Region quiz · Level 0 · Todo.io Learns AWS

Question 1Todo.io may only run in us-east-1 and eu-west-1, in every account, now and in future accounts. What enforces that?

An SCP attached to the organization's root, at the top of the tree, that denies requests outside those two Regions.Correct. A preventive guardrail at the top of the tree covers every member account, including ones created later. (As always, SCPs skip the management account.) Global services such as IAM are left out of a Region rule.An IAM policy on every user and role that only allows those Regions.Not this one. Anyone who can edit IAM policies can remove it, and every new user or role needs it added.An AWS Config rule that flags resources in other Regions.Not this one. Config reports after the fact. The requirement says it may only run there.Deleting the default VPC in every other Region.Not this one. Many services don't need a VPC at all, and anyone can create a new VPC.

Learn it: SCP (service control policy) · Controls (guardrails) · Region

Question 2Todo.io created an IAM role while the console was set to us-east-1. Can an app running in eu-west-1 use the role?

Yes. IAM is global, so roles aren't tied to a Region.Correct. A few services, IAM among them, are global. Most others, like RDS, are regional.No. The role only exists in us-east-1.Not this one. That's true of most services, but not of IAM.Only after the role is copied to eu-west-1.Not this one. There is nothing to copy; the same role works in every Region.Only if the app signs in through IAM Identity Center.Not this one. Apps use roles directly. Identity Center is for people.

Learn it: IAM (Identity and Access Management) · Region

Question 3Todo.io's app servers all sit in one subnet. Which Availability Zones does that subnet cover?

Exactly one. A subnet lives in a single Availability Zone.Correct. So everything in one subnet goes down if that AZ does. Surviving an AZ failure needs subnets in more than one.Every Availability Zone in the Region.Not this one. That is true of a VPC, not of a subnet.Two, for redundancy.Not this one. Redundancy comes from using several subnets in different AZs.None. Subnets aren't tied to Availability Zones.Not this one. Each subnet is created in one AZ and stays there.

Learn it: Subnet · Region

Question 4A teammate created Todo.io's RDS database while the console was set to eu-west-1. The app runs in us-east-1 and can't find the database. Why?

RDS is a regional service: a database exists only in the Region it was created in.Correct. Most AWS services are regional. Always check the Region menu before you build or go looking.An SCP is hiding the database from us-east-1.Not this one. SCPs allow or deny API calls. They don't hide resources, and nothing is denied here.The database hasn't finished copying itself to the other Regions yet.Not this one. Nothing is copied between Regions unless you set it up (Level 3). The database will only ever be in eu-west-1.The database's Availability Zone is down.Not this one. Availability Zones are inside a Region. The database isn't in us-east-1 at all.

Learn it: Region · Set up AWS: Wrong Region

Question 5Todo.io created its Todos table in us-east-1. An app in eu-west-1 calls DynamoDB in eu-west-1 and gets ResourceNotFoundException. Why?

Tables are regional: Todos only exists in us-east-1.Correct. Call the us-east-1 endpoint, or copy the data across Regions (later levels).IAM blocks calls between Regions.Not this one. IAM is global, and this is "not found", not "denied".DynamoDB tables only exist in us-east-1.Not this one. You can create tables in any Region; this one was created in us-east-1.The table is still copying to eu-west-1.Not this one. Nothing is copied between Regions unless you set it up.

Learn it: Region · DynamoDB

Question 6Todo.io looks in CloudTrail Event history in us-east-1 for a call made in eu-west-1, and can't find it. Why?

Event history is kept per Region; switch the console to eu-west-1 to see it.Correct. A multi-Region trail collects every Region in one place.Calls made in eu-west-1 aren't recorded.Not this one. They are recorded, in eu-west-1.Event history only records global services.Not this one. It records management events from regional services too.Events are deleted after one day.Not this one. Event history keeps 90 days.

Learn it: CloudTrail · Region

Question 7Todo.io turned on AWS Config in us-east-1 only. Resources in eu-west-1 aren't being recorded. Why?

Config records per Region; it has to be turned on in every Region Todo.io uses.Correct. Control Tower does this for you in the Regions it governs.Config is global, so this must be a bug.Not this one. Config is regional.Config doesn't work in eu-west-1.Not this one. It works in every commercial Region.Config needs CloudTrail to be on first.Not this one. They are separate services.

Learn it: AWS Config · Region

Question 8What does "Region" mean?

A geographic area where AWS runs data centres, like us-east-1 (N. Virginia).Correct. Think of it as: A city where AWS has its buildings.Your own private network inside an AWS Region.Not this one. That describes VPC (Virtual Private Cloud).A slice of a VPC's addresses that lives in one Availability Zone.Not this one. That describes Subnet.The VPC's door to the public internet.Not this one. That describes Internet gateway.

Learn it: Region

Question 9Which term is this? "A geographic area where AWS runs data centres, like us-east-1 (N. Virginia)."

RegionCorrect. Yes. Think of it as: A city where AWS has its buildings.VPC (Virtual Private Cloud)Not this one. VPC (Virtual Private Cloud) is: Your own private network inside an AWS Region.SubnetNot this one. Subnet is: A slice of a VPC's addresses that lives in one Availability Zone.Internet gatewayNot this one. Internet gateway is: The VPC's door to the public internet.

Learn it: Region

Question 10Which AWS term is described by this analogy? "A city where AWS has its buildings."

RegionCorrect. Yes: A geographic area where AWS runs data centres, like us-east-1 (N. Virginia).VPC (Virtual Private Cloud)Not this one. VPC (Virtual Private Cloud) is: Your own private network inside an AWS Region. Its analogy: A fenced-off private estate inside the city.SubnetNot this one. Subnet is: A slice of a VPC's addresses that lives in one Availability Zone. Its analogy: One street on the estate.Internet gatewayNot this one. Internet gateway is: The VPC's door to the public internet. Its analogy: The estate's front gate.

Learn it: Region

Region

Worth another look

Your weak spots

Services

Concepts