8 Questions to ask an AWS Expert

If you’re headhunting a cloud computing expert, specifically someone who knows Amazon Web Services (AWS) and EC2, you’ll want to have a battery of questions to ask them to assess their knowledge.  As with any technical interview focus on concepts and big picture.  As the 37Signals folks like to say “hire for attitude, train for skill”.  Absolutely!

If you want more general info about Amazon Web Services, read our Intro to EC2 Deployments.

  1. Explain Elastic Block Storage?  What type of performance can you expect?  How do you back it up?  How do you improve performance?
  2. EBS is a virtualized SAN or storage area network.  That means it is RAID storage to start with so it’s redundant and fault tolerant.  If disks die in that RAID you don’t lose data.  Great!  It is also virtualized, so you can provision and allocate storage, and attach it to your server with various API calls.  No calling the storage expert and asking him or her to run specialized commands from the hardware vendor.

    Performance on EBS can exhibit variability.  That is it can go above the SLA performance level, then drop below it.  The SLA provides you with an average disk I/O rate you can expect.  This can frustrate some folks especially performance experts who expect reliable and consistent disk throughput on a server.  Traditional physically hosted servers behave that way.  Virtual AWS instances do not.

    Related: Is Amazon too big to fail?

    Backup EBS volumes by using the snapshot facility via API call or via a GUI interface like elasticfox.

    Improve performance by using Linux software raid and striping across four volumes.

  3. What is S3?  What is it used for? Should encryption be used?
  4. S3 stands for Simple Storage Service.  You can think of it like ftp storage, where you can move files to and from there, but not mount it like a filesystem.  AWS automatically puts your snapshots there, as well as AMIs there.  Encryption should be considered for sensitive data, as S3 is a proprietary technology developed by Amazon themselves, and as yet unproven vis-a-vis a security standpoint.

  5. What is an AMI?  How do I build one?
  6. AMI stands for Amazon Machine Image.  It is effectively a snapshot of the root filesystem.  Commodity hardware servers have a bios that points the the master boot record of the first block on a disk.  A disk image though can sit anywhere physically on a disk, so Linux can boot from an arbitrary location on the EBS storage network.

    Need an AWS expert? Email me for a quote hullsean @ gmail.com

    Build a new AMI by first spinning up and instance from a trusted AMI.  Then adding packages and components as required.  Be wary of putting sensitive data onto an AMI.  For instance your access credentials should be added to an instance after spinup.  With a database, mount an outside volume that holds your MySQL data after spinup as well.

  7. Can I vertically scale an Amazon instance? How?
  8. Yes.  This is an incredible feature of AWS and cloud virtualization.  Spinup a new larger instance than the one you are currently running.  Pause that instance and detach the root ebs volume from this server and discard.  Then stop your live instance, detach its root volume.  Note the unique device ID and attach that root volume to your new server.   And the start it again.  Voila you have scaled vertically in-place!!

  9. What is auto-scaling? How does it work?
  10. Autoscaling is a feature of AWS which allows you to configure and automatically provision and spinup new instances without the need for your intervention.  You do this by setting thresholds and metrics to monitor.  When those thresholds are crossed a new instance of your choosing will be spun up, configured, and rolled into the load balancer pool.  Voila you’ve scaled horizontally without any operator intervention!

    Also: Are we fast approaching cloud-mageddon?

    With MySQL databases autoscaling can get a little dicey, so we wrote a guide to autoscaling MySQL on amazon EC2.

  11. What automation tools can I use to spinup servers?
  12. The most obvious way is to roll-your-own scripts, and use the AWS API tools.  Such scripts could be written in bash, perl or other language or your choice.  Next option is to use a configuration management and provisioning tool like puppet or better it’s successor Opscode Chef.  You might also look towards a tool like Scalr.  Lastly you can go with a managed solution such as Rightscale.

  13. What is configuration management?  Why would I want to use it with cloud provisioning of resources?
  14. Configuration management has been around for a long time in web operations and systems administration.  Yet the cultural popularity of it has been limited.  Most systems administrators configure machines as software was developed before version control – that is manually making changes on servers.  Each server can then and usually is slightly different.  Troubleshooting though is straightforward as you login to the box and operate on it directly.  Configuration management brings a large automation tool into the picture, managing servers like strings of a puppet.  This forces standardization, best practices, and reproducibility as all configs are versioned and managed.  It also introduces a new way of working which is the biggest hurdle to its adoption.

    Read: When hosting data on Amazon turns bloodsport

    Enter the cloud, and configuration management becomes even more critical.  That’s because virtual servers such as amazons EC2 instances are much less reliable than physical ones.  You absolutely need a mechanism to rebuild them as-is at any moment.  This pushes best practices like automation, reproducibility and disaster recovery into center stage.

    While on the subject of configuration management take a quick peek at hiring a devops guide.

  15. Explain how you would simulate perimeter security using Amazon Web Services model?
  16. Traditional perimeter security that we’re already familiar with using firewalls and so forth is not supported in the Amazon EC2 world.  AWS supports security groups.  One can create a security group for a jump box with ssh access – only port 22 open.  From there a webserver group and database group are created.  The webserver group allows 80 and 443 from the world, but port 22 *only* from the jump box group.  Further the database group allows port 3306 from the webserver group and port 22 from the jump box group.  Add any machines to the webserver group and they can all hit the database.  No one from the world can, and no one can directly ssh to any of your boxes.

    Also: A history lesson for cloud detractors – January 2012

    Want to further lock this configuration down?  Only allow ssh access from specific IP addresses on your network, or allow just your subnet.

Did you make it this far?!?! Grab our newsletter.

  • Pingback: Best of Guide - Highlights of Our Popular Content

  • Pingback: Reading Notes 2012-07-23 | Matricis

  • Tarun

    Excellent content & nice questions

    • hullsean

      Thx @9c18fbce730054d1265405bd16c91eb2:disqus do you have a blog?

  • Andrew

    The AWS SDK for .NET is quite good as well. Combine that with PowerShell and you can automate all your Windows Instances quite easily.

    Also Cloud Formation is great for spinning up baseline (or pre-configured) server images. But don’t do this with SharePoint as it gets nasty

    • http://www.iheavy.com/blog/ Sean Hull

      Thx Andrew good to know. I haven’t used PowerShell.

  • Varun Malhotra

    Excellent Article. Sean, I am a System Administrator and I work in VMware/Windows, I m learning AWS now and want to make my career in Cloud Computing.I’m a VCP 5 certified and now a days, I m preparing for AWS Cloud Architect Associate level exam. Could you please advise me what shall I learn in order to switch the domain from Windows Administration to Cloud computing(AWS, VMware). Any scripting language/any specific Application deployment? Thanks in advance.

    • http://www.iheavy.com/blog/ Sean Hull

      Hi Varun, I would learn the ins & outs of Linux. Build some kernels, play around with vagrant & oracle virtualbox. Also this Deploying Rails book is superb: https://pragprog.com/book/cbdepra/deploying-rails

      • Varun Malhotra

        Thanks Sean for your valuable suggestion. I would order the book which you advised to read. But, I’m from Windows/VMware background. I have basic understanding of Linux but I don’t work in Linux. :( Could you please tell me a scripting language which I should learn to enhance my AWS skills. I am planning to write AWS Cloud solution architect exam in couple of months.

        • http://www.iheavy.com/blog/ Sean Hull

          AWS & the internet are built on Linux.

          I’d recommend building your proficiency.

  • Ranjit

    I have a question on AWS SES whether SES can be used to operate Pramotional emails and Operational emails both if so both are working parallel or one after another..

    • http://www.iheavy.com/blog/ Sean Hull

      Hi Ranjit, yes I believe you can do this. I haven’t tried it in production, however.

  • Ranjit

    Whether AWS SES can be used for both operational emails and Promotional emails if so both can be working parallel or not ? Because i have a problem for my client if i am sending Promotional emails to my clients (ex:13,00,000 users) same time some one forgot email he requested for if (operational emails) he will not get response immediately because promotional emails are distributed that time i need answer please respond if anyone have an idea