AWS Cloud, Docker, and DevOps CI/CD Fundamentals

What is cloud computing, and why do organizations use AWS?

Cloud computing provides on-demand compute, storage, databases, and networking over the internet. AWS lets organizations provision resources without owning physical servers and scale or pay according to usage.

What is the difference between an AWS Region and an Availability Zone?

A Region is a separate geographic AWS area. An Availability Zone is an isolated data-center location within a Region. Deploying across AZs improves availability if one AZ fails.

What is IAM, and what is the principle of least privilege?

AWS Identity and Access Management controls which identities can access resources and what actions they can perform. Least privilege means granting only the permissions necessary for the task.

What is EC2, and when would you use it?

Amazon Elastic Compute Cloud provides virtual server instances. Use EC2 when you need control over the operating system, runtime, and installed software.

What are an AMI and EBS in EC2?

An Amazon Machine Image (AMI) is a template used to launch an EC2 instance. Elastic Block Store (EBS) provides persistent block storage volumes that can be attached to EC2 instances.

What is an EC2 security group?

A security group is a stateful virtual firewall for EC2 resources. Its inbound and outbound rules control allowed network traffic by port, protocol, and source or destination.

What are EC2 Auto Scaling and a load balancer?

Auto Scaling adjusts the number of EC2 instances based on demand or health. A load balancer distributes incoming traffic across healthy targets, improving responsiveness and availability.

What is Amazon S3, and what are buckets and objects?

Amazon Simple Storage Service (S3) is object storage. A bucket is a named container for objects; each object consists of data and associated metadata identified by a key.

What are S3 versioning and lifecycle rules?

Versioning keeps multiple versions of an object, helping recover overwritten or deleted data. Lifecycle rules automatically transition objects to different storage classes or expire them based on configured policies.

How does S3 differ from EBS and EFS?

S3 is object storage accessed via APIs; EBS is block storage typically attached to EC2; EFS is managed shared file storage that multiple instances can mount.

What is AWS Lambda, and what triggers it?

AWS Lambda runs code in response to events without managing servers. Triggers can include API requests, S3 object events, schedules, or messages from supported AWS services.

What is a Lambda cold start?

A cold start is the extra initialization time when Lambda creates a new execution environment before invoking a function. A warm invocation may reuse an existing environment.

What is DynamoDB, and how is it different from RDS?

DynamoDB is a managed NoSQL key-value and document database designed for scalable low-latency access. RDS manages relational databases such as PostgreSQL that use tables, SQL, and relational constraints.

What is a partition key in DynamoDB?

A partition key is an attribute whose value helps DynamoDB determine how items are distributed. Good key design spreads workload and avoids hot partitions.

What are the main cloud service models IaaS, PaaS, and SaaS?

Infrastructure as a Service supplies compute, storage, and networking that you configure. Platform as a Service manages more of the application runtime, while Software as a Service delivers ready-to-use software to customers.

What is the AWS shared responsibility model?

AWS secures the underlying cloud infrastructure, while customers are responsible for security in the cloud, including their data, identities, access settings, and configurations. The exact division varies by service.

What is a VPC, and why do subnets matter?

A Virtual Private Cloud is a logically isolated AWS network. Subnets divide its IP address space into network segments, allowing different routing and access for resources such as a public load balancer and private database.

What is an IAM role, and how does it differ from an IAM user?

An IAM user is an identity with long-term credentials if configured. An IAM role is assumed temporarily by users or services, supplying permissions through temporary credentials; ECS tasks commonly use roles.

What is the purpose of an S3 storage class?

An S3 storage class offers a cost and access pattern for objects, such as frequently accessed Standard storage or less frequently accessed and archival tiers. Choose based on retrieval needs, durability requirements, and cost.

How do S3 bucket policies and block public access help protect data?

A bucket policy defines resource-level permissions on a bucket and its objects. S3 Block Public Access adds safeguards against accidental public exposure, even if another permission setting would otherwise allow it.

When should you use Lambda rather than EC2?

Lambda suits short, event-driven code where AWS manages the execution environment and scaling. EC2 suits workloads that need more server-level control, persistent processes, or customized operating-system configuration.

What is the difference between DynamoDB provisioned and on-demand capacity?

Provisioned capacity configures expected read/write throughput and can use auto scaling. On-demand capacity adapts to changing request traffic with usage-based pricing, reducing the need to plan capacity in advance.

What is containerization, and how does it differ from a virtual machine?

Containers package applications with dependencies while sharing the host operating-system kernel. Virtual machines run separate guest operating systems on virtualized hardware, so containers are typically lighter and start faster.

What is Docker, and what are its main components?

Docker is a platform for building, distributing, and running containers. Its key concepts include Dockerfiles, images, containers, the Docker Engine, and image registries.

What is the difference between a Docker image and a Docker container?

An image is an immutable packaged template containing an application and dependencies. A container is an instance of that image running as an isolated process.

What is a Dockerfile, and what do FROM, WORKDIR, COPY, RUN, and CMD do?

A Dockerfile is a recipe for building an image. FROM chooses a base image; WORKDIR sets the working directory; COPY adds files; RUN executes build-time commands; CMD specifies the default container command.

What is a multi-stage Docker build, and why use it for Spring Boot?

A multi-stage build compiles the application in a builder stage and copies the resulting JAR into a smaller runtime stage. It keeps build tools out of the final image and reduces image size.

How do docker build, docker run, and docker ps differ?

docker build creates an image from a Dockerfile; docker run creates and starts a container from an image; docker ps lists running containers (use -a to include stopped containers).

What do docker pull, docker tag, and docker push do?

docker pull downloads an image from a registry; docker tag adds or changes a registry/repository tag for an existing image; docker push uploads the tagged image to a registry.

What is the difference between a Docker volume and a container filesystem?

A container writable layer is generally discarded when that container is removed. A volume persists data independently of the container and can be reused.

What is the difference between Docker Hub and Amazon ECR?

Docker Hub is a general-purpose public/private container image registry. Amazon ECR is AWS-managed container image storage integrated with AWS IAM and deployment services such as ECS.

What is the purpose of a .dockerignore file?

It excludes unnecessary files from the Docker build context, such as local build outputs, logs, and secrets. This can speed up builds and reduce unintended file inclusion.

What do EXPOSE, ENV, and ENTRYPOINT mean in a Dockerfile?

EXPOSE documents the port an image expects to use, ENV sets environment variables, and ENTRYPOINT defines the main executable to run when a container starts. EXPOSE alone does not publish a host port.

What does docker run -p 8080:8080 accomplish?

It maps port 8080 on the host to port 8080 inside the container, allowing traffic to reach a service listening on that container port, subject to network and application settings.

Why are Docker image layers and build caching useful?

Docker builds images in reusable layers. If earlier steps have not changed, cached layers can reduce rebuild time; structuring a Dockerfile to copy dependency files before frequently changing source often improves caching.

What is the difference between a container registry and container orchestration?

A registry such as Docker Hub or Amazon ECR stores and distributes container images. An orchestrator such as ECS or Kubernetes deploys, schedules, scales, and monitors running containers.

How can you inspect a container that fails to start?

Use docker ps -a to check container status and docker logs for application output. Also inspect the configured command, environment variables, ports, and required dependencies.

What is DevOps, and what problem does it address?

DevOps is a culture and set of practices that brings development and operations together to deliver software reliably and quickly through collaboration, automation, monitoring, and feedback.

What is continuous integration (CI)?

CI means frequently merging code changes into a shared repository and automatically building and testing them to catch integration problems early.

How do continuous delivery and continuous deployment differ?

Continuous delivery automatically prepares validated changes for release but can require manual production approval. Continuous deployment automatically releases every change that passes the pipeline.

What is GitHub Actions, and what starts a workflow?

GitHub Actions is GitHub's workflow automation platform. Workflows are YAML files triggered by events such as push, pull_request, a schedule, or manual dispatch.

What is the difference between a workflow, job, step, action, and runner?

A workflow is the full automation definition; jobs are groups of steps; steps run commands or reusable actions; an action packages reusable functionality; a runner is the machine executing a job.

What is YAML used for in GitHub Actions?

YAML expresses workflow configuration, including triggers, jobs, runners, and steps. A workflow file is generally stored under .github/workflows/ in the repository.

What is a GitHub Actions secret, and why should credentials not be committed to code?

A GitHub Actions secret stores a sensitive value for controlled use by workflows. Keeping credentials out of source code reduces accidental exposure, though access permissions and logs still require care.

What is Infrastructure as Code (IaC), and what is Terraform?

IaC defines infrastructure through version-controlled configuration instead of manual clicks. Terraform is an IaC tool that plans and applies changes to provision infrastructure from declarative configuration.

What stages commonly appear in a CI/CD pipeline?

A typical pipeline checks out code, installs dependencies, builds the application, runs tests, packages artifacts, and deploys to a target environment. Quality or approval gates may control release.

What is the difference between GitHub-hosted and self-hosted runners?

GitHub-hosted runners are managed execution machines provided by GitHub. Self-hosted runners are machines you operate, giving more environment control but requiring your own security, updates, and maintenance.

What does needs do in a GitHub Actions workflow?

The needs keyword makes one job depend on another job, so dependent work can run only after prerequisites complete successfully unless conditions alter this behavior.

Why use artifacts and caching in GitHub Actions?

Artifacts preserve files produced by a workflow, such as test reports or compiled builds, for later use or download. Caching reuses dependencies or build data across workflow runs to make future runs faster.

What is the difference between terraform plan and terraform apply?

terraform plan previews the infrastructure changes Terraform intends to make. terraform apply executes an approved plan, creating, modifying, or deleting resources to match the configuration.

Why is Terraform state important?

Terraform state records the resources Terraform manages and their current identifiers so it can compare real infrastructure with configuration. State should be protected and coordinated, particularly in team workflows.

How does the Week 9 Angular and Spring Boot AWS deployment work end-to-end?

Angular build files are stored in S3 and delivered through CloudFront. CloudFront routes API requests to an Application Load Balancer in front of the Spring Boot container running on ECS; the backend connects to PostgreSQL on RDS.

What is Amazon ECR versus Amazon ECS?

ECR is a managed registry that stores container images. ECS is a service that schedules, runs, and manages containers using task definitions and services.

What is AWS Fargate in the context of ECS?

Fargate is a serverless compute option for running ECS containers without directly managing EC2 instances. You specify container resource requirements while AWS manages underlying compute infrastructure.

What is an ECS task definition, task, and service?

A task definition describes container settings such as image, CPU, memory, ports, and environment configuration. A task is a running instance of that definition; a service maintains a desired number of tasks.

What is Amazon RDS, and why does the course configure PostgreSQL as private?

RDS manages relational databases such as PostgreSQL. Keeping the database without public access limits direct internet exposure and allows access from authorized resources within the VPC.

What is AWS Secrets Manager used for in the deployment?

Secrets Manager securely stores sensitive values such as database usernames and passwords. ECS can retrieve or inject configured secrets so they are not hardcoded in the application or image.

What is CloudFront, and what is an origin or behavior?

CloudFront is AWS's content delivery network. An origin is the backend resource it retrieves content from, such as S3 or an ALB; a cache behavior sets how matching request paths are handled and routed.

Why can refreshing an Angular route cause a 404 on S3/CloudFront, and how is it handled?

An Angular single-page application may have routes that do not exist as physical S3 files. Configure CloudFront rewrite/fallback handling so app routes resolve to index.html and Angular handles navigation.

Why use environment variables and application.properties in a Spring Boot cloud deployment?

Spring Boot can resolve configuration placeholders from environment variables. This lets the same application image run in multiple environments with different database endpoints and settings without rebuilding code.

How would you investigate an ECS deployment that does not become healthy?

Check ECS service events and stopped/running task status, read application logs, verify container port and health-check path, inspect IAM and secrets permissions, and confirm security group/database connectivity.

Why does the backend need an Application Load Balancer in the course architecture?

An Application Load Balancer receives HTTP or HTTPS traffic and forwards requests to healthy backend targets such as ECS tasks. It separates public routing from individual container instances and supports health checks.

What is the role of the ECS task execution role versus the task role?

The execution role lets ECS infrastructure pull images and retrieve configured startup resources such as secrets or logs. The task role grants permissions to application code running inside the container when it calls AWS services.

Why do AWS deployments use health checks?

Health checks verify that a target responds correctly at a configured path or port. A load balancer or ECS service can stop sending traffic to unhealthy targets and replace failing tasks.

What is the AWS CLI and what does aws configure set up?

The AWS Command Line Interface lets you interact with AWS services from a terminal. aws configure sets default credentials and configuration such as Region and output format for a profile; securely managed roles and temporary credentials are preferable where available.

What happens when a GitHub Actions deployment pushes a new backend image to ECR?

A workflow builds and pushes an image to ECR, then the deployment must point ECS to that image and update or roll the service to run new tasks. Merely uploading an image does not update running containers.

Why should you clean up RDS, ECS, and other cloud resources after practice?

Provisioned infrastructure can continue billing even when you are not actively using the application. Removing unnecessary databases, services, load balancers, storage, and other resources helps avoid surprise costs.

What is Kubernetes, and how is it different from Docker?

Docker builds and runs containers. Kubernetes orchestrates containerized workloads across a cluster, handling scheduling, desired state, scaling, and recovery.

What are the Kubernetes control plane and worker nodes?

The control plane manages cluster state, API requests, and scheduling decisions. Worker nodes run application workloads using a container runtime and node agents.

What is a Kubernetes Pod?

A Pod is the smallest deployable unit in Kubernetes. It contains one or more closely coupled containers that share networking and can share storage volumes.

What are Kubernetes Deployments and Services?

A Deployment manages a desired set of replicated Pods and rolling updates. A Service provides a stable way to reach Pods even as their individual IP addresses change.

What is kubectl used for?

kubectl is the CLI for communicating with the Kubernetes API. For example, kubectl get pods lists Pods, kubectl describe shows resource details, and kubectl logs reads container logs.

What are Amazon EKS and CloudWatch?

EKS is AWS's managed Kubernetes service, which manages the Kubernetes control plane. CloudWatch collects AWS metrics and logs and supports alarms and dashboards for monitoring.

What is the difference between desired state and actual state in Kubernetes?

Desired state is the configuration you declare, such as three replicas of a service. Kubernetes controllers continually compare it with actual cluster state and take action to reconcile differences.

What is a ReplicaSet and how is it related to a Deployment?

A ReplicaSet maintains a specified number of matching Pods. A Deployment manages ReplicaSets and supports controlled rollout and updates of an application.

What is the difference between ClusterIP, NodePort, and LoadBalancer Services?

ClusterIP exposes a Service within the cluster. NodePort opens a port on worker nodes, and LoadBalancer requests external load-balancer connectivity when supported by the environment.

What are ConfigMaps and Secrets in Kubernetes?

ConfigMaps store non-sensitive configuration for applications. Secrets hold sensitive values such as credentials, but still require appropriate access controls and encryption practices.

What is the difference between Kubernetes scaling and self-healing?

Scaling changes how many application replicas run to handle demand. Self-healing detects missing or unhealthy Pods and replaces or restarts workloads to restore the declared state.

What is the difference between a monolith and microservices?

A monolith packages application functions into one deployable application. Microservices split functions into independently deployable services communicating over APIs or messaging, trading isolation and scaling flexibility for distributed-system complexity.

What is service discovery, and what does Netflix Eureka do?

Service discovery helps services locate available instances of other services without hardcoded addresses. Eureka provides a registry where services can register and look each other up.

What does an API Gateway do in a microservices architecture?

An API Gateway provides an entry point for client requests and routes them to backend services. It may also provide cross-cutting features such as authentication, rate limiting, or request filtering.

What is OpenFeign (Feign Client) in Spring Cloud?

OpenFeign is a declarative HTTP client. Developers define an interface describing remote API calls, and the framework provides the HTTP client implementation.

What is the circuit breaker pattern?

A circuit breaker stops repeatedly calling a failing remote dependency after failures exceed a threshold. It can fail fast or use a fallback, then probe later to determine whether the dependency has recovered.

What are Spring Cloud Config Server and distributed tracing?

Config Server centralizes application configuration for multiple services. Distributed tracing follows a request across service boundaries to help diagnose latency and failures.

What is CQRS?

Command Query Responsibility Segregation separates operations that change state (commands) from those that read state (queries). It may use different models for writes and reads when that complexity is justified.

Why can microservices be harder to operate than a monolith?

Independent services add network calls, deployment coordination, distributed logs, and possible partial failures. Teams must handle service discovery, observability, retries, and data consistency across boundaries.

What is the database-per-service pattern?

Each microservice owns its data store or data schema rather than directly sharing database tables. This reduces coupling but requires API calls, messaging, or other coordination for cross-service data.

What is the difference between synchronous and asynchronous microservice communication?

Synchronous calls, such as HTTP requests, usually wait for a response and can propagate latency or outages. Asynchronous messaging allows services to process events independently but introduces eventual consistency and message-handling concerns.

What is a fallback in the circuit breaker pattern?

A fallback is an alternative response or behavior when a remote dependency cannot be used, such as returning cached data or a controlled error. It should not conceal unsafe or incorrect application results.

What is client-side load balancing in Spring Cloud?

Client-side load balancing selects a service instance from discovered available instances before making a request. Spring Cloud LoadBalancer can integrate with service discovery to distribute requests.