Flashcards
Choose a part. Say the answer aloud before revealing it. Name the mechanism, what can fail, and one trade-off. Review the linked chapter when your answer misses one of those.
There are 40 cards, five for each completed path part (0–6) and the casebook (8). Part 7 deep dives will add their own deck when written. Practice works without browser storage; changing part or reloading starts fresh. The expandable list below also works without JavaScript.
Card 1 of 5
Which layer gives the ordered explanation?
The path, Parts 0–6. The map and reference support it.
All questions and answers, without the controls
Part 0: reading the book
Which layer gives the ordered explanation?
The path, Parts 0–6. The map and reference support it.
Does built in the repository mean accepted in AWS?
No. A live acceptance claim needs a recorded acceptance entry.
What decides a current resource name or permission?
The current source code. Old notes preserve incidents and measurements.
What should you do before revealing an interview answer?
Say your own answer aloud, then compare its mechanism, failure case and trade-off.
What can the map explain that a list of services cannot?
Which pieces connect and the specific network rule, IAM policy or credential that allows each connection.
Part 1: the whole request
Which store decides whether a booking gets seats?
Postgres, inside the locked booking transaction.
Where does /trpc/* go at the public entry?
The ALB routes it to the API; other paths go to the web service.
What becomes durable together with the booking?
The seat change and a confirmation outbox row in the same Postgres transaction.
How many worker destinations receive the booking event?
Two independent SQS queues subscribed to SNS: email and ticket generation.
Where does HTTPS terminate in the committed mode?
At the ALB, using ACM. CloudFront is implemented but disabled in the committed dev configuration.
Part 2: AWS foundations
Which role reads injected ECS secrets before the app starts?
The task execution role. The task role supplies permissions to the running application.
What permits the API network path to Postgres?
The database security group allows TCP 5432 from the API security group; routes and credentials must also work.
How do the current public-subnet tasks reach public AWS endpoints without NAT?
Their public IPs and the public route through the internet gateway provide outbound connectivity.
What is the difference between trust and permission policies?
Trust says who may assume a role. Permission policies say what the resulting identity may do.
What does a target group's /health result prove?
That the configured health endpoint responds as expected. It does not prove a booking or its database dependencies work.
Part 3: app correctness
Which key identifies a retryable booking intent?
A UUID stored uniquely per user with the booking; retries reuse that same key.
What protects the last seat under concurrent requests?
A Postgres row lock, checks and writes in one transaction, with a nonnegative-seat constraint.
Why cannot nonce-bearing HTML use a shared page cache?
Each response needs its own nonce; current HTML and RSC responses are private, no-store.
Does the current events.search use the legacy events.list cache?
No. Search uses indexed Postgres pages and bypasses the legacy list caches.
What happens when shared rate-limit storage fails?
Rate limiting fails closed with unavailability. The advisory inventory gate separately falls back to Postgres.
Part 4: asynchronous work
What makes partial batch failure reporting effective?
The handler returns failed message IDs and the event source mapping enables ReportBatchItemFailures.
Can the email worker promise exactly one email?
No. Send-before-record crashes and concurrent workers can duplicate an accepted send.
What permits SNS to deliver to a queue?
Its queue resource policy allows sns.amazonaws.com to SendMessage, scoped to the booking-events topic ARN.
What repairs a ticket written to S3 but not marked ready?
Redelivery reuses the canonical ticket reservation and deterministic object key, then retries marking it ready.
Does a presigned URL replace application ownership checks?
No. The API verifies the requesting owner before issuing a short-lived URL; the URL itself can be shared until it expires.
Part 5: safe delivery
What changes the environment's shape?
Committed Pulumi stack configuration; CD applies that configuration.
How does an application rollback preserve current infrastructure code?
Run current deployment code with an older compatible existing image tag, respecting database migrations.
What does GitHub OIDC remove?
Stored long-lived AWS access keys; trust conditions still need to constrain the temporary session.
Why use the new image for migrations before rolling application tasks?
Its migration files match the release. Schema changes still need compatibility with the application version currently serving requests.
Does successful publishing prove the new image is serving traffic?
No. Check deployed service/task revisions, running image digests, Lambda image resolution and route acceptance.
Part 6: operating it
Which identifier links an API request to worker processing?
The correlationId carried through the outbox message and added to worker logs, alongside booking and message identifiers.
What does an empty DLQ prove after redrive?
Only that those messages left the DLQ. Verify processing outcomes and the source queue too.
Do budget alerts stop spending?
No. They notify; the owner must investigate and deliberately change resources or configuration.
Where else can confirmations be waiting when SQS looks quiet?
In pending Postgres outbox rows, before SNS accepted publication.
Does an OK alarm prove full recovery?
No. Verify the affected user action and its outcomes; low traffic or missing data can hide an ongoing failure.
Part 8: reading failures
What does an S3 AccessDenied establish?
A request reached an authorization boundary. Identify the actual caller, action and resource before changing policy.
Does a successful retry after an IAM change prove propagation caused the failure?
No. Inspect the actual live policy and deployment history; another deploy may have reverted the change.
Does every unhealthy target cause an ALB 503?
No. An ALB can fail open to unhealthy registered targets; absent or unused targets are a distinct 503 cause.
Why separate an S3 CORS error from an upload authorization failure?
A browser may hide the service response. Inspect preflight and the actual request to distinguish CORS, signature and IAM failures.
Why preserve the exact error before making changes?
Its service, action, resource and denial type narrow the investigation, and the original evidence may disappear after recovery.
Read this book online: https://book.theversehub.in/