Recently, at AWS Community Day Bengaluru, I had the pleasure of sitting down with Jason, the Community Head for the AWS Community Builders program. Jason’s journey from a self-taught tech enthusiast to a leader at AWS is as inspiring as the vibrant developer community he oversees.

We talked about everything from his unconventional career path to the incredible "India scale" of the AWS community. Here is the full podcast.

Chandra: Jason, most welcome to the podcast! Let’s start with your career at AWS. How did it all begin for you?

Jason: Thank you, Chandra! I just celebrated my fifth anniversary with AWS. I was actually hired right at the start of the pandemic, in March 2020. I remember interviewing for the role while I was on vacation in Mexico with my family—which was pretty funny looking back. Starting a new job when the whole world was shutting down was definitely a strange experience.

Chandra: Did you apply specifically for the community program, or did your journey start elsewhere?

Jason: I actually wasn't part of the AWS community before this. I’m not a technical builder and I had never used AWS. My background is in marketing and communications. When I saw a job listing for a community program within the marketing department, it felt like the perfect fit for my skill set.

Chandra: That’s interesting! A lot of people are curious about your background. How did you get into this space?

Jason: I studied applied communications in school—things like public relations, writing, and organizational dynamics. But I never had a "traditional" communications job. For years, I was self-employed; I ran technology blog sites, was a YouTuber long before it was mainstream, and was a Microsoft MVP for 15 years for my contributions to their technical community.

Eventually, my freelance work for Microsoft transitioned into a role at HTC, where I worked on their Android phone community. From there, I moved to AT&T Business to manage a community of small business owners, and finally, I landed here at AWS.

Chandra: AWS is known for its incredible community. From your lens, what makes the program so special?

Jason: When I joined, I was amazed by the passion. I didn't know much about user groups back then, but my job was to tap into that energy and build a new type of community from scratch. We launched the AWS Community Builders program in beta in June 2020—just 60 days after I started. At Amazon, we have a leadership principle called "Bias for Action," so we just figured out the best way to get it out the door.

Chandra: You’re quite a celebrity here! People are lining up for selfies. Did you expect this kind of reception in India?

Jason: I had a hunch! At events like re:Invent, I take a lot of pictures, but I knew coming to India would be on another level.

Chandra: What is the most unique thing you’ve noticed about the developer community here?

Jason: It’s what I call "India scale". Everything is just bigger here. For example, when we opened Community Builder applications this year, we had about 4,700 total—and 2,000 of those were from India alone. This Community Day in Bengaluru feels like a professional AWS summit; the energy and the population of young developers are just incredible.

Chandra: You actually chose to attend this Community Day over the AWS Summit that happened two weeks ago. Why was that?

Jason: Two reasons. At a Summit, my job is mostly standing in a booth and shaking hands. But at a Community Day, I get to speak, present, and really get to the heart of the community. I had heard how amazing the Indian community events were, and I wanted to experience it firsthand.

Chandra: We’ve seen great growth in India, but what about regions where the community is smaller, like Saudi Arabia? Do you have plans for those areas?

Jason: It’s not always easy growing in new regions, but our strategy is to leverage existing members. We encourage our builders in places like Saudi Arabia to share the application and grow the base. User groups are the most important part of this; if we can get a user group started in a city, the community grows from there, eventually producing Community Builders and AWS Heroes.

Chandra: You also mentioned "Cloud Clubs" in your presentation. Can you tell us more about that?

Jason: Cloud Clubs is a newer initiative, launched around late 2023 or early 2024. It’s essentially a user group specifically for students at colleges and universities. It’s led by students, for students, to get them interested in AWS early on. We’re already seeing Cloud Club captains transition into becoming Community Builders.

Chandra: How many countries have you visited to build these communities?

Jason: Honestly, not that many yet! Last year was my first big international push—I went to Thailand and Malaysia. Malaysia was actually the first Community Day I ever attended. This year, India is my first stop, followed by Singapore, Indonesia, and Argentina. I’m trying to hit as many places as possible.

Chandra: For someone in a small city wanting to start a local user group, what is your advice?

Jason: We encourage people to partner with existing groups first. However, if you’re in a city where it’s not realistic for people to travel to the nearest group, we absolutely encourage you to start your own. Even in a "small" city of a million people—which I know is small by "India scale"—if there are people who want to learn, we want to help them connect.

Chandra: Finally, how has your actual stay in India been so far?

Jason: It had a rough start! I arrived at 4:00 AM after a long flight, and then the airline lost my bag. But now I’m well-rested, I have new clothes, and I’m looking forward to doing some "photo walking" around the city this weekend.

And the food has been great! Last night I had corn and cheese samosas from a food cart—I asked for the least spicy thing they had, and it was still pretty spicy for me, but delicious. I also had a sweet Lassi and some Gulab Jamun, which I’ve had before from my neighbors back home. I love Indian food!

Chandra: Jason, it’s been a pleasure. I hope your stay is memorable, and we look forward to seeing you back in India soon.

Jason: Thank you for having me! It’s been a great event.

Databases are important part of any applications. But due to various reasons like cost, compliance, application compatibility etc. database migrations are required. In this blog we will discuss importance of doing database migration in the right way and using AWS DMS for this purpose with a hands-on example.

Why a live database migration is challenge

During Live migrations it is required to keep the database operational during the transition, which risks data inconsistency, extended downtime, and increased manual effort. Database migration is challenge due to various reasons like:

• Data Type Differences: Handling discrepancies between different data types like MySQL and PostgreSQL has certain difference in schema and conventions.

• Schema Conversion: Adapting schema definitions and constraints to match PostgreSQL requirements.

• Downtime: Potential service disruption if the database is live and critical.

• Manual Effort: Increased risk of human error and additional time in manual configuration.

• Data Integrity: Ensuring consistency and accuracy during data transformation and transfer.

Different ways to perform database migration

There are different ways to perform database migration. All of these approach have their own pros and cons.

One of the most popular approach is using SQL Dumps. Here we Use mysqldump to export data and import into PostgreSQL but this is manual and error prone. Similarly, various ETL tools like Talend or Apache NiFi can be used and there are various specialized utilities like pgloader for automated schema and data conversion as well.

But all these approaches have significant risks of data loss, downtime and human error. This is where AWS DMS comes in picture.

What is AWS DMS?

AWS DMS is a managed service from AWS that facilitates database migration to AWS. It supports both homogeneous (same database engine) and heterogeneous (different database engines) migrations.

When to Use AWS DMS

• Migrating on-premises databases to the cloud.

• Modernizing or consolidating databases across different environments.

• Enabling continuous data replication during live migrations with minimal downtime.

Benefits of AWS DMS

• Cost-Efficient: Reduces overhead with a managed solution.

• Minimal Downtime: Supports continuous data replication, ensuring business continuity.

• Simplified Management: Automates replication and offers robust monitoring tools.

• Flexibility: Adapts to various migration scenarios, whether homogeneous or heterogeneous.

How to setup DMS

Migrating databases between different engines or environments can be challenging. As discussed earlier, out of various approaches AWS DMS provides the most robust way to perform this task. Let’s setup a DMS service using terraform.

Automating AWS DMS Cluster Deployment with Terraform

AWS Database Migration Service (DMS) setup with Terraform makes the process very highly automated and reproducible. In this lab, we’ll create a full Terraform configuration that provisions a DMS replication instance, configures source and target endpoints, defines a replication task for migrating an entire schema, and sets up the necessary IAM roles for seamless operation.

1. AWS Provider Setup

Terraform starts by configuring the AWS provider. This tells Terraform where to deploy your resources. Adjust the region as needed:

provider "aws" {
  region = "us-east-1"  # Adjust region as needed
}

2. Creating the DMS Replication Instance

The replication instance is the core compute resource for DMS. It handles the data migration process. Here’s the complete resource configuration:

resource "aws_dms_replication_instance" "dms_instance" {
  replication_instance_id   = "dms-instance"
  replication_instance_class = "dms.t3.medium"  # We are using Smallest available instance class for DMS to control cost.
  allocated_storage         = 50 # This is also smallest possible value
  publicly_accessible       = true # You can keep it false in prod env
}

In this code we are creating dms-instance and uses the dms.t3.medium class. We are allocatting 50 GB of storage.

3. Configuring DMS Endpoints

Endpoints specify where data is coming from (source) and where it is going (target). This example uses an Aurora MySQL database as the source and an Aurora PostgreSQL database as the target.

Source Endpoint – Aurora MySQL

resource "aws_dms_endpoint" "source_mysql" {
  endpoint_id   = "source-mysql-endpoint"
  endpoint_type = "source"
  engine_name   = "mysql"

  username      = "admin"
  password      = "SUPERSECRET"
  server_name   = "rds-mysql-url.us-east-1.rds.amazonaws.com"
  port          = 3306
  database_name = "sample_db"
}

Target Endpoint – Aurora PostgreSQL

resource "aws_dms_endpoint" "target_postgres" {
  endpoint_id   = "target-postgres-endpoint"
  endpoint_type = "target"
  engine_name   = "postgres"

  username      = "master"
  password      = "SUPERSECRET"
  server_name   = "rds-postgres-url.us-east-1.rds.amazonaws.com"
  port          = 5432
  database_name = "sample_db"
}

Here we are setting the source and target. We specify the PostgreSQL connection details ensuring that DMS knows where to load the data.

4. Defining the DMS Replication Task

The replication task orchestrates the data migration. This task defines what to migrate, the migration type, and includes detailed settings to control the behavior during the migration.

resource "aws_dms_replication_task" "dms_task" {
  replication_task_id      = "mysql-to-postgres-migration"
  replication_instance_arn = aws_dms_replication_instance.dms_instance.replication_instance_arn
  source_endpoint_arn      = aws_dms_endpoint.source_mysql.endpoint_arn
  target_endpoint_arn      = aws_dms_endpoint.target_postgres.endpoint_arn

  migration_type = "full-load"  # Use "full-load-and-cdc" for ongoing changes

  table_mappings = <<EOF
{
  "rules": [
    {
      "rule-type": "selection",
      "rule-id": "1",
      "rule-name": "IncludeAllTables",
      "object-locator": {
        "schema-name": "sample_db",
        "table-name": "%"
      },
      "rule-action": "include"
    }
  ]
}
EOF

  replication_task_settings = <<EOF
{
  "TargetMetadata": {
      "TargetSchema": "",
      "SupportLobs": true,
      "FullLobMode": false,
      "LobChunkSize": 64,
      "LimitedSizeLobMode": true,
      "LobMaxSize": 32,
      "InlineLobMaxSize": 0,
      "LoadMaxFileSize": 0,
      "ParallelLoadThreads": 0,
      "ParallelLoadBufferSize": 0,
      "BatchApplyEnabled": false,
      "TaskRecoveryTableEnabled": false
  },
  "FullLoadSettings": {
      "TargetTablePrepMode": "DO_NOTHING",
      "CreatePkAfterFullLoad": false,
      "StopTaskCachedChangesApplied": false,
      "StopTaskCachedChangesNotApplied": false,
      "BatchApplyEnabled": false,
      "BatchApplyPreserveTransaction": false,
      "BatchApplyTimeoutMin": 0,
      "BatchApplySkipErrorTables": false
  },
  "Logging": {
      "EnableLogging": true
  }
}
EOF
}

Important details:

• Task Identification: The replication_task_id uniquely labels the task.

• Migration Type: It uses full-load to migrate the entire schema and data at once.

• Table Mappings: The JSON mapping rule ensures that all tables in the CompanyDB schema are included.

• Task Settings: These JSON blocks provide detailed configurations like LOB handling and logging options, ensuring that the task behaves as expected.

5. Configuring IAM Roles for DMS

AWS DMS requires specific IAM roles to interact with your VPC and CloudWatch logs. Two roles are created—one for VPC management and another for CloudWatch logging.

IAM Role for VPC Management

resource "aws_iam_role" "dms_vpc_role" {
  name = "dms-vpc-role"
  assume_role_policy = jsonencode({
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Principal": {
          "Service": "dms.amazonaws.com"
        },
        "Action": "sts:AssumeRole"
      }
    ]
  })
}

resource "aws_iam_role_policy_attachment" "dms_vpc_role_attach" {
  role       = aws_iam_role.dms_vpc_role.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonDMSVPCManagementRole"
}

Here, we are granting the DMS service permission to assume the role.

IAM Role for CloudWatch Logs

Here we are handling the logging permissions. Policy Attachment ensures DMS can write logs to CloudWatch for monitoring and troubleshooting.

resource "aws_iam_role" "dms_cloudwatch_logs_role" {
  name = "dms-cloudwatch-logs-role"
  assume_role_policy = jsonencode({
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Principal": {
          "Service": "dms.amazonaws.com"
        },
        "Action": "sts:AssumeRole"
      }
    ]
  })
}

resource "aws_iam_role_policy_attachment" "dms_cloudwatch_logs_role_attach" {
  role       = aws_iam_role.dms_cloudwatch_logs_role.name
  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonDMSCloudWatchLogsRole"
}

Creating the DMS cluster

Let’s apply the terraform configuration and observe the changes.

terraform apply

Observe the created DMS service

If everything is correct then it should start creating the DMS replication instance.

Pre-migration

Pre-migration assessment is important process to analyze the source database to identify compatibility issues, estimate migration effort, and plan the migration strategy.

Why is it important?

• Detects schema and data type mismatches.

• Estimates required changes and risks.

• Helps choose the right tools and migration path.

• Reduces surprises during migration.

Once you hit create migration assessment, it will start the process and give you the migration assessment result.

Reviewing migration results

After migration, AWS DMS can store detailed logs and migration reports in an S3 bucket. When you are reviewing them you can focus on these points:

• Verify which tables and rows were migrated.

• Identify any skipped or failed records.

• Troubleshoot issues using detailed error logs.

• Ensure data consistency between source and target.

This is how a sample report looks like

Finally, let’s start migration

Now comes the exciting part—starting the migration!

With everything configured and validated, kicking off the DMS task sets your data in motion. Watch as your tables begin flowing from MySQL to PostgreSQL, live and in real time. It’s the moment where planning turns into action, all with minimal downtime and full control via DMS.

Once this task is over, then your database has successfully migrated from Mysql to Postgres Sql. You can celebrate now! Yeyyy!

Generative AI (GenAI) a new field of artificial intelligence has taken the world on revolution with OpenAI Chatgpt being launch almost an year back. Using this we can create entirely new things, from text and images to code and music. It has the potential to transform many industries and our daily lives.

What future holds:

The Future of GenAI is very promising. With every predictions that GenAI models are going to become more sophisticated, affordable and accessible. We can expect even more creative applications, automation of complex tasks, and a deeper understanding of the world around us.

GenAI is going to increase enhanced creativity, increase efficiency, personalize experiences and propel speed of new discoveries.

Amazon Bedrock

Amazon Bedrock is a powerful platform that makes GenAI more accessible and user-friendly. AWS is bringing its decade long cloud leadership and experience in making GenAI available for developers and users.

Why Amazon Bedrock matters:

Amazon Bedrock is going to significantly effect the GenAI ecosystem due to following reaons:

• Lower Barrier to Entry: Bedrock provides access to powerful generative models from various AI providers through a single platform. This eliminates the need for extensive technical knowledge. learning curve and huge cost investment. Pay-per-use model will make it more easily accessible.

• Simplified Development: Bedrock offers pre-built tools and playgrounds for experimentation and fine-tuning models. Being part of AWS cloud it has deep integrations with various core AWS services like Opensearch, S3, IAM, KMS etc which will make development faster and simpler.

• Focus on Innovation: Bedrock will abstract the infrastructure and technical complexities so that application developers can just focus on innovation rather than going into research which is different area of expertise.

Amazon Bedrock for Beginners: A Hands-on Guide for developers

This guide gets you started with Amazon Bedrock, a powerful tool for building generative AI applications. I'll break down the key concepts and present you a path forward to start your learning journey. The whole learning journey has been broken down in multiple modules.

Prerequisites:

This guide is focused on developer. I assume you should have basic understanding of GenAI ecosystem, prompting and AWS cloud. If not then these modules are also important to learn.

Getting Started (Optional):

• Module 1: Introduction module covers the core ideas of generative AI and Amazon Bedrock if you are totally unaware of GenAI and its impact.

• Module 2: Intro to AWS (optional) module is essential guides you through setting up an AWS account if you don't already have one. You should also learn basic AWS cloud services before going to use Amazon Bedrock.

• Module 3: Prompt Engineering (optional) teaches you how to craft effective prompts, which are starting points for AI generation. It is optional but important to get quality response from the models.

Hands-on with Amazon Bedrock:

Once you have learnt the above concepts or modules then you are ready to dive into learning Amazon Bedrock with following lessons.

• Module 4: In this module you should dive into learning Amazon Bedrock's playgrounds and demos. Here, you'll experiment with pre-built models for text, chat, and image generation. You'll also learn to fine-tune these models for specific tasks.

Deep Dive into Amazon Bedrock:

• Module 5: Building Your App goes under the hood of Amazon Bedrock. You'll learn best practices for designing and building cost-effective and secure generative AI applications.

Building a Knowledge Base:

• Module 6: Knowledge Base teaches you how to build a knowledge base, which is a collection of information your AI can access. You'll also learn how to secure this data.

Building Generative AI Agents:

• Module 7: Building Agents walks you through creating secure and scalable generative AI applications. You'll learn to design and integrate the key components of these applications, called agents.

Building GenAI apps with Amazon Bedrock:

Building Generative AI Applications with Python:

• Module 8: Building Applications shows you how to leverage foundational models for various applications. You'll build simple generative AI chatbots, image generators, and more using Python.

Wrapping Up:

• Module 9: Putting it All Together discusses the ethical considerations of generative AI and how to stay updated on the latest developments in Amazon Bedrock. You'll also learn how to troubleshoot common issues.

Most AWS users in beginning miss to keep track of services they create. It’s very easy to forget the services creating via console in different regions. AWS is definitely a sea of services.

I myself have lost over 5000 in three occasions in total. With one alone being 4,000$ because I left a P5d.large Nvidia H100 GPU running which I created for an experiment.

Using AWS billings and alarms are some of the easiest way to keep track of AWS expenses. I also encourage using AWS organizations for centralised billing to utilise AWS accounts as disposals resources for all experiments and testing purposes.

I’ve written other blogs on using AWS billing and alarms and using AWS organizations effectively. In this article we will explore using AWS Nuke a powerful tool for destroying AWS resources.

I’m writing this blog as step by step lab instruction so that you can easily follow it just by running the given commands in sequence.

Objective of the lab:

• Understand the purpose and functionalities of AWS Nuke.

• Set up AWS Nuke for safe experimentation.

• Write configurations to target specific resources for deletion.

• Execute a dry run to simulate resource deletion.

Prerequisites

To finish this lab you should have:

• An AWS account with access credentials. Preferably with some resources created.

• Basic understanding of AWS resources.

• Familiarity with the command line interface (CLI).

Use cases:

1. Destroying the disposable AWS accounts created for testing and experiments.

2. Destroying inter-dependable AWS resources which are otherwise hard to be deleted.

3. Finding all resources known or unknown in all regions and deleting them.

Steps:

Step1: Setting Up the Lab Environment (Optional)

If you have an AWS account with some resources which you don’t need then you can try this on same account or you must create a new AWS account for testing AWS Nuke.

Important Note: AWS Nuke is a destructive tool, so use it with caution even in a non-production environment.

Step 2: Install AWS CLI

If you running this command from your local machine or non-Amazon Linus EC2 server then you must install AWS CLI.

• Running this command installs AWS CLI on Linux.

curl "<https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip>" -o "awscliv2.zip"

sudo apt install unzip

unzip awscliv2.zip

sudo ./aws/install

For further guidance in setting up CLI and configuring it with credentials follow this link. https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html

You must ensure that using are using credentials of administrator level AWS user or root can be used as well (not preferred).

Step 3: Installing AWS Nuke

• For macOS

brew install aws-nuke

• For Linux machines

# Download and extract 
wget -c <https://github.com/rebuy-de/aws-nuke/releases/download/v2.25.0/aws-nuke-v2.25.0-linux-amd64.tar.gz> -O - | tar -xz -C $HOME/bin

#Run
aws-nuke-v2.25.0-linux-amd64

You can find the latest version from release

Step 4: Configuring AWS Nuke basic configuration

AWS Nuke offers various configuration options. Explore the configuration file (~/.aws-nuke/config.yml) to customize behavior.

• This is a minimal configuration

regions: # List of regions to execute
- eu-west-1
- us-east-1

account-blocklist:
- "999999999999" # production

accounts:
  "000000000000": {} # aws-nuke-example

Step 5: Adding target and excludes

aws-nuke provides option to target or exclude particular resources from deletion. There are multiple ways to configure this.

• Using target to delete certain resources

---
regions:
  - "eu-west-1"
account-blocklist:
- 987654321

resource-types:
  # only nuke these three resources
  targets:
  - S3Object
  - S3Bucket
  - IAMRole

accounts:
  98769876: {}

• Using excludes to delete all but specified resources.

---
regions:
  - "eu-west-1"
account-blocklist:
- 987654321

resource-types:
  # don't nuke IAM users
  excludes:
  - IAMUser

accounts:
  98769876: {}

Step 6: Using resources filtering

aws-nuke provides option to avoid deleting the current user for example or for resources like S3 Buckets which have a globally shared namespace and might be hard to recreate. Currently the filtering is based on the resource identifier.

• For example we can delete all resources but certain IAMUser and IAMUserPolicyAttachment

---
regions:
  - "eu-west-1"

account-blocklist:
- 1234567890

accounts:
  0987654321:
    filters:
      IAMUser:
      - "admin"
      IAMUserPolicyAttachment:
      - "admin -> AdministratorAccess"
      IAMUserAccessKey:
      - "admin -> AKSDAFRETERSDF"
      - "admin -> AFGDSGRTEWSFEY"

aws-nuke supports using multiple types of filters like exact filter, contains, regex, date based etc.

Example configuration file.

version: 0.34.0  # Replace with the installed version

resources:
  - type: EC2
    filters:
      - Name: tag:Name=chandra-ec2
  - type: S3Bucket
    filters:
      - Name: name  # Matches bucket names containing "test"
        values:
          - application-data-store-12345364

Explanation of the configuration file

• version: Specifies the AWS Nuke version used.

• resources: This section defines the resources to target.

  • The first entry targets EC2 instances with the tag Name: My-Test-Instance.

  • The second entry targets S3 buckets containing "test" in their names.

Filters:

• Filters allow for more granular targeting within a resource type.

• In the first entry, we use a tag filter to target a specific EC2 instance.

• The second entry uses a name filter with a value to target buckets containing application-data-store-12345364.

Step 7: Executing a dry run

AWS Nuke is very distructive so it provides option to perform a dry run to see which resources would be deleted.

• Run the following command with flag --dry-run in the config path.

aws-nuke --dry-run -c nuke-config.yml

This command simulates the deletion process based on your configuration. It will display a list of resources slated for deletion without actually deleting them.

Step 8: Review and Deletion (ACTUAL & DISTRUCTIVE)

This step involves actual resource deletion. Here we just remove the --dry-run flag and run only when we are confident in the targeted resources.

Important: This will permanently delete the targeted resources. Use this step with extreme caution!

Result

Easily removed AWS resources giving me peace of mind with no surprise bills anymore.

Move #1 : Deciding Budgets and over-utilisation alarms

Situation:

• Budget is always a constraint for startups

• With founders wearing multiple hats, it’s easy to lose the track of cost. Common resources are unattached EBS volumes, Elastic IPs, Bastion hosts, Instances for ML model trainings etc.

• You wake up with surprise bills

• AWS provides billing predictions which helps to plan runway

Solution

• AWS Billing provides budget planning and tracking features

• You can create billing alarms to track unused resources and outlier costs

• Alerts can be created on forecasted costs or actual costs

AWS recommends following two approaches:

Proactive approach: AWS Instance Scheduler This approach involves using tags to resources like EC2/RDS instances and then create schedule to start or stop.

Reactive approach: AWS Budgets - This is the most basic and must do approach which involves creating email alerts when monthly AWS spend exceeds the budget threshold.

Move #2 : Deciding Infrastructure as Code (IAC)

Infrastructure as Code enables programmatic provisioning and management of cloud resources. It help to improve the efficiency, reliability, and scalability of your infrastructure, while also reducing costs and increasing flexibility.

Situation

• As startup grows services grow and scale increases. It becomes difficult to track resources and configurations.

• With increasing user demands need to deploy additional server in a different availability zones or region increases which is difficult to replicate in absence of IAC.

• Once the “Too small to be be notices” phase ends for a company attackers can create security nightmares. Implementing security policies and best practices are consistently applied across the infrastructure is difficult in absence of IAC.

• As startup budget is always a constraint. IAC reduces time-consuming and error-prone manual tasks and brings automation and hence cost saving.

Solutions:

• AWS CloudFormation: AWS CloudFormation is a good choice for organizations already using AWS, but it only supports AWS. This is a free tool and low learning curve. This is specially useful for startups to experiment faster.

• Terraform: Terraform is a good choice for organizations looking to support multiple cloud providers. But that has steeper compared to other Cloudformation and its complexity is higher as well.

Generally speaking for startup cloudformation is easier option to start with because of easiness to adopt, low learning curve and simplicity.

Move #3 :Choosing managed AWS services

AWS managed services can help organizations achieve greater scalability, reliability, security, and cost-effectiveness. Managed services are always updated to the latest cloud technologies and best practices in the industry.

Situation

• Self managed services have high cost and require more efforts in maintenance. So, to reduce cost and human efforts you should always use the correct AWS managed services.

• As a startup you should ways focus on your niche and innovate around that. Managing cloud is just a side hassle to be always avoided.

• As a startup you can never scale to match the level of experts of the domain like AWS and its engineers. So best idea is to just use the innovation at scale.

• Managed services have built-in features such as automated backups, disaster recovery, and security controls. You just need to plug and play.

Solution

Just use the right managed services.

Here is a table comparing self-managed solution with an AWS managed service.

In this blog we are going to look at five such technique which give you edge in the exam. All techniques are discussed with examples and alerts or warning for all questions.

Question technique 1

An application uses an Application Load Balancer, an Auto Scaling Group and currently, 10 EC2 instances. To ensure cost efficacy you have been asked to ensure that when average CPU utilisation is below 20% instances are terminated and added when average CPU is above 70%.

Alert1 - As it can be seen this is a pretty average type of question in term of its length and difficulty. All questions have some unnecessary information so we should start with identifying the keywords in it which actually matter. Click toggle button below to find the idetified keywords.

• Question highlights

  An application uses an Application Load Balancer, an Auto Scaling Group and currently, 10 EC2 instances. To ensure cost efficacy you have been asked to ensure that when average CPU utilisation is below 15% instances are terminated and added when average CPU is above 65%.

Which option should you suggest?

1. Implement a Scheduled Scaling Policy to add instances during periods of heavy CPU usage and remove them when CPU usage is below 20%
2. Run a script on each EC2 instance to report the CPU load back to the auto scaling service which can make decisions based on target rules
3. Implement Target Tracking Scaling Policies at 20% and 70%, use an IAM Role to provide the policies with permissions to add and remove EC2 instances
4. Use CloudWatch to monitor average CPU levels and create simple scaling policies within the Auto Scaling Group

Answer highlights

1. Implement a Scheduled Scaling Policy to add instances during periods of heavy CPU usage and remove them when CPU usage is below 20%

   not the case of scheduled scaling policy. Eliminated.

2. Run a script on each EC2 instance to report the CPU load back to the auto scaling service which can make decisions based on target rules

   This is not the case of scheduled scaling policy and secondly we hardly use script based solution in AWS.

3. Implement Target Tracking Scaling Policies at 20% and 70%, use an IAM Role to provide the policies with permissions to add and remove EC2 instances

   This talks about target tracking while questions seems to be needing simple scaling and it talks about IAM Role which we don’t use for autoscaling.

4. Use CloudWatch to monitor average CPU levels and create simple scaling policies within the Auto Scaling Group

   Only option which fits well after elimination.

Trick1 - Eliminate absurd answers.

Start with identifing the keywords in the question and the answer and eliminate one or two answers quickly.

Question technique 2

A professional baseball league has chosen to use AWS DynamoDB for its backend data storage. Many of the data requirements involve high-speed processing of images caputured using a flying drone. All these data including position and images are stored in DynamoDB. Users of the analytics applications using this database complain of slow load times for the positioning data including images. Currently the data and related informations are stored within DynamoDB.

Which option represents the best fix for this type of problem?

Alert2- Just think why it mentions DynamoDB as backend data storage. It also mentions storing image in the database. Why would someone use DynamoDB to storage images.

Question highlights

A professional baseball league has chosen to use AWS DynamoDB for its backend data storage. Many of the data requirements involve high-speed processing of images caputured using a flying drone. All these data including position and images are stored in DynamoDB. Users of the analytics applications using this database complain of slow load times for the positioning data including images. Currently the data and related informations are stored within DynamoDB.

Which option represents the best fix for this type of problem?

Which options do you suggest

Which option represents the best fix for this type of problem? (choose one)

1. Change from DynamoDB to Aurora running in a VPC and use multiple replicas to scale read capability for the analytics application.
2. Copy the drone images to S3, replace the database stored images with a link to the S3 location.
3. Change from DynamoDB to Aurora running in a VPC and use multiple replicas to scale read capability for the analytics application.
4. Modify the DynamoDB table to use on-demand pricing to cope with the incoming demand, use an SQS queue to buffer writes to cope with peak load.

Answer highlights

1. Change from DynamoDB to Aurora running in a VPC and use multiple replicas to scale read capability for the analytics application.

   Analytics application is based on nosql database. We can’t change the whole database and application.

2. Copy the drone images to S3, replace the database stored images with a link to the S3 location.

   As it can be seen the main issue storing the captured image data in DynamoDB itself. DynamoDB has limits on per items storage and that loading will take time. Changing this to point to image location on S3 seems a good option as with minimal changes in the application to show the images from the coming link will solve the issue.

3. Adjust the RCU and WCU on the DynamoDB tables to 10,000 each to cope with the load on the database.

   There is no limit to increasing the RCU and WCU. What if larger images keep getting stored in the database.

4. Modify the DynamoDB table to use on-demand pricing to cope with the incoming demand, use an SQS queue to buffer writes to cope with peak load.

   Similar to the last option, there is no limit to increasing demand of the application. Main issue is storing the image.

Trick2- Find anti-patterns.

Some questions give application level information which are not written obviously. Like this question mentions storing image in the DynamoDB itself. DynamoDB is not good for storing binary data. So trick is to find anti-patterns that the application might be using.

Question technique 3

A non-profit organization elastic **website runs on EC2 instances provisioned and terminated by an Auto Scaling Group. Authors connect to the system publish a post with attached images which can receive millions of views a day. With the introduction of the auto scaling group to allow the site to scale a regular bug is that posts have broken links instead of images.

Which of the following options is a potential fix? (choose one)

Motivation - This question is actually interesting because it doesn't give you a heads as to what is the root cause of the problem. It is very open ended and they give you little information about its implementation.This means to get additional information to about the question we will have to use the answers. It also mentions that ec2 instances termination of older instances by auto scaling group. This means problem is likely to be related to this change. This could be causing the broken links in the broken images. Good thing with this question is the its answers are very short so easier and quicker to evaluate.

Question highlights

A non-profit organization elastic website runs on EC2 instances provisioned and terminated by an Auto Scaling Group. Authors connect to the system publish a post with attached images which can receive millions of views a day. With the introduction of the auto scaling group to allow the site to scale a regular bug is that posts have broken links instead of images.

Which options do you suggest

1. Implement CloudFront to cache images to avoid the broken links
2. Change the EC2 volumes on all instances in the ASG from ST1 to GP2, adjust the ASG to use GP2 for any newly provisioned instances
3. Implement EFS and configure all Instances to mount it via a Mount Target
4. Use EBS Snapshots to restore any missing images on a case by case basis

Answer highlight

1. Implement CloudFront to cache images to avoid the broken links

Can’t decide to use CloudFront without actually knowing the backend source of images.

1. Change the EC2 volumes on all instances in the ASG from ST1 to GP2, adjust the ASG to use GP2 for any newly provisioned instances

ST1 to GP2 only changes the performance. Not the actual problem.

1. Implement EFS and configure all Instances to mount it via a Mount Target

This is the only good option after elimination of rest three. This is a shared file system to all instances with images stored in it permanently. So this will work like a charm.

1. Use EBS Snapshots to restore any missing images on a case by case basis

Elastic solutions need to be automated. Not case by casis.

Trick3 - Get clue from answers for open ended questions

This question required you need to read between the lines and understand the reasons why images could be broken because the storage of the instnace is vanishing as instances get terminated by ASG. This type of questions which require reviews and analysis are very common in the professional level. Even in associate level certifications have some questions like this.

Question technique 4

You are auditing a serverless application for a live aution system. The application uses API Gateway, S3 and Lambda to provide the frontend serverless compute and DynamoDB for backend data storage. During yearly auction registration periods the system is expected to have 10000x the load vs other times of the year. The DynamoDB tables use provisioned capacity of 50 RCU/WCU.

Which architecture changes could you suggest to reduce the impact of the extra load? (choose two)

Motivation- This is a clasic example of burst problem that for a certain period of time large amount of requests come which vanish later. If we look closely we find that frontend and backend part of the application is serverless which means it will scale automatically so this can’t be a concern for us to scale. API gateway, S3 and lambda are serverless services. But if we look at DynamoDB it is not. So, we may have to focus on this. Last part mentioning 50 RCU/WCU also gives us clue that this detail is useful to us. So answer mostly lies in DynamoDB.

Question highlights

You are auditing a serverless application for a live aution system. The application uses API Gateway, S3 and Lambda to provide the frontend serverless compute and DynamoDB for backend data storage. During yearly auction registration periods the system is expected to have 10000x the load vs other times of the year. The DynamoDB tables use provisioned capacity of 50 RCU/WCU.

Which architecture changes could you suggest to reduce the impact of the extra load? (choose two)

Which options do you suggest

1. Launch 100 DynamoDB databases during the peak period to spread the 10000x load
2. Backup the data from DynamoDB and restore the snapshot into an Aurora Serverless cluster, configure for public access and modify the application code
3. Change from provisioned to on-demand capacity
4. Add an SQS queue, modify the application so it writes to the queue and use a backend Lambda to parse auction registration records from the queue and add to the database over time
5. Increase the RCU and WCU on the table from 50 to 500,000 for the brief peak periods and return afterwards

Answer highlights

1. Launch 100 DynamoDB databases during the peak period to spread the 10000x load

   Straight no.

2. Backup the data from DynamoDB and restore the snapshot into an Aurora Serverless cluster, configure for public access and modify the application code

   Straight no. Can’t replatform.

3. Change from provisioned to on-demand capacity

   Yes. Let AWS handle the scaling. It may be very costly but this solution will work. So it is a potential solution. Since we have to select two this can be one of that. If we were to select cheapest one, then we could avoid this. But that’s not the case here.

4. Add an SQS queue, modify the application so it writes to the queue and use a backend Lambda to parse auction registration records from the queue and add to the database over time.

   Decoupled solution are great. This soultion will work at low cost as well and handle the peak volume using SQS queue. So, it is a great solution.

5. Increase the RCU and WCU on the table from 50 to 500,000 for the brief peak periods and return afterwards

   Nope. We need automated solution and there is no limit to load increase. What if load increases even higher.
   Trick4- Focus on non-serverless services for performance. Go for decoupled solutions.

Question technique 5

You are auditing the AWS environment for an enterprise application. It runs from EC2 instances provisioned via an ASG connected to an application load balancer. A SysAdmin team manages the AWS and EC2 environment, and development teams connect to EC2 when they perform application maintenance. You're adding SSL capability and need to ensure the Development team, who have Root access to the EC2 instances can't access the SSL Certificate for the application.

Which solution should you suggest? (choose one)

Motivation -

• Question highlights

You are auditing the AWS environment for an enterprise application. It runs from EC2 instances provisioned via an ASG connected to an application load balancer. A SysAdmin team manages the AWS and EC2 environment, and development teams connect to EC2 when they perform application maintenance. You're adding SSL capability and need to ensure the Development team, who have Root access to the EC2 instances can't access the SSL Certificate for the application.

Which solution should you suggest? (choose one)

Which options do you suggest

1. Store the SSL Certificate on S3, copy onto the EC2 instances at boot, load and remove afterwards
2. Store the SSL certificate on the EC2 instances and set the permissions to allow access onto from the SysAdmins IAM group
3. Generate a certificate within ACM, configure it on the ALB and set the EC2 instances to use the HTTPS protocol for ALB -> Instance connections
4. Import the certificate into ACM, configure it on the ALB and set the EC2 instances to use the HTTP protocol for ALB-> Instance Connections

Answer highlights

1. Store the SSL Certificate on S3, copy onto the EC2 instances at boot, load and remove afterwards

Once certificate is loaded on the instance root user will still have access to it.

1. Store the SSL certificate on the EC2 instances and set the permissions to allow access onto from the SysAdmins IAM group

   Any user with root permission could remove this still.

2. Generate a certificate within ACM, configure it on the ALB and set the EC2 instances to use the HTTPS protocol for ALB -> Instance connections

   If you set certificate on ALB then ALB→ instance connection will become http not https without setting another certificate on ec2 again.

3. Import the certificate into ACM, configure it on the ALB and set the EC2 instances to use the HTTP protocol for ALB-> Instance Connections

   Works well. Set the certificate on ALB and that make the application level access to the end users https and we can leave the ALB→instance connection http.

Trick5- Focus on wording difference in similar answers.

In this case last two options were very similar which is good because they have higher chances of being a valid answer and it is easy to find the keyword difference between them. And just focusing on that part will answer the question.

In this case first option of the last two options are the same because ACM supports both options → generating and importing certificates. Just focusing on the second part of the answers shows the difference.

Question technique 6

A software gaming company has produced an online racing game which has become an overnight craze. Due to the overwhelming success of the gaming application you need to implement security controls within the environment. The application uses EC2 instances, provisioned by an ASG, connected to an application load balancer. You need to implement a system using AWS tools and services which can conduct an analysis of EC2 instances checking for vulnerabilities. And a tool which can check the AWS account, products and services for compliance against best practice standards over time.

Which AWS products should you suggest? (choose two)

Motivation - Essentially this question revolves around security. It talks about vulnerabilities scan and compliance. Most likely everything about ALB, ASG are just useless information. Also it asks for AWS products recommendations so we just need to find a suitable service which meets the requirement.

Question highlight

A software gaming company has produced an online racing game which has become an overnight craze. Due to the overwhelming success of the gaming application you need to implement security controls within the environment. The application uses EC2 instances, provisioned by an ASG, connected to an application load balancer. You need to implement a system using AWS tools and services which can conduct an analysis of EC2 instances checking for vulnerabilities. And a tool which can check the AWS account, products and services for compliance against best practice standards over time.

Which AWS products should you suggest? (choose two)

Which options do you suggest

1. CloudTrail
2. AWS Config
3. Inspector
4. WAF & Shield

Answer highlights

1. CloudTrail

Used for access logging. Nothing to do with vulnerabilities scan.

1. AWS Config

Great to check mismatch from compliance standards.

1. Inspector

Great to do vulnerability scan on ec2.

1. WAF & Shield

Used for application security. Nothing to do with AWS account or ec2 instances.

Trick6- Ignore the garbage

Some questions have large amount of unncessary information. Finding this comes with experience. For example in this last two requirements actually matter. Rest whole paragraph is useless.