Aws Cloud Practitioner

Front 1

Acting as a "firewall" on EC2 instances

Back 1

Security Groups

Front 2

Regulate access to ports

Control inbound network (from other to instance)

Control outbound network

Authorised IP ranges - IPv4 and IPv6

Back 2

Security Groups

Front 3

Classic Port 22

Back 3

SSH (secure shell) - log into a Linux instance //

SFTP (Secure File Transport Protocol) - upload files using SSH

Front 4

Classic Port 21

Back 4

FTP (File Transport Protocol) - upload files into a file

Front 5

Classic Port 80

Back 5

HTTP - access unsecured websites

Front 6

Classic Port 442

Back 6

HTTPS - access secured websites

Front 7

Classic Port 3389

Back 7

RDP (Remote Desktop Protocol) - log into a Windows instance

Front 8

Allows you to control a remote machine, all using the command line

Back 8

SSH

Front 9

Supports Mac, Linux, Windows 10+

Back 9

SSH

Front 10

Supports Windows

Back 10

Putty

Front 11

Supports Mac, Linux, all windows

Back 11

EC2 Instance Connect

Front 12

Short workload, predictable pricing

Back 12

On-demand instances

Front 13

Long workload (MIN 1 year)

Back 13

Reserved Instances

Front 14

Long workloads with flexible instances

Back 14

Convertible Reserved Instances

Front 15

Short workloads, cheap, can lose instances (less reliable)

Back 15

Spot instances

Front 16

book an entire physical server, control instance placement

Back 16

Dedicated hosts

Front 17

Pay for what you use

Highest cost, but no upfront payment

No long term commitment

Back 17

EC2 On Demand

Front 18

Recommended for short-term and uninterrupted workloads, where you can't predict how the application will behave

Back 18

EC2 On Demand

Front 19

EC2 On Demand Billing for Linux

Back 19

Billing per SECOND

Front 20

EC2 On Demand Billing for all other OS (not Linux)

Back 20

Billing per HOUR

Front 21

Up to 75% discount compared to on-demand

Reservation period (only 1 OR 3 year term)

Recommended for steady state usage applications (think database)

Can pay no upfront, partial upfront, all upfront

Specific instance type

Back 21

EC2 Reserved Instances

Front 22

Up to 54% discount

Can change EC2 instance type

Back 22

Convertible Reserved Instance

Front 23

Launch within time frame you reserve

When you require a fraction of a day/week/month

Back 23

Scheduled Reserved Instances

Front 24

Discount up to 90% compared to On-Demand

Most cost-efficient instances

Can "lose" instance at any point in time

Not suitable for critical jobs or databases

Back 24

EC2 Spot Instances

Front 25

Useful for workloads that are resilient to failure:

Batch jobs

Data analysis

Image processing

Any distributed workloads

Workloads with flexible start and end time

Back 25

EC2 Spot Instances

Front 26

physical server with EC2 instance capacity fully dedicated to your use

Back 26

EC2 Dedicated Host

Front 27

Help address compliance requirements and reduce costs allowing you to use existing server-bound software licenses

Allocated for a 3 year reservation

Useful for software that have complicated licensing model (BYOL - Bring Your Own License)

Useful for strong regulatory or compliance needs

Back 27

EC2 Dedicated Host

Front 28

Instances running on hardware dedicated to you

May share hardware with other instances on same account

No control over instance placement (can move hardware after Stop/Start)

Back 28

EC2 Dedicated Instance

Front 29

Enables use of dedicated physical servers

Per instance billing ($2 per region fee)

Automatic instance placement

Back 29

Dedicated Instances

Front 30

Enables use of dedicated physical servers

Per host billing

Visibility of sockets, cores, host ID

Affinity between host and instance

Targeted instance placement

Automatic instance placement

Add capacity using allocation request

Back 30

Dedicated hosts

Front 31

Infrastructure (Global Network Security)

Isolation on Physical Hosts

Replacing faulty hardware

Compliance Validation

Back 31

AWS Responsibility for EC2

Front 32

Security Groups rules

OS patches and updates

Software and utilities installed on EC2 Instance

IAM Roles assigned to EC2 & IAM user access management

Data security on your instance

Back 32

User Responsibility for EC2

Front 33

AMI (OS) + Instance Size (CPU + RAM) + Storage + Security Groups + EC2 User Data

Back 33

EC2 Instance

Front 34

Link to IAM roles

Back 34

EC2 Instance Role

Front 35

Script launched at the first start of an instance

Back 35

EC2 User Data

Front 36

Start a terminal into our EC2 instances (port 22)

Back 36

SSH

Front 37

On-Demand

Spot

Reserved (Standard/Convertible/Scheduled)

Dedicated Host

Dedicated Instance

Back 37

EC2 Purchasing Options

Front 38

network drive you can attach to your instances while they run

Think of as a "network USB stick"

Uses network to communicate - may be latency

Back 38

EBS (Elastic Block Store) Volume

Front 39

Allows instances to persist data, even after termination

Can only be mounted to one instance at a time (at CCP level)

Can be detached from instance and attached to another quickly

Bound to specific availability zone - to move across you first need to snapshot it

Free tier: 30N GB free storage of type gp2 per (provisioned capacity) month

Back 39

EBS (Elastic Block Store) Volume

Front 40

Make a backup of your EBS volume

Not necessary to detach volume to do snapshot, but recommended

Can copy across AZ or Region - able to transfer some data to different region

Back 40

EBS Snapshots

Front 41

Customization of an EC2 instance (Add own software, config, OS, monitoring) - Faster boot time

Built for specific region (can be copied across region)

Back 41

Amazon Machine Image (AMI)

Front 42

Public AMI

Back 42

AWS provided

Front 43

Your Own AMI

Back 43

make and maintain yourself

Front 44

AWS Marketplace AMI

Back 44

made by someone else and potentially sells

Front 45

1. Start EC2 instance & customize it

2. Stop instance (for data integrity)

3. Build AMI - this will also create EBS snapshots

4. Launch instances from other AMIs

Back 45

AMI Process (from an EC2 Instance)

Front 46

If you need a high-performance hardware disk

Better I/O performance

Lose storage if stopped

Good for buffer/cache/scratch data/temp content

Risk of data loss if hardware fails

Backups and Replication your responsibility

Back 46

EC2 Instance Store

Front 47

Managed NFS that can be mounted on 100s of EC2 instances at a time

Only works with Linux EC2 instances - in multiple AZ

Highly available, scalable, expensive (3x cost of gp2), pay per use, no capacity planning

Back 47

EFS (Elastic File System)

Front 48

Infrastructure

Replication for data for EBS volumes & EFS drives

Replacing faulty hardware

Ensuring their employees cannot access your data

Back 48

AWS Responsibility for EC2 Storage

Front 49

Setting up backup/snapshot procedures

Setting up data encryption

Responsibility of any data on the drives

Understanding risk of using EC2 Instance Store

Back 49

Customer Responsibility for EC2 Storage

Front 50

Network drives attached to one EC2 instance at a time

EC2 instances can have multiples attached

Mapped to AZ

Allow data to persist even after termination

Back 50

EBS Volumes

Front 51

Create ready-to-use EC2 instances with our customizations

Back 51

AMI

Front 52

high performance hardware disk attached to EC2 instance

Lost if instance is stopped/terminated

Back 52

EC2 Instance Store

Front 53

Fully managed service that makes it easy to set up, scale, and cost-optimize file storage

Network file system, can be attached to 100s of instances in a region

Back 53

EFS

Front 54

app/system can handle greater loads by adaptability

is linked but different to High Availability

Back 54

Scalability

Front 55

Increasing the SIZE of an instance

Common for non-distributed systems, such as database

Usually limit to how much you can scale (hardware limit)

Ex: appruns on t2.micro to t2.large (change size of instance)

Scale Up/Down

Back 55

Vertical Scalability

Front 56

Increasing number of instances/systems

Implies distributed systems

Common for web applications

Easy thanks to cloud operations like EC2

Auto Scaling Group

Load Balancer

Scale Out/In

Back 56

Horizontal Scalability

Front 57

Usually goes hand in hand with horizontal scaling

Running app/system in at least 2 AZ

Goal = survive data center loss

Auto Scaling Group Multi AZ

Back 57

High Availability

Front 58

once a system is scalable, there will be "auto scaling" based on load

Cloud friendly, pay-per-use, match demand, optimize costs

Back 58

Elasticity

Front 59

Not related to scalability

New IT resources are only a click away - reduce time to make resources available

Back 59

Agility

Front 60

servers that forward traffic to multiple servers (EC2 instances) downtream

Backhand EC2 instances

Expose single point of access (DNS) to app

Seamlessly handle failures of downstream instances

Regular health checks

Provide SSL termination (HTTPS) for websites

High availability across zones

Back 60

Load Balancer

Front 61

Managed load balancer

AWS guarantees it will be working

AWS takes care of upgrades, maintenance, high availability

AWS provides only a few config knobs

Cannot help with back-end autoscaling

Back 61

Elastic Load Balancing (ELB)

Front 62

3 kinds of load balancers

Back 62

1. Application Load Balancer

2. Network Load Balancer

3. Classic Load Balancer

Front 63

HTTP/HTTPS only - Layer 7

Back 63

Application Load Balancer

Front 64

Ultra-high performance

Allows for TCP

Layer 4

Back 64

Network Load Balancer

Front 65

Layer 4 & 7

Slowly retiring

Back 65

Classic Load Balancer

Front 66

Goal = scale out/scale in to match load

Ensure a min and max # of machines running

Automatically register new instances to load balancer

Replace unhealthy instances

Cost savings : only run at optimal capacity (principle of cloud)

Cannot change EC2 instance types on the fly

Easy horizontal scaling

Back 66

Auto Scaling Group

Front 67

Distribute traffic across backend EC2 instances, can be multi AZ

Supports Health Checks

3 types

Back 67

Elastic Load Balancers (ELB)

Front 68

Implement elasticity for app, across multiple AZ

Scale EC2 instance based on demand, replace unhealthy

Integrated with ELB

Back 68

Auto Scaling Groups

Front 69

A main building block of AWS

Advertised as "infinitely scaling" storage

Backbone for websites

Used as an integration

Back 69

Amazon S3

Front 70

IAM policies - which API calls should be allowed for specific user from IAM console

Back 70

User based S3 Security

Front 71

Bucket policies - bucket wide rules from the S3 console -n allows cross account

Object Access Control List - finer grain

Bucket Access Control List - less common

Back 71

resource Based S3 Security

Front 72

An IAM principal can access an S3 object if:

Back 72

The user IAM permissions allow it

OR the resource policy allows it

AND there is no explicit DENY

Front 73

JSON based policies

Back 73

S3 Bucket Policies

Front 74

Buckets and objects

Back 74

Resources

Front 75

Set of API to ALLOW or DENY

Back 75

Actions

Front 76

Allow or Deny

Back 76

Effect

Front 77

Account or user to apply the policy to

Back 77

Principal

Front 78

Use S3 Bucket Policy to:

Back 78

Grant public access to the bucket

Force objects to be encrypted at upload

Grant access to another account (cross account)

Front 79

Settings created to prevent company data leaks

Can be set at the account level

If you know your bucket should never be public, leave these on

Back 79

Bucket settings for Block Public Access

Front 80

Can host static websites and have them accessible on the www

If you get 403 error, make sure bucket policy allows public reads

Back 80

S3 Websites

Front 81

Version your files for S2

Enabled at bucket level

Back 81

S3 Versioning

Front 82

For audit purposes, may want to log all access to S3 buckets

Any request made to S3 will be logged into another S3 bucket

Data can be analyzed using data analysis tools

Very helpful to identify root cause of an issue or audit usage, view suspicious patterns, etc

Back 82

S3 Access Logs

Front 83

Must enable versioning in source and destination

Buckets can be in different accounts

Copying is asynchronous

Must give proper IAM permissions to S3

2 types : CRR & SRR

Back 83

S3 Replication

Front 84

Use cases:

Compliance

Lower latency access
Replication across accounts

Back 84

Cross Region Replication (CRR)

Front 85

Use cases:

Log Aggregation

Live replication between prod and test accounts

Back 85

Same Region Replication (SRR)

Front 86

7 types of S3 Storage Classes

Back 86

1. Amazon S3 Standard - General Purpose

2. Amazon S3 Standard - Infrequent Access (IA)
3. Amazon S3 One Zone - Infrequent Access

4. Amazon S3 Intelligent Tiering

5. Amazon Glacier

6. Amazon Glacier Deep Archive

7. Amazon S3 Reduced Redundancy Storage (deprecated)

Front 87

Amazon S3 Standard

Back 87

General purpose

Commonly used

Front 88

Amazon S3 Standard - Infrequent Access (IA)

Back 88

Uploading file not accessed very often

Front 89

Amazon S3 One Zone - Infrequent Access

Back 89

File you know you can recreate over time

Front 90

Amazon S3 Intelligent Tiering

Back 90

Don't know where to put file

Front 91

Amazon Glacier

Back 91

Know you have copies of file

Front 92

Amazon Glacier Deep Archive

Back 92

Know it takes a while to retrieve copies

Front 93

If you store 10 mil objects with S3, you can on avg expect to incur a loss of single object once every 10,000 years

Same for all storage classes

Back 93

S3 Durability

Front 94

Measures how readily available a service is

Standard has 99.99% availability - not available 53 min per year

VAries depending on storage class

Back 94

S3 Availability

Front 95

99.99% availability

99.9% availability SLA

low latency, high throughput

Used for frequently accessed data

Sustain 2 concurrent facility failures

Use cases:

big data analytics

mobile and gaming apps

content distribution

no retrieval fee

Back 95

S3 Standard - General Purpose

Front 96

99.9% availability

99% availability SLA

For data less frequently accessed but requires rapid access when needed

Lower cost compared to standard, but retrieval fee

Sustain 2 concurrent facility failures

Use cases:

data store for disaster recovery

backups

min storage duration charge : 30 days

min capacity charge per object: 128KB

Back 96

S3 Standard - Infrequent Access (IA)

Front 97

99.9% Availability

99% availability SLA

Cost-optimized by automatically moving objects between two access tiers based on changing access patterns

Resilient against events that impact entire AZ

min storage duration charge : 30 days

no retrieval fee

Back 97

S3 Intelligent Tiering

Front 98

Same as IA but data is stored in single AZ

99.5% availability

99% availability SLA

Lower cost compared to S3-IA (by 20%)

Use cases:

Storing secondary backup copies of on-premises data, or storing data you can recreate

min storage duration charge : 30 days

min capacity charge per object: 128KB

Back 98

S3 One Zone - Infrequent Access

Front 99

low cost object storage (GB/month) meant for archiving/backup

data retained for longer term

various retrieval options of time + fee for retrieval

min storage duration charge : 90 days

min capacity charge per object: 40KB

Back 99

Amazon Glacier & Glacier Deep Archive

Front 100

99.99% availability

Cheap

Expedited (1-5 min)

Standard (3 -5 hours)

Bulk (5 - 12 hours)

Back 100

Amazon Glacier

Front 101

99.99% availability

Standard (12 hours)

Bulk (48 hours)

Cheapest

Back 101

Amazon Glacier Deep Archive

Front 102

Infrastructure (global security, durability, availability, sustain concurrent loss of data in 2 facilities)

Config and vulnerability analysis

Compliance validation

Back 102

AWS Responsibility for S3

Front 103

S3 Versioning

S3 Bucket Policies

S3 Replication Setup

Logging and monitoring

S3 Storage Classes

Data encryption at rest and in transit

Back 103

Customer Responsibility for S3

Front 104

physical data transport solution that helps moving TBs or PBs of data in.out of AWS

RULE OF THUMB: use if it takes more than a week to transfer over network

Alternative to moving data over network

Pay per data transfer job

Use cases:

large data cloud migrations

DC decomission

Disaster recovery

Back 104

Snowball

Front 105

1. Request snowball devices from AWS console for delivery

2. Install snowball client on servers

3. Connect snowball to servers and copy files using client

4. Ship back device when done

5. Data loaded into S3 bucket

6. Snowball completely wiped

Back 105

Snowball process

Front 106

1000TB capacity

Add computational capability to device

Supports custom EC2 AMI to perform processing on the go

Supports custom Lambda functions

Very useful to pre-process data while moving

Use cases:

data migration

image collation

IoT capture

Machine Learning

Back 106

Snowball Edge

Front 107

Transfer exabytes of data (1,000PB = 1mil TB)

Has 100PB of capacity ( can use multiple in parallel)

Better than Snowball if transferring more than 10PB

Back 107

AWS Snowmobile

Front 108

Why Hybrid cloud for storage?

Back 108

long cloud migrations

security requirements

compliance requirements

IT strategy

Front 109

S3 is a proprietary storage technology (unlike EFS/NFS), so how do you expose the S3 data on-premise?

Back 109

AWS Storage Gateway

Front 110

AWS Storage Cloud Native Options

Back 110

Block:

Amazon EBS

EC2 Instance Store

File:

Amazon EFS

Object:

Amazon S3

Glacier

Front 111

bridge between on-premise data and cloud data in S3

Hybrid storage service to allow on-premise to seamlessly use AWS cloud

Use cases:

disaster recovery

backup/restore

tiered storage

Back 111

AWS Storage gateway

Front 112

Types of storage gateways

Back 112

File

Volume

Tape

Front 113

global unique name, tied to a region

Back 113

buckets

Front 114

IAM policy

S3 Bucket Policy

S3 Encryption

Back 114

S3 Security

Front 115

Host static website on S3

Back 115

S3 Websites

Front 116

Multiple versions for files

Prevent accidental deletes

Back 116

S3 versioning

Front 117

log requests made within S3 bucket

Back 117

S3 Access Logs

Front 118

same-region or cross-region

must enable versioning

Back 118

S3 replication

Front 119

standard

IA

OZ-IA

Intelligent

Glacier

Deep Archive

Back 119

S3 Storage Classes

Front 120

transition objects between classes (cost-savings)

Back 120

S3 Lifecycle Rules

Front 121

import data on S3 through physical device

Back 121

Snowball/Snowmobile

Front 122

hybrid solution to extend on-premises storage to S3

Back 122

Storage Gateway

Front 123

composed of key, value, metadata

Back 123

Objects

Front 124

used to sign programmatic requests to AWS CLI or AWS API

Back 124

access keys

Front 125

Can structure data

Build indexes to efficiently query/search through data

Define relationships between datasets

Optimized for a purpose and come with different features, shapes, and constraints

Back 125

Databases

Front 126

Looks like Excel spreadhseets with links between them

Can use SQL language to perform queries/lookups

Back 126

Relational Databases

Front 127

non-SQL/non relational databases

JSON is a common form of data that fits

Data can be nested

Fields can change over time

Support for new types

Purpose built for specific data models and have flexible schemas for building modern apps

Back 127

NoSQL Databases

Front 128

Benefits:

Flexibility - easy to evolve data model

Scalability - designed to scale out by using distributed clusters

High-performance - optimized for specific data model

Highly functional - types optimized for data model

Examples:

key-value

Document

graph

in-memory

search databases

Back 128

NoSQL databases

Front 129

AWS offers use to manage different databases

Benefits:

Quick provisioning, high availability, vert/horz scaling

Automated backup & restore, operations, upgrades

OS system patching

Monitoring, alerting

DB tech could be run on EC2 but must handle resiliency, bakcup patching, etc, by yourself

Back 129

AWS Databases Responsibilities

Front 130

managed DB service for DB use SQL as query language

Allows to create databases in cloud managed by AWS

Postgres

MySQL

MariaDB

Oracle

Microsoft SQL Server

Aurora (AWS Proprietary database)

Back 130

Relational Database Service (RDS)

Front 131

Automated provisioning, OS patching

Continous backups and restore to specific timestamp

Monitoring dashboards

Read replicas for improved read performance

Multi AZ setup for disaster recovery

Maintenance windows for upgrades

Scaling capability (vertical and horizontal)

Storage backed by EBS (gb2 or io1)

CANNOT SSH into your instances

Back 131

Advantage using RDS vs deploying DB on EC2

Front 132

proprietary tech from AWS

PostgreSQL and MySQL supported

Claims 5x performance over MySQL on RDS

Over 3x performance of Postgres on RDS

Storage automatically grows in increments of 10GB, up to 64TB

Costs more than RDS (20% more) - but is more efficient

NOT in the free tier

Back 132

Amazon Aurora

Front 133

2 ways to run RDS in AWS

Back 133

1. Aurora - more cloud native

2. RDS - running tech as managed service

Front 134

managed Redis or Memcached

Helps reduce load off databases for read intensive workloads

AWS takes care of OS maintenance/patching, optimizations, setup, config, monitoring, failure recovery and backups

Back 134

Amazon ElastiCache

Front 135

in-memory databases with high performance, low latency

Back 135

Caches

Front 136

Fully managed, highly available with replication across 3 AZ

NoSQL database - not relational

Flagship product

Scales to massive workloads, distributed "serverless" database

Millions of requests per seconds

Fast and consistent

Single digit millisecond latency - low latency retrieval

Integrated with IAM for security, auth, and administration

Low cost and auto scaling capabilities

Key/Valye database

Back 136

DynamoDB

Front 137

Based on PostgreSQL, NOT used for OLTP

OLAP used for analytics and data warehousing

Load data once every hour, not every second

10x better performance

Columnar storage (instead of row based)

Massive Parallel Query EXecution (MPP), highly available

Pay as you go based on instances provisioned

SQL interface for queries

BI tools integration - AWS Quicksight or Tableau

Back 137

Redshift

Front 138

Helps create Hadoop clusters (big data) to analyze and process lots of data

Clusters can be 100s of EC2 instances

Supports Apache Spark, HBase, Presto, Flink

Takes care of all the provisioning and configuration

Auto-scaling and integrated with Spot instances

Use case:

Data processing

Machine Learning

Web indexing

Big data

Back 138

Amazon EMR (Elastic MapReduce)

Front 139

Fully serverless database with SQL capabilities

USed to query data in S3

Pay per query

Output results back to S3

Secured through IAM

Use case:

one-time SQL queries

serverless queries on S3

log analytics

Serverless database to perform queries on S3

Back 139

Athena

Front 140

quickly and securely migrate databases to AWS, resilient, self healing

Source database remains available during migration

Supports homogeneous and heterogeneous migrations

Back 140

Database Migration Service (DMS)

Front 141

managed extract, transform, and load (ETL) service

Useful to prep and transform data for analytics

Fully serverless service

Back 141

AWS GLue

Front 142

Catalog of datasets

Can be used by Athena, Redshift, EMR to discover datasets and use proper schema

Back 142

AWS Glue Data Catalog

Front 143

OLTP: RDS & Aurora(SQL)

Back 143

Relational Databases

Front 144

In-memory database

Back 144

ElastiCache

Front 145

Key/Value database (serverless)

Back 145

DynamoDB

Front 146

OLAP/ Warehouse

Back 146

Redshift(SQL)

Front 147

Hadoop Cluster

Back 147

EMR

Front 148

Query data on S3 (serverless & SQL)

Back 148

Athena

Front 149

Managed ETL and Data Catalog Service

Back 149

Amazon Glue

Front 150

database migration

Back 150

DMS

Front 151

software development platform to deploy apps

apps packed in containers that can be run on any OS

apps run the same, regardless of where they're run

virtualization technology

versatile, easy to scale

resources shared with host - many containers on one server

Back 151

Docker

Front 152

Where are Docker images stored?

Back 152

Docker repositories

Public: Docker Hub

Private: Amazon ECR

Front 153

Public Docker Repositories

Back 153

Docker Hub

Ubuntu

MySQL

NodeJS, Java

Front 154

Private Docker Repository

Back 154

Amazon ECR (Elastic Container Registry)

Front 155

Launch Docker containers on AWS

You must provision and maintain the infrastructure

AWS takes care of starting/stopping containers

Integrations with Application Load Balancer

Back 155

ECS (Elastic Container Service)

Front 156

Launch Docker containers on AWS

Do NOT need to provision and maintain infrastructure (no EC2 instances)

Serverless offering

AWS runs containers for you based on CPU/RAM needed

Back 156

Fargate

Front 157

Private Docker registry on AWS

Where you store Docker images to be run by ECS or Fargate

Back 157

Elastic Container Registry (ECR)

Front 158

Function as a Service

pioneered by AWS Lambda

Amazon S3

DynamoDB

Fargate

Lambda

Back 158

Serverless

Front 159

Virtual servers in cloud

limited by RAM and CPU

continuously running

scaling means intervention to add/remove servers

Back 159

Amazon EC2

Front 160

Virtual functions - no servers to manage

Limited by time - short executions

Run on-demand

Scaling is automated

Back 160

AWS Lambda

Front 161

Easy pricing

Pay per request & compute time

Free tier of 1mil Lambda requests and 400k GBs of compute time

Integrated with whole AWS suite of services

Event-Driven: function invoked by AWS when needed

Reactive

Integrated with many languages

Easy monitoring through AWS CloudWatch

Easy to get mroe resources per functions (up to 3GB RAM)

Increasing RAM will also improve CPU and network

Back 161

Benefits of AWS Lambda

Front 162

Node.js

Python

Java

C#

Golang

Powershell

Ruby

Custome Runtime API)

Docker is NOT for Lambda, its for ECS/Fargate

Back 162

AWS Lambda Language Sypport

Front 163

Serverless Thumbnail Creation

Fully event-driven, fully serverless

Easily scalable

Back 163

lambda function

Front 164

Serverless CROn job

Run on Linux AMI, use CloudWatch Evemts/EventBridge

Back 164

Lambda function

Front 165

Pay per calls:

1st 1mil requests are free

$0.20 per 1 mil requests thereafter

Pay per duration (in increments of 100ms):

400k GB seconds per month if FREE

400k seconds if function is 1GB RAM

3.2mil seconds if function is 128MB RAM

After that, $1.00 for 600k GB-seconds

Usually very cheap to run Lambda

Back 165

AWS Lambda pricing

Front 166

Fully managed batch processing at any scale

Efficiently run 100,000s of computing batch jobs on AWS

Will dynamically launch EC2 instances or Spot instances

Provisions the right amount of compute/memory

You submit or schedule batch jobs and AWS Batch does the rest

Helpful for cost optimizations focusing less on the infrastructure

Back 166

AWS Batch

Front 167

job with a start and end (as opposed to continuous)

Ex: Docker images and run on ECS

Back 167

batch job

Front 168

time limit

limited runtimes

limited temp disk space

serverless

Back 168

Lambda

Front 169

no time limit

any runtime as long as it's packaged as a Docker image

rely on EBS/instance store for disk space

Relies on EC2 (can be managed by AWS)

Runs thousands of jobs, don't manage compute resources

Back 169

Batch

Front 170

Virtual servers, storage, databases, and networking

Low and predictable pricing

Simpler alternative to using EC2, RDS, ELB, EBS, Route 53

Great for people with little cloud experience

Can setup notifications and monitoring of your Lightsail resources

High availability, no auto-scaling, limited AWS integrations

Use cases:

Simple web apps (templates for LAMP, Nginx, MEAN, Node.js)

Websites (templates for WordPress, Magento, Joomla)

Dev/Test enviornment

Back 170

Amazon Lightsail

Front 171

container technology to run applications

Back 171

Docker

Front 172

Run Docker Containers on EC2 instances

Back 172

Elastic container Services (ECS)

Front 173

Run Docker containers without provisioning the infrastructure

Serverless offering (no EC2 instance)

Back 173

Fargate

Front 174

Private Docker Images Repository

Where you store your Docker image to be run by ECS or Fargate

Back 174

ECR (Elastic Container Registry)

Front 175

Run batch jobs on AWS across managed EC2 instances

Back 175

Batch

Front 176

Predictable & low pricing for simple application and DB stacks

Back 176

Lightsail

Front 177

Serverless

Function as a Service

Seamless scaling

Reactive

Back 177

Lambda

Front 178

By the run time x RAM provisioned

By # of innovations

Language support: many except Docker

Invocation time : up to 15 minutes

Use cases:

Create thumbnails for images uploaded onto S3

Run serverless chron job

Back 178

Lambda

Front 179

declarative way of outlining your AWS infrastructure, for any resources (most are supported)

creates in right order with exact config you specify

Back 179

CloudFormation

Front 180

Infrastructure as code (base)

No resources manually created

Changes to infrastructure reviewed through code

Each resource within stack is tagged to see how much each costs you

Estimate costs of resources using CF template

ability to destroy/re-create infrastructure on the fly

Automated generation of diagram for templates

Declarative proframming

Leverage existing templates and documentation

Back 180

Benefits of CloudFormation

Front 181

Used when we have infrastructure as code and when we need to repeat an architecture in different environments, regions, or different AWS accounts

Ex: WordPress CloudFormation Stack

- can see all resources

- can see relations between components

Back 181

CloudFormation Stack Designer

Front 182

typical architecture

can easily be reproduced manually, reproduced on AWS through CloudFormation

Back 182

Web App 3-tier

Front 183

Managing infrastructure

Deploying code

Configuring all databases, load balancers

Scaling concerns

Most web apps have same architecture (ALB + ASG)

All developers want is for their code to run

Possibly, consistently across multiple environments

Back 183

Developer Problems on AWS

Front 184

Developer-centric view of deploying an application on AWS

All in one view that's easy to make sense of

Have full control over the config

Platform as a Service

Free but pay for underlying instances

Back 184

AWS Elastic Beanstalk

Front 185

Managed service

Instance config/OS handled by Beanstalk

Deployment strategy configureable but performed by Elastic Beanstalk

Just the application code is the responsibility of the developer

Back 185

AWS Elastic Beanstalk

Front 186

3 architecture models for Beanstalk

Back 186

1. Single instance deployment - good for dev

2. LB + ASG - great for production or pre-production web applications

3. ASG only - great for non-web apps in production

Front 187

Deploy application automatically

Works with EC2 instances

Works with On-Premises servers

Hybrid service

Servers/instances must be provisioned and configure ahead of time with CodeDeploy Agent

Back 187

AWS CodeDeploy

Front 188

Way to patch fleet of EC2 instances

Helps manage your EC2 and On-Premises systems at scale

Hybrid Service

Get operational insights about the state of infrastructure

Suite of 10+ products

Patching automation for enhanced compliance

Run commands across an entire fleet of servers

Store parameter config with the SSM Parameter Store

Works for Windows and Linux

Back 188

AWS Systems Manager (SSM)

Front 189

Chef & Puppet - help perform server config automatically or repetitive actions

Works great with EC2 & On-Premises VM

Managed Chef & Puppet

Alternative to AWS SSM

Only provision standard AWS resources: EC2 instances, databases, load balancers, EBS volumes

Back 189

AWS OpsWorks

Front 190

Infrastructure as Code, works with almost all AWS resources

Repeat across Regions & Accounts

Free for use, pay for resources created

CloudFormation templates are JSON or YAML-formatted text files

Declarations of the AWS resources that make up a stack

Back 190

CloudFormation (AWS only)

Front 191

Platform as a Service

Limited to certain programming languages or Docker

Deploy code consistently with a known architecture: ex, ALB + EC2 + RDS

Free for use, pay for resources created

Back 191

Beanstalk (AWS)

Front 192

Deploy & upgrade any application onto servers (automatic)

Back 192

CodeDeploy (Hybrid)

Front 193

Patch, configure, and run commands at scale

Unified user interface

Back 193

Systems Manager (hybrid)

Front 194

Managed Chef & Puppet in AWS

Back 194

OpsWorks (Hybrid)

Front 195

application deployed in multiple geographies

could be Regions and/or Edge locations

Back 195

Global application

Front 196

time it takes for network packet to reach a server

Deploy app closer to users to decrease latency

Back 196

latency

Front 197

Why make a global application?

Back 197

Decreased latency

Disaster recovery - important to increase availability

attack protection - distributed global infrastructure is harder to attack

Front 198

Global AWS Infrastructure

Back 198

Regions: for deploying applications and infrastructure

Availability Zones: made of multiple data centers

Edge Locations: for content delivery as close as possible to users

Network: links between regions, AZs

Front 199

Great to route users to the closest deployment with least latency

great for disaster recover strategies

Back 199

Global DNS: Route 53

Front 200

Replicate part of your application to AWS Edge Locations - decrease latency

Cache common requests - improved user experience and decreased latency

Back 200

Global Content Delivery Network (CDN): CloudFront

Front 201

Accelerate global uploads & downloads into Amazon S3

Back 201

S3 Transfer Acceleration

Front 202

Improve global application availability and performance using the AWS global network

Back 202

AWS Global Accelerator

Front 203

collection of rules and records which helps clients understand how to reach a server through URLs

Back 203

Domain Name System (DNS)

Front 204

managed DNS

most common records are:

Back 204

Amazon Route 53

Front 205

No health checks

Back 205

Simple Routing Policy

Front 206

Distribute across - enable health checks

Back 206

Weighted Routing Policy

Front 207

Minimize latency

Back 207

Latency Routing Policy

Front 208

Disaster Recovery

Health check on primary

Back 208

Failover Routing Policy

Front 209

Route 53 Routing Policies

Back 209

Simple

Weighted
Latency

Failover

Front 210

Content Delivery Network (CDN)

Improves read performance, content is cached at the edge

Improves user experience

216 Edge Locations

DDoS protection, integration with Shield, AWS Web Application Firewall

Back 210

AWS CloudFront

Front 211

For distributing files and caching them at the edge

Enhanced security with CloudFront Origin Access Identity (OAI)

CloudFront can be used as an ingress (to upload files to S3)

Back 211

S3 Bucket - CloudFront Origins

Front 212

Application Load Balancer

EC2 Instance

S3 Website (must first enable the bucket as a static S3 website)

Any HTTP backend you want

Back 212

Custom Origin (HTTP) - CloudFront Origins

Front 213

Global edge network

Files cached for a TTL (maybe a day)

Cache

Great for static content that must be available everywhere

Back 213

CloudFront

Front 214

Must be setup for each region you want replication to happen

Files are updated in near real-time

Read only

Replicate entire bucket into another region

Great for dynamic content that needs to be available at low-latency in few regions

Back 214

S3 Cross Region Replication

Front 215

Increase transfer speed by transferring file into an AWS Edge Location which will forward the data to the S3 bucket in the target region

Only used when you want to upload/download from S3 bucket that is far away from you

Back 215

S3 Transfer Acceleration

Front 216

Improve global application availability and performance using the AWS global network

Leverage the AWS internal network to optimize the route to your applications (60% improvement)

2 Anycast IP are created for your application and traffic is sent through Edge Locations

Edge location send traffic to your application

Back 216

AWS Global Accelerator

Front 217

Improved performance for your cacheable conent (such as images and videos)

Content is served at the edge

Back 217

CloudFront - CDN

Front 218

No caching

Proxying packets at the edge to applications running in one or more AWS regions

Improves performance for a wide range of applications over TCP and UDP

Good for HTTP use cases that require static IP addresses

Good for HTTP use cases that required deterministic, fast regional failover and good performance

Back 218

Global Accelerator

Front 219

Great to route users to the closest deployment with least latency

Great for disaster recovery strategies

Domain Registration, DNS, Health Checks, Routing Policy

Back 219

Global DNS: Route 53

Front 220

Replicate part of your application to AWS Edge Locations - decrease latency

Cache common requests - improved user experience and decreased latency

Integrates WAF & Shielf to protect against web attacks

Back 220

Global Content Delivery Network (CDN): CloudFront

Front 221

Accelerate global uploads & downloads into S3

Back 221

S3 Transfer Acceleration

Front 222

Improve global application availability and performance using the AWS global network

Will go through global locations but not cached at

Back 222

AWS Global Accelerator

Front 223

Two patterns of application communication

Back 223

1. Synchronous communications

2. Asynchronous/ Event based

Front 224

Application to application

Can be problematic if there are sudden spikes of traffic

Back 224

Synchronous communications

Front 225

Application to queue to application

Better to decouple apps

Using SQS: queue model

Using SNS: pub/sub model

Using Kineses: real-time data streaming model

Back 225

Asynchronous / Event based Communications

Front 226

Oldest AWS offering (over 10 years old)

Fully managed service (serverless), used to decouple applications

Scales from 1 message per second to 10,000s per second

Default retention of messages: 4 days, max 14 days

No limit to how many messages can be in the queue

Messages deleted after they're read by consumers

Low latency (<10 ms on publish and receive)

consumers share the work to read messages & scale horizontally

Back 226

Amazon SQS (Standard Queue)

Front 227

event publishers only send messages to one SNS topic

as many Event subscribers as we want to listen to the SNS topic notifications

Each subscriber to the topic will get all the messages

Up to 10mil subscriptions per topic/ 100k topics limit

Back 227

Amazon SNS

Front 228

SNS Subscribers can be:

Back 228

1. HTTP/HTTPS (with delivery retries - how many times)

2. Emails, SMS messages, Mobile Notifications

3. SQS queues (fan-out pattern), Lambda functions (write-your-own integration)

Front 229

Queue service in AWS

Multiple Producers, messages kept up to 14 days

Multiple COnsumers share the read and delete messages when done

Used to decouple applications

Pull-based system

Back 229

SQS (standard queue)

Front 230

Notification service in AWS

Subscribers : email, Lambda, SQS, HTTP, Mobile

Multiple Subscribers: send messages to all of them

No message retention

Push-based system

Back 230

SNS

Front 231

metrics for every service in AWS

metrics have timestamps

can create CloudWatch dashboards of metrics

Back 231

Amazon CloudWatch Metrics

Front 232

variable to monitor (CPU Utilization, NetworkIN)

ex: Billing (us-east-1)

Back 232

metric

Front 233

Important metrics

Back 233

EC2 instances

EBS volumes

S3 Buckets

Billing

Service Limits

Custom metrics

Front 234

CPU Utilization, Status Checks, Network (not RAM)

Default metrics every 5 min

Option for Detailed Monitoring ($$$): metrics evert 1 min

Back 234

EC2 Instance Metrics

Front 235

Disk read/writes

Back 235

EBS Volumes Metrics

Front 236

BucketSizeBytes

NumberOfObjects

AllRequests

Back 236

S3 Buckets Metrics

Front 237

Total Estimated Charge (only in us-east-1)

Back 237

Billing metric

Front 238

How much you've been using a service API

Back 238

Service Limits Metrics

Front 239

Push your own metrics

Back 239

Custom metrics

Front 240

used to trigger notifications for any metric

various options (sampling, %, max, min, etc)

Can choose period on which to evaluate an alarm

Ex: create a billing alarm on the CloudWatch Billing metric

Back 240

Amazon CloudWatch Alarms

Front 241

Alarms actions

Back 241

Auto Scaling

EC2 Actions

SNS Notifications

Front 242

Increase or decrease EC2 instances "desired" count

Back 242

Auto Scaling actions

Front 243

stop, terminate, reboot, or recover an EC2 instance

Back 243

EC2 Actions

Front 244

Send notification into SNS topic

Back 244

SNS notifications

Front 245

Alarm states

Back 245

OK

Insufficient data - not enough data

ALARM - bad

Front 246

logs can collect log from:

Elastic Beanstalk

ECS

AWS Lambda

CloudTrail

CloudWatch

enables real-time monitoring of logs

Adjustable CloudWatch Logs retention

Back 246

Amazon CloudWatch Logs

Front 247

collection of logs from application

Back 247

Elastic Beanstalk Log

Front 248

Collection from containers

Back 248

ECS Log

Front 249

Collection from function logs

Back 249

AWS Lambda Logs

Front 250

log Based on filter

Back 250

CloudTrail Logs

Front 251

on EC2 machines or on-premises servers

Back 251

CloudWatch log agents

Front 252

Log DNS Queries

Back 252

Route53 logs

Front 253

log agent can be setup on-premises too

Make sure IAM permissions are correct

By default, no logs from EC2 instance will go to CloudWatch

Need to run CloudWatch agent on EC2 to push the log files you want

Back 253

CloudWatch Logs for EC2

Front 254

Schedule: Cron jobs (scheduled scripts)

Event Pattern: event rules to react to a service doing something

Trigger lambda functions, send SQS/SNS messages

Back 254

Amazon CloudWatch Events

Front 255

next evolution of CloudWatch Events

Back 255

Amazon EventBridge

Front 256

Default event bus

Back 256

generated by AWS services (CloudWatch Events)

Front 257

Partner event bus

Back 257

receive events from SaaS service or applications (Zendesk, Datadog, Segment, Auth0)

Front 258

Custom Event buses

Back 258

for your own applications

Front 259

Schema Registry

Back 259

model event schema

Front 260

Provides governance, compliance and audit for your AWS Account

Enabled by default

Get a history of events/API calls made within your AWS Account by:

Console

SDK

CLI

AWS Services

Can put logs from CloudTrail into CloudWatch Logs or S3

A trail can be applied to All Regions (default) or a single Region

If resource deleted in AWS, investigate CloudTrail first

Back 260

AWS CloudTrail

Front 261

Debugging in Production

Test locally

Add log statements everywhere

Re-deploy in production

Log formats differ across applications

No common views of entire architecture

Debugging: one big (easy), distributed services (hard)

Back 261

AWS X-Ray

Front 262

Troubleshooting performance (bottlenecks)

Understand dependencies in a microservice architecture

Pinpoint service issues

Review request behavior

Find errors and exceptions

Identify users that are impacted

Are we meeting time SLA?

Where am I throttled?

Back 262

AWS X-Ray Advantages

Front 263

Shows all regions, all services health

Shows historical information for each day

Has an RSS feed you can subscribe to

Back 263

AWS Status - Service Health Dashboard

Front 264

Provides alerts and remediation guidance when AWS is experiencing events that may impact you

personalized view into the performance and availability of the AWS services underlying your AWS resources

displays relevant and timely information to help you manage events in progress and provides proactive notification to help you plan for scheduled activities

shows how AWS outages directly impact you & your AWS resources

Alert, remediation, proactive, scheduled activities

Back 264

AWS Personal Health Dashboard

Front 265

monitor the performance of AWS services and billing metrics

Back 265

CloudWatch Metrics

Front 266

Automate notification, perform EC2 action, notify to SNS based on metric

Trigger notifications when metrics reach specific threshold

Back 266

CloudWatch Alarms

Front 267

Collect log files from EC2 instances, servers, Lambda functions

Single, highly scalable service that centralizes logs from all of your systems, apps, and AWS services

Back 267

CloudWatch Logs

Front 268

React to events in AWS or trigger a rule on a schedule

Back 268

CloudWatch Events (EventBridge)

Front 269

Audit API calls made within your AWS account

Inspect, audit, record events and API calls made within AWS account

Back 269

CloudTrail

Front 270

Trace requests made through your distributed applications

Help analyze and debug production as well as distributed applications

Back 270

X-Ray

Front 271

Status of all AWS services across all regions

Back 271

Service Health Dashboard

Front 272

AWS events that impact your infrastructure

Back 272

Personal Health Dashboard

Front 273

Private network to deploy your resources (regional resource)

Back 273

VPC (Virtual Private Cloud)

Front 274

Allow you to partition your network inside your VPC (AZ resource)

Back 274

Subnets

Front 275

subnet that is accessible from the internet

Back 275

Public subnet

Front 276

Subnet that is not accessible from the internet

Back 276

Private subnet

Front 277

to define access to the internet and between subnets, we use

Back 277

Route Tables

Front 278

help our VPC instances connect with the internet

Public Subnets have a route to

Back 278

Internet Gateway

Front 279

Allows instances in your private subnets to access the internet while remaining private

Back 279

NAT Gateways (AWS managed)

NAT Instances (self-managed)

Front 280

Firewall which controls traffic from and to subnet

Can have ALLOW and DENY rules

Attached at the Subnet level

Rules only include IP addresses

Process rules in number order

Is stateless: return traffic must be explicitly allowed by rules

Automatically applies to all instances in the subnets it's associated with

Back 280

NACL (Network ACL)

Front 281

A firewall that controls traffic to and from an ENI/EC2 instance

Can only have ALLOW rules

Rules include IP addresses and other security groups

Evaluate all rules before allowing traffic

Operates at the Instance level

Applies to an instance only if someone specified the SG when launching the instance

Back 281

Security Groups

Front 282

Capture information about IP Traffic going into your interfaces

Helps monitor and troubleshoot connectivity issues

-subnets to internet

-subnets to subnets

-internets to subnets

Captures network infor from AWDS managed interfaces

Data can go to S3/CloudWatch Logs

Back 282

VPC Flow Logs

Subnet Flow Logs

Elastic Network Interface Flow Logs

Front 283

Connect 2 VPC privately using AWS network

Behave as if they were in the same network

Must not have overlapping CIDR (IP address range)

Connection is not transitive - must be established for each VPC that need to communicate with one another

Back 283

VPC Peering

Front 284

allow you to connect to AWS services using a private network instead if the public www network

enhanced security and lower latency to access AWS services

Back 284

VPC Endpoints

Front 285

VPC Endpoint Gateway

Back 285

S3& DynamoDB

Front 286

VPC Endpoint Interface:

Back 286

the rest

Front 287

Connect on-premises VPN to AWS

Connection is automatically encrypted

Goes over the public internet

Limited bandwidth, security concerns

Back 287

Site to Site VPN

Front 288

Establish a physical connection between on-premises and AWS

Connection is private, secure, and fast

Goes over a private network

Takes at least a month to establish

Back 288

Direct Connect (DX)

Front 289

must use a customer Gateway (CGW)

Back 289

Site-to-site VPN On-premises

Front 290

must use a Virtual Private Gateway (VPG)

Back 290

Site-to-site VPN AWS

Front 291

works with direct connect gateway, VPN connections

For having transitive peering between thousands of VPC and on-premises, hub-and-spoke (star) connection

Back 291

Transit Gateway

.

Front 292

logically isolated from other virtual networks, can launch AWS resources in a private network that you define

Back 292

Virtual Private Cloud

Front 293

tied to an AZ, network partition of the VPC

Back 293

Subnets

Front 294

at the VPC level, provide internet access

horizontally scaled, redundant, highly available VPC component that allows communication between VPC and internet

Back 294

Internet Gateway

Front 295

give internet access to private subnets

Back 295

NAT Gateway/Instances

Front 296

stateless, subnet rules for inbound and outbound

Back 296

NACL

Front 297

stateful, operate at the EC2 instance level or ENI

Back 297

security groups

Front 298

connect 2 VPC with non overlapping IP ranges, non-transitive

Back 298

VPC Peering

Front 299

Provide private access to AWS services within VPC

Back 299

VPC ENdpoints

Front 300

network traffic logs

Back 300

VPC flow logs

Front 301

VPN over public internet between on-premises DC and AWS

Back 301

Site to Site VPN

Front 302

direct private connection to AWS (physical connection)

Back 302

Direct Connect

Front 303

Connect 1000s of VPC and on-premises networks together

Back 303

Transit Gateway

Front 304

Protecting infrastructure (hardware, software, facilities, and networking) that runs all AWS services

Managed services like S3, DynamoDB, RDS, etc.

Back 304

AWS Responsibility Security OF the Cloud

Front 305

For EC2 instance, customer is responsible for management of the guest OS (including security patches and updates), firewall & network configuration, IAM

Encrypting application data

Back 305

Customer Responsibility - Security IN the Cloud

Front 306

Patch management

Config management

Awareness and training

Back 306

Shared controls for Security

Front 307

Manage the underlying EC2 instance, disable SSH access

Automated DB patching

Automated OS patching

Audit the underlying instance and disks & gurantee it functions

Back 307

AWS Responsibility for RDS

Front 308

Check ports/IP/security group inbound rules in DBs SG

In-database user creation and permissions

Creating a database with or without public access

Ensure parameter groups or DB is configured to only allow SSL connections

Database encryption setting

Back 308

Customer responsibility for RDS

Front 309

Guarantee you get unlimited storage

Guarantee you get encryption

Ensure separation of the data between different customers

Ensure AWS employees can't access your data

Back 309

AWS Responsibility for S3

Front 310

Bucket Configuration

Bucket policy/public settings

IAM user and roles

Enabling encryption

Back 310

Customer responsibility for S3

Front 311

protects against DDOS attack for your website and applications, for all customers at no additional cost

Back 311

AWS Shield Standard

Front 312

24/7 premium DDOS protection

Back 312

AWS SHield Advanced

Front 313

Filter specific requests based on rules

Back 313

AWS WAF

Front 314

availability protection using global edge network

Combined with AWS Shield, provides attack mitigation at the edge

Back 314

CloudFront and Route53

Front 315

What is a DDOD

Back 315

Distributed Denial-of-Service attack

Front 316

Free service activated for every AWS customer

Provides protection from attacks like SYN/UDP floods, Reflection attacks and other layer 3/layer 4 attacks

Back 316

AWS Shield Standard

Front 317

Option DDOS mitigation service ($3k per month per org)

Protect against more sophisticated attack on EC2, ELB, CloudFront, global accelerator, Route 53

24/7 access to AWS DDOS response team (DRP)

Protect against higher fees during usage spikes due to DDOS

Back 317

AWS Shield Advanced

Front 318

Protects your web apps from common web exploits (layer 7)

Layer 7 is HTTP (vs Layer 4 is TCP)

Deploy on Application Load Balancer, API Gateway, CloudFront

Back 318

AWS Web Application Firewall (WAF)

Front 319

Rules can include IP addresses, HTTP headers, HTTP body, or URI strings

Protects from common attack - SQL injection, Cross-Site Scripting (XSS)

Size constraints, geo-match (block countries)

Rate-based rules (to count occurrences of events) - for DDOS protection

Back 319

Web Access Control List (WACL)

Front 320

AWS customers can carry out penetration tests against their AWS infrastructure without prior approval for 8 services:

Back 320

1. EC2 instances, NAT Gateways, ELBs

2. RDS

3. CloudFront

4. Aurora

5. API Gateways

6. Lambda and Lambda Edge functions

7. Lightsail resources

8. Elastic Beanstalk environments

Front 321

Prohibited activities for penetration tests

Back 321

1. DNS zone walking via Route 53 Hosted Zones

2. DOS, DDOS, simulated DOS, simulated DDOS

3. Port flooding

4. Protocol flooding

5. Request flooding (login request flooding, API request flooding)

Front 322

encryption for AWS service

AWS manages software for encryption

Back 322

AWS Key Management Service (KMS)

Front 323

Encrypt volumes

Back 323

EBS Volumes

Front 324

Server-side encryption of objects

Back 324

S3 Buckets

Front 325

encryption of data

Back 325

Redshift database/EFS drives

Front 326

Encryption Opt-in

Back 326

EBS Volumes

S3 buckets

Redshift database

EFS drives

Front 327

Encryption Automatically Enabled for:

Back 327

cloudTrail logs

S3 Glacier

Storage Gateway

Front 328

AWS provisions encryption hardware

you manage your own encryption keys

Dedicated hardware (HSM) - tamper resistant, FIPS 140-2 Level 3 compliance

Back 328

CloudHSM

Front 329

3 types of KMS Keys

Back 329

1. Customer Manager CMK

2. AWS managed CMK

3. CloudHSM Keys (custom keystore)

Front 330

Create, manage and use, can enable/disable

Possibility of rotation policy (new key generated every year, old key preserved)

Possibility to bring-your-own-key

Back 330

Customer Manager CMK

Front 331

Used by AWS service (S3, EBS, Redshift)

Managed by AWS

Back 331

AWS managed CMK

Front 332

Keys generated from your own CloudHSM hardware device

Cryptographic operations are performed within the CloudHSM cluster

Back 332

CloudHSM Keys (custom keystore)

Front 333

Newer service, meant for storing secrets

Capability to force rotation of secrets every X days

Automate generation of secrets on rotation (uses Lambda)

Integration with RDS (MySQL, PostgreSQL, Aurora)

Secrets are encrypted using KMS

Mostly meant for RDS integration

Back 333

AWS Secrets Manager

Front 334

portal that provides customers with on-demand access to AWS compliance documentation and AWS agreements

Back 334

AWS Artifact

Front 335

allows you to download AWS security and compliance documents, like AWS ISO certifications, Payment Card Industry (PCI), and SYstem and Organization Conteol (SOC) reports

Back 335

Artifacts Reports

Front 336

allows you to review, accept, and track the status of AWS agreements such as the Busienss Associate Addendum (BAA)

Can be used to support internal audit or compliance

Back 336

Artifacts Agreement

Front 337

Intelligent Threat discovery to protect AWS account

uses ML algorithms, anomaly detection, 3rd party data

One click to enable (30 day trial), no need to install software

Can set up CloudWatch Event rules to be notified in case of findings

CloudWate events rules can target Lambda or SNS

Back 337

Amazon Guard Duty

Front 338

Input data for GuardDuty inclides:

Back 338

1. CloudTrail Logs: unusual API calls, unauthorized deployments

2. VPC Flow Logs: unusual internet traffic, unusual IP address

3. DNS Logs: compromised EC2 instances sending encoded data within DNS queries

Front 339

automated security assessments for EC2 instances

Analyze the running OS against known vulnerabilities

analyze against unitended network accessibility

must be installed on OS in EC2 instances

After assessment, you get a report with list of vulnerabilities

Back 339

Amazon Inspector

Front 340

Helps with auditing and recording compliance of your AWS resources

Helps record configurations and changes over time

Possibility of storing the configuration data into S3 (analyzed by Athena)

Can receive alerts for any changes

Per-region service

can be aggregated across regions and accounts

Back 340

AWS Config

Front 341

Is there unrestricted SSH access to my security groups?

Do my buckets have any public access?

How has my ALB configuration changed over time?

Back 341

Questions that can be solved by AWS Config

Front 342

View compliance of a resoirce over time

View configuration of a resource over time

View CloudTrail API calls if enabled

Back 342

AWS Config Resource

Front 343

Fully managed data security and data privacy service that uses ML and pattern matching to discover and protect your sensitive data in AWS

Helps identify and alert you to sensitive data, such as PII

Back 343

Amazon Macie

Front 344

Responsible for firewall and network config

Server-side encryption

Client-side data protection

Customer data protection

Back 344

Customer responsibility for Security

Front 345

Get access to compliance reports such as PCI, ISO

Back 345

Artifact

Front 346

Find malicious behavior with VPC, DNS, CloudTrail logs

Threat Detection service

Back 346

GuardDuty

Front 347

For EC2 only, install agent and find vulnerabilities

Back 347

Inspector

Front 348

Track config changes and compliance against rules

Back 348

Config

Front 349

Find sensitive data in S3 buckets

Back 349

Macie

Front 350

Track API calls made by users within account

Back 350

CloudTrail

Front 351

Find objects, people, text, scenes in images and videos using ML

Facial analysis and facial search to do user verification, people counting

Create a database of "familiar faces" or compare against celebrities

Use cases:

Labeling

Content moderation

text detection

face detection and analysis

face search and verification

Celebrity recognition

Pathing (sports game analysis)

Back 351

Amazon Rekognition

Front 352

Automatically convert speech to text

Uses deep learning process called automatic speech recognition (ASR) to convert speech to text quickly and accurately

Use cases:

Transcribe customer calls

Automate closed captioning and subtitling

Generate metadata for media assets to create a fully searchable archive

Back 352

Amazon Transcribe

Front 353

Turn text into lifelike speech using deep learning

Allow you to create applications that talk

Back 353

Amazon Polly

Front 354

Natural and accurate language translation

Allows you to localize content - such as websites and apps - for international users and easily translate large volumes of text efficiently

Back 354

Amazon Translate

Front 355

Same technology that powers Alexa

ASR to convert speech to text

Natutal language understanding to recognize the intent of text, callers

Helps build chatbots, call center bots

Can be used as a stand-alone service

Back 355

Amazon Lex

Front 356

Receive calls, create contact flows, cloud-based virtual contact center

Can integrate with other CRM systems or AWS

Back 356

Amazon Connect

Front 357

for NLP

Fully managed and serverless service

Use ML to find insights and relationships in text

Language of text

Extracrs key phrases, people, places, brands or events

Understands how positive or negative the text is

Analyzes text using tokenization and parts of speech

Automatically organizes a collection of text files by topic

USe cases:

analyze customer interactions to find what leads to pos/neg experience

Create and group articles by topics that comprehend will uncover

Back 357

Amazon Comprehend

Front 358

Fully managed service for developers/data scientists to build ML models

Typically difficult to do all processes in one place and provision servers

Back 358

Amazon Sage Maker

Front 359

Global service

Allows you to manage multiple AWS accounts

Main account is master account

Cost benefits

API available to automate AWS account creation

Restrict account privileges using Service Control Policies (SCP)

Back 359

AWS Organizations

Front 360

Consilidated billing across all accounts - single payment method

PRicing benefits from aggregated usage (volume discount for EC2, S3)

Pooling of Reserved EC2 instances for optimal savings

Back 360

Cost benefits of AWS Organizations

Front 361

Create accounts per department, per cost center, per enviornment, based on regulatory restrictions (using SCP) for better resource isolation (ex:VPC) to have separate per-account service limits, isolated account for logging

Multi Account v One Account Multi VPS

Use tagging standards for billing purposes

Enable CloudTrail on all accounts, send logs to central S3 account

Back 361

Multi Account Strategies

Front 362

4 pricing models in AWS

Back 362

1. Pay as you go

2. Save when you reserve

3. Pay less by using more

4. Pay less as AWS grows

Front 363

pay for what you use, remain agile, responsive, meet scale demands

Back 363

Pay as you go

Front 364

Minimize risks, predictably manage budgets, comply with long-term requirements

Back 364

Save when you reserve

Front 365

volume-based discounts

Back 365

pay less by using more

Front 366

Free services in AWS

Back 366

IAM

VPC

Consolidated billing

Elastic beanstalk (pay for resources created)

CloudFormation (pay for resources created)

AutoScaling Groups (pay for resources created)

Front 367

Free tier in AWS

Back 367

EC2 t2.micro instance for a year

S3, EBS, ELB, AWS Data transfer

Front 368

only charged for what you use

Number of instances

Instance configuration

ELB running time and amount of data processed

Detailed monitoring

Back 368

Compute Pricing - EC2

Front 369

Physical capacity

Region

OS and software

Instance type

Instance size

Back 369

Instance configuration

Front 370

Minimum of 60s

Pay per second (Linux)

Pay per hour (Windows)

Back 370

EC2 On-Demand Instance pricing

Front 371

Up to 75% discount compared to on-demand hourly rate

1 or 3 year commitment

all upfront, partial, no upfront

Back 371

Reserved instance pricing

Front 372

up to 90% discount compared to On-demand on hourly rate

Bid for unused capacity

Back 372

Spot instances

Front 373

Up to 72% discount compared to ON-demand hourly rate

Commit to usage of individual instance families in a region ($ per hour)

Regardless of AZ, size, OS, or tenancy

1 or 3 year commitment

all upfront, partial, no upfront

Back 373

Savings Plans

Front 374

On-demand

Reserved

Savings plans

Back 374

Dedicated host

Front 375

Pay per call

Pay per duration

Back 375

Lambda Pricing

Front 376

EC2 Launch Type midel

No additional fees, you pay for resources stored and created in your application

Back 376

ECS

Front 377

Fargate Launch Type Model

Pay for vCPU and memory resources allocated to your applications in your containers

Back 377

Fargate

Front 378

S3 Standard

S3 IA

S3 OZ IA

S3 Intelligent Tiering

S3 Glacier

S3 Glacier Deep Archive

Back 378

Storage classes

Front 379

Storage class

Number and size of objects: price can be tiered (based on volume)

Number and type of reauests

Data transfer OUT of the S3 region

S3 Transfer acceleration

Lifecycle transitions

Similar service: EFS (pay per use, has infrequent access and lifecycle rules)

Back 379

S3 Storage Pricing

Front 380

Volume type (based on performance)

Storage volume in GB per month provisioned

IOPS

Snapsots -0 added data cost per GB per month

Data tranfer - outbount tiered for volume discounts

(inbound is free)

Back 380

EBS Storage Pricing

Front 381

General Purpose SSD: included

Provisioned IOPS SSD: provisioned amount in IOPS

Magnetic: Number of requests

Back 381

IOPS

Front 382

Per hour billing

Database characteristice (engine, size, memory class)

Purchase type (on-demand, reserved with required up front)

Backup storage - no additional charge up to 100% of total DB storage for a region

Additional storage - per GB per month

Number of input/outout requests per month

Deployment type (Storage and I/O are variable) - single AZ/ multi AZ

Data transfer - outbount tiered for volume discounts (inbound is free)

Back 382

RDS Database pricing

Front 383

pricing is different across geographic regions

Aggregated for each edge location, then applied to bill

Data transfer out (volume discount)

Number of HTTP/HTTPS requests

Back 383

Content Delivery - CloudFront pricing

Front 384

Use Private IP instead of Public IP for good savings and better network performance

Use same AZ for max savings (at cost of high availability)

Back 384

Networking Costs per GB

Front 385

estimating costs in the cloud

Back 385

TCO Calculator

Simple Monthly Calculator

Front 386

Tracking costs in the cloud

Back 386

Billing dashboard

Cost allocation tags

Cost and usage reports

Cost explorer

Front 387

Monitoring against cost plans

Back 387

billing alarms

budgets

Front 388

allow you to estimate the cost savings when using AWS and provide a detailed set of reports that can be used in executive presentations

compare cost of applications in an on-premises or traditional hosting environment to AWS: server, storage, network, IT labor

Back 388

AWS Total Cost of Ownership Calculator (TCO)

Front 389

how does AWS help reduce TCO

Back 389

by reducing the need to invest in large capital expenditures and providing a pay-as-you-go model

Front 390

points of comparison of On_Premises vs AWS

Back 390

1. server costs

2. storage costs

3. network costs

4. IT labor costs

Front 391

replaced by AWS pricing calculator

Estimate cost for your architecture solution

Back 391

Simple Pricing Calculator

Front 392

Shows cost for the month

Back 392

AWS Billing Dashboard

Front 393

shows usage for each free tier

Back 393

AWS Free Tier Dashboard

Front 394

used to track AWS costs on a detailed level

Back 394

Cost Allocation Tags

Front 395

automatically applied to the resource you create

starts with Prefix aws:

Back 395

AWS Generated tages

Front 396

defined by the user

starts with prefix user:

Back 396

user-defined tags

Front 397

used for organizing resources

EC2: instances, images, load balancers, security groups

RDS, VPC resources, route53, IAM users

resources created by CloudFormation are all tagged the same way

can be used to create Resource Groups

Back 397

Tags

Front 398

create, maintain, and view a collection of resources that share common tags

manage these tags using the tag editor

Back 398

resource groups

Front 399

free naming, common tags

Back 399

Name, Enviornment, Team

Front 400

contains most comprehensive set of AWS cost and usage data available, including additional metadata about services, pricing, and reservations (ex: EC2 Reserved Instances)

Lists AWS usage for each service category used by an account and its IAM users in hourly or daily line items, as well as any tags that you have activated for cost allocation purposes

Can be integrated with Athena, Redshift, or QuickSight

Back 400

Cost & Usage Reports

Front 401

Visualize, understand, and manage your AWS costs and usage over time

Create custom reports to analyze cost and usage data

analyze data at high level: total costs and usage across all accounts

Choose an optimal savings plan (to lower prices on your bill)

Forecast usage up to 3 months based on previous usage

Back 401

Cost Explorer

Front 402

for actual cost, not projected costs

intended as a simple alarm (not as powerful as AWS Budgets)

data for overall worldwide AWS costs

metric stored in us-east-1

Back 402

Billing alarms in CloudWatch

Front 403

create budget and send alarms when costs exceeds budget

3 types of budgets: usage, cost, reservation

up to 5 SNS notifications per budget

same options as AWS Cost Explorer

2 budgets are free, then $0.02/day/budget

Can filter by: service, linked account, tag, purchase option, instance type, region, AZ, API operation

For reserved instances:

track utilization, supports EC2 / elasticache /rds /redshift

Back 403

AWS Budgets

Front 404

no need to install - high level AWS account assessment

analyze AWS accounts and provides recommendation:

cost optimization

performance

security

fault tolerance

service limits

core checks and recommendations - all customers

can enable weekly email notification from the console

Back 404

trusted advisor

Front 405

ability to set CloudWatch alarms when reaching limits

programmatic access using AWS support API

Back 405

Full Trusted Advisor

Front 406

low utilization EC2 instances, idle load balancers, under-utilized EBS volumes

Reserved instances and savings plans optimizations

Back 406

Trusted advisor checks - cost optimizations

Front 407

High utilization EC2 instances, CloudFront CDN optimizations

EC2 to EBS throughout optimizations, alias records recommendations

Back 407

trusted advisor checks - performance

Front 408

MFA enabled on Root Account, IAM key rotation, exposed Access Keys

S3 Bucket Permissions for public access, sedcurity groups with unrestricted ports

Back 408

trusted advisor checks - Security

Front 409

EBS snapshots age, AZ balance

ASG multi AZ, RDS multi AZ, ELB configuration

Back 409

Trusted advisor checks - fault tolerance

Front 410

trusted advisor checks

Back 410

cost optimizations

performance

security

fault tolerance

service limits

Front 411

Free

Customer Service & communities - 24x7 access to customer service, documentation,whitepapers, and support forums

Trusted Advisor - Access to 7 core trusted advisor checks and guidance to provision resources following best practives to increase performance and improve security

Personal Health Dashboard - personalized view of health of AWS services and alerts when resources impacted

Back 411

Basic Support Plan

Front 412

All basic support plan +

Business hours email access to Cloud Support Associates

Unlimited cases / 1 primary contact

Case severity/response times:

general guidance: < 24 hours

system impaired: < 12 hours

Back 412

Developer support plan

Front 413

intended to be used if you have production workloads

Trusted advisor - full set of checks + API access

24x7 phone, email, chat access to Cloud Support Engineers

unlimited cases/unlimited contacts

access to infrastrucure event management - for additional fee

case severity/response times:

general guidance: <24 hours

system impaired:: <12 hours

Production system impaired: <4 hours

production system down: < 1 hour

Back 413

Bussiness Support Plan

Front 414

Intended for use if you have mission critical workloads

All of business support plan +

access to a technical account manager (TAM)

Concierge support team (for billing and account best practices)

Infrastructure Event Management, Well-architected & Operations reviews

case severity/response times:

business critical system down: < 15 min

Back 414

Enterprise Support Plan

Front 415

operate multiple accounts using Organizations

use SCP to restrict account power

use tags & cost allocation tags for easy management & billing

IAM guidelines: MFA, least-privilege, password policy, password rotation

Config to record all resources configs & compliance over time

CloudFormation to deploy stacks across accounts and regions

Trusted Advisor to get insights, Support Plan adapted to your needs

Send service logs and access logs to S3 or CloudWatch logs

CloudTrail to record API calls made within your account

If account compromised: change root password, delete and rotate all pww/keys, contact AWS support

Back 415

Account Best practices

Front 416

plan move from on-premises to aws, cost savings

Back 416

TCO calculator

Front 417

cost of services on AWS

Back 417

pricing calculator

Front 418

high level overview + free tier dashboard

Back 418

billing dashboard

Front 419

tag resources to create details on reports

Back 419

cost allocation tags

Front 420

most comprehensive billing dataset

Back 420

cost & usage reports

Front 421

view current usage (detailed) and forecast usage

Back 421

cost explorer

Front 422

in us-east-1

track overall and per-service billing

Back 422

billing alarms

Front 423

more advanced

track usage, costs, RI, and get alerts

Back 423

Budgets

Front 424

identity for your Web and Mobile application users (potentially millions)

instead of creating them an IAM user

Back 424

Amazon Cognito

Front 425

found on any Windows server with AD Domain services

database of objects: user accounts, computers, printers, file shares, security groups

centralized security management, create account, assign permissions

Back 425

Microsoft Active Directory

Front 426

AWS Managed Microsoft AD

Create your own AD in AwS, manage users locally, supports MFA

establish "trust" connections with your on-premise AD

Back 426

AWS Directory Services

Front 427

Directory Gateway(proxy) to redirect to on-premise AD

users are managed on the on-premise AD

Back 427

AD Connector

Front 428

AD-compatible managed directory on AWS

cannot be joined with on-premise AD

Back 428

Simple AD

Front 429

centrally manage SSO to access multiple accounts and 3rd party business applications

integrated with AWS organizations

supports SAML 2.0 markup

Integration with on-premise AD

Back 429

AWS SSO

Front 430

Identity and Access Management inside your account

for users that you trust and belong to your company

Back 430

IAM

Front 431

manage multiple AWS accounts

Back 431

organizations

Front 432

create a database of users for your mobile and web applications

Back 432

Cognito

Front 433

integrate microsfot AD in aws

Back 433

Directory services

Front 434

one login for multiple aws accounts & applications

Back 434

SSO

Front 435

stop guessing your capacity needs - use ASG based on demand

test systems at production scale

automate to make architectural experimentation easier

allow for evolutionary architectures - design based on changing requirements

drive architectures using data

improve through game days - simulate apps for flash sale days

Back 435

Well architected framework general guiding principles

Front 436

scalability

disposable resources

automation: serverless, infrastructure as a service, auto scaling

Loose coupling

services, not servers

Back 436

AWS Cloud Best practices

Front 437

well-architected framework 5 pillars

Back 437

1. Operational Excellence

2. Security

3. Reliability

4. Performance Efficiency

5. Cost Optimization

Front 438

ability to run and monitor systems to deliver business value and to continually improve supporting processes and procedures

Back 438

operation excellence

Front 439

perform operations as code - infrastructure as code

annotate documentation - automate creation of annotated documentation after every build

make frequent, small, reversible changes

refine operations procedures frequently

anticipate failure

learn from all operational failures

Back 439

design principles for operational excellence

Front 440

Prepare

- AWS cLoudFormation, AWS Config (evaluate compliance)

Operate

- AWS CloudFormation, Config, CloudTrail, CloudWatch, X-Ray

Evolve

- CloudFormation, CodeBuild, CodeCommit, CodeDeploy, CodePipeline

Back 440

Operational excellence AWS Services

Front 441

ability to protect information, systems, and assets while deliverying business value through risk assessments and mitigation strategies

Back 441

Security

Front 442

Implement a strong identity foundation - centralize privilege management and reduce reliance on long-term credentials - Principle of least privilege - IAM

Enable traceability - integrate logs and metrics with systems to automatically respond and take action

Apply security at all layers - edge network, VPC, subnet, load balancer, every instance, OS

Automate security best practices

Protect data in transit and at rest - encryption, tokenization, and access control

Keep people away from data - reduce or eliminate the need for direct access or manual processing of data

Prepare for security events - run incident response simulations and use tools with automation to increase your speed for detection, investigatoin and recovery

Back 442

Security Design Principles

Front 443

Identity and Access Management

- IAM, AWS-STS, MFA Token, Organizations

Detective Controls

- Config, CloudTrail, CloudWatch

Infrastructure Protection

-CloudFront, VPC, Shield, WAF, Inspector

Data Protection

-KMS, S3, ELB, EBS, RDS

Incident Response

- IAM, CloudFormation, CloudWatch Events

Back 443

Security AWS Services

Front 444

ability of a system to recover from infrastructure or service disruptions dynamically acquire computing resources to meet demand, and mitigate disruptions such as misconfigurations or transient network issues

Back 444

Reliability

Front 445

Test recovery procedures - use automation to simulate different failures

Automatically recover from failure - anticipate and remediate failures before they occur

Scale horizontally to increase aggregate system availability - distribute request across multiple, smaller resources to ensure they don't share a common point of failure

Stop guessing capacity - maintain optimal level to satisfy demand - use auto scaling

Manage change in automation - use automation to make changes to infrastructure

Back 445

Reliability Design Principles

Front 446

Foundations

-IAM, VPC, Service Limits, Trusted Advisor

Change Management

- AWS Auto Scaling, CloudWatch, CloudTrail, Config

Failure Management

-Backups, CloudFormation, S3, S3 Glacier, Route53

Back 446

Reliability AWS Services

Front 447

Ability to sue computing resources efficiently to meet system requirements, and to maintain that efficiency as demand changes and technology evolves

Back 447

Performance Efficiency

Front 448

Democratize advanced technologies

Go global in minutes - easy deployment in multiple regions

Use serverless architectures - avoid burden of managing servers

Experiment more often - easy to carry out comparative testing

Mechanical sympathy - be aware of all AWS services

Back 448

Performance Efficiency design principles

Front 449

Selection

-Auto scaling, Lambda, EBS, S3, RDS

Review

-CloudFormation, News Blog

Monitoring

-CloudWatch, Lambda

Tradeoffs

-RDS, Elasticache, Snowball, CloudFront

Back 449

Performance efficiency AWS services

Front 450

ability to run systems to deliver business value at the lowest price point

Back 450

cost optimization

Front 451

adopt a consumption mode - pay only for what you use

Measure overall efficiency - use CloudWatch

Stop sending money on data center operations - AWS does infrastructure enabling customers to focus on organization projects

Analyze and attribute expenditure - accurate identification of system usage and costs, helps measure return on investment - use tags

Use managed and application level services to reduce cost of ownership - as managed services operate at cloud scale, they can offer a lower cost per transaction or service

Back 451

cost optimizations design principles

Front 452

Expenditure Awareness

-Budgets, Cost & Usage Report, Cost Explorer, RI Reporting

Cost-Effective Resources

-Spot instances, reserved, S3 Glacier

Matching supply and demand

-Auto Scaling, Lambda

Optimizing Over Time

-Trusted Advisor, Cost & Usage Report

Back 452

Cost Optimization AWS Services

Front 453

AWS Ecosystem Free resources

Back 453

Blogs

Forums

Whitepapers & Guides

Quick Starts

-automates gold-standard deployments in the Cloud

-WordPress on AWS

-Leverages CloudFormation

Solutions

-Vetted Technology solutions for the AWS Cloud

-Ex: Landing Zone: secure, multi-account environment

Front 454

digital catalog with thousands of software listings from independent software vendors (3rd party)

Ex: Custom AMI (custom OS, firewalls, technical solutions), CloudFormation templates, Software as a Service, Containers

Goes into AWS bill

Can sell your own solutions on the Marketplace

Back 454

AWS Marketplace

Front 455

AWS Digital and Classroom Training

Private Training (for your org)

Training and certificatoin for the US Gov

Training and certification for Enterprise

Academy - help universities teach AWS

Online teacher

Back 455

AWS Training

Front 456

global team of experts

work alongside your team and chosen member of APN

Back 456

AWS Professional Services

Front 457

APN

Back 457

AWS Partner Network

Front 458

providing hardware, connectivity, and software

Back 458

APN Technology Partners

Front 459

Professional services firm to help build on AWS

Back 459

APN Consulting Partners

Front 460

find who can help you learn AWS

Back 460

APN Training Partners

Front 461

AWS competencies are granted to an APN Partners who have demonstrated technical proficiency and proven customer success in specialized solution areas

Back 461

AWS Competency Program

Front 462

cables, routers, servers connected

Back 462

network

Front 463

forwards data packets between networks

Back 463

router

Front 464

takes packet and sends to correct server/client

Back 464

switch

Front 465

pay for rent for data center

pay for power supply, cooling, maintenance

hardware costs

scaling is limited

pay team to monitor infrastructure

Back 465

Problems with Traditional IT

Front 466

on-demand delivery of computer power, DB, storage, IT resources, pay as you go pricing

Back 466

Cloud computing

Front 467

used by single org, complete control, specific needs

Back 467

private cloud

Front 468

AWS, azure, google, owned and operated by 3rd party

Back 468

public cloud

Front 469

5 characteristics of cloud computing

Back 469

on-demand self service

broad network access

multi-tenancy and resource pooling

rapid elasticity and scalability

measured service

Front 470

6 advantages of cloud computing

Back 470

trade capital expenditures for operational expenditures

benefit from economies of scale

stop guessing capacity

increased speed and agility

stop spending $ running and maintaining data centers

go global in minutes

Front 471

problems solved by cloud

Back 471

flexibility

cost effectiveness

scalability

elasticity

high availability + fault tolerance

agility

Front 472

3 types of cloud computing

Back 472

Infrastrucute as a Service

- building blocks, highest level of flexibility

Platform as a Service

-deployment, management of apps

Software as a Service

- completed product run and managed by service provider

Front 473

3 Pricing fundamentals`

Back 473

1. Compute - pay for computer time

2. Storage

3. Data transfer OUT of the cloud

Front 474

Examples of IaaS

Back 474

EC2

GCO

Azure

Rackspace

Digital Ocean

Front 475

Examles of PaaS

Back 475

Elastic Beanstalk

Heroku

Google App Engine

Windows Azure

Front 476

Examples of SaaS

Back 476

AWS services

Gmail

Dropbox

Zoom