[DEVELOPER] Advanced EC2

Question 1

What is the primary role of the EC2 Instance Profile?

Answer 1

A container that passes the IAM Role to the EC2 instance, allowing applications running on the instance to assume the role and access AWS services.

Question 2

What is AWS Systems Manager (SSM) Session Manager used for?

Answer 2

It provides secure, auditable access to EC2 instances without needing SSH keys or opening inbound ports (like port 22) on the Security Group.

Question 3

How do you securely provide application secrets (e.g., database password) to an EC2 instance at runtime?

Answer 3

Use AWS Secrets Manager or SSM Parameter Store (SecureString). The EC2 instance’s IAM Role must be granted permission to retrieve and decrypt the secret.

Question 4

What is the primary function of AWS Instance Connect?

Answer 4

It provides a simple, browser-based way to connect to EC2 instances using temporary SSH keys that are automatically pushed to the instance metadata, eliminating the need to manage long-term SSH keys.

Question 5

What are the three core components of an EC2 Auto Scaling Group (ASG)?

Answer 5

1. Launch Template (or Launch Configuration)
2. Auto Scaling Group (defines min, max, desired capacity)
3. Scaling Policies (defines when to scale).

Question 6

What is the difference between a Target Tracking Scaling Policy and a Step Scaling Policy?

Answer 6

• Target Tracking: The easiest way; sets a target value for a metric (e.g., keep average CPU utilization at 70%).
• Step Scaling: Defines specific actions (e.g., add 2 instances) based on specific CloudWatch alarm thresholds.

Question 7

How does an Application Load Balancer (ALB) direct traffic to different target groups based on the request?

Answer 7

Using Listener Rules that can evaluate the request path, host header, or query strings.

Question 8

What is the main benefit of using a Network Load Balancer (NLB) over an ALB?

Answer 8

NLB handles extremely high traffic and provides ultra-low latency (Layer 4 only), whereas ALB is better for flexible, feature-rich routing (Layer 7).

Question 9

What happens if an instance in an Auto Scaling Group is marked as unhealthy by a Load Balancer?

Answer 9

The Load Balancer informs the Auto Scaling Group, and the ASG will terminate the unhealthy instance and launch a new replacement instance.