AWS flashcards, generated for you.

An IAM role is a set of permissions without permanent credentials. Use roles for: EC2 instances, Lambda functions, cross-account access, and temporary elevated privileges. Roles are assumed temporarily and return temporary credentials.

Copies files to/from S3. Example: `aws s3 cp /local/file.txt s3://mybucket/path/file.txt` uploads a file. Use `--recursive` flag to copy entire directories.

Security groups: stateful, instance-level, allow rules only, default deny. NACLs: stateless, subnet-level, allow and deny rules, evaluated in order. Security groups are primary; NACLs are secondary.

Use `ssh -i /path/to/key.pem ec2-user@<public-ip>`. Common errors: key permissions too open (fix: `chmod 400 key.pem`), wrong username (use ec2-user, ubuntu, or admin), or security group not allowing port 22.

S3 bucket policy: resource-based, attached to bucket, controls access to that specific bucket. IAM policy: identity-based, attached to user/role, controls what that principal can do across AWS. Bucket policies can grant public access; IAM policies cannot.

VPC: isolated network environment with custom IP range (CIDR). Key components: subnets (partition VPC into AZs), route tables (define traffic rules), Internet Gateway (public access), NAT Gateway (outbound-only access for private subnets), security groups, NACLs.

Multi-AZ: synchronous standby in different AZ, automatic failover, same endpoint, high availability. Read replicas: asynchronous copies (same or different region), separate endpoints, for read scaling. Multi-AZ for resilience; replicas for performance.

ASG uses scaling policies: target tracking (maintain metric like CPU %), step scaling (thresholds), simple scaling (single adjustment). Launch template defines instance config. Min/max/desired capacity controls bounds. CloudWatch alarms trigger scale-up/down actions.

CloudFront: CDN that caches content at edge locations globally. Use cases: serve static assets (S3), reduce origin load, accelerate dynamic content, DDoS protection. Configure origin (S3, EC2, ALB), TTL, behaviors (path-based routing), cache headers.

Lambda: serverless compute, triggered by events, billed per invocation and memory-duration. Execution: initialization (cold start) → function code. Optimize cold starts: provisioned concurrency, smaller package size, arm64 architecture, connection reuse in code, layer pre-warming.