The words we use

In 1 minute

This book uses the real AWS words, because those are the words an interviewer uses. Each word is explained once, in plain English, and then used as it is. Most of them answer one of three questions about a connection: can the packet get there, do the rules let it in, and does the caller have the right password?

Picture it

flowchart LR
  Q["Can A talk to B?"] --> R["Reach<br/>VPC, subnet, route table"]
  Q --> A["Allowed<br/>security group, IAM role"]
  Q --> P["Password<br/>secret, certificate"]

We call these three questions Reach / Allowed / Password.

How it works

1. Reach. A VPC is our private network in AWS. It is split into subnets. A route table says where packets for each address range go.
2. Allowed, at the network. A security group is a firewall on a network card. Each inbound rule names a port and a source that may connect.
3. Allowed, in AWS. An IAM role is an identity that a service can take on for a while. Its trust policy says who may take it on; its permission policy says which actions it may call on which resources.
4. Password. A secret in Secrets Manager holds a password or URL, so it is never in the code. A certificate proves a server’s name for HTTPS.

In MiniTickets

Term	In one sentence	In MiniTickets
Task	One running copy of a container on ECS	an api task, a web task
Task execution role	The role ECS uses to start a task	pulls the image, reads secrets
Task role	The role the app’s own code runs with	the api may publish to one SNS topic
Target group	The list of healthy tasks a load balancer may use	api on port 4000, web on 3000
Listener rule	A routing rule on the load balancer	/trpc/* goes to the api
Event source mapping	Lambda’s poller for a queue	jobs queue → worker Lambda
Dead-letter queue	Where a message goes after too many failures	minitickets-dev-jobs-dlq

AWS names start with minitickets-dev-, from the stack name (infra/src/names.ts → namesFor). More words: the glossary.

Play “Why can it connect?” on the map →

See it in AWS

Console

Most words are console pages: EC2 → Security Groups, IAM → Roles, ECS → Clusters.

CLI

aws ec2 describe-security-groups --filters Name=tag:Name,Values=minitickets-dev-db-sg shows one security group and its inbound rules.

Code

The security groups: infra/src/security.ts → createSecurityGroups.

Break it

Symptom	Cause	Where to look
A connection times out	Reach or Allowed fails: a route or an inbound rule is missing	Route table, then security group
AccessDenied from an AWS API	Allowed fails in IAM: the role lacks the action	The role’s permission policy
“password authentication failed”	Password fails: the secret is wrong or old	The secret, and when the task started

Say it in an interview

Say it like this (20-30 seconds)

I check every connection with three questions. Reach: is there a network path, so the right VPC, subnets and route table? Allowed: does the target’s security group have an inbound rule for this port and source, and does the caller’s IAM role allow the API action? Password: does the caller hold the right secret or certificate? A timeout usually means Reach or the security group; an AccessDenied means IAM.

Follow-ups

What is the difference between a security group and an IAM policy?

A security group controls network packets to a network card: port and source. IAM controls calls to AWS APIs: who may call which action on which resource. Postgres on port 5432 is a security group question; reading a secret is an IAM question.

Why does a timeout point at the network, but AccessDenied at IAM?

A security group drops packets silently, so the caller waits until it gives up. IAM answers at once with an explicit error that names the action.

Why use roles instead of access keys?

A role gives short-lived credentials that AWS rotates by itself. An access key lives until someone deletes it, so a leak lasts. MiniTickets stores no AWS access key anywhere, not even in CI.

Is the analogy line ever enough in an interview?

No. “Think of it like…” helps the first read. In the interview, say “inbound rule on the database security group, TCP 5432, source the api security group”.

Advanced: Words that look alike

• Task definition vs task: the recipe (image, CPU, memory, env vars) vs one running copy.
• Service vs task: an ECS service keeps a number of tasks running and replaces failed ones.
• Trust policy vs permission policy: who may assume the role vs what the role may do.
• Identity policy vs resource policy: a policy attached to a role vs a policy on the target (a queue, a bucket, a repository) that names who may use it.
• Health check: the load balancer’s regular request to each target; failing targets get no traffic.

Checkpoint

Answer these without scrolling up. If one feels hard, reread that section.

1. What are the three questions behind every connection?
2. What is the difference between a task role and a task execution role?
3. What does an inbound rule name?
4. What would you check first for a timeout, and for an AccessDenied?
5. Where does every MiniTickets resource name come from?

Redraw it from memory: the Reach / Allowed / Password picture, with two AWS terms under each

Try this: on the map, play the flow 'Why can the api connect to Postgres?' and name which question each step answers

Mark this page as read