-
Notifications
You must be signed in to change notification settings - Fork 0
EN_AWS
A summary of AWS concepts for DevOps engineers. Click each link for full details.
- Assume Role: Obtain temporary security credentials to access resources in another account or assume different permissions within the same account
- sts:AssumeRole: IAM credential-based role delegation — used for cross-account access
- sts:AssumeRoleWithWebIdentity: OIDC/SAML token-based role delegation — integrates with GitHub Actions, Kubernetes SA, and other external identity providers
- Temporary Credentials: Composed of access key + secret access key + session token, with configurable expiration
-
Ingress Group: Consolidates multiple Ingresses into a single ALB (
alb.ingress.kubernetes.io/group.name) - group.order: Sets Ingress rule priority — lower numbers apply first
- listen-ports: Specifies the ports the ALB listens on (HTTP/HTTPS)
- ssl-redirect: Configures HTTP → HTTPS redirect port
-
target-type:
instance(via NodePort) orip(direct Pod routing) mode -
scheme:
internet-facing(public) orinternal(VPC-only) ALB access type - inbound-cidrs: Restricts the IP ranges allowed to access the ALB
- security-groups: Specifies the security groups to attach to the load balancer
- Security Group (Stateful): Per-instance security — supports allow rules only, automatically allows outbound responses
- Network ACL (Stateless): Per-subnet security — supports both allow and deny rules, evaluated in order by rule number
- VPC: Isolated virtual network — composed of subnets, route tables, and internet gateway
- Scope hierarchy: Narrows from Global/Edge → Region → VPC → AZ → Subnet; the inner layers get closer to a single fault domain
- Availability Zone (AZ): A group of physically isolated data centers within a region — a single fault domain; a subnet is bound to exactly one AZ
-
Public Zone: A subnet whose route table has a
0.0.0.0/0 → IGWroute — hosts internet-facing ALB, NAT Gateway, and bastion - Private Zone: A subnet with no direct internet route — hosts EC2/EKS, RDS, ElastiCache (outbound via NAT GW when needed)
- IGW vs NAT GW: The IGW is a VPC-level bidirectional gateway (no AZ binding); the NAT GW is outbound-only for private subnets and sits in a Public Subnet (AZ-bound)
Covers cross-account access using AWS STS sts:AssumeRole in 4 steps (create IAM role → attach policy → assume role → use temporary credentials), and compares it with OIDC/SAML-based sts:AssumeRoleWithWebIdentity.
→ Details
Covers IngressGroup configuration for consolidating multiple Ingresses into a single ALB, listen-ports and SSL redirect settings, instance/ip mode traffic routing annotations, and access control using scheme, inbound-cidrs, and security-groups.
→ Details
Explains the differences between Stateful Security Groups (per-instance, allow-only) and Stateless Network ACLs (per-subnet, allow/deny, evaluated by rule number order), with a mermaid diagram illustrating VPC traffic flow (IGW → Router → Route Table → ACL → Subnet → SG → EC2).
→ Details
Covers where key resources — IGW, NAT Gateway, CloudFront, ALB, RDS — sit by scope (Global/Edge · Region · VPC · AZ · Subnet), why an AZ is a single fault domain, and why Public/Private Zone is not an AWS-defined resource type but a logical split WE impose via the route table — along with its meaning (minimized attack surface, defense in depth, outbound control) and a full architecture diagram.
→ Details
An interview-style write-up of replacing Cluster Autoscaler with Karpenter on production EKS. Covers CA vs Karpenter, the Terraform (AWS infra) ↔ Helm (in-cluster) ownership split (contract = 2 strings), why Pod Identity over IRSA, SQS+EventBridge spot-interruption handling, per-workload NodePool strategy (build=SPOT multi-family vs game=ON_DEMAND WhenEmpty+do-not-disrupt), WhenEmpty vs WhenEmptyOrUnderutilized consolidation, and the CRD prepare-hook bootstrap.
→ Details