AWS Cloud Fundamentals and Docker Essentials: Core Services, Networking, and Containers

What is cloud computing, and why do organizations use AWS?

Cloud computing provides on-demand compute, storage, databases, and networking over the internet. AWS lets organizations provision resources without owning physical servers and scale or pay according to usage.

What is the difference between an AWS Region and an Availability Zone?

A Region is a separate geographic AWS area. An Availability Zone is an isolated data-center location within a Region. Deploying across AZs improves availability if one AZ fails.

What is IAM, and what is the principle of least privilege?

AWS Identity and Access Management controls which identities can access resources and what actions they can perform. Least privilege means granting only the permissions necessary for the task.

What is EC2, and when would you use it?

Amazon Elastic Compute Cloud provides virtual server instances. Use EC2 when you need control over the operating system, runtime, and installed software.

What are an AMI and EBS in EC2?

An Amazon Machine Image (AMI) is a template used to launch an EC2 instance. Elastic Block Store (EBS) provides persistent block storage volumes that can be attached to EC2 instances.

What is an EC2 security group?

A security group is a stateful virtual firewall for EC2 resources. Its inbound and outbound rules control allowed network traffic by port, protocol, and source or destination.

What are EC2 Auto Scaling and a load balancer?

Auto Scaling adjusts the number of EC2 instances based on demand or health. A load balancer distributes incoming traffic across healthy targets, improving responsiveness and availability.

What is Amazon S3, and what are buckets and objects?

Amazon Simple Storage Service (S3) is object storage. A bucket is a named container for objects; each object consists of data and associated metadata identified by a key.

What are S3 versioning and lifecycle rules?

Versioning keeps multiple versions of an object, helping recover overwritten or deleted data. Lifecycle rules automatically transition objects to different storage classes or expire them based on configured policies.

How does S3 differ from EBS and EFS?

S3 is object storage accessed via APIs; EBS is block storage typically attached to EC2; EFS is managed shared file storage that multiple instances can mount.

What is AWS Lambda, and what triggers it?

AWS Lambda runs code in response to events without managing servers. Triggers can include API requests, S3 object events, schedules, or messages from supported AWS services.

What is a Lambda cold start?

A cold start is the extra initialization time when Lambda creates a new execution environment before invoking a function. A warm invocation may reuse an existing environment.

What is DynamoDB, and how is it different from RDS?

DynamoDB is a managed NoSQL key-value and document database designed for scalable low-latency access. RDS manages relational databases such as PostgreSQL that use tables, SQL, and relational constraints.

What is a partition key in DynamoDB?

A partition key is an attribute whose value helps DynamoDB determine how items are distributed. Good key design spreads workload and avoids hot partitions.

What are the main cloud service models IaaS, PaaS, and SaaS?

Infrastructure as a Service supplies compute, storage, and networking that you configure. Platform as a Service manages more of the application runtime, while Software as a Service delivers ready-to-use software to customers.

What is the AWS shared responsibility model?

AWS secures the underlying cloud infrastructure, while customers are responsible for security in the cloud, including their data, identities, access settings, and configurations. The exact division varies by service.

What is a VPC, and why do subnets matter?

A Virtual Private Cloud is a logically isolated AWS network. Subnets divide its IP address space into network segments, allowing different routing and access for resources such as a public load balancer and private database.

What is an IAM role, and how does it differ from an IAM user?

An IAM user is an identity with long-term credentials if configured. An IAM role is assumed temporarily by users or services, supplying permissions through temporary credentials; ECS tasks commonly use roles.

What is the purpose of an S3 storage class?

An S3 storage class offers a cost and access pattern for objects, such as frequently accessed Standard storage or less frequently accessed and archival tiers. Choose based on retrieval needs, durability requirements, and cost.

How do S3 bucket policies and block public access help protect data?

A bucket policy defines resource-level permissions on a bucket and its objects. S3 Block Public Access adds safeguards against accidental public exposure, even if another permission setting would otherwise allow it.

When should you use Lambda rather than EC2?

Lambda suits short, event-driven code where AWS manages the execution environment and scaling. EC2 suits workloads that need more server-level control, persistent processes, or customized operating-system configuration.

What is the difference between DynamoDB provisioned and on-demand capacity?

Provisioned capacity configures expected read/write throughput and can use auto scaling. On-demand capacity adapts to changing request traffic with usage-based pricing, reducing the need to plan capacity in advance.

How do you connect securely to a Linux EC2 instance using SSH?

Typically use `ssh -i key.pem ec2-user@PUBLIC_IP` (the username depends on the AMI), with the private key protected and security group rules allowing SSH from an appropriate source IP.

What is an EC2 key pair used for?

An EC2 key pair supplies public-key cryptography for supported instance login methods, especially SSH to Linux. The public key is configured for the instance and the user protects the private key.

What is an EC2 instance type, and what affects the choice?

An instance type specifies a hardware resource profile such as vCPUs, memory, storage, and networking. Choose based on workload needs, performance requirements, architecture, and cost.

What is the difference between stopping and terminating an EC2 instance?

Stopping an EBS-backed instance shuts it down while usually preserving attached EBS volumes, so it can be started again. Terminating permanently removes the instance and may delete EBS volumes according to their delete-on-termination setting.

What is Amazon EBS, and why is it called persistent storage?

EBS provides block-storage volumes for EC2 and related uses. Data on an EBS volume can persist beyond an instance stop, unlike temporary in-memory data; persistence after termination depends on volume settings.

What is a security group inbound rule versus an outbound rule?

Inbound rules define which new connections may reach the resource. Outbound rules define which connections the resource may initiate. Security groups are stateful, so response traffic for allowed connections is automatically permitted.

What is an Elastic IP address?

An Elastic IP is a static public IPv4 address allocated to an AWS account for use with supported resources. It can be reassociated, but AWS may charge for public IPv4 address usage.

What happens when EC2 Auto Scaling replaces an unhealthy instance?

An Auto Scaling group compares actual capacity with its desired capacity and health status. If an instance becomes unhealthy, it can terminate or replace it to restore the desired number of instances.

What is the difference between a public subnet and a private subnet in a VPC?

A public subnet has a route to an internet gateway; a private subnet does not have a direct route to the internet gateway. A private subnet can still obtain outbound access through configured mechanisms such as a NAT gateway.

How does an Application Load Balancer use target groups and health checks?

An ALB listener uses rules to forward requests to a target group. Health checks help determine which registered targets are healthy enough to receive traffic.

What is the difference between Route 53 and CloudFront?

Route 53 is primarily DNS and domain routing; CloudFront is a CDN for delivering cached content and forwarding requests to configured origins. A domain can use Route 53 DNS to reach a CloudFront distribution.

What does the AWS CLI command `aws sts get-caller-identity` tell you?

It returns the AWS account and principal identity associated with the current credentials. It is useful for confirming which IAM user or assumed role is active before deployment.

What is containerization, and how does it differ from a virtual machine?

Containers package applications with dependencies while sharing the host operating-system kernel. Virtual machines run separate guest operating systems on virtualized hardware, so containers are typically lighter and start faster.

What is Docker, and what are its main components?

Docker is a platform for building, distributing, and running containers. Its key concepts include Dockerfiles, images, containers, the Docker Engine, and image registries.

What is the difference between a Docker image and a Docker container?

An image is an immutable packaged template containing an application and dependencies. A container is an instance of that image running as an isolated process.

What is a Dockerfile, and what do FROM, WORKDIR, COPY, RUN, and CMD do?

A Dockerfile is a recipe for building an image. FROM chooses a base image; WORKDIR sets the working directory; COPY adds files; RUN executes build-time commands; CMD specifies the default container command.

What is a multi-stage Docker build, and why use it for Spring Boot?

A multi-stage build compiles the application in a builder stage and copies the resulting JAR into a smaller runtime stage. It keeps build tools out of the final image and reduces image size.

How do docker build, docker run, and docker ps differ?

docker build creates an image from a Dockerfile; docker run creates and starts a container from an image; docker ps lists running containers (use -a to include stopped containers).

What do docker pull, docker tag, and docker push do?

docker pull downloads an image from a registry; docker tag adds or changes a registry/repository tag for an existing image; docker push uploads the tagged image to a registry.

What is the difference between a Docker volume and a container filesystem?

A container writable layer is generally discarded when that container is removed. A volume persists data independently of the container and can be reused.

What is the difference between Docker Hub and Amazon ECR?

Docker Hub is a general-purpose public/private container image registry. Amazon ECR is AWS-managed container image storage integrated with AWS IAM and deployment services such as ECS.

What is the purpose of a .dockerignore file?

It excludes unnecessary files from the Docker build context, such as local build outputs, logs, and secrets. This can speed up builds and reduce unintended file inclusion.

What do EXPOSE, ENV, and ENTRYPOINT mean in a Dockerfile?

EXPOSE documents the port an image expects to use, ENV sets environment variables, and ENTRYPOINT defines the main executable to run when a container starts. EXPOSE alone does not publish a host port.

What does docker run -p 8080:8080 accomplish?

It maps port 8080 on the host to port 8080 inside the container, allowing traffic to reach a service listening on that container port, subject to network and application settings.

Why are Docker image layers and build caching useful?

Docker builds images in reusable layers. If earlier steps have not changed, cached layers can reduce rebuild time; structuring a Dockerfile to copy dependency files before frequently changing source often improves caching.

What is the difference between a container registry and container orchestration?

A registry such as Docker Hub or Amazon ECR stores and distributes container images. An orchestrator such as ECS or Kubernetes deploys, schedules, scales, and monitors running containers.

How can you inspect a container that fails to start?

Use docker ps -a to check container status and docker logs for application output. Also inspect the configured command, environment variables, ports, and required dependencies.

What does `docker ps -a` show compared with `docker ps`?

`docker ps` lists running containers. `docker ps -a` lists all containers, including stopped and exited ones; use it to identify containers that failed or terminated.

What is the difference between `docker run` and `docker start`?

`docker run IMAGE` creates a new container from an image and starts it. `docker start CONTAINER` starts an existing stopped container without creating a new one.

What do `docker stop` and `docker kill` do differently?

`docker stop` requests graceful shutdown, allowing the main process time to exit before forcing termination. `docker kill` sends a termination signal immediately (SIGKILL by default), so it is more abrupt.

How do you view logs from a running or stopped Docker container?

Use `docker logs CONTAINER`, or `docker logs -f CONTAINER` to stream new log output. This is a first step for diagnosing startup failures and application exceptions.

How do you open an interactive shell in a running container?

Use `docker exec -it CONTAINER sh` (or `bash` if installed). `-i` keeps standard input open and `-t` allocates a terminal; the container must already be running.

What is the difference between `docker rm` and `docker rmi`?

`docker rm CONTAINER` removes a container. `docker rmi IMAGE` removes a local image, provided it is not required by existing containers or removal is otherwise allowed.

What does the command `docker run -d -p 8080:80 nginx` mean?

It creates and runs an Nginx container in detached mode (`-d`) and maps host port 8080 to container port 80. Browsers reach the service through the host on port 8080.

What does `docker inspect CONTAINER` help you find?

`docker inspect` prints detailed JSON metadata such as container configuration, environment variables, networking, mounts, and state. Use it when `docker ps` or logs do not explain a problem.

How do you find the installed Docker version and verify Docker can run containers?

Use `docker --version` for the CLI version and `docker run hello-world` for a basic engine test. `docker info` provides information about the daemon and its environment.

How do `docker pull`, `docker tag`, and `docker push` work together?

`docker pull` downloads an image, `docker tag SOURCE TARGET` assigns another image reference, and `docker push TARGET` uploads the tagged image to a registry after authentication.

What is the practical difference between `COPY` and `RUN` in a Dockerfile?

`COPY` places files from the build context into an image. `RUN` executes commands during image build, such as installing packages or compiling code; neither is the container startup command.

What is the difference between `ENV` and `ARG` in a Dockerfile?

`ARG` supplies build-time values and is not automatically available when a container runs. `ENV` sets environment variables that persist in the image and are normally available at runtime. Neither is a safe place to bake sensitive secrets into an image.

What is a Docker image tag, and why avoid relying only on `latest`?

A tag is a human-readable image reference such as `myapp:1.2.0`. Specific version or commit tags make deployments reproducible and traceable, whereas `latest` is mutable and does not guarantee the newest build.

What is Docker Compose used for, and which command starts a Compose application?

Docker Compose defines multi-container applications, networks, and volumes in a YAML file. Run `docker compose up -d` to create and start the defined services in the background.

What is a bind mount compared with a Docker volume?

A bind mount maps a specific host file or folder into a container; a Docker volume is managed by Docker. Both can persist data, but volumes usually simplify containerized data management.

Why should containers generally run as non-root users?

Running a process without root privileges reduces potential damage if the process is compromised. It is one layer of defense alongside minimal images, patched dependencies, and limited permissions.

What is DevOps, and what problem does it address?

DevOps is a culture and set of practices that brings development and operations together to deliver software reliably and quickly through collaboration, automation, monitoring, and feedback.

What is continuous integration (CI)?

CI means frequently merging code changes into a shared repository and automatically building and testing them to catch integration problems early.

How do continuous delivery and continuous deployment differ?

Continuous delivery automatically prepares validated changes for release but can require manual production approval. Continuous deployment automatically releases every change that passes the pipeline.

What is GitHub Actions, and what starts a workflow?

GitHub Actions is GitHub's workflow automation platform. Workflows are YAML files triggered by events such as push, pull_request, a schedule, or manual dispatch.

What is the difference between a workflow, job, step, action, and runner?

A workflow is the full automation definition; jobs are groups of steps; steps run commands or reusable actions; an action packages reusable functionality; a runner is the machine executing a job.

What is YAML used for in GitHub Actions?

YAML expresses workflow configuration, including triggers, jobs, runners, and steps. A workflow file is generally stored under .github/workflows/ in the repository.

What is a GitHub Actions secret, and why should credentials not be committed to code?

A GitHub Actions secret stores a sensitive value for controlled use by workflows. Keeping credentials out of source code reduces accidental exposure, though access permissions and logs still require care.

What is Infrastructure as Code (IaC), and what is Terraform?

IaC defines infrastructure through version-controlled configuration instead of manual clicks. Terraform is an IaC tool that plans and applies changes to provision infrastructure from declarative configuration.

What stages commonly appear in a CI/CD pipeline?

A typical pipeline checks out code, installs dependencies, builds the application, runs tests, packages artifacts, and deploys to a target environment. Quality or approval gates may control release.

What is the difference between GitHub-hosted and self-hosted runners?

GitHub-hosted runners are managed execution machines provided by GitHub. Self-hosted runners are machines you operate, giving more environment control but requiring your own security, updates, and maintenance.

What does needs do in a GitHub Actions workflow?

The needs keyword makes one job depend on another job, so dependent work can run only after prerequisites complete successfully unless conditions alter this behavior.

Why use artifacts and caching in GitHub Actions?

Artifacts preserve files produced by a workflow, such as test reports or compiled builds, for later use or download. Caching reuses dependencies or build data across workflow runs to make future runs faster.

What is the difference between terraform plan and terraform apply?

terraform plan previews the infrastructure changes Terraform intends to make. terraform apply executes an approved plan, creating, modifying, or deleting resources to match the configuration.

Why is Terraform state important?

Terraform state records the resources Terraform manages and their current identifiers so it can compare real infrastructure with configuration. State should be protected and coordinated, particularly in team workflows.

What is the difference between `push`, `pull_request`, and `workflow_dispatch` triggers?

`push` runs workflows for matching push events, `pull_request` runs for configured PR events, and `workflow_dispatch` permits manual invocation through GitHub.

What is the purpose of `actions/checkout` in a workflow?

It checks out repository content into the runner workspace so later steps can inspect, build, and test the source code.

What is the difference between a workflow artifact and a dependency cache?

An artifact stores a build output or file from a workflow so it can be downloaded or passed to later jobs. A cache reuses dependencies or build inputs to speed up future runs and is not a deployment artifact guarantee.

What does `runs-on: ubuntu-latest` mean?

The job is scheduled on an Ubuntu runner image selected by GitHub. The runner executes the job steps in the configured environment.

What does `needs` mean in a GitHub Actions job?

`needs` declares that a job depends on one or more other jobs. The dependent job normally waits for those jobs to complete successfully before running.

Why might a GitHub Actions pipeline fail before deployment?

Possible causes include dependency installation errors, compilation or test failures, YAML mistakes, missing secrets, unavailable runners, or permission problems. Check the failed job and step logs before investigating deployment infrastructure.

What is the difference between `terraform init`, `plan`, `apply`, and `destroy`?

`init` initializes the working directory and providers, `plan` previews changes, `apply` performs approved changes, and `destroy` removes Terraform-managed infrastructure.

What is Terraform state, and why should teams protect it?

State records Terraform-managed resources and their current mappings. It is needed to plan changes accurately and may contain sensitive values, so use access controls and protected remote storage with locking when supported.

How does the Week 9 Angular and Spring Boot AWS deployment work end-to-end?

Angular build files are stored in S3 and delivered through CloudFront. CloudFront routes API requests to an Application Load Balancer in front of the Spring Boot container running on ECS; the backend connects to PostgreSQL on RDS.

What is Amazon ECR versus Amazon ECS?

ECR is a managed registry that stores container images. ECS is a service that schedules, runs, and manages containers using task definitions and services.

What is AWS Fargate in the context of ECS?

Fargate is a serverless compute option for running ECS containers without directly managing EC2 instances. You specify container resource requirements while AWS manages underlying compute infrastructure.

What is an ECS task definition, task, and service?

A task definition describes container settings such as image, CPU, memory, ports, and environment configuration. A task is a running instance of that definition; a service maintains a desired number of tasks.

What is Amazon RDS, and why does the course configure PostgreSQL as private?

RDS manages relational databases such as PostgreSQL. Keeping the database without public access limits direct internet exposure and allows access from authorized resources within the VPC.

What is AWS Secrets Manager used for in the deployment?

Secrets Manager securely stores sensitive values such as database usernames and passwords. ECS can retrieve or inject configured secrets so they are not hardcoded in the application or image.

What is CloudFront, and what is an origin or behavior?

CloudFront is AWS's content delivery network. An origin is the backend resource it retrieves content from, such as S3 or an ALB; a cache behavior sets how matching request paths are handled and routed.

Why can refreshing an Angular route cause a 404 on S3/CloudFront, and how is it handled?

An Angular single-page application may have routes that do not exist as physical S3 files. Configure CloudFront rewrite/fallback handling so app routes resolve to index.html and Angular handles navigation.

Why use environment variables and application.properties in a Spring Boot cloud deployment?

Spring Boot can resolve configuration placeholders from environment variables. This lets the same application image run in multiple environments with different database endpoints and settings without rebuilding code.

How would you investigate an ECS deployment that does not become healthy?

Check ECS service events and stopped/running task status, read application logs, verify container port and health-check path, inspect IAM and secrets permissions, and confirm security group/database connectivity.

Why does the backend need an Application Load Balancer in the course architecture?

An Application Load Balancer receives HTTP or HTTPS traffic and forwards requests to healthy backend targets such as ECS tasks. It separates public routing from individual container instances and supports health checks.

What is the role of the ECS task execution role versus the task role?

The execution role lets ECS infrastructure pull images and retrieve configured startup resources such as secrets or logs. The task role grants permissions to application code running inside the container when it calls AWS services.

Why do AWS deployments use health checks?

Health checks verify that a target responds correctly at a configured path or port. A load balancer or ECS service can stop sending traffic to unhealthy targets and replace failing tasks.