AWS has the security shared responsibility model.
Anyone on the AWS platform understands where this model. However, security on AWS is not easy as AWS has always been a platform of innovation. AWS has released a ton of services AWS Config, Macie, Shield, Web Application Firewall, SCPs. Over the years, Landing zones and then Control Tower which builds security when starting multi-account on AWS. Lastly, the Well Architected Security Pillar to review and confirm your workload is well architected.
Last month, AWS released a comprehensive guide to a Security Reference Architecture. It was built by Professional Services, which is the customer implementation arm of AWS.
I’m not going to try to summarize a 62-page document in a blog article. Mainly the document is about defense-in-depth, which is security at each layer of the workload. There two key observations from the document. The first observation is it does follow Control Tower guidance. Terms have been changed. It requires workloads to be in separate OU from security and infrastructure(shared services). Again these are general security principles that limit blast radius if an application or account is compromised. Security account and log collection account need to be separate. This Control Tower recommended an OU structure. Also, keeping log data in an immutable state is best for audit analysis.
The second observation is it now talks about leverage the Infrastructure account for Egress and Ingress traffic to the internet. This is only possible with Transit Gateway or a Transit VPC, defined in the document but not mentioned as part of the VPC diagram.
Maybe it’s just because of hyperfocus on renewing certifications. However, I notice the bleed-over between networking and security and how proper networking architecture is to start good security hygiene.
AWS has the security shared responsibility model.
Anyone on the AWS platform understands where this model. However, security on AWS is not easy as AWS has always been a platform of innovation. AWS has released a ton of services AWS Config,
After studying for Advanced Networking Exam, I pondered a question about global backbones. There is a need for common understanding. So let’s take a step back. Transit gateway was a service introduced at ReInvent 2018. Transit Gateway(TGW) puts a router between VPCs and other networking services. The transit gateway works by putting attachments in each VPC using ENIs. If you’re lost before proceeding, watch the Re: Invent Video. TGW uses attachments is fundamental to the VPC architecture as the VPC doesn’t process traffic from a source destination outside the VPC. So the attachment ENI becomes part of the VPC. So now I have an attachment in the VPC thru a subnet. So instead of terminating my DirectConnect Gateway(DXGW) on a VGW in a VPC, it’s terminated in a TGW. A quick whiteboard of this architecture.
This becomes challenging while building a global network because European network would look like this assuming I had three pops in one Europe region:
Still better than Direct Connect Gateways to the VPCs. But there is a limitation Transit Gateways which are peered, don’t dynamically pass routes. This works great if you summarize routes by region. Like the US was all 10.50.0.0/12, and Europe was all 10.100.0.0/12. What doesn’t work is when I have unsummarized routes. But I digress route summarization doesn’t matter to the question. So here is a quick view of our whiteboard architecture of Europe and US regions:
The question is if there was dynamic routing, could I use the AWS backbone to haul traffic around the world without having to build my own global network as the two TGWs would exchange my prefixes from the exchange or pop locations?
After studying for Advanced Networking Exam, I pondered a question about global backbones. There is a need for common understanding. So let’s take a step back. Transit gateway was a service introduced at ReInvent 2018. Transit Gateway(TGW) puts a router between VPCs and other networking services. The transit gateway works...
I needed to recertify the Advanced Networking specialty. Technically it expired on 6/20. So I decided to focus on the Professional as it would include Networking and Security topics. I need to recertify Security Speciality later this month.
I took the AWS Advanced Networking Speciality on Tuesday and passed.
I took this exam with Pearson VUE. The exam opens 30 minutes before to get checked out. The process with the same as PSI, only there wasn’t a long wait. Personally, the interface in PSI is a little nicer than Pearson VUE. However, the experience of the otherwise of taking the exam is the same as it’s from the comfort of home.
I’m not going to talk about the exam, as that would violate the NDA. There are three observations. First, the exam requires deep AWS networking knowledge. Make sure you get in the console and get hands-on. The exam, as advertised, requires deep understanding and experience, which can only come thru practical hands-on experience. The other observation I would make is that the exam requires knowledge of services touched by networking, which is why acloud.guru course recommends associate level certification. The last comment on this exam has the most deficient written questions and answers of the certification exams I’ve taken. The questions and answers lack clarity found on the other exams.
I took the exam in about 90 minutes, which is half the allocated time. There were enough questions that I struggled to know the correct answer. I had no sense if I had no sense during the exam of a pass or fail.
Now the parts I can talk about, which was my preparation for the exam. In studying, the number of new networking specific services, including Transit Gateway announced Re:Invent 2018, Firewall Manager introduced April 2018 to name a few. The changes in networking services like AWS Shield, VPC FLow Logs, WAF between studying back in 2018 and studying three years later is incredible. Probably the reason, these certifications have to be re-certified every three years. The first time for the exam, I put about 50 hours of preparation into studying for the exam. This time I put maybe 16 hours into studying.
I watched about 80% of the acloud.guru course. I did watch most of it in 1.75x speed. I would slow down if I didn’t understand a topic or wanted more. I also read many whitepapers and FAQs and watched Youtube videos (2x) and linked below.
Resources:
I needed to recertify the Advanced Networking specialty. Technically it expired on 6/20. So I decided to focus on the Professional as it would include Networking and Security topics. I need to recertify Security Speciality later this month.
I took the AWS Advanced Networking Speciality on Tuesday and passed.
I...
I sat the AWS Certified Solutions Architect - Professional exam last Monday. This was to recertify my expiring AWS Professional Certification, which recertified my Cloud Practioner and Associate Architect.
The exam is challenging. Probably the most time I spent taking an AWS exam, 2 hours and 21 minutes. My original certification came with what was the famous reading comprehension exam, which retired in 2019. This exam didn’t require that level of reading but was harder. Also, I finished the old exam faster than this one.
Let provide three observations on the exam that won’t violate any NDA. First, it feels more SysOps than Architect because the scenarios aren’t as drawn out in the exam, which retired in 2019. Secondly, it tests both the breadth and depth of AWS services. Lastly, back in 2018, I said, “The entire exam is a challenge to pick the more correct answer based on the scenario and question with a driving factor of one more or more of the following, scalability, cost, recovery time, performance, or security.” That statement holds true on this exam.
For preparation, I watched about 50% of the acloud.guru course. I skipped the sections thru comfortable sections. I also read a bunch of whitepapers, FAQs and watched Youtube videos and linked below.
I took the exam with PSI. First, PSI doesn’t start the check till the exam slot, which takes 20-30 minutes. Secondly, the app will suck battery power. Given the requirements, I couldn’t use my regular desk, so be prepared.
Last comment, not that the team at AWS is trying to, but the exam is about getting you stuck on a question, so you run out of time or rush thru and miss core context. I’ve been on the platform a long time and work for AWS, it took me 78% of the allocated time on a Monday night to do the exam, and I read fast. The main takeaway is to develop an exam strategy that works for you and is practiced on the associate level exams before sitting this exam.
List of resources:
I sat the AWS Certified Solutions Architect - Professional exam last Monday. This was to recertify my expiring AWS Professional Certification, which recertified my Cloud Practioner and Associate Architect.
The exam is challenging. Probably the most time I spent taking an AWS exam, 2 hours and 21 minutes. My original...
Passed the AWS Cloud Partitioner Certification Exam. Given I have 7 of the 9 certifications before sitting this exam, I didn’t study. The goal before taking the exam was 100% in 20 minutes. I missed 3 questions and took 16 minutes. I took the exam at some point I am going to complete the Big Data Speciality, which will give me all the AWS certifications for a brief moment. The Machine Learning AI beta completed last month and the Alexa Skill Builder just completed its beta. This means by March there could be 10 or 11 AWS Certifications.
Passed the AWS Cloud Partitioner Certification Exam. Given I have 7 of the 9 certifications before sitting this exam, I didn’t study. The goal before taking the exam was 100% in 20 minutes. I missed 3 questions and took 16 minutes. I took the exam at some point I...
I posted to Github a list of links I found valuble when studying for the AWS DevOps Pro certification exam.
The original blog article about passing the test can be found here AWS Certified DevOps Engineer - Professional
I posted to Github a list of links I found valuble when studying for the AWS DevOps Pro certification exam.
The original blog article about passing the test can be found here AWS Certified DevOps Engineer - Professional
AWS Certification SME program helps AWS Certification team, develop the certification exams. It’s a complicated process which as many steps, but I won’t get into now. However, I have now done two workshops on two different steps, one an item writing workshop back in November and now a Standard setting workshop.
The most interesting aspect is fellow partitioners create the exams with certifications, there are people to facilitate, validate and review the information.
The questions are designed to have you apply AWS experience and knowledge of situations. Someone asked if labs would be a replacement, maybe running thru a hundred labs would be the equivalent of real-world experience.
Doing the course, reading all the FAQs and whitepapers and watching all the 400 reinvent videos would be the minimum.
AWS Certification SME program helps AWS Certification team, develop the certification exams. It’s a complicated process which as many steps, but I won’t get into now. However, I have now done two workshops on two different steps, one an item writing workshop back in November and now a Standard...
Today I officially started with Amazon Web Services as a Senior Cloud Architect. The position is with Professional Services working with Strategic Accounts.
I am looking forward to helping AWS customers continue to build on their cloud journey.
Today I officially started with Amazon Web Services as a Senior Cloud Architect. The position is with Professional Services working with Strategic Accounts.
I am looking forward to helping AWS customers continue to build on their cloud journey.
Every year 10s of thousands of AWS customers and prospect customers desend on Las Vegas. For those of us to don’t make the trek Amazon live streams the the daily Key Notes. Those are where AWS announces it’s newest products and changes. Each year I build a list before November as AWS has a tendency to leak smaller items. This year my wish list for AWS was as follows:
- Mixing sizes and types in ASG - Announced
- DNS fixed for Collapsed AD - Announced
- Cross regional replication for Aurora PostGreSQL - Regions expanded still waiting on the cross regions to be announced
- Lambda and more Lambda integrations - Announced
- AWS Config adding machine learning based on account.
- Account level S3 bucket control - Partly Announced
- 40Gbps Direct Connect
There a lot of announcements, far too many to recap if interested in them all go read the AWS News Blog. I do like to find two announcements which shock me and two things that seem interesting.
The two items which shocked me were:
- DynamoDB added transactional support (ACID). This means someone could build an e-commerce or banking application which requires consistent transactions on dynamoDB.
- AWS Outposts and AWS RDS on VMware allows you to deploy AWS on-premise and AWS will manage this for you. I can only assume this is to help with migrations or workloads so sensitive they can’t move off-premise. It would be interesting to see how AWS manages storage capacity and compute resources as many companies struggle with these and how the management model will work. However, given the push to move away from traditional data centers, so reserves that course. It will be interesting to see how it plays out over the next year and what services this provides a company migrating to the cloud.
On my passions is security, so the two things which interested me are
- AWS Security Hub and AWS Control Tower - I consider these one thing as they will be used in tandem. Control Center will provide security launch zone for an organization while AWS Security Hub will provide governance and monitoring of security
- The ARM processor in the a1 instances which Amazon developed internally. Based on pricing these instances seem to offer cost advantages to the existing instance types.
What did you find interesting, amusing or shocking? What were you looking for which wasn’t announced?
Every year 10s of thousands of AWS customers and prospect customers desend on Las Vegas. For those of us to don’t make the trek Amazon live streams the the daily Key Notes. Those are where AWS announces it’s newest products and changes. Each year I build a list before November...
Last week, I got the privilege to attend an Item Development Workshop for the Associate Architect Exam. I participated as a Subject Matter Expert as the certification program pulls both Amazonians and industry professionals together to develop questions. I’m not going to go into details about the workshop or share any content, because of the NDA. I do want to share 3 observations I found during my time in the in the workshop:
- AWS takes certification, the validity of certification and the value of certifications with immense regard. The program is designed to recognize those who have AWS knowledge. As the certification is not about memorization but the ability to learn, understand and apply.
- The AWS certification team is amazing.
- AWS people are very intelligent and have a deep understand of both AWS and technology.
The experience was a learning fascinating experience and hope to continue to participate as an SME for other workshops.
Last week, I got the privilege to attend an Item Development Workshop for the Associate Architect Exam. I participated as a Subject Matter Expert as the certification program pulls both Amazonians and industry professionals together to develop questions. I’m not going to go into details about the workshop or share...
Amazon recently released a presentation on Data-safe Cloud. It appears to be based on some Gartner question and other data AWS collected. The presentation discusses 6 core benefits of a secure cloud.
- Inherit Strong Security and Compliance Controls
- Scale with Enhanced Visibility and Control
- Protect Your Privacy and Data
- Find Trusted Security Partners and Solutions
- Use Automation to Improve Security and Save Time
- Continually Improve with Security Features.
I find this marketing material to be confusing at best, let’s analyze what it is saying.
For point 1, Inherit Strong and Compliance Controls, which reference all the compliance AWS achieves. However, it loses track of the shared responsibility model and doesn’t even mention until page 16. Amazon has compliance in place which is exceptional, and most data center operators or SaaS providers struggle to achieve. This does not mean my data or services running within the Amazon environment meet those compliances
For point 2, 4 and 6 those are not benefits of the secure cloud. Those might be high-level objects one uses to form a strategy on how to get to a secure cloud.
Point 3 I don’t even understand, the protection of privacy and data has to be the number one concern when building out workloads in the cloud or private data centers. It’s not a benefit of the secure cloud, but a requirement.
For point 5, I am a big fan of automation and automating everything. Again this is not a benefit of a secure cloud, but how to have a repeatable, secure process wrapped in automation which leads to a secure cloud.
Given the discussions around cloud and security given all the negative press, including the recent AWS S3 Godaddy Bucket exposure, Amazon should be publishing better content to help move forward the security discussion.
Amazon recently released a presentation on Data-safe Cloud. It appears to be based on some Gartner question and other data AWS collected. The presentation discusses 6 core benefits of a secure cloud.
- Inherit Strong Security and Compliance Controls
- Scale with Enhanced Visibility and Control
- Protect Your Privacy and Data
...
Earlier today AWS released t3 instances. There are a bunch of press releases about the topic. The performance is supposed to be 30% better than T2. Hopefully, in the next few days, independently published benchmarks will be released to confirm if the instances are 30% faster. In the interim go to the Amazon pages for all the details on T3 instances. The cost is a few cents less. For example, a reserved instance from T2.small to T3.small with no upfront went from .17 cents to .15 cents in the US-WEST-2 region.
Before today awsarch.io ran off T2 instances, to build this blog article it was updated to T3 instances. AWS makes it easy to change instance type, just shut down the instance and from the AWS console go to Instance Settings->Change Instance type. Then select the appropriate t3 instance. It can be done via the AWS CLI as well.
Change Instance
T3 force you to select EBS optimized volumes. EBS optimized volumes for T3 provide additional IOPS. Here is the link for the complete EBS optimized information.
T3 EBS Optimized
The T3 instance uses an ENA adapter so before starting your instance change the ENA adapter thru the AWS command line:
aws ec2 modify-instance-attribute –instance-id --ena-support
Lastly, I notice mount points changed. Previously the EBS volumes devices in the Linux /dev directory changes. Before the change to T3 they were /dev/xvdf1, /dev/xvdf2, etc. Now the devices are /dev/nvme1n1p1, /dev/nvme1n1p2, etc. Something to keep in mind if you have additional volumes with mount points on the ec2 instance.
Earlier today AWS released t3 instances. There are a bunch of press releases about the topic. The performance is supposed to be 30% better than T2. Hopefully, in the next few days, independently published benchmarks will be released to confirm if the instances are 30% faster. In the interim go...
Amazon generates a lot of logs via VPC Flow Logs, CloudTrail, S3 access logs, CloudWatch (See the end of the blog article for a full list.) Additionally, there are OS, Application, web server logs. That is a lot of data which provides valuable insight into your running AWS environment. What are you doing to manage this log files? What are you doing with those log files? What are you doing to analysis these log files?
There are a lot of logging solutions available that integrate with AWS. Honestly, I’m a big fan of Splunk and have set it up multiple times. However, I wanted to look at something else for this blog article. Something open source and relatively low cost. This blog is going to explain what I did to setup Graylog. Graylog has no charges for the software, but you’re going to get charged for the instance, Kinesis, SQS, and data storage. It actually a good exercise if to familiarize yourself with AWS services, especially for the Sysops exams.
Graylog provides great instructions. I followed the steps remember to use their image which is already self-built on Ubuntu. One difference with this setup, I didn’t use a 4GB memory systems. I picked a t2.small which proves 1vCPU and 2GB of memory. I didn’t notice performance issues. Remember to allow ports 443 and 9000 in security groups and the Networking ACLs. I prefer to run this over HTTPS. And it bugs me when you see NOT SECURE HTTP: I installed an SSL certificate, and this is how I did it.
- Create a DNS name
- Get a free certificate
- Install the Certificate as such
Now my instance is up, and I can log into the console. I want to get my AWS logs into Graylog. To do this is requires the logs sent to Kinesis or SQS. I am not going to explain the SQS setup as there plenty of resources for the specific AWS Service. Also, the Graylog Plugin describes how to do this. Graylog plugin for CloudTrail, CloudWatch and VPC Flow logs is available on Github at Graylog Plugin for AWS.
What about access_logs? Graylog has the Graylog Collector Sidecar. I’m not going to rehash the installation instructions here as there are great installation instructions. Graylog has a great documentation. Also if you are looking for something not covered here, it will be in the documentation or in their Github project.
What are you using as your log collection processing service on Amazon?
List of AWS Servers generating logs:
Amazon S3 Access logs Amazon CloudFront Access logs Elastic Load Balancer (ELB) logs Amazon Relational Database Service (RDS) logs Amazon Elastic MapReduce (EMR) logs Amazon Redshift logs AWS Elastic Beanstalk logs AWS OpsWorks logs (or this link) AWS Import/Export logs AWS Data Pipeline logs AWS CloudTrail logs
Amazon generates a lot of logs via VPC Flow Logs, CloudTrail, S3 access logs, CloudWatch (See the end of the blog article for a full list.) Additionally, there are OS, Application, web server logs. That is a lot of data which provides valuable insight into your running AWS...
Amazon released AWS Well Architected Framework to help customers Architect solutions within AWS. The amazon certifications require detailed knowledge of 5 white papers which make up the Well Architected Framework. Given I have recently completed 6 Amazon certifications, I decided I was going to write a blog which pulled my favorite lines from each paper.
Operational excellence pillar
The whitepaper says on page 15, “When things fail you will want to ensure that your team, as well as your larger engineering community, learns from those failures.” It doesn’t say “If things fail”, it says “When things fail” implying straight away things are going to fail.
security pillar
On page 18, “Data classification provides a way to categorize organizational data based on levels of sensitivity. This includes understanding what data types are available, where is the data located and access levels and protection of the data”. This to me sums up how security needs to be defined. Modern data security is not about firewalls and having a hard outside shell or malware detectors. It about protecting the data based on its classification from both internal (employees, contractors, vendors) actors and hostile actors.
reliability pillar
The document is 45 pages long and the word failure appears 100 times and the word fail exists 33 times. The document is really about how to architect an AWS environment to respond to failure and what portion of your environment based on business requirements should be over-engineered to withstand multiple failures.
performance efficiency pillar
Page 24 the line, “When architectures perform badly this is normally because of a performance review process has not been put into place or is broken”. When I first read this line, I was perplexed. I immediately thought this implies a bad architecture can perform well if there is a performance review in place. Then I thought when has a bad architecture ever performed well under load? Now I get the point this is trying to make.
cost optimization
On page 2, is my favorite line from this white paper, “A cost-optimized system will fully utilize all resources, achieve an outcome at the lowest possible price point, and meet your functional requirements.” It made me immediately think back to before the cloud, every solution had to have a factor over the life of hardware for growth it was part of the requirements. In the cloud you need to support capacity today, if you need more capacity tomorrow, you just scale. This is one of the biggest benefits of cloud computing, no more guessing about capacity.
Amazon released AWS Well Architected Framework to help customers Architect solutions within AWS. The amazon certifications require detailed knowledge of 5 white papers which make up the Well Architected Framework. Given I have recently completed 6 Amazon certifications, I decided I was going to write a blog which pulled my...
Sat the AWS Certified Security - Speciality Exam this morning. The exam is hard, as it scenario based. Most of the exam questions were to pick the best security scenario. It could be renamed the Certified Architect - Security. Every one of those questions had 2 good answers, it came down to which was more correct and more secure. It’s the hardest exam I’ve taken to date. I think it is harder than the Solution Architect - Professional exam. The majority of the exam questions where on KMS, IAM, securing S3, CloudTrail, CloudWatch, multiple AWS account access, Config, VPC, security groups, NACLs, and WAF.
I did the course on acloud.guru and I think the whitepapers and links really helped me in the studying for this exam:
The exam took me about half the allocated time, I read fast and have a tendency to flag questions I don’t know the answer to and come back later and work thru them. This exam, I flagged 20 questions, highest of any AWS exam taken to date. Most of them I could figure out, once I thought about them for a while. Thru the exam, I was unsure of my success or failure.
Upon submission, I got the “Congratulations! You have successfully completed the AWS Certified Security - Specialty exam…”
Unfortunately, I didn’t get my score, I got the email, which says, “Thank you for taking the AWS Certified Security - Specialty exam. Within 5 business days of completing your exam,”
That now makes my 6th AWS Certification.
Sat the AWS Certified Security - Speciality Exam this morning. The exam is hard, as it scenario based. Most of the exam questions were to pick the best security scenario. It could be renamed the Certified Architect - Security. Every one of those questions...
Amazon is crashing on Prime Day, made breaking news. Appears the company is having issues with the traffic load.
Given Amazon runs from AWS as of 2011. Not a great sign for either Amazon or the scalability model they deployed on AWS.
Amazon is crashing on Prime Day, made breaking news. Appears the company is having issues with the traffic load.
Given Amazon runs from AWS as of 2011. Not a great sign for either Amazon or the scalability model they deployed on...
I sat the AWS Certified Solutions Architect - Professional exam this morning. This exam is hard, probably the hardest of the AWS exams I have taken to date. I did it in about half the allowed time. Generally, the test is challenging as it covers a lot of topics and each answer always had two correct choices. The entire exam is a challenge to pick the more correct answer based on the scenario and question with a driving factor of one more or more of the following, scalability, cost, recovery time, performance or security.
I felt like I passed the exam while doing it, but its always a relief to see:
Congratulations! You have successfully completed the AWS Certified Solutions Architect - Professional exam and you are now AWS Certified.
Here is my score breakdown from the exam.
Topic Level Scoring:
| 1.0 |
High Availability and Business Continuity: |
81% |
| 2.0 |
Costing: |
75% |
| 3.0 |
Deployment Management: |
85% |
| 4.0 |
Network Design: |
85% |
| 5.0 |
Data Storage: |
81% |
| 6.0 |
Security: |
85% |
| 7.0 |
Scalability & Elasticity: |
63% |
| 8.0 |
Cloud Migration & Hybrid Architecture: |
57% |
I sat the AWS Certified Solutions Architect - Professional exam this morning. This exam is hard, probably the hardest of the AWS exams I have taken to date. I did it in about half the allowed time. Generally, the test is challenging as it covers a lot of topics and...
Completed the Amazon interview on site. It’s a meeting with 5 Amazonians. The interviews are between 30 minutes and 45 minutes. They start promptly on time and end promptly on time. Each question is about telling a story and relating back to the Amazon Leadership Principles.
There were a lot of great questions during the session. It requires you to be detailed, communicate clearly and explain your answers.
There three questions which stood out:
-
What Leadership Principle do you associate the most with?
-
What Leadership Principle do you associate the least with or disagree with?
-
What was a decision you made wrong and why?
The other notable things I noticed, is all the interviewers loved their jobs and loved the culture of Amazon. Also, if the right amount of lean in, any idea could take shape and become part of AWS.
The other thing, I noticed is Amazon has a long lead process for developing Solution Architects. They want a person to know AWS before speaking with customers, which could take 6 to 9 months and require multiple AWS certifications. Also if you want to speak on behalf of Amazon, you have to get public speaking certified within Amazon.
It’s clear they want the smartest people with the most AWS knowledge.
Completed the Amazon interview on site. It’s a meeting with 5 Amazonians. The interviews are between 30 minutes and 45 minutes. They start promptly on time and end promptly on time. Each question is about telling a story and relating back to the Amazon Leadership Principles.
There...
Amazon requires a writing sample of 2 pages about a topic they provide. To do this I wrote 3 paragraphs on 6 different key events from my career. Then I took 3 of those topics and made it a page long. Finally, I decided on which topic covered the most Amazon Leadership Principles and used that on for the final essay by elaborating and extending it to two full pages.
The writing sample has been submitted let’s see how it goes.
Let’s see how it goes.
Amazon requires a writing sample of 2 pages about a topic they provide. To do this I wrote 3 paragraphs on 6 different key events from my career. Then I took 3 of those topics and made it a page long. Finally, I decided on which topic covered the...
