What Happens When You Run swapoff -a on a Running Server?

✅ 1. All swap pages are moved into RAM

swapoff disables swap.
But before the kernel can turn it off, every page currently in swap must be loaded back into physical RAM.

If enough free RAM is available

→ System continues normally.
→ You’ll probably notice some slowdown as the system swaps pages back into memory.

If RAM is insufficient

→ Linux starts struggling to free enough memory
→ Can trigger the OOM-Killer (Out Of Memory Killer)

---

❌ 2. OOM-Killer might kill important services

The kernel tries to free memory by killing processes based on OOM score.

This can result in:

• Database services dying (MySQL, PostgreSQL, Oracle, MongoDB)
• JVM applications crashing
• Docker containers terminating
• SSH sessions closing
• Even the kernel panicking in rare cases

As a Database Architect, this is high-risk because DB instances usually use large buffers (Oracle SGA, MySQL InnoDB buffer pool).

---

⚠️ 3. System may freeze or become unresponsive

If memory pressure becomes too high:

• System may hang
• Commands stop responding
• You might lose remote access
• Only a forced reboot recovers the machine

---

🧠 4. Why swap was being used matters

If swap is actively used heavily

Turning it off is dangerous because the system needed that memory.

If swap is barely used

Impact is minimal. You can check with:

free -h

or:

swapon --show

---

🛡️ Best Practices Before Running swapoff

✔️ 1. Check swap usage

If swap is >20–30% used, consider scaling RAM or stopping heavy services first.

✔️ 2. Add temporary RAM using zRAM (safe method)s

systemctl enable --now zramswap.service

✔️ 3. Reduce swap use instead of disabling it

Usually the goal is to stop active swapping, not to disable swap entirely.
Use:

sysctl -w vm.swappiness=10

✔️ 4. Only disable swap during maintenance window

Especially on DB or production servers.

---

🧩 Summary

Situation	What happens after swapoff
Enough free RAM	System works normally, small slowdown.
Moderate swap in use	System slows, may trigger OOM-Killer.
Heavy swap usage + low RAM	High chance of service crash or freeze.
DB servers under load	Very high risk of outages.

---

If you want, I can also help you evaluate your server’s swap usage and memory safety before you disable swap — just share the output of:

free -h
swapon --show
top -o %MEM | head -20

AWS EC2 interview Question and Answers

 

EC2 Instances

What is an EC2 instance?

An EC2 instance is a virtual machine running in the Amazon Elastic Compute Cloud (EC2) environment. It provides scalable compute capacity in the AWS cloud, allowing you to deploy applications without investing in physical hardware. EC2 instances can run various operating systems (Linux, Windows, etc.) and can be resized, stopped, started, or terminated based on needs. They form the core compute layer for applications hosted in AWS.

---

Explain the difference between an instance and an AMI.

An EC2 instance is an operational virtual server currently running in AWS.
An Amazon Machine Image (AMI) is a template used to create instances.

AMI serves as the blueprint containing:

• OS
• Application software
• Configurations
• Optional data

You use AMIs to create new instances rapidly and consistently. Instances are the live, running machines created from these AMIs.

---

How do you launch an EC2 instance?

You can launch an EC2 instance in several ways:

1. AWS Management Console – The GUI-based approach where you pick an AMI, choose instance type, configure storage, networking, security groups, and launch.
2. AWS CLI – Using commands like: 
   aws ec2 run-instances --image-id ami-12345 --instance-type t2.micro
3. AWS SDKs – Using Python, Java, or other languages with programmatic control.

---

What is the significance of an instance type?

Instance types define the hardware characteristics assigned to an instance, such as:

• CPU (vCPUs)
• Memory (RAM)
• Networking throughput
• Storage type and capacity

AWS categorizes instance types into:

• General Purpose
• Compute Optimized
• Memory Optimized
• Storage Optimized
• Accelerated Computing

Choosing the correct instance type directly affects performance, cost, and application behavior.

---

What is the purpose of user data in EC2 instances?

User data lets you supply scripts or configuration commands that run automatically when the instance starts for the first time. Typical use cases include:

• Software installation
• Bootstrapping applications
• File downloads
• System configuration
• Automated deployments

User data scripts run as root and significantly reduce manual configuration effort.

---

How can you stop and start an EC2 instance?

You can stop, start, or restart EC2 instances through:

• AWS Console
• AWS CLI using commands like:
  
  aws ec2 stop-instances --instance-id i-1234
  
  aws ec2 start-instances --instance-id i-1234
• AWS SDK

Stopping an instance shuts it down but preserves its EBS-backed data.

---

What is the difference between stopping and terminating an EC2 instance?

• Stopping an instance:

  • Halts the VM
  • Retains the EBS root volume
  • You can start it again
  • You continue incurring EBS charges

• Terminating an instance:

  • Permanently deletes the VM
  • Deletes the root volume (unless “Delete on Termination” is disabled)
  • Cannot be restarted

---

How do you resize an EC2 instance?

To change the instance type:

1. Stop the instance.
2. Modify instance type from the console or CLI.
3. Start the instance again.

Some instance families require the underlying virtualization type to be compatible.

---

Can you attach an IAM role to an existing EC2 instance?

Yes. You can attach or modify an IAM role for an existing instance by:

• Stopping the instance (sometimes optional)
• Editing IAM role settings
• Restarting the instance

IAM roles eliminate the need to store access keys inside instances.

---

Explain the concept of an Elastic IP address.

An Elastic IP (EIP) is a static public IPv4 address assigned to your AWS account. You can map it to any instance, ensuring:

• The public IP remains the same even if the instance stops/starts
• High availability by remapping it to a standby instance

AWS charges for unused Elastic IPs to encourage efficient usage.

---

Security Groups

What is a security group in EC2?

A security group acts as a virtual stateful firewall controlling inbound and outbound traffic at the instance level. You define rules based on:

• Protocol (TCP, UDP, ICMP)
• Port range
• Source/destination (IP or security group)

---

How is a security group different from a NACL?

Security Group	NACL
Instance-level	Subnet-level
Stateful	Stateless
Automatically allows response traffic	Requires explicit inbound & outbound rules
Applied to EC2 instances	Applied to subnets

---

Can you associate multiple security groups with one EC2 instance?

Yes. An instance can have multiple security groups, and the rules from all associated groups are combined (logical OR).

---

What are inbound and outbound rules?

• Inbound rules: Define allowed incoming traffic to the instance.
• Outbound rules: Define allowed outgoing traffic from the instance.

All unspecified traffic is automatically denied.

---

How does security group evaluation work?

Security groups allow only the traffic explicitly permitted by rules. Because they are stateful:

• If inbound traffic is allowed, outbound response is automatically allowed.
• If outbound traffic is allowed, inbound response is automatically allowed.

Default behavior: deny all unless explicitly allowed.

---

EBS Volumes

What is an EBS volume?

An EBS volume is durable, block-level storage that persists independently from EC2 instances. It replicates data within an Availability Zone to ensure high availability and can be used as:

• Root volumes
• Data volumes
• Database storage

---

Difference between EBS-backed and instance-store backed instances.

• EBS-backed:

  • Root volume stored on EBS
  • Persistent across stop/start
  • Supports snapshots and resizing

• Instance-store backed:

  • Root volume stored on ephemeral storage on host hardware
  • Data is lost if instance stops or fails
  • Higher performance but non-persistent

---

How can you increase EBS volume size?

Steps:

1. Take a snapshot of the existing volume (optional but recommended).
2. Modify the volume size from console or CLI.
3. Expand the filesystem inside the OS.

Modern EBS volumes allow online resizing without detaching.

---

Can you attach multiple EBS volumes to an EC2 instance?

Yes. Instances can have multiple EBS volumes (limited by instance type), each assigned a unique device name like /dev/xvdf.

---

Difference between gp2 and io1.

• gp2 (General Purpose SSD):

  • Balanced price/performance
  • Baseline performance with burst capability

• io1/io2 (Provisioned IOPS SSD):

  • Designed for high I/O workloads like databases
  • You can specify exact IOPS
  • Higher cost and more consistent performance

---

DLM (Data Lifecycle Manager)

What is AWS Data Lifecycle Manager?

AWS DLM automatically manages EBS snapshot creation, retention, and deletion based on defined policies, reducing manual backup management overhead.

---

How do you create a lifecycle policy?

You define:

• Target volumes
• Snapshot frequency
• Retention rules
• Tags

DLM automates snapshot creation and cleanup using the policy.

---

What is a retention policy?

Retention policies specify:

• How many snapshots to keep
• How long snapshots should be retained

Older snapshots are automatically deleted by AWS.

---

Snapshots

What is an EBS snapshot?

A snapshot is a point‑in‑time backup of an EBS disk stored in Amazon S3 (managed internally). You can restore these snapshots to create new EBS volumes or AMIs.

---

How do you create a snapshot?

Through:

• Console
• CLI: aws ec2 create-snapshot --volume-id vol-1234
• SDKs

Snapshots are incremental, storing only changed blocks.

---

Can you snapshot a root volume of a running instance?

Yes, AWS supports snapshots of running volumes. For perfect consistency, especially for databases, stopping the instance or freezing the filesystem is recommended.

---

Difference between a snapshot and an AMI.

• Snapshot = Backup of a single EBS volume.
• AMI = Template to launch instances that includes:
  • OS image
  • Software
  • Configuration
  • One or more snapshots

---

Load Balancers

What is an Elastic Load Balancer?

An ELB automatically distributes incoming traffic across multiple targets (EC2, containers, IP addresses) and ensures high availability and fault tolerance.

---

Types of AWS load balancers:

1. Application Load Balancer (ALB) – Layer 7 (HTTP/HTTPS), intelligent routing, host/path‑based routing.
2. Network Load Balancer (NLB) – Layer 4 (TCP/UDP), high performance, low latency.
3. Classic Load Balancer (CLB) – Legacy Layer 4/7 load balancer.

---

Difference between ALB and NLB.

• ALB – Works at application layer, supports HTTP routing, WebSockets, microservices
• NLB – Works at transport layer, supports millions of connections per second, static IPs

---

What is a Target Group?

Target Groups define where the load balancer forwards traffic. Targets (EC2, IPs, Lambda) are registered and monitored using health checks.

---

Auto Scaling Group

What is Auto Scaling?

Auto Scaling automatically adjusts EC2 capacity based on demand. It helps maintain performance while minimizing cost.

---

How do you set up an Auto Scaling Group?

1. Define a Launch Template or Launch Configuration
2. Create an Auto Scaling Group specifying:
   • Min/Max/Desired capacity
   • VPC and subnets
   • Load balancer (optional)

Scaling policies define when to add/remove instances.

---

Significance of Launch Configurations?

A Launch Configuration is a template describing:

• AMI
• Instance type
• Key pair
• Security groups
• Storage

It ensures new instances launched by Auto Scaling are identical.

---

IAM Roles for EC2

What is an IAM role?

An IAM role is an identity in AWS that provides temporary permissions through policies. It is used by AWS services and applications without exposing credentials.

---

How do you associate an IAM role with EC2?

Either:

• During instance launch
  OR
• Modify the IAM role of a running instance via console or CLI

---

Advantages of IAM roles for EC2?

• No need to store credentials in code
• Automatically rotated temporary credentials
• Centralized access control and least privilege
• More secure than environment variables or config files

---

Elastic Beanstalk

What is AWS Elastic Beanstalk?

Elastic Beanstalk is a Platform‑as‑a‑Service (PaaS) that simplifies application deployment. AWS automatically handles:

• EC2 provisioning
• Load balancing
• Auto scaling
• Monitoring
• Deployment orchestration

You only upload your code.

---

How does Elastic Beanstalk differ from EC2?

• Beanstalk = Fully managed deployment environment
• EC2 = Requires manual setup and management

With Beanstalk, the infrastructure is abstracted away.

---

Supported platforms:

Elastic Beanstalk supports:

• Java, Python, Node.js, Ruby
• Go, PHP, .NET
• Docker
• Nginx/Apache web servers

---

Placement Groups

What is a placement group?

Placement Groups influence how AWS places your instances to meet performance or high availability requirements.

---

Types of placement groups:

1. Cluster – Instances placed close together for high network throughput.
2. Spread – Instances spread across different hardware to reduce failure risk.
3. Partition – Instances split into partitions useful for distributed systems like Hadoop.

---

Cluster vs Spread Placement Group?

• Cluster – Low latency, high bandwidth, but higher failure risk.
• Spread – Isolates instances across hardware for better resilience.

---

Can you move an instance to a placement group?

No. You must:

• Create an AMI of the instance
• Launch a new instance inside the placement group

---

Systems Manager – Run Command

What is AWS Systems Manager Run Command?

A fully managed service that lets you execute commands at scale on EC2 or on-prem servers without SSH/RDP. It centralizes command execution with logging and security controls.

---

How do you run a command on multiple instances?

Using:

• SSM console
• Predefined or custom SSM Document
• Selecting target instances via tags

---

Benefits over SSH/RDP:

• No open inbound ports
• No need for key pairs
• Fully auditable
• Works even without public IPs

---

What are SSM Documents?

JSON/YAML files that define the actions Run Command or Automation should execute. They contain steps, parameters, and execution logic.

---

How do you schedule commands?

Using State Manager, which lets you apply:

• Patches
• Configuration changes
• Scripts

on a defined schedule.

---

Difference between Run Command and Automation:

• Run Command = Manual execution
• Automation = Workflow‑based, event-driven execution

---

Systems Manager – Parameter Store

What is Parameter Store?

A secure hierarchical store for:

• Secrets
• Config values
• Environment variables

Supports versioning and encryption.

---

Types of parameters:

• String – Plain text
• SecureString – Encrypted with KMS

---

How to retrieve a parameter on EC2?

Using CLI:

aws ssm get-parameter --name MyParam --with-decryption

---

Benefits over environment variables/config files:

• Centralized management
• More secure (KMS encryption)
• Versioning
• IAM access control

---

SecureString vs String:

• SecureString: KMS-encrypted, used for secrets
• String: plain text, used for non-sensitive configs

---

Systems Manager – Session Manager

What is Session Manager?

A secure way to connect to EC2 instances using a browser or CLI without SSH/RDP, even if they have no public IP.

---

How does it ensure security?

• IAM‑based access control
• All actions logged in CloudWatch/CloudTrail
• No inbound ports required (0 open ports)

---

Can it connect to on‑prem servers?

Yes, as long as the SSM agent is installed and the server is registered in AWS Systems Manager.

---

Advantages over SSH/RDP:

• No key management
• No open ports
• Full session logging
• Fine‑grained IAM control

---

How do you configure Session Manager?

Ensure:

1. SSM Agent is installed
2. Instance has IAM role with SSM permissions
3. Instance is connected to Systems Manager (via VPC endpoints or internet)

AWS IAM interview Question and Answers

 

1. What is AWS IAM?

Answer:
AWS Identity and Access Management (IAM) is a core AWS service that enables you to securely manage access to AWS resources. It allows you to create and manage users, groups, and roles, and define policies that control what actions these entities can perform. IAM provides fine-grained access control, ensuring that only authorized identities can access specific AWS services and resources.

---

2. Explain the purpose of IAM in AWS.

Answer:
The primary purpose of IAM is to provide a centralized and secure access management system for AWS resources. It helps organizations:

• Implement least privilege access.
• Assign permissions based on roles and responsibilities.
• Enforce compliance by auditing and monitoring access.
• Enable secure integration with external identity providers.
  IAM ensures that access is controlled, monitored, and aligned with organizational security policies.

---

3. What are IAM users, groups, and roles?

Answer:

• IAM Users: Individual identities within your AWS account. Each user has unique credentials (password, access keys) and can be assigned permissions via policies.
• Groups: Collections of IAM users. Permissions applied to a group are inherited by all its members, simplifying management.
• Roles: Temporary identities with defined permissions that can be assumed by trusted entities (AWS services, users, or external identities). Roles do not have permanent credentials; instead, they provide temporary security tokens.

---

4. How do you secure your AWS account with IAM?

Answer:
Best practices include:

• Enable MFA for root and IAM users.
• Strong password policies and regular rotation.
• Principle of Least Privilege: Grant only necessary permissions.
• Avoid long-term access keys: Use roles for temporary access.
• Enable CloudTrail: Monitor all API activity.
• Regular audits: Review IAM policies and remove unused accounts.

---

5. How do you grant permissions to an IAM user?

Answer:
Permissions are granted by attaching IAM policies to users, groups, or roles.

• Direct attachment: Attach a policy directly to a user.
• Group-based: Add the user to a group with predefined policies.
  Policies define allowed or denied actions on AWS resources.

---

6. Explain the concept of IAM policies.

Answer:
IAM policies are JSON documents that define permissions. They specify:

• Actions: What operations are allowed (e.g., s3:GetObject).
• Resources: Which resources the actions apply to.
• Conditions: Optional constraints (e.g., IP address, time).
  Policies can be attached to users, groups, or roles.

---

7. What are the different types of IAM policies?

Answer:

• Managed Policies:
  • AWS Managed: Predefined by AWS for common use cases.
  • Customer Managed: Created and managed by you.
• Inline Policies: Embedded directly into a user, group, or role for specific permissions.

---

8. What is the principle of least privilege in IAM?

Answer:
Grant only the minimum permissions required for a user or role to perform their tasks. This reduces the risk of accidental or malicious misuse.

---

9. How do you manage access keys for IAM users?

Answer:
Access keys (Access Key ID and Secret Access Key) allow programmatic access. Best practices:

• Rotate keys regularly.
• Delete unused keys.
• Avoid hardcoding keys in applications; use AWS SDK or Secrets Manager.

---

10. What is MFA (Multi-Factor Authentication) in IAM?

Answer:
MFA adds an extra layer of security by requiring two forms of authentication:

• Something you know (password).
• Something you have (MFA device or app).
  This prevents unauthorized access even if credentials are compromised.

---

11. Explain IAM roles for EC2 instances.

Answer:
IAM roles allow EC2 instances to access AWS services without storing credentials locally. The instance assumes the role and receives temporary credentials via the Instance Metadata Service.

---

12. What is IAM federation?

Answer:
IAM federation integrates external identity providers (e.g., Active Directory, SAML, OIDC) with AWS. Users can access AWS resources using existing corporate credentials without creating separate IAM users.

---

13. What is the IAM policy evaluation logic?

Answer:
IAM follows deny by default. Evaluation steps:

• If an explicit deny exists → Access denied.
• If an explicit allow exists → Access granted.
• If no policy allows the action → Access denied.

---

14. How do you create a custom IAM policy?

Answer:
Create via AWS Console, CLI, or SDK:

• Define actions, resources, and conditions in JSON format.
• Validate using IAM Policy Simulator.
• Attach to users, groups, or roles.

---

15. What is IAM condition element in a policy?

Answer:
Conditions restrict when a policy applies. Examples:

• IP-based: Allow access only from specific IP ranges.
• Time-based: Allow access during business hours.
• Tag-based: Allow actions only on resources with specific tags.

---

16. How do you rotate access keys for an IAM user?

Answer:
Steps:

1. Create a new access key.
2. Update applications to use the new key.
3. Delete the old key.
   This ensures uninterrupted access during rotation.

---

17. What is IAM policy versioning?

Answer:
AWS maintains multiple versions of a policy. You can roll back to previous versions if needed. Only one version is active at a time.

---

18. How can you monitor IAM events and activities?

Answer:
Enable AWS CloudTrail to log all IAM API calls. Analyze logs for suspicious activity and integrate with Amazon CloudWatch for alerts.

---

19. What is AWS Organizations and how does it relate to IAM?

Answer:
AWS Organizations allows centralized management of multiple AWS accounts. It uses Service Control Policies (SCPs) to enforce permissions across accounts. IAM operates at the account level, while Organizations provides governance at the organizational level.

---

20. How do you troubleshoot IAM permission issues?

Answer:

• Use IAM Policy Simulator to test permissions.
• Check attached policies and resource-based policies.
• Review CloudTrail logs for denied actions.
• Validate conditions and explicit denies.