask do? · Download PNG · Open card page
Why is /tmp 1777?. Everyone may write there. Sticky stops deleting others' files. See the t.
Interview card: Why is /tmp 1777? · Download PNG · Open card page
644 file, still 403?. A parent folder lacks x. Check every part of the path. Walk the path.
Interview card: 644 file, still 403? · Download PNG · Open card page

Lesson: Linux File Permissions: chmod, chown, chgrp, umask, SUID, SGID and Sticky Bit Explained

Linux ACL and File Attributes: setfacl, getfacl, chattr and lsattr with Examples

ACLs in 4 steps. Give one more user access. setfacl -m adds, getfacl reads. Add -d so new files inherit. Read access for one user.
Revision card: ACLs in 4 steps · Download PNG · Open card page
chattr locks. Even root cannot change it. +i immutable, +a append only. lsattr shows the flags. Protect DNS config.
Revision card: chattr locks · Download PNG · Open card page
chmod vs setfacl. Owner, one group, others. / Any number of users and groups.
Comparison: chmod vs setfacl · Download PNG · Open card page
chattr +i vs chattr +a. Nothing: no write, delete, rename. / Only adding to the end.
Comparison: chattr +i vs chattr +a · Download PNG · Open card page
What is the + in ls -l?. The file has an ACL. chmod may not show all access. Read it.
Interview card: What is the + in ls -l? · Download PNG · Open card page
What is the ACL mask?. Max rights for named entries. chmod on group changes the mask. Raise it.
Interview card: What is the ACL mask? · Download PNG · Open card page
New files lose access?. Normal ACLs apply to existing files. Default ACLs pass to new files. Set default.
Interview card: New files lose access? · Download PNG · Open card page
Root cannot delete a file?. It may be immutable. lsattr shows i. Remove the flag.
Interview card: Root cannot delete a file? · Download PNG · Open card page

Lesson: Linux ACL and File Attributes: setfacl, getfacl, chattr and lsattr with Examples

Linux Process Management: ps, top, htop, pgrep, jobs, bg, fg, nohup, nice and renice

Find processes. Know what eats CPU and RAM. ps aux, sort by usage. pgrep finds PIDs by name. Top memory users.
Revision card: Find processes · Download PNG · Open card page
Jobs and priority. Run long work without blocking. & background, jobs list, fg back. nice 19 is the gentlest. Low priority backup.
Revision card: Jobs and priority · Download PNG · Open card page
ps vs top. One snapshot. / Live, refreshing view.
Comparison: ps vs top · Download PNG · Open card page
nohup vs disown. Before starting the job. / After the job already runs.
Comparison: nohup vs disown · Download PNG · Open card page
High load, low CPU?. Processes wait on disk (D state). Check wa in top and STAT D. Snapshot.
Interview card: High load, low CPU? · Download PNG · Open card page
Job dies when SSH drops?. Logout sends SIGHUP. Use nohup, disown or tmux. Survive logout.
Interview card: Job dies when SSH drops? · Download PNG · Open card page
nice vs renice?. nice sets priority at start. renice changes a running one. Lower PID 8812.
Interview card: nice vs renice? · Download PNG · Open card page
Port already in use?. Another process holds it. lsof or ss shows who. Find it.
Interview card: Port already in use? · Download PNG · Open card page

Lesson: Linux Process Management: ps, top, htop, pgrep, jobs, bg, fg, nohup, nice and renice

Linux Signals and kill Command: kill, pkill, killall, SIGTERM vs SIGKILL and trap

Stop a process right. Let apps clean up first. kill sends TERM by default. Use -9 only as last step. Polite then force.
Revision card: Stop a process right · Download PNG · Open card page
trap cleanup. Scripts must clean up always. trap runs code on a signal. EXIT covers normal and error exits. Remove the lock file.
Revision card: trap cleanup · Download PNG · Open card page
kill vs pkill. One PID you know. / Processes matching a pattern.
Comparison: kill vs pkill · Download PNG · Open card page
pkill vs killall. Pattern, user, terminal. / Exact process name.
Comparison: pkill vs killall · Download PNG · Open card page
TERM vs KILL?. TERM asks, app can clean up. KILL cannot be caught. Force after waiting.
Interview card: TERM vs KILL? · Download PNG · Open card page
Exit code 137?. 128 plus 9 means SIGKILL. Often the OOM killer. Name the signal.
Interview card: Exit code 137? · Download PNG · Open card page
Why send HUP to nginx?. Many daemons reload on HUP. No downtime for new config. Reload by PID.
Interview card: Why send HUP to nginx? · Download PNG · Open card page
Can you kill a zombie?. It is already dead. Fix or restart the parent. Find the parent.
Interview card: Can you kill a zombie? · Download PNG · Open card page

Lesson: Linux Signals and kill Command: kill, pkill, killall, SIGTERM vs SIGKILL and trap

Linux systemd and systemctl: Manage Services and Write Unit Files Step by Step

systemctl daily 4. Services run your apps. status, start, stop, restart. enable = start at boot. Enable and start now.
Revision card: systemctl daily 4 · Download PNG · Open card page
A unit file in 4 steps. Run your own app as a service. [Unit] [Service] [Install]. Restart=on-failure keeps it up. Reload after editing.
Revision card: A unit file in 4 steps · Download PNG · Open card page
start vs enable. Runs the service now. / Starts it at every boot.
Comparison: start vs enable · Download PNG · Open card page
restart vs reload. Stops and starts the process. / Re-reads config in place.
Comparison: restart vs reload · Download PNG · Open card page
restart vs reload?. restart stops and starts. reload re-reads config, no drop. Reload nginx.
Interview card: restart vs reload? · Download PNG · Open card page
enable vs start?. start = now. enable = at boot. Both at once.
Interview card: enable vs start? · Download PNG · Open card page
What does mask do?. Links the unit to /dev/null. Nobody can start it. Block a service.
Interview card: What does mask do? · Download PNG · Open card page
Service will not start?. Read status and logs. Check ExecStart path, user. Last logs.
Interview card: Service will not start? · Download PNG · Open card page

Lesson: Linux systemd and systemctl: Manage Services and Write Unit Files Step by Step

Linux Logs Explained: journalctl, /var/log, rsyslog and logrotate with Examples

journalctl filters. Find the error fast. -u unit, -f follow. -p err, --since, -b. Errors of one service today.
Revision card: journalctl filters · Download PNG · Open card page
logrotate safely. Stop logs filling the disk. daily, rotate 7, compress. Dry-run before trusting. Test a config.
Revision card: logrotate safely · Download PNG · Open card page
journalctl vs /var/log files. Binary indexed journal. / Plain text via rsyslog.
Comparison: journalctl vs /var/log files · Download PNG · Open card page
logrotate vs journalctl --vacuum. Text log files. / The systemd journal.
Comparison: logrotate vs journalctl --vacuum · Download PNG · Open card page
journald vs rsyslog?. journald: binary, indexed. rsyslog: text files, remote. Both often run together.
Interview card: journald vs rsyslog? · Download PNG · Open card page
Logs filled the disk?. Find the big files. Vacuum journal, fix rotation. Shrink the journal.
Interview card: Logs filled the disk? · Download PNG · Open card page
Why copytruncate?. App keeps the file open. Copy then empty it in place. Or signal the app to reopen.
Interview card: Why copytruncate? · Download PNG · Open card page
Keep logs after reboot?. Default may be in /run. Create /var/log/journal. Restart journald.
Interview card: Keep logs after reboot? · Download PNG · Open card page

Lesson: Linux Logs Explained: journalctl, /var/log, rsyslog and logrotate with Examples

Linux Job Scheduling: cron, crontab, at and systemd Timers Explained

cron 5 fields. Run jobs on a schedule. min hour day month weekday. Use full paths, log output. Edit your jobs.
Revision card: cron 5 fields · Download PNG · Open card page
systemd timers. Cron with logs and catch-up. .timer starts a .service. Persistent=true runs missed jobs. See next runs.
Revision card: systemd timers · Download PNG · Open card page
cron vs systemd timer. One line in crontab. / Two unit files.
Comparison: cron vs systemd timer · Download PNG · Open card page
cron vs at. Again and again. / Once.
Comparison: cron vs at · Download PNG · Open card page
Works in shell, not cron?. cron has a tiny PATH. Use full paths, log output. Check cron logs.
Interview card: Works in shell, not cron? · Download PNG · Open card page
cron vs timer?. cron: simple, everywhere. timer: logs, deps, catch-up. List timers.
Interview card: cron vs timer? · Download PNG · Open card page
When to use at?. One-time future job. atq lists, atrm cancels. Schedule at 18:00.
Interview card: When to use at? · Download PNG · Open card page
Stop jobs overlapping?. Long run meets next start. Use flock in cron. Lock a job.
Interview card: Stop jobs overlapping? · Download PNG · Open card page

Lesson: Linux Job Scheduling: cron, crontab, at and systemd Timers Explained

Linux Package Management: apt, dnf, yum, rpm, dpkg and snap Commands Explained

apt and dnf. Install from trusted repos. apt on Ubuntu, dnf on RHEL. Refresh lists first. Install on Amazon Linux.
Revision card: apt and dnf · Download PNG · Open card page
rpm / dpkg queries. Know what is installed. -qa all, -ql files. -qf / -S who owns a file. Owner of a file.
Revision card: rpm / dpkg queries · Download PNG · Open card page
apt vs dnf. Debian, Ubuntu. / RHEL, Fedora, Amazon Linux.
Comparison: apt vs dnf · Download PNG · Open card page
rpm vs dnf. Low level, one file. / High level, repos.
Comparison: rpm vs dnf · Download PNG · Open card page
apt vs dnf?. apt: Debian, Ubuntu (.deb). dnf: RHEL, Fedora, AL2023 (.rpm). Update all.
Interview card: apt vs dnf? · Download PNG · Open card page
rpm vs dnf?. rpm: one file, no deps. dnf: repos and deps. Who provides a command.
Interview card: rpm vs dnf? · Download PNG · Open card page
Pin a version?. Stop surprise upgrades. apt-mark hold / versionlock. Hold on Ubuntu.
Interview card: Pin a version? · Download PNG · Open card page
When snap?. Bundled, auto-updating apps. Bigger, slower start. List snaps.
Interview card: When snap? · Download PNG · Open card page

Lesson: Linux Package Management: apt, dnf, yum, rpm, dpkg and snap Commands Explained

Linux tar, gzip, zip and xz: Archive and Compress Files with Examples

tar c t x. Pack a folder into one file. c create, t list, x extract. z gzip, J xz, f file. Make a backup.
Revision card: tar c t x · Download PNG · Open card page
gzip zip xz. Smaller files, faster copies. gzip fast, xz smallest. zip for Windows friends. Read without extracting.
Revision card: gzip zip xz · Download PNG · Open card page
gzip vs xz. Fast. / Slower.
Comparison: gzip vs xz · Download PNG · Open card page
tar.gz vs zip. Linux backups. / Sharing with Windows.
Comparison: tar.gz vs zip · Download PNG · Open card page
gzip vs xz?. gzip: fast, common. xz: smaller, slower. xz with all cores.
Interview card: gzip vs xz? · Download PNG · Open card page
tar.gz vs zip?. tar keeps Linux permissions. zip opens anywhere. Zip a folder.
Interview card: tar.gz vs zip? · Download PNG · Open card page
Skip folders in tar?. node_modules is huge. Use --exclude. Skip it.
Interview card: Skip folders in tar? · Download PNG · Open card page
Check a backup?. Corrupt archives fail restores. List or test it. Test gzip.
Interview card: Check a backup? · Download PNG · Open card page

Lesson: Linux tar, gzip, zip and xz: Archive and Compress Files with Examples

Linux Environment Variables, PATH, .bashrc and alias Explained Simply

export vs set. Programs read settings from env. NAME=value: this shell only. export: children see it. Export a value.
Revision card: export vs set · Download PNG · Open card page
PATH safely. Why command not found. Searched left to right. Always keep $PATH. Add a folder.
Revision card: PATH safely · Download PNG · Open card page
NAME=value vs export NAME=value. This shell only. / Child programs too.
Comparison: NAME=value vs export NAME=value · Download PNG · Open card page
~/.bashrc vs ~/.bash_profile. Every interactive shell. / Login shells.
Comparison: ~/.bashrc vs ~/.bash_profile · Download PNG · Open card page
.bashrc vs .bash_profile?. profile: login shells. bashrc: every interactive. Apply now.
Interview card: .bashrc vs .bash_profile? · Download PNG · Open card page
which vs type?. which: files in PATH. type: aliases, builtins too. Check ll.
Interview card: which vs type? · Download PNG · Open card page
Why no . in PATH?. A fake ls could run. Run local files with ./. Run a script.
Interview card: Why no . in PATH? · Download PNG · Open card page
Service ignores env?. systemd does not read bashrc. Use Environment=. Add an override.
Interview card: Service ignores env? · Download PNG · Open card page

Lesson: Linux Environment Variables, PATH, .bashrc and alias Explained Simply

tmux and screen Tutorial: Keep Linux Sessions Alive, Split Panes and Windows

tmux survive SSH drops. Long jobs keep running. new -s, Ctrl+b d. ls, attach -t to return. Start a named session.
Revision card: tmux survive SSH drops · Download PNG · Open card page
tmux panes. Logs and shell side by side. Ctrl+b % and Ctrl+b ". Ctrl+b z zoom, [ scroll. Split from a script.
Revision card: tmux panes · Download PNG · Open card page
tmux vs screen. Ctrl+b. / Ctrl+a.
Comparison: tmux vs screen · Download PNG · Open card page
tmux vs nohup. A full live terminal. / One command alive.
Comparison: tmux vs nohup · Download PNG · Open card page
tmux vs nohup?. nohup: one command, no interaction. tmux: full live terminal. Background session.
Interview card: tmux vs nohup? · Download PNG · Open card page
tmux vs screen?. Same idea, different keys. tmux: panes, scripting. screen list.
Interview card: tmux vs screen? · Download PNG · Open card page
Survives reboot?. No, sessions are in memory. Use systemd for must-run jobs. Check uptime.
Interview card: Survives reboot? · Download PNG · Open card page
Share a terminal?. Same session, two clients. -r for read-only. Watch only.
Interview card: Share a terminal? · Download PNG · Open card page

Lesson: tmux and screen Tutorial: Keep Linux Sessions Alive, Split Panes and Windows

Linux Networking Commands: ip, ss, netstat, ping, traceroute and mtr Explained Simply

ip daily 4. See your network. ip a = addresses. ip r = routes, ip n = neighbours. Short view.
Revision card: ip daily 4 · Download PNG · Open card page
ss ports in 4 steps. Who listens on a port? t tcp, u udp, l listen. p process, n numbers. All listeners.
Revision card: ss ports in 4 steps · Download PNG · Open card page
ss vs netstat. Modern, fast, from iproute2. / Old, from net-tools.
Comparison: ss vs netstat · Download PNG · Open card page
ping vs mtr. Is the host reachable? / Where on the path is loss?
Comparison: ping vs mtr · Download PNG · Open card page
ss vs netstat?. ss is the modern tool. netstat is from old net-tools. Listeners.
Interview card: ss vs netstat? · Download PNG · Open card page
Ping fails but site works?. ICMP may be blocked. Test the real port. Port check.
Interview card: Ping fails but site works? · Download PNG · Open card page
Where is packet loss?. mtr combines ping and traceroute. Loss only at the last hops matters. Report.
Interview card: Where is packet loss? · Download PNG · Open card page
No route to host?. Check the route table. Check firewall REJECT too. Which route?
Interview card: No route to host? · Download PNG · Open card page

Lesson: Linux Networking Commands: ip, ss, netstat, ping, traceroute and mtr Explained Simply

Linux DNS and HTTP Tools: dig, nslookup, host, curl, wget, nc and /etc/hosts with Examples

dig in 4 steps. Check DNS. +short for just the answer. @server to ask another DNS. Mail servers.
Revision card: dig in 4 steps · Download PNG · Open card page
curl checks. Test HTTP from the server. -I headers, -L follow. -v shows TLS and timing. Headers only.
Revision card: curl checks · Download PNG · Open card page
dig vs nslookup. Full DNS detail, TTL. / Simple answer.
Comparison: dig vs nslookup · Download PNG · Open card page
curl vs wget. APIs, headers, any method. / Downloads, resume, mirror.
Comparison: curl vs wget · Download PNG · Open card page
Name does not resolve?. Check resolv.conf and hosts. Ask another server. Compare.
Interview card: Name does not resolve? · Download PNG · Open card page
/etc/hosts vs DNS?. hosts is local, checked first. Order is in nsswitch.conf. App view.
Interview card: /etc/hosts vs DNS? · Download PNG · Open card page
curl vs wget?. curl: APIs, headers, methods. wget: downloads, resume, mirror. Resume.
Interview card: curl vs wget? · Download PNG · Open card page
Why old IP after DNS change?. Caches keep it until TTL ends. Lower TTL before changes. See TTL.
Interview card: Why old IP after DNS change? · Download PNG · Open card page

Lesson: Linux DNS and HTTP Tools: dig, nslookup, host, curl, wget, nc and /etc/hosts with Examples

SSH Deep Dive: Keys, ~/.ssh/config, ssh-agent, Tunnels, Jump Hosts, scp, rsync and sftp

SSH keys in 4 steps. No passwords. ssh-keygen -t ed25519. ssh-copy-id to the server. Then log in.
Revision card: SSH keys in 4 steps · Download PNG · Open card page
~/.ssh/config. Short names for hosts. Host, HostName, User, IdentityFile. ProxyJump for a bastion. Just type the name.
Revision card: ~/.ssh/config · Download PNG · Open card page
scp vs rsync. Copies all files every time. / Sends only changes.
Comparison: scp vs rsync · Download PNG · Open card page
ssh -L vs ssh -R. Local port reaches remote target. / Remote port reaches you.
Comparison: ssh -L vs ssh -R · Download PNG · Open card page
Permission denied (publickey)?. Check key and user. Check .ssh 700, keys 600. Debug.
Interview card: Permission denied (publickey)? · Download PNG · Open card page
Agent forwarding risk?. Root on the jump host can use your agent. Prefer ProxyJump. Jump.
Interview card: Agent forwarding risk? · Download PNG · Open card page
-L vs -R?. -L: local port to remote target. -R: remote port back to you. Local tunnel.
Interview card: -L vs -R? · Download PNG · Open card page
scp vs rsync?. scp copies everything. rsync sends only changes. Mirror.
Interview card: scp vs rsync? · Download PNG · Open card page

Lesson: SSH Deep Dive: Keys, ~/.ssh/config, ssh-agent, Tunnels, Jump Hosts, scp, rsync and sftp

tcpdump and Linux Network Troubleshooting: Capture Packets and Fix Connection Problems Step by Step

tcpdump in 4 steps. See real packets. -i interface, -nn numbers. Filter: host, port, icmp. One port.
Revision card: tcpdump in 4 steps · Download PNG · Open card page
Network debug order. Go layer by layer. Link, IP, route, DNS. Port, firewall, app. Test the port.
Revision card: Network debug order · Download PNG · Open card page
refused vs timeout. Host replies with RST. / No reply at all.
Comparison: refused vs timeout · Download PNG · Open card page
firewalld vs security group. Inside the server. / Outside, in the cloud.
Comparison: firewalld vs security group · Download PNG · Open card page
When to use tcpdump?. When logs disagree. Prove if packets arrive. Capture.
Interview card: When to use tcpdump? · Download PNG · Open card page
Refused vs timeout?. Refused: host up, nothing listens. Timeout: firewall drops. Check listener.
Interview card: Refused vs timeout? · Download PNG · Open card page
Port open locally, blocked outside?. Check host firewall. Check cloud security group. Rules.
Interview card: Port open locally, blocked outside? · Download PNG · Open card page
Small requests work, big hang?. Likely MTU problem. Test with DF bit. Test.
Interview card: Small requests work, big hang? · Download PNG · Open card page

Lesson: tcpdump and Linux Network Troubleshooting: Capture Packets and Fix Connection Problems Step by Step

Linux Disks: lsblk, blkid, fdisk, parted, mkfs, mount, /etc/fstab and swap Explained

New disk in 4 steps. Find it: lsblk. Partition, then mkfs. Mount and add to fstab by UUID. Test fstab.
Revision card: New disk in 4 steps · Download PNG · Open card page
Swap file in 4 steps. Extra memory on disk. fallocate, chmod 600. mkswap, swapon. Check.
Revision card: Swap file in 4 steps · Download PNG · Open card page
ext4 vs xfs. Can grow and shrink. / Can only grow.
Comparison: ext4 vs xfs · Download PNG · Open card page
fdisk vs parted. Interactive menu. / Scriptable commands.
Comparison: fdisk vs parted · Download PNG · Open card page
Why UUID in fstab?. Device names can change. UUID stays the same. Find it.
Interview card: Why UUID in fstab? · Download PNG · Open card page
umount: target is busy?. A process uses it. Find and stop it. Who?
Interview card: umount: target is busy? · Download PNG · Open card page
Grow a cloud disk?. Resize the volume. growpart, then grow the fs. XFS.
Interview card: Grow a cloud disk? · Download PNG · Open card page
fdisk vs parted?. fdisk: interactive. parted: scriptable, big GPT. List.
Interview card: fdisk vs parted? · Download PNG · Open card page

Lesson: Linux Disks: lsblk, blkid, fdisk, parted, mkfs, mount, /etc/fstab and swap Explained

Linux LVM Tutorial: pvcreate, vgcreate, lvcreate, lvextend, Snapshots and Resizing Explained

LVM in 4 steps. Flexible disks. pvcreate the disk. vgcreate a group, lvcreate a volume. Make a volume.
Revision card: LVM in 4 steps · Download PNG · Open card page
Grow an LV. Disk almost full. Check VFree with vgs. -r grows the filesystem too. Grow by 10G.
Revision card: Grow an LV · Download PNG · Open card page
-L vs -l. Size in units like 10G. / Extents or percent.
Comparison: -L vs -l · Download PNG · Open card page
thick LV vs thin LV. Space reserved now. / Space used as written.
Comparison: thick LV vs thin LV · Download PNG · Open card page
Why LVM?. Grow without downtime. Pool many disks, snapshots. Overview.
Interview card: Why LVM? · Download PNG · Open card page
Shrink an XFS LV?. XFS cannot shrink. Backup, recreate, restore. ext4 can.
Interview card: Shrink an XFS LV? · Download PNG · Open card page
LVM snapshot use?. Safe point before upgrade. Merge to roll back. Create.
Interview card: LVM snapshot use? · Download PNG · Open card page
Replace a disk in LVM live?. vgextend with the new disk. pvmove data off old. Then remove.
Interview card: Replace a disk in LVM live? · Download PNG · Open card page

Lesson: Linux LVM Tutorial: pvcreate, vgcreate, lvcreate, lvextend, Snapshots and Resizing Explained

Linux RAID with mdadm plus df and du: Disk Space Troubleshooting Explained Simply

mdadm in 4 steps. Survive a disk failure. --create with level and disks. Watch /proc/mdstat. Save config.
Revision card: mdadm in 4 steps · Download PNG · Open card page
Disk full in 4 steps. Which filesystem: df -h. Which folder: du -x. Deleted but open: lsof +L1. Inodes too.
Revision card: Disk full in 4 steps · Download PNG · Open card page
RAID 1 vs RAID 5. Mirror, 50% usable. / Parity, (n-1)/n usable.
Comparison: RAID 1 vs RAID 5 · Download PNG · Open card page
df vs du. Space per filesystem. / Space per folder.
Comparison: df vs du · Download PNG · Open card page
Is RAID a backup?. No. Deletes are mirrored too. Health only.
Interview card: Is RAID a backup? · Download PNG · Open card page
RAID for a busy DB?. RAID 10: fast and safe. RAID 5 has write penalty. Create.
Interview card: RAID for a busy DB? · Download PNG · Open card page
df full but du small?. Deleted files still open. Restart or truncate. Find.
Interview card: df full but du small? · Download PNG · Open card page
No space but GBs free?. Inodes are full. Millions of small files. Check.
Interview card: No space but GBs free? · Download PNG · Open card page

Lesson: Linux RAID with mdadm plus df and du: Disk Space Troubleshooting Explained Simply

Linux Performance Tuning: vmstat, iostat, sar, free, lsof, strace and sysctl Explained Simply

vmstat in 4 steps. Is the server slow? r = run queue, b = blocked. wa high = waiting for disk. Every 2 seconds.
Revision card: vmstat in 4 steps · Download PNG · Open card page
iostat disk check. Which disk is busy? -x gives extended stats. %util near 100 = saturated. Watch.
Revision card: iostat disk check · Download PNG · Open card page
vmstat vs iostat. CPU, memory, run queue. / Per-disk I/O detail.
Comparison: vmstat vs iostat · Download PNG · Open card page
lsof vs strace. Which files and ports are open. / What system calls run now.
Comparison: lsof vs strace · Download PNG · Open card page
High load but CPU idle?. Load counts D-state tasks too. Usually slow disk or NFS. Check wa.
Interview card: High load but CPU idle? · Download PNG · Open card page
free shows little free memory?. Linux uses spare RAM as cache. Look at available, not free. Human view.
Interview card: free shows little free memory? · Download PNG · Open card page
App hangs, no logs?. strace shows system calls. See where it waits. Attach.
Interview card: App hangs, no logs? · Download PNG · Open card page
Change a kernel setting safely?. sysctl -w for now. File in /etc/sysctl.d for reboot. Reload.
Interview card: Change a kernel setting safely? · Download PNG · Open card page

Lesson: Linux Performance Tuning: vmstat, iostat, sar, free, lsof, strace and sysctl Explained Simply

Linux Security Hardening: firewalld, ufw, iptables, nftables, fail2ban, SELinux, AppArmor and auditd

firewalld in 4 steps. Open only what you need. --add-service or --add-port. --permanent, then --reload. See rules.
Revision card: firewalld in 4 steps · Download PNG · Open card page
SELinux denied?. Do not disable it. Check mode: getenforce. Read AVC denials, fix labels. Recent denials.
Revision card: SELinux denied? · Download PNG · Open card page
ufw vs firewalld. Simple rules, Ubuntu. / Zones, RHEL family.
Comparison: ufw vs firewalld · Download PNG · Open card page
SELinux vs AppArmor. Labels on every file. / Profiles by path.
Comparison: SELinux vs AppArmor · Download PNG · Open card page
iptables vs nftables?. nftables is the modern framework. iptables-nft wraps it. See all.
Interview card: iptables vs nftables? · Download PNG · Open card page
Stop SSH brute force?. Keys only, no root login. fail2ban bans bad IPs. Status.
Interview card: Stop SSH brute force? · Download PNG · Open card page
SELinux vs AppArmor?. SELinux: labels, RHEL family. AppArmor: paths, Ubuntu. AppArmor status.
Interview card: SELinux vs AppArmor? · Download PNG · Open card page
Who changed /etc/passwd?. auditd watches files. Add a watch rule with a key. Search.
Interview card: Who changed /etc/passwd? · Download PNG · Open card page

Lesson: Linux Security Hardening: firewalld, ufw, iptables, nftables, fail2ban, SELinux, AppArmor and auditd

Linux Kernel Basics: Modules, /proc, /sys, Namespaces and cgroups (How Containers Work)

Kernel modules. Drivers loaded at runtime. lsmod lists, modinfo explains. modprobe loads with deps. Load one.
Revision card: Kernel modules · Download PNG · Open card page
cgroups in 4 steps. Limit CPU and memory. Containers use them. systemd sets them per unit. Live view.
Revision card: cgroups in 4 steps · Download PNG · Open card page
namespaces vs cgroups. What a process can see. / How much it can use.
Comparison: namespaces vs cgroups · Download PNG · Open card page
modprobe vs insmod. Loads by name with dependencies. / Loads one .ko file only.
Comparison: modprobe vs insmod · Download PNG · Open card page
What is /proc?. Virtual files from the kernel. Live process and system info. Process limits.
Interview card: What is /proc? · Download PNG · Open card page
How do containers isolate?. Namespaces: pid, net, mnt, uts. cgroups limit resources. List.
Interview card: How do containers isolate? · Download PNG · Open card page
Process killed suddenly?. OOM killer, memory limit hit. Check kernel log. Find.
Interview card: Process killed suddenly? · Download PNG · Open card page
cgroup v1 vs v2?. v2 has one unified tree. Modern distros use v2. Check.
Interview card: cgroup v1 vs v2? · Download PNG · Open card page

Lesson: Linux Kernel Basics: Modules, /proc, /sys, Namespaces and cgroups (How Containers Work)

Linux Troubleshooting Playbook: 20 Real Production Cases with Commands and Fixes

Troubleshooting order. Calm, one step at a time. What changed? Read logs. CPU, memory, disk, network. Last errors.
Revision card: Troubleshooting order · Download PNG · Open card page
Service down in 4 steps. Status first. Read its logs. Check port and config. Logs.
Revision card: Service down in 4 steps · Download PNG · Open card page
dmesg vs journalctl. Kernel ring buffer. / All systemd logs.
Comparison: dmesg vs journalctl · Download PNG · Open card page
Restart vs Root cause. Brings service back fast. / Finds why it broke.
Comparison: Restart vs Root cause · Download PNG · Open card page
Website slow, where to start?. Measure first, guess later. Top, then disk, then network. Timing.
Interview card: Website slow, where to start? · Download PNG · Open card page
Filesystem went read-only?. Kernel saw disk errors. Check dmesg, then fsck offline. Errors.
Interview card: Filesystem went read-only? · Download PNG · Open card page
Server does not boot after change?. Often a bad fstab line. Use rescue mode, fix, nofail. Test before reboot.
Interview card: Server does not boot after change? · Download PNG · Open card page
After an outage, what?. Write a blameless postmortem. Timeline, root cause, actions. Gather logs.
Interview card: After an outage, what? · Download PNG · Open card page

Lesson: Linux Troubleshooting Playbook: 20 Real Production Cases with Commands and Fixes

Shell Scripting Complete

Revision, X vs Y and interview cards for the Shell Scripting Complete chapters. Every card has a QR code to its lesson.

Shell Scripting Complete 1: Your First Bash Script with Shebang, chmod, PATH and Exit Codes

First script in 4 steps. Line 1: the shebang. Write your commands below. Make it executable. Run it.
Revision card: First script in 4 steps · Download PNG · Open card page
Safe script header. Stop on errors. Fail on unset variables. Fail inside pipes too. Top of every script.
Revision card: Safe script header · Download PNG · Open card page
sh vs bash. POSIX, small, often dash. / Arrays, [[ ]], more features.
Comparison: sh vs bash · Download PNG · Open card page
./run.sh vs bash run.sh. Uses the shebang. / Ignores the shebang.
Comparison: ./run.sh vs bash run.sh · Download PNG · Open card page
Why the shebang line?. It picks the interpreter. Without it, the caller shell runs it. Portable form.
Interview card: Why the shebang line? · Download PNG · Open card page
Permission denied on ./x.sh?. The file is not executable. Or the disk is mounted noexec. Fix.
Interview card: Permission denied on ./x.sh? · Download PNG · Open card page
What is an exit code?. 0 means success. 1 to 255 means failure. See the last one.
Interview card: What is an exit code? · Download PNG · Open card page
Check a script before running?. bash -n checks syntax. shellcheck finds bugs. Run.
Interview card: Check a script before running? · Download PNG · Open card page

Lesson: Shell Scripting Complete 1: Your First Bash Script with Shebang, chmod, PATH and Exit Codes

Shell Scripting Complete 2: Bash Variables, Quoting, Command Substitution and Parameter Expansion

Quotes in 4 rules. Single quotes: exact text. Double quotes: variables expand. Always quote variables. Example.
Revision card: Quotes in 4 rules · Download PNG · Open card page
Parameter expansion. Default if empty. Length. Cut suffix. Replace.
Revision card: Parameter expansion · Download PNG · Open card page
'single' vs "double". Exact text, no expansion. / $var and $( ) expand.
Comparison: 'single' vs "double" · Download PNG · Open card page
var=x vs export var=x. Only this shell. / This shell and child programs.
Comparison: var=x vs export var=x · Download PNG · Open card page
Single vs double quotes?. Single: nothing expands. Double: $var and $( ) expand. Try.
Interview card: Single vs double quotes? · Download PNG · Open card page
$( ) vs backticks?. Both capture output. $( ) nests and reads better. Example.
Interview card: $( ) vs backticks? · Download PNG · Open card page
Why export a variable?. Plain variables stay in this shell. export passes them to children. Example.
Interview card: Why export a variable? · Download PNG · Open card page
Do math in bash?. Use $(( )) for integers. No decimals in bash. Example.
Interview card: Do math in bash? · Download PNG · Open card page

Lesson: Shell Scripting Complete 2: Bash Variables, Quoting, Command Substitution and Parameter Expansion

Shell Scripting Complete 3: Script Input with Arguments, $@, shift, read and getopts

Script arguments. $1, $2 = first, second. $# = how many. "$@" = all, safely. Drop the first.
Revision card: Script arguments · Download PNG · Open card page
getopts in 4 steps. List flags; colon = needs value. Loop with while. case on the letter. Value is in OPTARG.
Revision card: getopts in 4 steps · Download PNG · Open card page
arguments vs read. Given on the command line. / Typed while running.
Comparison: arguments vs read · Download PNG · Open card page
getopts vs while/case. Built in, short flags. / Hand-written loop.
Comparison: getopts vs while/case · Download PNG · Open card page
"$@" vs "$*"?. "$@" keeps each argument separate. "$*" joins them into one. Use "$@" almost always.
Interview card: "$@" vs "$*"? · Download PNG · Open card page
Missing arguments?. Check $# first. Print usage to stderr. Exit with code 2.
Interview card: Missing arguments? · Download PNG · Open card page
Read a password safely?. read -s hides typing. -p shows a prompt. Example.
Interview card: Read a password safely? · Download PNG · Open card page
getopts vs manual parsing?. getopts: short flags, built in. Manual case loop for long --flags. Shift after getopts.
Interview card: getopts vs manual parsing? · Download PNG · Open card page

Lesson: Shell Scripting Complete 3: Script Input with Arguments, $@, shift, read and getopts

Shell Scripting Complete 4: if, else, test, [[ ]], (( )) and case Explained Simply

if in 4 steps. if runs a test. Exit code 0 = true. Strings and patterns: [[ ]]. Numbers: (( )).
Revision card: if in 4 steps · Download PNG · Open card page
File tests. -f regular file. -d directory. -s not empty. Example.
Revision card: File tests · Download PNG · Open card page
[ ] vs [[ ]]. POSIX, quote everything. / Bash, safer word handling.
Comparison: [ ] vs [[ ]] · Download PNG · Open card page
if/elif vs case. Any tests, any mix. / One value, many patterns.
Comparison: if/elif vs case · Download PNG · Open card page
[ ] vs [[ ]]?. [ ] is POSIX test. [[ ]] is bash: safer, patterns, regex. Regex.
Interview card: [ ] vs [[ ]]? · Download PNG · Open card page
Compare numbers?. (( )) uses < > ==. In [ ] use -lt -gt -eq. Example.
Interview card: Compare numbers? · Download PNG · Open card page
&& and || as if?. a && b: b runs if a worked. a || b: b runs if a failed. Example.
Interview card: && and || as if? · Download PNG · Open card page
When to use case?. Many choices on one value. Patterns with * and |. Start.
Interview card: When to use case? · Download PNG · Open card page

Lesson: Shell Scripting Complete 4: if, else, test, [[ ]], (( )) and case Explained Simply

Shell Scripting Complete 5: Bash Loops with for, while, until, while read and IFS

for loop forms. Over a list. Over files. Over a range. C style.
Revision card: for loop forms · Download PNG · Open card page
Read a file line by line. Use while read. IFS= keeps spaces. -r keeps backslashes. Pattern.
Revision card: Read a file line by line · Download PNG · Open card page
for vs while. Over a known list. / Until a test fails.
Comparison: for vs while · Download PNG · Open card page
while vs until. Runs while test is true. / Runs while test is false.
Comparison: while vs until · Download PNG · Open card page
Loop breaks on spaces in names?. Do not loop over ls output. Use a glob and quote "$f". Safe.
Interview card: Loop breaks on spaces in names? · Download PNG · Open card page
Variable lost after a pipe loop?. A pipe runs the loop in a subshell. Read from a file or < <( ) instead. Example.
Interview card: Variable lost after a pipe loop? · Download PNG · Open card page
break vs continue?. break leaves the loop. continue skips to the next round. Nested.
Interview card: break vs continue? · Download PNG · Open card page
Run loop jobs in parallel?. Add & to start in background. wait for all to finish. Then.
Interview card: Run loop jobs in parallel? · Download PNG · Open card page

Lesson: Shell Scripting Complete 5: Bash Loops with for, while, until, while read and IFS

Shell Scripting Complete 6: Bash Functions, local, return and Reusable Script Libraries

Functions in 4 steps. Define: name() { }. Args are $1, $2 inside. Use local for variables. Status with return.
Revision card: Functions in 4 steps · Download PNG · Open card page
Script library. Put helpers in one file. Only functions inside. Load it. Call main last.
Revision card: Script library · Download PNG · Open card page
return vs exit. Leaves the function. / Ends the whole script.
Comparison: return vs exit · Download PNG · Open card page
source vs ./script. Same shell. / New child shell.
Comparison: source vs ./script · Download PNG · Open card page
return vs echo in a function?. return gives a status 0-255. echo gives data to capture. Capture.
Interview card: return vs echo in a function? · Download PNG · Open card page
Why local?. Variables are global by default. local keeps them inside. Example.
Interview card: Why local? · Download PNG · Open card page
source vs ./script?. source runs in the current shell. ./script starts a new shell. Load helpers.
Interview card: source vs ./script? · Download PNG · Open card page
Clean up on exit?. trap runs code on signals. EXIT fires on any end. Example.
Interview card: Clean up on exit? · Download PNG · Open card page

Lesson: Shell Scripting Complete 6: Bash Functions, local, return and Reusable Script Libraries

Shell Scripting Complete 7: Bash Arrays and Associative Arrays (declare -A) Explained Simply

Arrays in 4 steps. Create. One item. Count. Loop.
Revision card: Arrays in 4 steps · Download PNG · Open card page
Associative arrays. Declare first. Set a key. Read a key. All keys.
Revision card: Associative arrays · Download PNG · Open card page
indexed vs associative. Numbered 0, 1, 2. / Named keys.
Comparison: indexed vs associative · Download PNG · Open card page
mapfile vs while read. All lines at once. / One line at a time.
Comparison: mapfile vs while read · Download PNG · Open card page
${a[@]} vs ${a[*]}?. "${a[@]}" keeps items separate. "${a[*]}" joins into one string. Loop safely.
Interview card: ${a[@]} vs ${a[*]}? · Download PNG · Open card page
File lines into an array?. mapfile reads all lines. -t drops newlines. Example.
Interview card: File lines into an array? · Download PNG · Open card page
Count words with bash only?. declare -A counter. Add one per word. Print keys and values.
Interview card: Count words with bash only? · Download PNG · Open card page
declare -A fails on Mac?. macOS ships bash 3.2. Associative arrays need bash 4+. Check.
Interview card: declare -A fails on Mac? · Download PNG · Open card page

Lesson: Shell Scripting Complete 7: Bash Arrays and Associative Arrays (declare -A) Explained Simply

Shell Scripting Complete 8: String Manipulation and Parameter Expansion (${var#}, ${var%}, ${var//}) Explained Simply

Cut prefix and suffix. # cuts from the front, shortest. ## cuts from the front, longest. % cuts from the end. %% longest from the end.
Revision card: Cut prefix and suffix · Download PNG · Open card page
Default values. Use default if empty. Set default too. Stop if missing. Value only if set.
Revision card: Default values · Download PNG · Open card page
${v#pat} vs ${v%pat}. Cuts from the front. / Cuts from the end.
Comparison: ${v#pat} vs ${v%pat} · Download PNG · Open card page
${s//a/b} vs sed 's/a/b/g'. Built in, one variable. / External, streams and files.
Comparison: ${s//a/b} vs sed 's/a/b/g' · Download PNG · Open card page
${f#*.} vs ${f##*.}?. One # = shortest match. Two ## = longest match. Extension.
Interview card: ${f#*.} vs ${f##*.}? · Download PNG · Open card page
basename without a command?. Cut up to last slash. Folder part. No subshell, faster.
Interview card: basename without a command? · Download PNG · Open card page
Change case in bash?. Upper. Lower. First letter only.
Interview card: Change case in bash? · Download PNG · Open card page
${v:-x} vs ${v-x}?. :- treats empty as missing. - only unset. Usually use :-.
Interview card: ${v:-x} vs ${v-x}? · Download PNG · Open card page

Lesson: Shell Scripting Complete 8: String Manipulation and Parameter Expansion (${var#}, ${var%}, ${var//}) Explained Simply

Shell Scripting Complete 9: Arithmetic, Exit Codes, set -euo pipefail and Error Handling

Strict mode. -e stops on errors. -u fails on unset vars. pipefail catches pipe errors. Top of the script.
Revision card: Strict mode · Download PNG · Open card page
Bash maths. Integers with $(( )). Compare with (( )). Decimals need bc. Exit code in $?.
Revision card: Bash maths · Download PNG · Open card page
$(( )) vs bc. Built in integers. / Calculator with decimals.
Comparison: $(( )) vs bc · Download PNG · Open card page
&& and or vs set -e. Per command choice. / Whole script stops.
Comparison: && and or vs set -e · Download PNG · Open card page
Where does set -e not stop?. Inside if or while tests. Left of && or ||. Add explicit checks.
Interview card: Where does set -e not stop? · Download PNG · Open card page
Why pipefail?. Pipe status = last command. A failed first step is hidden. Show all.
Interview card: Why pipefail? · Download PNG · Open card page
Common exit codes?. 0 ok, 1 error, 2 usage. 126 not executable, 127 not found. 128+N killed by signal N.
Interview card: Common exit codes? · Download PNG · Open card page
Decimals in bash?. $(( )) is integer only. Use bc or awk. Example.
Interview card: Decimals in bash? · Download PNG · Open card page

Lesson: Shell Scripting Complete 9: Arithmetic, Exit Codes, set -euo pipefail and Error Handling

Shell Scripting Complete 10: Redirection, Pipes, tee, Here-docs and Process Substitution

0, 1, 2 streams. 0 stdin, 1 stdout, 2 stderr. Save output. Both to one file. Show and save.
Revision card: 0, 1, 2 streams · Download PNG · Open card page
Here-doc and here-string. Many lines into a command. One string in. Command as a file. Quote EOF to stop expansion.
Revision card: Here-doc and here-string · Download PNG · Open card page
pipe vs <( ). Output into stdin. / Output as a file name.
Comparison: pipe vs <( ) · Download PNG · Open card page
<<EOF vs <<<. Many lines. / One string.
Comparison: <<EOF vs <<< · Download PNG · Open card page
Why order of 2>&1 matters?. Redirects run left to right. 2>&1 copies where 1 points now. Right.
Interview card: Why order of 2>&1 matters? · Download PNG · Open card page
Variable empty after a pipe loop?. Pipe runs the loop in a subshell. Feed it with < <( ). Or shopt -s lastpipe.
Interview card: Variable empty after a pipe loop? · Download PNG · Open card page
sudo echo > file fails?. Your shell does the redirect. Use tee as root. Append: tee -a.
Interview card: sudo echo > file fails? · Download PNG · Open card page
<<EOF vs <<'EOF'?. Unquoted expands $vars. Quoted keeps text exact. <<- strips leading tabs.
Interview card: <<EOF vs <<'EOF'? · Download PNG · Open card page

Lesson: Shell Scripting Complete 10: Redirection, Pipes, tee, Here-docs and Process Substitution

Shell Scripting Complete 11: trap, Signals, flock Locks and Background Jobs

trap cleanup. Make a temp folder. Clean on any exit. Catch Ctrl+C. Report errors.
Revision card: trap cleanup · Download PNG · Open card page
Run only once. Two cron runs can overlap. Lock or skip. Wait max 30 s. Lock frees on exit.
Revision card: Run only once · Download PNG · Open card page
SIGTERM vs SIGKILL. Polite, can be trapped. / Forced, cannot be trapped.
Comparison: SIGTERM vs SIGKILL · Download PNG · Open card page
nohup vs systemd service. Survives logout. / Managed and restarted.
Comparison: nohup vs systemd service · Download PNG · Open card page
Why not kill -9 first?. TERM lets it clean up. KILL cannot be trapped. Order.
Interview card: Why not kill -9 first? · Download PNG · Open card page
trap EXIT vs INT?. EXIT runs on any end. INT only on Ctrl+C. Cleanup goes on EXIT.
Interview card: trap EXIT vs INT? · Download PNG · Open card page
Keep a job after logout?. nohup ignores HUP. Or disown a running job. Best: systemd service.
Interview card: Keep a job after logout? · Download PNG · Open card page
Limit parallel jobs?. xargs -P N. Or wait -n in a loop. Do not flood the server.
Interview card: Limit parallel jobs? · Download PNG · Open card page

Lesson: Shell Scripting Complete 11: trap, Signals, flock Locks and Background Jobs

Shell Scripting Complete 12: Debugging with bash -x, ShellCheck and Logging

Debug in 4 steps. Syntax only. Lint. Trace with line numbers. Read the logs.
Revision card: Debug in 4 steps · Download PNG · Open card page
Script logging. A log function. To syslog with a tag. Error priority. Read by tag.
Revision card: Script logging · Download PNG · Open card page
bash -n vs bash -x. Syntax only. / Runs and traces.
Comparison: bash -n vs bash -x · Download PNG · Open card page
echo >&2 vs logger. To the terminal or file. / To syslog / journald.
Comparison: echo >&2 vs logger · Download PNG · Open card page
bash -x vs bash -n?. -n checks syntax, runs nothing. -x runs and prints each step. Trace a part only.
Interview card: bash -x vs bash -n? · Download PNG · Open card page
ShellCheck SC2086?. Unquoted variable. It splits on spaces. Fix.
Interview card: ShellCheck SC2086? · Download PNG · Open card page
$'\r': command not found?. Windows line endings. See them. Fix.
Interview card: $'\r': command not found? · Download PNG · Open card page
Logs to stdout or stderr?. Data to stdout. Messages to stderr. So pipes stay clean.
Interview card: Logs to stdout or stderr? · Download PNG · Open card page

Lesson: Shell Scripting Complete 12: Debugging with bash -x, ShellCheck and Logging

Shell Scripting Complete 13: Scheduling Scripts with cron and systemd Timers

Cron 5 fields. min hour day month weekday. Every day 2 AM. Every 15 minutes. Weekdays 9 AM.
Revision card: Cron 5 fields · Download PNG · Open card page
systemd timer in 4 steps. Write x.service. Write x.timer. Enable it. Check next run.
Revision card: systemd timer in 4 steps · Download PNG · Open card page
cron vs systemd timer. One line per job. / Two unit files.
Comparison: cron vs systemd timer · Download PNG · Open card page
OnCalendar vs OnUnitActiveSec. Wall clock time. / Every N after last run.
Comparison: OnCalendar vs OnUnitActiveSec · Download PNG · Open card page
Works by hand, fails in cron?. Cron has a tiny PATH. No ~/.bashrc, wrong folder. Use full paths and log.
Interview card: Works by hand, fails in cron? · Download PNG · Open card page
Why % breaks crontab?. % means newline in cron. Escape it. Or move code to a script.
Interview card: Why % breaks crontab? · Download PNG · Open card page
Missed run while server was off?. cron skips it. Timer catches up. Check last run.
Interview card: Missed run while server was off? · Download PNG · Open card page
Test an OnCalendar?. systemd parses it. Shows next time. Run.
Interview card: Test an OnCalendar? · Download PNG · Open card page

Lesson: Shell Scripting Complete 13: Scheduling Scripts with cron and systemd Timers

Shell Scripting Complete 14: 30 Real-World Bash Scripts for Ops, DevOps and Data Teams

Script template. Strict mode. log and die. Lock. Temp and cleanup.
Revision card: Script template · Download PNG · Open card page
Top ops scripts. Dated backup + keep 7. Disk check. URL check. Symlink deploy.
Revision card: Top ops scripts · Download PNG · Open card page
cp into place vs symlink switch. Overwrites live files. / Points to a new folder.
Comparison: cp into place vs symlink switch · Download PNG · Open card page
bash vs Python. Glue for commands. / Real programming.
Comparison: bash vs Python · Download PNG · Open card page
Instant rollback?. Each release in its own folder. current is a symlink. Point back.
Interview card: Instant rollback? · Download PNG · Open card page
Safe delete script?. Guard empty vars. Dry run with -print first. Then -delete.
Interview card: Safe delete script? · Download PNG · Open card page
Check SSL expiry in a script?. openssl s_client gets the cert. x509 -enddate prints date. Exit 1 under N days.
Interview card: Check SSL expiry in a script? · Download PNG · Open card page
When to stop using bash?. Complex data or JSON. Long logic, many APIs. Then use Python or Go.
Interview card: When to stop using bash? · Download PNG · Open card page

Lesson: Shell Scripting Complete 14: 30 Real-World Bash Scripts for Ops, DevOps and Data Teams

Ravi Sir's Linux Interview and Capstone Cards

Revision, X vs Y and interview cards for the Linux interview pack and the capstone. Every card has a QR code to its lesson.

Linux Complete Interview Pack 1: 300 Linux Interview Questions and Answers for Beginner, Mid and Senior Level

Server triage. Load and uptime. Memory and swap. Disk and inodes. Errors this boot.
Revision card: Server triage · Download PNG · Open card page
Answer like a pro. Say what it is. Say why it matters. Show one command. Add a real story.
Revision card: Answer like a pro · Download PNG · Open card page
kill vs kill -9. Polite SIGTERM. / Forced SIGKILL.
Comparison: kill vs kill -9 · Download PNG · Open card page
df vs du. Filesystem view. / File and folder view.
Comparison: df vs du · Download PNG · Open card page
Explain the boot process.. Firmware, GRUB, kernel. initramfs mounts root. systemd reaches target.
Interview card: Explain the boot process. · Download PNG · Open card page
df full but du small?. Deleted file still open. Find it. Restart or truncate.
Interview card: df full but du small? · Download PNG · Open card page
High load, low CPU?. Tasks waiting on I/O. Look for D state. Check disk wait.
Interview card: High load, low CPU? · Download PNG · Open card page
Hard vs soft link?. Hard: same inode. Soft: path pointer. Soft crosses filesystems.
Interview card: Hard vs soft link? · Download PNG · Open card page

Lesson: Linux Complete Interview Pack 1: 300 Linux Interview Questions and Answers for Beginner, Mid and Senior Level

Linux Complete Interview Pack 2: 150 Shell Scripting Interview Questions and Answers with Coding Exercises

Safe script template. Strict mode. Usage and exit 2. Temp and cleanup. Quote every var.
Revision card: Safe script template · Download PNG · Open card page
Interview one-liners. Top IPs. Column sum. Replace in file. Old files.
Revision card: Interview one-liners · Download PNG · Open card page
set -e vs trap ERR. Stop on failure. / Run code on failure.
Comparison: set -e vs trap ERR · Download PNG · Open card page
awk vs sed. Columns and maths. / Edit lines.
Comparison: awk vs sed · Download PNG · Open card page
Why quote variables?. Stops word splitting. Stops glob expansion. Always.
Interview card: Why quote variables? · Download PNG · Open card page
Var empty after pipe loop?. Pipe = subshell. Redirect input. Or process substitution.
Interview card: Var empty after pipe loop? · Download PNG · Open card page
Stop double cron runs?. Use a lock file. Exit if locked. Kernel frees it.
Interview card: Stop double cron runs? · Download PNG · Open card page
Bash or Python?. Bash: glue commands. Python: data, APIs. Over ~150 lines, rethink.
Interview card: Bash or Python? · Download PNG · Open card page

Lesson: Linux Complete Interview Pack 2: 150 Shell Scripting Interview Questions and Answers with Coding Exercises

Linux Complete Interview Pack 3: Linux Interview Questions Commonly Asked at TCS, Infosys, Accenture, Wipro, Amazon, Google and Red Hat, with RHCSA-Style Tasks

Make it persist. Mounts: fstab + mount -a. Firewall: --permanent. SELinux: semanage. Services: enable.
Revision card: Make it persist · Download PNG · Open card page
Three interview styles. Service: basics + ITIL. Product: depth + design. Red Hat: hands-on RHEL. All are typical, not fixed.
Revision card: Three interview styles · Download PNG · Open card page
chcon vs semanage fcontext. Temporary label. / Persistent rule.
Comparison: chcon vs semanage fcontext · Download PNG · Open card page
--add-port vs --permanent. Runtime only. / Saved to disk.
Comparison: --add-port vs --permanent · Download PNG · Open card page
httpd on port 82 fails?. SELinux blocks the port. Add the type. Open firewall too.
Interview card: httpd on port 82 fails? · Download PNG · Open card page
Reset root password RHEL 9?. rd.break at GRUB. Remount, chroot, passwd. Relabel.
Interview card: Reset root password RHEL 9? · Download PNG · Open card page
Incident vs problem?. Incident: restore service. Problem: find root cause. Change: planned update.
Interview card: Incident vs problem? · Download PNG · Open card page
What happens when you run ls?. Shell forks, execve. openat, getdents64. Watch it.
Interview card: What happens when you run ls? · Download PNG · Open card page

Lesson: Linux Complete Interview Pack 3: Linux Interview Questions Commonly Asked at TCS, Infosys, Accenture, Wipro, Amazon, Google and Red Hat, with RHCSA-Style Tasks

Linux Complete Capstone: Linux Admin Labs to Build, Secure, Monitor and Fix a Production Server

Server lifecycle. Plan, then build. Secure and deploy. Monitor and back up. Break, fix, improve.
Revision card: Server lifecycle · Download PNG · Open card page
Hardening checklist. Keys only SSH. No root login. Tight firewall. SELinux enforcing.
Revision card: Hardening checklist · Download PNG · Open card page
nohup app & vs systemd service. Manual background. / Managed service.
Comparison: nohup app & vs systemd service · Download PNG · Open card page
restic backup vs LVM snapshot. Copy elsewhere. / Point in time, same disk.
Comparison: restic backup vs LVM snapshot · Download PNG · Open card page
502 behind nginx?. Is the app up? SELinux proxy boolean. Read error.log.
Interview card: 502 behind nginx? · Download PNG · Open card page
Is the backup good?. Only a restore proves it. Restore and compare. Log the test date.
Interview card: Is the backup good? · Download PNG · Open card page
Avoid SSH lockout?. Test config first. Keep a session open. Have console access.
Interview card: Avoid SSH lockout? · Download PNG · Open card page
Boots to emergency mode?. Usually bad fstab. Remount rw. Fix and verify.
Interview card: Boots to emergency mode? · Download PNG · Open card page

Lesson: Linux Complete Capstone: Linux Admin Labs to Build, Secure, Monitor and Fix a Production Server

Linux Commands A-Z Cards

Revision, X vs Y and interview cards for the Linux Commands A-Z series. Every card has a QR code to its lesson.

Linux Commands A-Z Index: 180+ Commands with Links to Why, What and How

Learn any command. Ask why you need it. Read the short help. Read the manual. Try it in /tmp.
Revision card: Learn any command · Download PNG · Open card page
Find the right command. Search by keyword. One-line meaning. Where is it? Which package?
Revision card: Find the right command · Download PNG · Open card page
type vs which. Shell view of a name. / PATH file search.
Comparison: type vs which · Download PNG · Open card page
--help vs man. Short usage text. / Full manual page.
Comparison: --help vs man · Download PNG · Open card page
How do you learn a new command?. Short help first. Then the man page. Test safely in /tmp.
Interview card: How do you learn a new command? · Download PNG · Open card page
Builtin vs external command?. Builtin lives in the shell. External is a file in PATH. Check it.
Interview card: Builtin vs external command? · Download PNG · Open card page
Why did my alias vanish?. Alias lives in one shell. Save it in ~/.bashrc. Reload.
Interview card: Why did my alias vanish? · Download PNG · Open card page
Command not found?. Not installed or not in PATH. Check PATH. Find the package.
Interview card: Command not found? · Download PNG · Open card page

Lesson: Linux Commands A-Z Index: 180+ Commands with Links to Why, What and How

Linux Commands A-Z Part 1: alias, apt, awk, bc, cat, chattr and More with Examples

awk in 4 steps. Print a column. Set separator. Filter rows. Sum at END.
Revision card: awk in 4 steps · Download PNG · Open card page
Change access. Mode bits. Owner and group. Group only. Lock a file.
Revision card: Change access · Download PNG · Open card page
awk vs cut. Mini language for columns. / Simple column cutter.
Comparison: awk vs cut · Download PNG · Open card page
chmod vs chown. Changes permissions. / Changes owner.
Comparison: chmod vs chown · Download PNG · Open card page
awk or cut?. cut: fixed one-char separator. awk: spaces, logic, math. Example.
Interview card: awk or cut? · Download PNG · Open card page
root cannot delete a file?. Immutable flag set. See it. Remove it.
Interview card: root cannot delete a file? · Download PNG · Open card page
Run a job once at 2 AM?. Use at, not cron. Schedule it. List the queue.
Interview card: Run a job once at 2 AM? · Download PNG · Open card page
App gets permission denied?. Check owner and mode. Fix the owner. Check SELinux too.
Interview card: App gets permission denied? · Download PNG · Open card page

Lesson: Linux Commands A-Z Part 1: alias, apt, awk, bc, cat, chattr and More with Examples

Linux Commands A-Z Part 2: chronyc, crontab, curl, cut, date, dd, df, diff, dig, dnf and du with Examples

Disk full?. Which filesystem. Inodes too. Biggest folders. Kernel errors.
Revision card: Disk full? · Download PNG · Open card page
Check a web service. DNS answer. HTTP status. Timing. Clock in sync.
Revision card: Check a web service · Download PNG · Open card page
df vs du. Filesystem view. / File and folder view.
Comparison: df vs du · Download PNG · Open card page
diff vs cmp. Line by line. / Byte by byte.
Comparison: diff vs cmp · Download PNG · Open card page
df full but du small?. Deleted file still open. Find it. Restart that service.
Interview card: df full but du small? · Download PNG · Open card page
Why is dd dangerous?. It writes raw blocks. Wrong of= wipes a disk. Check first.
Interview card: Why is dd dangerous? · Download PNG · Open card page
Cron job did not run?. Cron has a tiny PATH. Use full paths and log. Check the log.
Interview card: Cron job did not run? · Download PNG · Open card page
Test an API from a server?. Show headers. Fail on HTTP errors. Send JSON.
Interview card: Test an API from a server? · Download PNG · Open card page

Lesson: Linux Commands A-Z Part 2: chronyc, crontab, curl, cut, date, dd, df, diff, dig, dnf and du with Examples

Linux Commands A-Z Part 3: echo, find, grep, firewall-cmd, free, fsck and More with Examples

grep in 4 steps. Ignore case, line numbers. Search a folder. Two patterns. Context around a hit.
Revision card: grep in 4 steps · Download PNG · Open card page
Find big and old files. By name. By size. By age. Check memory too.
Revision card: Find big and old files · Download PNG · Open card page
grep vs find. Searches inside files. / Searches names and properties.
Comparison: grep vs find · Download PNG · Open card page
gzip vs tar. Compresses one file. / Bundles many files.
Comparison: gzip vs tar · Download PNG · Open card page
grep exit codes in scripts?. 0 found, 1 not found, 2 error. Quiet check. Fixed text with brackets.
Interview card: grep exit codes in scripts? · Download PNG · Open card page
Port open but gone after reboot?. Rule was runtime only. Add it permanently. Reload.
Interview card: Port open but gone after reboot? · Download PNG · Open card page
free shows little free memory?. Linux uses spare RAM for cache. Read available. Check swap use.
Interview card: free shows little free memory? · Download PNG · Open card page
When is fsck safe?. Only on an unmounted disk. Check first, no changes. Then repair.
Interview card: When is fsck safe? · Download PNG · Open card page

Lesson: Linux Commands A-Z Part 3: echo, find, grep, firewall-cmd, free, fsck and More with Examples

Linux Commands A-Z Part 4: hostname, ip, journalctl, jq, kill, lsof, lvcreate and More with Examples

First 5 minutes of an incident. Right server? Network up? What failed? Who holds the port?
Revision card: First 5 minutes of an incident · Download PNG · Open card page
Add storage with LVM. See disks. Disk to pool. Make a volume. Grow online.
Revision card: Add storage with LVM · Download PNG · Open card page
ip vs ifconfig. Modern iproute2 tool. / Old net-tools tool.
Comparison: ip vs ifconfig · Download PNG · Open card page
kill vs killall. Signals one PID. / Signals all by name.
Comparison: kill vs killall · Download PNG · Open card page
SIGTERM or SIGKILL?. TERM lets the app clean up. KILL cannot be caught. Use KILL last.
Interview card: SIGTERM or SIGKILL? · Download PNG · Open card page
Why did the server reboot?. When did it boot? Errors from last boot. Look for OOM.
Interview card: Why did the server reboot? · Download PNG · Open card page
Hard link vs symlink?. Hard: same inode, same FS. Symlink: a path, can break. Switch a release.
Interview card: Hard link vs symlink? · Download PNG · Open card page
iptables ACCEPT does nothing?. First match wins. List with numbers. Insert above DROP.
Interview card: iptables ACCEPT does nothing? · Download PNG · Open card page

Lesson: Linux Commands A-Z Part 4: hostname, ip, journalctl, jq, kill, lsof, lvcreate and More with Examples