Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

AWS > Amazon Web Services - CP > Flashcards

Amazon Web Services - CP Flashcards

1
Q

SQS

A

Simple Queue Services

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

S3

A

Simple Storage Service

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

EC2

A

Elastic Compute Cloud

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

CSP

A

Cloud Service Provider

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

X’tics of CSP

A

Multiple Cloud Services…
Which can be chained together to form cloud architectures
Accessible via Single Unified API
Utilized metered billing based on usage
Have rich monitoring built in (AWS CloudTrail)
Have an infrastructure as a Service (IaaS)
Offers automation via infrastructure as code (IaC)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Tier-1 CSPs

A

AWS, Microsoft Azure, Google Platform (GCP), Alibaba Cloud

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Tier-2 (specialization)

A

IBM Cloud, Oracle Cloud, Rackspace (Openstack)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Tier-3 (VPS) offer IaaS

A

Vultr, Digital Ocean, Linode

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Magic Quadrant (MQ)

A

A series of market research reports published by IT consulting firm Gartner that rely on proprietary qualitative data analysis methods to demonstrate market trends, such as direction, maturity and participants.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Cloud services for IaaS

A

Compute
Network
Storage
Databases

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Example of 4 core cloud services

A

Compute - EC2 Virtual machines
Storage - EBS Virtual hard drives
Database - RDS SQL databases
Networking and content delivery - VPC Private Cloud Network

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Dedicated

A

A physical server wholly utilized by a single customer
Guess your capacity
Overpay for an underutilized server
Can’t vertical scale, you need a manual migration
Replacing a server is very difficult
Limited by host’s OS
Results in conflicts in resource sharing
Guaranteed security, privacy and full utility of underlying resources

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

VMs

A

Multiple Virtual machines on one machine.
Hypervisor is software layer that lets you run the VMs.
Physical server shared by multiple customers.
Overpay for an underutilized Virtual Machine.
Limited by your Guest OS.
Multiple apps on a single VM can result in conflicts in resource sharing.
Easy to export or import images for migration.
Easy to vertical or horizontal scale.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Containers

A

VM running multiple containers.
Docker Deamon is the name of the software layer that runs multiple containers
Maximize available capacity, cost-effective
Containers share same underlying OS, thus more efficient than multiple VMs
Multiple apps run side-by-side w/o being limited to the same OS requirements and will not cause conflict during resource sharing.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Functions

A

Managed VMs running managed containers.
Serverless Compute
Upload a piece of code, choose the amount of memory and duration.
Responsible for only code and data.
Very cost-effective, only pay for time code is running, VMs only run when there is code to be executed
Cold Starts is a side-effect of this setup

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q
A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q
A
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Types of Cloud Computing

Software as a Service

For customers

Product that is run and managed by the service provider. eg. salesforce, Office365, gmail

A

SaaS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Types of Cloud Computing

Platform as a Service

For Developers

Focus on the deployment and management of your apps. (Heroku, google app engine)

A

PaaS

Don’t worry about, provisioning, confinguring or understanding the hardw

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Infrastructure as a Service

For administrators

Basic building blocks for cloud IT. Provides access to networking features, computers and data storage space. Eg. Microsoft Azure, AWS, Oracle

A

IaaS

Don’t worry about IT staff, data centers and hardware.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Cloud Computing Deployment Models

Public Cloud

Everything (the workload or project) is build on the CSP. Eg. Dropbox, Startups, SaaS offerings

A

Cloud-Native or Cloud First

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Cloud Computing Deployment Models

Private Cloud

Everything built on company’s data centers. Eg. public sector like government, hospitals, insurance companies.

A

On-Premise or Openstack

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

Cloud Computing Deployment Models

Hybrid

Using both On-Promise and a Cloud Service Provider
Eg. Banks, FinTech, Investment management, Large professional Service providers like Deloitte, Legacy on-premise.

A

Both public and private cloud

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

Cloud Computing Deployment Models

Cross-Cloud

Using multiple Cloud Providers. Eg. Anthos

A

Multi-cloud

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What is computing Power?

Types of computing

The throughput measured at which a computer can complete computational task.

A
  1. General computing (xeon CPU Processor; EC2)
  2. GPU Computing (50x faster than traditional CPUs; AWS Inferentiare (Inf1))
  3. Quantum computing (100 million times faster; AWS Bracket via CalTech)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

Benefits of the cloud

A
  • Agility
  • Pay-as-you go pricing
  • Economy of scale
  • Global Reach
  • Security
  • Reliability
  • High availability
  • Scalabilty
    ** Elasticity*
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What is the AWS Global Infrastructure?

Name the resources

Gobally distributed hardware and datacenters physically networked together.

A
  • 25 Launched Regions
  • 81 Availability zones
  • 108 Direct Connection Locations
  • 275+ Points of presence
  • 11 Local Zone
  • 17 Wavelength Zones
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

Global Infrastrure - Regions

Factors to consider in choosing a region

Geographically distinct locations consisting of 3 Availability Zones (except US-West, 2AZ). New services are avaible first in US-East. All billing information appears in US-EAST-1 (North Virginia). AWS cost varies by region.

A
  1. Regulatory compliance of the region
  2. AWS cost of services in the region
  3. Availability of AWS services in the region
  4. Distance or latency to end-users
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

Availability Zone

Physical location made up of one or more more datacenters. Datacenter is a secured building that contains hundreds of thousands of computers.

A
  1. Datacenters within a region are close enough to provide low-latency (<10ms)
  2. Common practice to run workloads in at least 3 AZs to ensure services remain available in case of one or two datacenters fail. (High Availability)
  3. AZs are shown as a Region Code, followed by a letter identifier eg. US-East-1a

Each region generally contain 3 Availability Zones

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

Subnet is associated with an AZ

Never choose the AZ when launching resources. You choose the Subnet which is associated to the AZ.

A

The US-EAST-1 region has 6AZs (the most AZs of any region)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

Structure of AWS Region

A
  1. Region has multiple AZs
  2. An AZ is made up of one or more datacenters
  3. All Azs in AWS Region are interconnected with high-bandwith, low-latency networking, over fully redundant, dedicated metro fiber providing high-throughput, low-latency networking between
  4. All traffic between AZs is encrypted
  5. AZs are within 100 km (60 miles) of each other.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

Discuss Fault Tolerance with regard to AWS

Scope of fault domain

Fault domain is a section of a network that is vulnerable to damage if a critical device or system fails. The purpose of a fault domain is that if a failure occurs, it will not cascade outside that domain, limiting the damage possible. Fault domains can be nested inside fault domains.
Fault leve is a collection of fault domains.

A
  • specific servers in a rack
  • an entire rack in a datacenter
  • an entire room in a dataceter
  • an entire data center building.

AWS Region would be fault level
AZ would be a fault domain

Scope of fault domain is chosen/defined by Cloud Service Provider like AWS

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

Failure Zone (AZs)

Each Amazon region is designed to be completely isolated from the other Amazon Regions to achieve the greatest possible fault tolerance and stability.

A

AWS version of a Fault domain
1. AZ are physically separated within a typical metropolitan region and are located in lower risk flood plains.
2. Discrete uninterrupted power supply(UPS) and onsite backup generation facilities
3. Data centers located in different AZ are designed to be supplied by independent substations to reduce the risk of an event on the power grid impacting more than one AZ
4. AZ are all redundantly connected to multiple tier-1-transit providers.

Multi-AZ for High Availablitiy: If an application is partitioned across

Each AZ is designated as an independent failure zone

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What is the backbone of AWS?

AWS Global Network

Represent the interconnections between AWS Global Infrastructure. Permits rapid mobility between datacenters.

A

1.Edge locations
2.Amazon CloudFront (CDN)
3.AWS Global accelerator, AWS S3 Transfer Acceleration
4.VPC Endpoints

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Points of Presence (PoP) Resources

Is an intermediate location between an AWS Region and the end user, and this location could be a datacenter or collection of hardware owned by AWS or a trusted partner for content delivery or expediated upload.

A

Edge locations
Regional Edge Caches

Edge locations are datacenters that hold cached (copy) on the most popular files (eg. web pages, images and videos) so that the delivery of distances to the end users are reduced
Regional Edge Locations are datacenters that hold much larger caches of less-popular files to reduce a full round trip and also to reduce the cost of transfer fees.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

Global Infrastructure - Point of Presence (PoP)

Tier 1 Network

Is a network that can reach every other network on the internet without purchasing IP transit or paying for peering.

A

AWS AWs are all redudantly connected to multiple tier-1 transit providers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

Global Infrasture - PoP

AWS services that use PoPs for content delivery or expediated upload

A
  1. Amazon CloudFront is a Content Delivery Network (CDN) service
  2. Amazon S3 Tansfer Acceleration
  3. AWS Global Accelerator
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

Global Infrastructure - PoP

Amazon CloudFront

A
  • You point your website to CloudFront so that it will route requests to nearest Edge Location cache
  • Allows you to choose an origin(such as web-server or storage) that will be source of cached
  • Caches the contents of what origin would return to various Edge Locations around the world.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
39
Q

Global Infrastructure - PoP

Amazon S3 Transfer Acceleration

A

Allows you to generate a special URL that can be used by end users to upload files to a nearby Edge Location.
Once a file is uploaded to an Edge Location, it can move much faster within the AWS Network to reach S3.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
40
Q

Global Infrastructure - PoP

AWS Global Accelerator

A
  • Can find the optimal path from the end user to your web-servers
  • Deployed within Edge Locations so you send user traffic to an Edge Location instead of directly to your web-application.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
41
Q

AWS Direct Connect

AWS Direct Connect

Is a private/dedicated connection between your datacenter, office, co-location and AWS.

A

Two very-fast network options:
1. Lower Bandwith 50MBps-500MBps
2. Higher Bandwith 1GBps or 10GBps

Helps reduce network costs and increase bandwith throughput(great for high traffic networks).
Provides a more consistent network experiece than a typical internet-based connection. (reliable and secure)

Co-located (aka carrier-hotel) is a data center where equipment, space, and bandwidth are available for rental to retail customers.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
42
Q

Direct Connect Locations

A

Trusted partnered datacenters that you can establish a dedicated high speed, low-latency connection from your on-premise to AWS.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
43
Q

Global Infrastructure - Local Zones

Local Zones

Are datacenters located very close to a densely populated area to provide single-digit millisecond low latency performance (eg. 7ms) for that area.

A
  • LA, California was first Local Zone to be deployed as a logisticla extension of US-West Region identified by us-west-2-lax-1a
  • Limited AWS services such as EC2 instance types, EBS, Amanzon FSx, Application Load Balancer, Amazon VPC

Purpose of local zone is the support highly-demanding applications sensitive to latencies: media & entertainment, electronic design automation, ad-Tech, machine learning

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
44
Q

Global Infrastructure - Wavelength Zones

AWS Wavelenth Zones

Allow for edge-computing on 5G Networks. Applications will have ultra-low latency being as close as possible to the users

A

You create a subnet tied to a Wavelength Zone and then you can launch Virtual Machines (VMs) to the edge of the targeted 5G Networks.

AWS has partnered with various Telecom companies to utilitze their 5G networks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
45
Q

Global Infrastructure - Data Residency

Data Residency

Is the physical or geographic location of where an organization or cloud resources reside.
Compliance Boundaries is a regulatory compliance (legal requirement) by a government that describes where data and cloud resources are allowed to reside.
Data sovereignty is the jurisdictional control or legal authority that can be asserted over data because it’s physical location is within jurisdiction boundaries.

A
  • AWS Config (Policy as Code service)
  • IAM Policies (Service Control Policy)
  • AWS Outposts(physical rack of servers)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
46
Q

Global Infrastructure - AWS For Government

Public sector

Include public goods and governmental services

A
  • Military
  • law enforcement
  • infrastructure
  • public transit
  • public education
  • health care
  • the government itself

AWS achieves this by meeting regulatory compliance programs along with specific governance and security controls.
AWS has special regions for US regulation called GovCloud

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
47
Q

Gloud Infrastructure - GovCloud(US)

AWS GovCloud Regions

A CSP generally will offer an isolated region to run FedRAMP workloads.

Federal Risk and Authorization Management Program (FedRAMP) is a US government-wide program that provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services.

A
  • Allow customers to host sensitive Controlled Unclassified Information and other types of regulated workloads.
  • Only operated by employees who are US citizens, on US soil.
  • Only accessible to US entities and root account holders who pass screening process.

Customers can architect secure cloud solutions that comply with: FedRAMP High baseline, DOJ’s Criminal Justice Information Systems (CJIS)Security Policy, US international traffic in Arm Regulations (ITAR), Export Administration Regulation (EAR), Department of Defense (DoD) Cloud Computing Security Requirements Guide.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
48
Q

Global Infrastructure - AWS in China

AWS China

Completely isolated intentionally from AWS Global due to regulatory and compliance requirement in Mainland China
Has its own domain at amazonaws.cn

A
  • Chinese Business Licence (ICP license) is required to operate in AWS China Region
  • Not all services are available in China eg. Route53
  • Consists of two region namely Ningxia CN-NorthWest-1 operated by NSWCF and Beijing CN-North-1 operated by SINNET
  • AWS label is banned in China. Thus, it is not shown on the chinese website.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
49
Q

Global Infrastructure - Sustainability

AWS Cloud Sustainability Goals

Amazon co-founded the Climate Pledge to achieve Net-Zero Carbon Emissions by 2040 across all of Amazon’s business (this includes AWS)

A
  1. Powered by100% Renewable Energy by 2025.
  2. Cloud Efficiency: AWS’ infrastructure is 3.6 times more energy efficient than the median of US enterprise data centers surveyed.
  3. Water stewardship: Direct evaporative technology/ non-potable (recycled) water for cooling, on-site water treatment to remove scale-forming minerals and reuse water for more cycles, water efficiency metrics to determine and monitor optimal water use for each AWS Region.

AWS purchases and retires environmental attributes to cover the non-renewable energy for AWS Global Infastructure:
- Renewable Energy Credits (RECs)
- Guarantees of Origin (GOs)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
50
Q

Global Infrastructure - AWS Ground Station

AWS Ground Station

Fully managed service that lets you control satelite communications, process data, and scale your operations without having to worry about building or managing your own ground station.

A

Use cases for Ground station:
* Weather forecasting
* Surface imaging
* Communications
* Video broadcasts

To use Ground Station:
- You schedule a contact (select satelite, start and end time, and the ground location)
- Use the AWS Ground Station EC2 AMI to launch EC2 instances that will uplink and downlink data during the contact or receive downlinked data in an Amazon s3 bucket.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
51
Q

Global Infrastructure - AWS Outposts

AWS Outposts

(rack of servers running AWS Infrastructure on your physical location)

Fully managed service that offers the same AWS infrastructure, AWS services, APIs, and tools to virtually any datacenter, co-location space, or on-premises facility for a truly consistent hyprid experience.

A
  1. Server Rack: Frame design to hold and organize IT equipment.
  2. Rack Heights: U stands for “rack units” or “U spaces” which equals to 1.75 inches. Industry standard rack size is 48U (7 Foot Rack). AWS highest full-size rack cage is 42U.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
52
Q

Global Infrastructure: AWS Outposts

AWS Outposts comes in 3 form factors

A
  • 42U: Delivered by AWS to preferred physical site fully assembles. Installed by AWS. Rack needs to be plugged into power and network.
  • 1U: Server that is placed into rack. Suitable for 19” wide x 24” deep cabinets. AWS Graviton2 (up to 64 vCPUs), 128 GiB memory, 4 TB of local NVMe storage
  • 2U: Server that is placed into rack. Suitable for 19” wide x 36” deep cabinets, Intel processor (up to 128 vCPUs), 256 GiB memory
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
53
Q

Solution Architect vs Cloud Architect

A
  1. Solutions architect is a role in a technical organization that architects a technical solution using multiple systems via research, documentation and experimentation
  2. Cloud architect is a solutions architect focused on architecting technical solutions using cloud services.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
54
Q

Terms for cloud architect

A
  1. Availablility - ability to ensure a service remains available eg. Highly Available (HA)
  2. Scalability - ability to grow rapidly or unimpeded
  3. Elasticity - ability to shrink and grow to meet the demand
  4. Fault Tolerance - ability to prevent a failure
  5. Disaster Recovery - ability to recover from a failure eg. Highly durable

Solutions Architect is guided by the following prompts:
- How secure is this solution? (security)
- How much is this going to cost? (cost)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
55
Q

High Availability

Elastic Load Balancer in high availability

High availability is the sbility for service to remain available by ensuring there is no single point of failure and/or ensure a certain level of perfomance

A

A load balancer allows you to evenly distribute traffic to multiple servers in one or more datacenter. If a datacenter or server becomes unavailable(unhealthy) the load balancer will route the traffic to only available datacenters with servers.

Running your workload across multiple Availability Zones ensures that if 1 or 2 AZs become unavailable your service/ applications remains available.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
56
Q

Types of scalability

High Scalability is ability to increase capacity based on the increasing demand of traffic, memory and computing power.

A
  1. Vertical Scaling: Scaling Up. Upgrade to a bigger server
  2. Horizontal Scaling: Scaling out. Add more servers of the same size
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
57
Q

High Elasticity

Horizontal Scaling

High elasticity is ability to automatically increase or decrease capacity based on current demand of traffic, memory and computing power.

A
  1. Scaling out - Add more servers of the same size
  2. Scaling in -Removing underutilized servers of the same size
    -Auto Scaling Groups (ASG) is an AWS feature that will automatically add or remove servers based on the scaling rules you define based on metrics.

Vertical scaling is generally hard for traditionsl architecture so you’ll usually only see horizontal scaling described with elasticity.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
58
Q

Highly Fault Tolerant

Fail-overs

Highly Faulat Tolerant: Ability for service to ensure there is no single point of failure preventing the chance of failure.

A
  1. Fail-overs is when you have a plan to shift traffic to a redundant system in case the primary system fails.
  2. A common example is having a copy (secondary) of your database where all ongoing changes are synced. The secondary systen is not in-use until a fail occurs and it becomes the primary database.
  3. RDS Multi-AZ is when you run a duplicate standby database in another Availability Zone in case your primary database fails.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
59
Q

High Durability

Disaster Recovery Concerns

High durability is ability to recover from a disaster and to prevent the loss of data. Solutions that recover from a disaster is known as Disaster Recovery (DR)

A
  1. Do you have a backup?
  2. How fast can you restore that backup?
  3. Does your backup still work?
  4. How do you ensure current live data is not corrupt?

CloudEndure Disaster Recovery continuously replicates your machines into a low-cost staging area in your target AWS account and preferred Region enabling fast and reliable recovery in case of IT data center failures.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
60
Q

Business Continuity Plan

A business continuity plan (BCP) is a document that outlines how a business will continue operating during an unplanned disruption in services

A
  1. Recovery Point Objective (RPO): How much data are you willing to lose?
  2. Recovery Time Objective: How much time are you willing to go down?

RPO: The maximum acceptable amount of data loss after an unplanned data-loss incident, experessed as an amount time
RTO: The maximum amount of downtime your business can tolerate without incurring a significant loss.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
61
Q

Disaster Recovery Options

Mutiple options for recovery that trade cost vs time to recover

A
  1. Backup & Restore
  2. Pilot Light
  3. Warm Standby
  4. Multi-site Active/active
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
62
Q

Distract Recovery Options

Backup & Restore

A
  1. RPO/RTO: Hours
  2. Backup data is restored to new infrastructure.

-Lower priority use cases
-Restore data after event
-Deploy resources after event
- Cost $$

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
63
Q

Disaster Recovery Options:

Pilot Light

A
  1. RPO/RTO: 10 mins
  2. Data is replicated to another region with the minimal services running

-Less stringent RTO & RPO
-Core Services
-Start & and scale resources after event
-Cost $$

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
64
Q

Disaster Recovery Options

Warm Standby

A
  1. RPO/RTO : Minutes
  2. Scaled down copy of your infrastructure running ready to scale up

-Business Critical Services
-Scale resources after event
- Expensive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
65
Q

Disaster Recovery Options

Multi-site Active/active

A
  1. RPO/RTO: Real-time
  2. Scaled up copy of your infrastructure in another region.

  • Zero downtime
  • Net zero loss
  • Mission critical services
  • Expensive
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
66
Q

AWS Application Progrmming Interface (API)

API

A
  1. An API is software that allows two applications/services to talk to each other.
  2. Most common type of API is via HTTP/S requests.
  3. AWS API is an HTTP API and you can interact by sending HTTPS requests, using an application interacting with APIs like Postman

  1. Each AWS service has its own Service Endpoint which you send requests
  2. To authorize you will need to generate a signed request. You make a separate request with your AWS credentials and get back a token.
  3. You need to also provide ACTION and accompanying parameters as the payroad.
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
67
Q

AWS Management Console

A

Web-based unified console to build, manage, and monitor everythig from simple web apps to complex cloud deployments. Clickops refers to performing all system operations via clicks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
68
Q

Service Console

A

AWS Services have customized console that can be accessed by searching the service name.
Some AWS Service Console acts as an umbrella console containing many AWS services:
* VPC console
* EC2 console
* Systems Manager console
* SageMaker console
* CloudWatch console

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
69
Q

AWS Account ID

A

-Found by dropping down the current user in the global navigation
-Composed of 12 digits
-Used for login by non-root users, cross-account roles, support cases
-Can also be found under IAM console
-Used when creating policies for users and cross-acount roles

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
70
Q

PowerShell

A

-A task automation and configuration management framework. Consits of command-line shell and a scripting language.
-Unlike most shells, which accept and return text, PowerShell is built on top of the .NET Common Language Runtime (CLR), and accepts and returns .NET objects.
-AWS Tools for PowerShell lets you interact with the AWS API via PowerShell Cmdlets
-Cmdlets is a special type of command in PowerShell in the form of capitialized verb-and-noun e.g. New-s3Bucket

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
71
Q

Amazon Resource Names (ARNs)

A

-Uniquely identify AWS resources
-Require to specify a resource unambigously across all of AWS
-Format is arn:partition:service:region:account-id:resource-type/resource-id

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
72
Q

Paths in ARN

can include wildcard character, namely an asterisk (*)

A

IAM Policy ARN Path arn:aws:iam::123456789012:user/Development/product_1234/*

S3 ARN Path arn:aws:s3:::my_corporate_bucket/Development/*

73
Q

Terminal, Shell or Console are commonly (erroneously) used to describe interacting with a Shell.

A

1.CLI processes commands to a computer in the form of lines of text.
2.Terminal is a text only interface (input/output environment)
3.Console is a physical computer to physically input information
4. Shell is the command line program that users interact with to input commands. Popular shell programs: Bash, Zsh, PowerShell

74
Q

AWS CLI

A
  • Allows users to programatically interact with the AWS API via entering single or multi-line commands into a shell or terminal
  • is a python executable program
  • Can be installed on Windows, Mac, or Linux/Unix
75
Q

AWS Software Development Kit (SDK) is a collection of software development tools in one installable package.

A
  • AWS SDK is used to programatically create, modify, delete or interact with AWS resources.
  • Offered in various programing languages:
    Java, Python, Node.js, Ruby, Go, .NET, PHP, JavaScript, C++
76
Q

AWS CloudShell : Browser-based shell built into AWS Management Console. Free Service.

A
  • Preinstalled Tools: AWS CLI, Python, Node.js git, make, pip, sudo, tar, tmux, vim, wget, and zip and more
  • Storage included: IGB of storage free per AWS region
  • Saved files & settings: Files saved in home directory available in future sessions for the same AWS region
  • Shell Environments: Seamlessly switch between bash, PowerShell, Zsh.
77
Q

Infrastructure as Code (IaC)

A
  • Write a configuration script to automate creating, updating or destroying cloud infrastructure.
  • Blueprint of your infrastructure
  • Allows to easily share, version or inventory cloud your cloud infrastructure
  • Two main offerings: AWS CloudFormation (CFN) and AWS Cloud Development kit (CDK)
  • AWS CFN: Declarative (explicit), more verbose with zero chance of mis-configuration, uses scripting languages eg. JSON, YAML, XML
  • AWS CDK: Imperative (implicit), less verbose with possible misconfiguration, does more than the declarative, uses programming languages eg. Python, JavaScript.
78
Q

AWS CloudFormation

A
  • Allows writing IaC as either JSON or YAML file
  • Simply, but can lead to large files or is limited in some regard to creating dynamic or repeatable infrastructure compared to CDK
  • Can be easier for DevOps Engineers who do not have a background in web programming languages
  • Important in debugging IaC stacks. CDK generates out CloudFormation.
79
Q

AWS CDK

A
  • Allows using programming language to write IaC eg. typescript, node.js, python, java, .Net
  • Powered by cloudFormation (generates out cloudFormation templates)
  • Has a large library of resuable cloud components called CDK construct
  • Like CloudFormation, comes with its own CLI
  • Piplelines to quickly setup CI/CD pipelines for CDK projects
  • Has a testing framework for unit and integration testing
    AWS SDK looks similar to CDK, but key difference is CDK ensures idempotent of your infrastructure.
80
Q

AWS Toolkit for Vscode

A

Is an open-source plugin for VSCode to create, debug, deploy AWS resources
* AWS Explorer: explore a wide range of AWS resources to your linked AWS Account
* AWS CDK Explorer: Allows you to explore your stacks defined by CDK
* Amazon Elastic Container Service: Provides intelliSense for ECS task-definitions files
* Serverless Applications: Create, debug and deploy serverless applications via SAM and CFN

81
Q

Access Keys

A
  • Is a key and secret required to have programmatic access to AWS resources when interacting with the AWS API outside of the AWS Management Console
  • Also known as AWS Credentials
  • User must be granted access
  • Should never be shared
  • Should never be committed to a codebase
  • Can be active at two at a time
  • Can be deactivated
  • Have whatever access a user has to AWS resources
  • Are stored in ~/.aws/credentials and follow a TOML file format
  • populate in response to aws configure CLI command
82
Q

AWS Documentation

A

Is a large collection of technical documentation on how to use AWS Services.
Found at docs.aws.amazon.com

83
Q

AWS Shared Responsibility Model

Goal: Security of the Cloud

A
  1. Customer: Configuration of Managed Services or Third-Party Software (Platforms, applications, IAM), Configuration of Virtual infrastructure and Systems (Operating system, network, firewall), Security Configuration of Data (client-side data encryption, server-side encryption, networking traffic protection, customer data). Responsible for security IN the cloud

2.AWS: Software(compute, storage, database, networking), Hardware/Global Infrastructure(regions, AZs, edge locations, physical security) . Responsible for security OF the cloud.

84
Q

Types of Cloud Computing Responsiblity

A
  • On-Premise: Customer (Applications, Data, Runtime, Middleware, OS, Virtualization, Servers, Storage, Networking)
  • Ifrastructure as a service: Customer (Applications, data, runtime, middleware, OS). AWS responsible for the rest.
  • Platform as a service Customer (Applications, data). AWS responsible for the rest.
  • Software as a service: AWS responsible for everything. Eg. Microsoft 360 subscription
85
Q

Shared Responsibility Model - Compute

A
  • Infrastructure as a Service (IaaS):
    1. Bare Metal: EC2 Bare Metal Instance: Customer (Host OS configuration, hypervisor) AWS (physical machine)
    2. Virtual Machine: EC2: Customer (Guest OS configuration, container runtime) AWS (hypervisor, physical machine)
    3. Containers: AWS ECS: Customer (configuration of containers, deployment of containers, storage of containers) AWS (OS, hypervisor, container runtime)
  • Platforms as a Service (PaaS): Managed platform: AWS Elastic Beanstalk: Customer (uploading code, configuration of environment, deployment strategies, configuration of associated services) AWS (servers, OS, Netwoking, Storage, Security)
  • Software as a Service (SaaS): Content Collaboration: Amazon WorkDocs: Customer (contents of documents, management of files, configuration of sharing access controls) AWS (servers, OS, Networking, Storage, Security)
  • Function as a Service (FaaS): Functions: AWS Lambda: Customer (upload your code) AWS (Deployment, container runtime, networking, storage, security, physical machine)

Container as a service: Fargate. AWS runs everything!

86
Q

Shared Responsibility Model per cloud services

Shared Responsibility Model is a simple visualization that helps determine what the customer is responsible for and what the CSP is responsible for related to AWS
Customer: responsible for the data and the configuration of access controls that resides in AWS. Specifically, configuration of cloud services and granting access to users via permissions. (Responsiblity in the cloud)

CSP is generally responsible for the underlying infrastructure (Responsibility of the cloud)

A

IaaS: Customer responsibility (Content, access policies, usage, deployment, web app secuirty, identity, operations, access and authentication, network security, guest OS, data & content)
PaaS: Customer responsibility (content, access policies, usage, deployment, web app security)
SaaS: Customer responsibility (Content, acess policies, usage)

In all cloud services, AWS is responsible for audit logging, network, storage & encryption, hardened Kernel +IPC, boot and hardware. It takes on more responsibilities based on the cloud service. AWS takes on most responsibilities in SaaS and the least responsiblities in IaaS.

87
Q

Shared Resposibility Model Architecture by customer responsibility

A

Less Responsibility: Serverless/Functions. No more servers, just worry about data and code. Eg. amplify and lambda.

Moderate Responsibility: Microservices/Containers. Mix & match languages, better utilization of resources. Eg. ECS/EKS containers, Fargate Serverless containers.

Most reponsibility: Traditional/VMs. Global workforce is most familiar with this kind of architecture and lots of documentation, frameworks & support. Eg. EC2 IaaS, Elastic Beanstalk PaaS

88
Q

EC2 allows you to launch Virtual Machines (VM)

VM - an emulation of physical computer using software. Server virtualization allows you to easily create, copy, resize or migrate your server. Multiple VMs can run on the same physical server so you can share the cost with other customers. Imagine if your server or computer was an executable file on your computer. When we launch a VM, we call it an “instance”

A

EC2 is highly configurable server where you can choose AMI that affects options such as:
* CPU
* RAM
* Network bandwith
* OS
* Attach multiple hard-drives for storage eg. Elastic Block Store (EBS)

AMI is a predefined configuration for a Virtual Machine.

EC2 is considered the backbone of AWS because the majority of AWS services uses EC2 as their underlying servers. eg.S3, RDS, DynamoDB

89
Q

Basic AWS Compute Services

VM

A

VM: An emulation of a physical computer using software. eg. EC2 VM, Amazon Lightsail (managed virtual service.”friendly” version of EC2 VM.

90
Q

Basic AWS Compute Services

Containers

A

Containers: Virtualization an OS to run multiple workloads on a single OS instance. Used in micro-service architecture(division of application into smaller applications that talk to each other). eg. ECS (container orchestration service that support Docker containers; launches a cluster of server(s) on EC2 instances with Docker installed),
ECR (respository for container images, images necessary to launch containers) image means saved copy. Repository means storage with version control,
ECS Fargate (severless orchestration container service). AWS manages its underlying server. Pay for running container.
EKS (managed Kubernetes service). K8 is an open-source orchestration software that was created by Google and is generallt the standard for managing microservices.

91
Q

Basic AWS Compute Services

Severless

A

Serverless: when the underlying servers are managed by AWS, you don’t worry or configure servers.
AWS Lambda is a serverless functions service. Run code without provisioning or managing servers.
Basically, upload small pieces of code, choose much memory and how long function is allowed to run before timing out. You are charged based on the runtime of the serverless function rounded to the 100ms.

92
Q

High Performance Computing Services

A

The Nitro System: Combination of dedicated hardware and lightweight hypervisor enabling faster innovation and enhanced security. All new EC2 instance types use the Nitro System.

Nitro cards - specialized cards for VPC, EBS and instance storage and controller card
Nitro security chips - integrated into the motherboard. Protects hardware resources.
Nitro Hypervisor - lightweight hypervisor Memory and CPU allocation Bare Metal-like performance.

93
Q

High Performance Computing Services

A

Bare Metal Instance: EC2 instance that have no hypervisor that run workloads directly on the hardware for maximum performance and control. The M5 and R5 EC2 instances run are bare metal. Bottlerocket is a Linux-based-open-source operation system that is purpose-built by AWS for running containers on VMs or bare metal hosts.

94
Q

What is High Performance Computing (HPC)

A

A cluster of hundreds of thousands of servers with fast connections between each of them with purpose of boosting computing capacity. Supecomputer abilities.

AWS ParallelCluster is an AWS-supported open source cluster management tool that makes it easy to deploy and manage High Performance Computing (HPC) clusters on AWS.

95
Q

Edge and Hybrid Computing

Edge Computing: Computing workloads outside of your networks to run close to the destination location.
Hybrid Computing: Running workloads on both on your on-premise datacenter and AWS Virtual Private Cloud (VPC)

A

AWS Outposts: physical rack of servers that you can put in your data center, Uses AWS API and Sevices such as EC2 right in your datacenter.

AWS Wavelength: Build and launch applications in a telecom datacenter. Allows for apps to have ultra-low latency by using 5G network and be closest as possible to the end user.

VMWare Cloud on AWS: Manage on-premise VM using VMWare as EC2 instances. Data-center must use VMWare for virtualization.

AWS Local Zones: Edge datacenters located outside of AWS region for proximity of AWS services to end destination.

96
Q

Cost and Capacity Management Computing Services

Cost Management: How do we save money?
Capacity Management: How do we meet the demand of traffic and usages through adding or upgrading servers?

A
  • EC2 Spot instances, Reserved Instances and Savings plan: Ways to save on computing, by paying in full or partically, committing to yearly contracts or by being flexible about availability and interruption to computing service.
  • AWS Batch: Plans, schedules, and executes batch computing workloads across full range of AWS compute services, utilitze spot instances to save money.
  • AWS Compute Optimizer: Reduce costs and improve performance by using machine learning to analyze previous usage history.
  • EC2 Autoscaling Groups (ASGs): Automatically adds or remove EC2 servers to meet the current demand or traffic. Savings and meeting capacity needs met by running the specific amount of servers needed.
  • Elastic Load Balancer (ELB): Distributes traffic to multiple instances, can re-route traffic from unhealthy instance to healthy instances.
  • AWS Elastic Beanstalk (EB) is for easily deploying web-applications without developer having to worry about setting up and understanding the undelying AWS Services. Similar to Heroku.
97
Q

Type of Storage Services

EBS, EFS, S3

A
  • Elastic Block Store (EBS) - Block. Data split into evenly split blocks directly accessed by the OS supported only by a single write volume. Best for virtual hard drive attached to a VM.
  • AWS Elastic File Storage (EFS) - File. File is stored with data and metadata. Multiple connections via a network share that supports multiple reads. Writing locks the file. Best for a file-share where multiple users or VMs need access to the same drive.
  • Amazon Simple Storage Service (S3) - Object. Object is stored with data, metadata and Unique ID. Scales with limited no file limit or storage limit that supports multiple reads and writes (no locks). Best for uploading files. Not intended for high IOPs. Uses HTTP/S, API
98
Q

Introduction to S3

S3- Object-based-Storage
Data storage architecture that manages data as objects, as opposed to other storage architectures:

Files systems: manages data as files with heirachy
Block storage: manages data as blocks within sectors and tracks.

A

S3 provides unlimited storage: S3 Console provides interface for upload and access of data.

S3 Object: Objects contain data like files. Object may consist of: Key (name of the object), Value (data itself made up of a sequence of bytes), Version ID (when versioning enabled, the version of object), Metadata (additonal information attached to the object)

S3 Bucket: Buckets hold objects. Buckets can have folders which in turn hold objects

S3 is a universal namespace so bucket names must be unique (think like having a domain name)

Can store an individual object from 0 Bytes to 5 Terabytes in size.

99
Q

S3 Storage Classes

S3 Storage Classes: AWS offers a range of S3 storage classes that trade Retrieval Time, Accessability, and Durability for cheaper storage.

A

In order of decreasing prices…
S3 standard(default): Fast! 99.99% Availability, 11.9% durability. Replicated across at least three AZs.

S3 Intelligent Tiering: Uses ML to analyze object usage and determine the appropriate storage class. Data is moved to the most cost-effective access tier, without any performance impace or added overhead.

S3 Standard-IA (Infrequent access): Still fast! Cheaper if you access files less than once a month. Additional retrieval fee is applied. 50% less than Standard (reduced availability)

S3 One-Zone-IA: Still fast! Objects only exist in one AZ. Availability (is 99.5%), but cheaper than Standard IA by 20% less (Reduce durability) Data could get destroyed. A retrieval is applied.
(All the above fall under S3 on the AWS mange,ent console)

S3 Glacier: For long-term cold storage. Retrieval of data can take minutes to hours but the off is very cheap storage.

S3 Glacier Deep Archive: The lowest cost storage class. Data retrieval time is 12 hours.

S3 Outposts has its own storage classes

100
Q

AWS Snow Family

AWS Snow Family: Storage and compute devices used to physically move data in or out the cloud(used when moving data over the internet or private connection is too slow, difficult or costly)

A

Snowcone: Comes in two sizes - 8TB of storage(HD) and 14TB of storage(SSD)
Snowball Edge: Comes generally in two types - Storage optimized (80TB) and Compute optimized (39.5TB)
Snowmobile: 100 PB of storage

All data is delivered to Amazon S3

101
Q

Storage Services

S3: serverless object storage service for uploading unlimited amount of files. Pay for what you store.

S3 Glacier: cold storage service designed as a low cost storage solution for archiving and long-term backup. Uses previous generation HDD drives to get that low cost. Highly secure and durable.

EBS: persistent block storage service. It is a virtual drive in the cloud you attach to EC2 instances at the same time. Used for sharing files between multiple servers.

Storage Gateway: Hybrid cloud storage service that extends on-premise storage to cloud.
File Gateway: extends local storage to AWS S3
Volume Gateway: caches local drives to S3 to allow for a continuous backup of local files in the cloud.
Tape Gateway: stores files onto virtual tapes for backing up your files on very cost effective long term storage.

Continued on answer section

A

AWS Snow Family: storage devices used to physically migrate large amounts of data to the cloud. Includes Snowcone, Snowball Edge and Snowmobile.

AWS Backup: managed backup service that makes it easy to centralize and automate the backup of data across multiple AWS services eg. EC2, EBS, RDS, DynamoDB, EFS, Storage Gateway. Create backup plans.

CloudEndure Disaster Recovery: Continuously replicates machines into a low-cost staging area in your target AWS account and preferred Region enabling fast and reliable recovery in case of IT data center failures.

Amazon FSx: Feature-rich and highly-performant file system that can be used for Windows (SMB) or Linux (Lustre)

Amazon FSx for Window File Server: Uses SMB protocol and allows mounting of FSx to Windows servers.

Amazon FSx for Lustre uses Linux’s file system and allows mounting FSx to Linux servers.

102
Q

Storage Services

A
103
Q
A
104
Q

Database

Database: Complex data stores requiring formal design and modelling techniques.

A simple database is a data-store that stores semi-structured and structured data.

A

Can be either: (1)Relational databases: structured data that strongly represents tabular data (tables, rows, & columns), can be row-oriented or columnar-oriented. (2) Non-relational databases: semi-structured that may or may not distantly resemble tabular data.

Functionality: (1) specialized language to query (retrieve data) (2) specialized modeling strategies to optimize retrieval for different use cases (3) more fine tune control over the transformation of the data into useful data structures or reports.

Normally a databases infers someone is using a relational row-oriented data store

105
Q

Data Warehouse

Data Warehouse: relational datastore designed for analytic workloads generally column-oriented data-store

Companies will have terabytes and millions of rows of data, and they need a fast way to be able to produce analytics reports.

A

Perform aggregation: aggregation is grouping data eg. find a total or average. Optimized around columns for quick aggregation of column data.

Designed as HOT: means data warehouse can return queries very fast even despite vast amount of data.

Infrequently accessed: means that data warehouses aren’t intended for real-time reporting, but maybe once or twice a day or once a week to generate business and user reports.

Needs to consume data from relational dabases on a regular basis.

106
Q

Key-Value Store

Key-value database: non-relational database (NoSQL) that uses key-value method to store data.

A

Key-values stores are dumb and fast. Generally lack features like relationships, indexes and aggregation.

Key-value stores unique key alongside a value

A simple key-value store will interpret this data resembling a dictionary (aka Associative arrays or hash)

A key-value store can resemble tabular data, it does not have to have the consistent columns per row (hence its schemaless)

Due to the simple desigan, NoSQL database can scale well beyond a relational database.

107
Q

Document Store

Document store: NoSQL database that stores documents as its primary data structure.

A

A document could be XML but more commonly JSON or JSON-like
Document stores are sub-class of Key-Value stores.
Components of a document store is comparable to that of Relational database, though features do not function similarly.

108
Q

AWS NoSQL Database Service

DynamoDB, DocumentDB & Amazon Keyspaces

A

DynamoDB: Serverless NoSQL key-value and document database designed to scale to billions of records with guaranteed consistent data return in at least a second. AWS’ flagship database service that’s scalable, cost effective and fast.

DocumentDB: NoSQL document database compatible with MangoDB database (open-source NoSQL key-value database).

Amazon Keyspaces: Fully managed Apache Cassandra database (an open-source NoSQL key-value columnar store database with additional functionality).

109
Q

Relational Databases

RDS: relational database service that supports multiple SQL engines. Relational synonymous with SQL and Online Transactional Processing (OLTP). Commonly used type of database among tech companies and start-ups.

A

RDS supports the ffl SQL Engines:
MySQL: most popular open-source SQL database that was purchased and now owned by Oracle.
MariaDB: Copy of MySQL under a diffrent open-source license.
Postgress (PSQL): Open-source SQL database among developers with rich features over MySQL, but added complexity.
Oracle: Oracle’s proprietary SQL database. Well used by Enterprise companies. Requires a license.
Microsoft SQL Server: Microsoft’s proprietary SQL database. Requires a license.
Aurora: Fully managed database.
(1) Aurora : fully managed database of either MySQL (5x faster) and PSQL(3x faster) database. Used as highly available, durable, scalable and secure relational database for Postgres or MySQL.
(2) Aurora Serverless: Serverless on-demand version of Aurora. Used “when you want ‘most’ of the benefits of Aurora, but can trade to have cold-starts or you don’t have lots of traffic demand”.

RDS on VMware: allows deployment of RDS-supported engines to on-premise datacenter. The datacenter must be using VMware for server virtualization. Used for RDS-managed databases on on-premise datacenter.

110
Q

Database and its management

Redshift: Petabyte-size data warehouse for online Analytical Processing (OLAP). Expensive due to keeping data “hot” - quickly generating analytics or reports from a large amount of data.

ElastiCache: managed database of the in-memory and caching open-source databases Redis or Memcached. Used for improving the performance of app by adding a caching layer in front of web-server or database.

Neptune: managed graph database. Data represented as interconnected nodes. Used for understanding connections between data eg. Mapping Fraud Rings or Social Media relationships.

Amazon Timestreams: Fully managed time series database. Think of devices that send lots of data that are time-sensitive such as IoT devices. Used for measuring how things change over time.

Amazon Quantum Ledger Databases: Fully managed ledger database that provides transparent, immutable and cyptographically variable transaction logs. Used to record trusted history of financial activities.

Database Migration Service (DMS): database migration service. Can migrate from: (1) on-premise database to AWS (2) two database in different or same AWS accounts using different SQL engines (3) SQL to NoSQL database

A

Intentionally left blank

111
Q

Cloud-Native Networking Services

VPC: Logically isolated section of the AWS Cloud where you can launch AWS resources

A

Route Tables: determines where network traffic from subnets are directed

Internet Gateway: Enable access to the internet

NACLs: Acts a firewall at the subnet level

Subnets: Logical partition of an IP network into multiple, smaller network segments.

AZ : Data center of your AWS resources

Region: Geographical location of your network

112
Q
A
113
Q
A
114
Q

Enterprise/Hybrid Networking

Enterprise/Hybrid Networking

A

DirectConnect: dedicated gigbait connection from on-premise datacenter to AWS (very fast connection)

AWS Virtual Private Network(VPN): secure connection between on-promise, remote offices, mobile employees.

PrivatLinks (VPC interface endpoints): Keeps traffic within the AWS network and not traverse the internet to keep traffic secure.

115
Q

Virtual Private Cloud (VPC) and Subnets

VPC : logically isolated section of the AWS Network where you launch AWS resources. Involves choosing a range of IPs using CDIR Range. CIDR range of 10.0.0.016 = 65,536 IP Addresses

Subnets: logical partition of an IP network into multiple smaller network segments. Breaking up IP range for VPC into smaller networks. Needs to have smaller CDIR range than its associated VPC. eg. Subnet CIDR Range 10.0.0.0/24 = 256 IP Addresses

Public subnet: one that can reach the internet

Private subnet: one that cannot reach the internet.

A
116
Q

Security Groups vs NACLs

Security Groups vs NACLs

A

NACLs: Acts as a virtual firewall at the subnet level. Allow and deny rules )stateless). eg. Block a specific IP address known for abuse.

Security Groups: Acts as a virtual firewall at the instance level. Allow rules only (stateful) eg. Allow and EC2 istance access on port 22 for SSH. You cannot block a single IP address.

117
Q

Introduction to EC2

EC2: Highly configurable virtual server. Resizable compute capacity. Takes 2 mins to launch new instances. All AWS services uses EC2 instances underneath.
Launching EC2 Steps
1. Choose OS via AMI eg. Red hat, windows…
2. Choose an Instance Type eg. t2.nano
3. Add storage (EBS, EFS) eg. SSD, HDD, Virtual magnetic tape, multiple volumes
4. Configure Instance Eg. security groups, key pairs, UserData, IAM Roles, Placement groups

A
118
Q

EC2 Instance Families

What are Instance Families?

A

Instance families are different combinations of CPU, Memory, Storage and Networking capacity.

Instance families allow for choice of appropriate combination of capacity to meet your application’s unique requirements.

Different instance families are different because of the varying hardware used to give them their unique properties.

Commonly instance families are called “Instance Types” but an instance type is a combination of size and family.

  1. General Purpose: A1, T2, T3, T3a, T4g, M4, M5, M5a, M6zn, M6g, M6i, Mac; balance of compute, memory, and networking resources; Use-cases web servers and code repositories.
  2. Compute Optimized: C5, C4, Cba, C5n, C6g, C6gn; ideal for compute bound applications that benefit from high performance processo. Use-cases scientific modeling, dedicated gaming servers and server engines
  3. Memory Optimized: R4, R5, R5a, R5b, R5n, X1, X1e, High Memory z1d; fast performance for workloads that process large data sets in memory. Use-cases in-memory caches, in-memory databases, real time big data analytics.
  4. Accelerated Optimized: P2, P3, P4, G3, G4ad, G4dn, F1, Inf1, VT1; hardware accelerators, or co-processors; Use-cases Machine learning, computational finance, seismic analysis, speech recognition.
  5. Storage Optimized: I3, I3en, D2, D3, D3en, H1; high, sequential read and write access to very large data sets on local storage; Use-cases NoSQL, in-memory or transactional databases warehousing
119
Q

EC2 Instance Types

An instance type is a particular instance size and instance family:

A

A common pattern for instance sizes:
* nano
* micro
* small
* medium
* large
* xlarge
* 2xlarge
* 4xlarge
* 8xlarge
There are many exceptions to this pattern for sizes eg: c6.metal - is a bare metal machine, c5.9large - is not a power of 2 or even number size.

120
Q

EC2 Instance Sizes

EC2 Instance sizes generally double in price and key attributes

A

For t2.small, price is $0.023/hr ($16.79/mo)
For t2.medium, price is $0.0464/hr ($33.87)

121
Q

EC2 dedicated Host

Dedicated Hosts are single-tenant EC2 instances designed to let you Bring-Your-Own-License based on machine characteristics

A

Differences:
1. Isolation: Dedicated Instance involves instance isolation. Dedicated Hosts involves physical server isolation.
2. Billing: Dedicated instance uses per instance billing (+2 per region fee). Dedicated Host uses per hosts billing.
3. Visibility of Physical x’tics: Dedicated instance has no visibilities. Dedicated hosts have socket, cores, host ID.
4. Affinity b/n a host and instance: Dedicated instance has no affinity. Dedicated hosts consistently deploy the same instances to the same physical server.
5. Targeted instance placement: Dedicated instance have no control. Dedicated hosts have additional control over instance placement on physical server.
6. Automatic instance placement: Both dedicated instance and dedicated hosts have automatic instance placement.
7. Add capacity using an allocation request: Dedicated instance does not allow addition of capacity using an allocation request. Dedicated hosts allow addition of capacity using an allocation request.

122
Q

EC2 Pricing Models

5 different ways to pay for EC2 (Virtual machines)

A

On-demand (least commitment)
* low cost and flexible
* only pay per hour or the second
* cannot be interrupted
* for first time apps

Spot up to 90% discount (Biggest Savings)
* request spare computing capacity
* flexible start and end times
* can handle interruptions (server randomly stopping and starting)
* for non-critical background jobs

Reserved up to 75% off (Best long-term)
* steady state or predictable usage
* commit to EC2 over a 1 or 3 year term
* can resell unused reserved instances

Dedicated (most expensive)
* Dedicated servers
* can be on-demand or reserved or spot
* When you need a guarantee of isolate hardware (enterprise requirements)

AWS Savings Pan: Another way to save, but can be used for more than just EC2.

123
Q

EC2 Tenancy

EC2 has three levels of tenancy

A
  1. Dedicated host tenancy: Control of the physical attributes of server
  2. Dedicated Instance tenancy: Server lives at one specific location in the cloud.
  3. Default tenancy: Server lives in a specific location until reboot.
124
Q
A
125
Q

EC2 Pricing Models

On-Demand: Pay-as-you-go (PAYG) where you consume compute and then you pay

A

When one launches an EC2 instance, it is by default using on-demand pricing. No upfron payment or long-term commitment. Charged by the second (minimum of 60 seconds) or the hour

On-Demand: For applications where the workload is for short-term, spikey, or unpredictable. Used for development of new app or running experiment.

126
Q

Ec2 Pricing Models: Reserved

Reserved Instances: Designed for app that have steady-state, predictable usage, or require reserved capacity.

Reduced pricing is based on Term x Class offering x RI Attributes x Payment Option

A

Term : the longer the term the greater the savings.
* Commit 1-3 year contract. Reserved instances do not renew automatically
* Upon expiration, instance use on-demand with no interruption to service

Class: The less flexible the greater the savings
* Standard: Up to 75% reduced pricing compared to on-demand. Can modify RI Attributes
* Convertible: Up to 54% reduced pricing compared to on-demand. Can exchange RI based on RI Attributes if greater or equal in value
* Scheduled: AWS no longer offer scheduled RI

Payment Options: The greater upfront the great the savings
* All Upfront: Full payment is made at the start of the term
* Partial Upfront: A portion of the cost must be paid upfront and the remaining hours in the term are billed at a discounted hourly rate
* No Upfront: Billed a discounted hourly rate for every hour within the term, regardless of whether the Reserved Instance is being used.

RIs can be shared between multiple accounts within an AWS Organization. Unused RIs can be sold in the Reserved Instance Marketplace.

127
Q

Reserved Instances(RI) - RI Attributes

RI Attributes (aka Instance Attributes): Limited based on Class Offering and can affect the final price of an RI instance. 4 RI Attributes.

A

RI Attributes:
1. Instance types: For example, m4.large. This is composed of the instance family (for example, m4) and the instance size (eg. large).
2. Region: The Region in which the Reserved Instance is purchased.
3. Tenancy: Whether instance runs on shared (default) or single-tenant (dedicated) hardware.
4. Platform: The operating system eg. Windows or Linux/Unix

128
Q

Regional and Zonal RI

When you purchase a RI, you determine the scope of the Reserved Instance. The sope does not affect the price.

A

Regional RI: purchase for a region
* Does not reserve capacity
* RI discount applies to instance usage in any AZ in the region
* RI discount applies to instance usage within the instance family, regardless or size. Only supported on Amazon Linux/Unix. Reserved Instances with default tenancy.

Zonal RI: purchase for an Availability Zone
* Reserves capacity in the specified Availability Zone
* RI discount applies to instance in the selected AZ (No AZ Flexibility)
* No instance size flexibility, RI discounts applies to instance usage for the specified instance type and size only.

129
Q

RI Limits

RI Limits: There is a limit to the number of Reserved Instances that you can purchase per month. Per month, you can purchase 20 Regional Reserved Instances per Region and 20 Zonal Reserved Instances per AZ

A

Regional Limits:
* You cannot exceed your running on-demand Instance limit by purchasing regional Reserve Instances. The default on-demand Instance limit is 20.
* Before purchasing RI ensure on-demand limit is equal to or greater than RI intended to purchase

Zonal Limits:
* Can exceed running on-demand Instance limit by puchasing zonal Reserved Instances
* If you already have 20 running on-demand instances, and you purchase 20 zonal Reserved instances, you can launch a further 20 on-demand instances that match the specifications of zonal reserved instances

130
Q

Capacity Reservations

EC2 instances are backed by different kind of hardware, and so there is a finite amount of servers available within an Availability Zone per instance type of family.

A

Capacity Reservation: a service of EC2 that allows request of EC2 instance type for a specific region or AZ

The reserved capacity is charged at the selected type’s on-demand rate whether an instance is running in it or not.

You can also use regional reserved instances with capacity reservations to benefit from billing discounts.

131
Q

Standard vs Convertible RI

Differences between standard and convertible

A

Standard RI
RI attributes can be modified:
* Change the AZ within same region
* Change the scope of the Zonal RI to Regional RI or vise versa
* Change the instance size (Linux/Unix only, default tenancy)
* Change network from EC2-Classic to VPC and vise versa
Can’t be exchanged
Can be bought or sold in the RI Marketplace

Convertible RI
RI attributes can’t be modified (you perform an excahange)
Can be exchanged during the term for another Convertible RI with new RI attributes, including:
* instance family
* instance type
* platform
* scope
* tenancy
Can’t be bought or sold in the RI Marketplace.

132
Q

RI Marketplace

EC2 Reserved instance Marketplace allows sale of unused Standard RI to recoup RI spend for RI not intended/cannot be used.

A
  1. Reserved instances can be sold after they have been active for at least 30 days and once AWS has received the upfront payment (if applicable)
  2. One must have a US bank account to sell Reserved Instances on the Reserved Instance Marketplace.
  3. There must be at least one month remaining in the term of the Reserved Instance listed.
  4. One will retain the pricing and capacity benefit of reservation until it’s sold and the transaction is complete.
  5. Company name (and address upon reques) will be shared with the buyer for tax purposes.
  6. A seller can set only the upfront price for a Reserved Instance. The usage price and other configuration (eg. instance type, AZ, platform) will remain the same as when the Reserved Instance was initially purchased.
  7. The term length will be rounded down to the nearest month. For example, a reservation with 9 months and 15 days remaining will appear as 9 months on the Reserved Instance Marketplace.
  8. One can sell up to $20, 000 in Reserved Instances per year, if you need to sell more Reserved Instances.
  9. Reserved Instances in the GovCloud region cannot be sold on the Reserved Instance Marketplace.
133
Q

Spot Instances:

AWS has unused compute capacity that they want to maximize the utility of their idle servers. Spot instances provide a discount of 90% compared to on-demand pricing. Spot instances can be terminated if the computing capacity is needed by other on-demand customers.

A

Designed for applications that have flexible start and end times or applications that are only feasible at very low compute costs.

AWS Batch: an easy and convenient way to use Spot pricing.

Termination Conditions
* Instances can be terminated by AWS at anytime
* If your instance is terminated by AWS, you don’t get charged for a partial hour of usage.
* If you terminate an instance you will still be charged for any hour that it ran.

134
Q

Dedicated instances:

Dedicated Instances: designed to meet regulatory requirements. When you’ve strict server-bound licensing that won’t support multi-tenancy or cloud deployments, use dedicated hosts.

A

Multi-Tenant: When multiple customers run workloads on the same hardware. Virtual Isolation is what seperate customers.

Single Tenant: When a single customer has dedicated hardware.Physical Isolation is what separates customers.

Dedicated can be offered for:
* On-demand
* Reserved (up to 60% savings)
* Spot (up to 90% savings)
* Choose tenancy during EC2 launch

Enterprises and Large Organizations may have security concerns or obligations about sharing the same hardware with other AWS customers.

135
Q

AWS Savings Plan

AWS Savings Plan: Saving plans offer similar discounts as Reserved Instances (RI) but simplifies the purchasing process

A

3 types of savings plans:
* Compute Savings Plans
* EC2 Instance Savings Plans
* SageMaker Savings Plan

Choose two different terms:
* 1-year
* 3-year

Choose the following payment:
* All Upfront
* Partial Upfront
* No Upfront

136
Q

AWS Savings Plan

AWS Savings Plan has 3 different savings types:

A
  1. Compute: Compute Savings Plans provide the most flexibility and help to reduce cost up to 66%. Plans automatically appy to EC2 instance usage, AWS Fargate, and AWS Lamba service usage regardless of instance family, size, AZ, region, OS, or tenancy.
  2. EC2 Instances: Provide lowest prices, offering savings up to 72% in exchange for commitment to usage of individual instane family in a region. Automatically reduces your cost on the selected instance family in that region regardless of AZ, size, OS or tenancy. Provides flexibility to change usage between instances within a family in that region.
  3. SageMaker: Helps reduce SageMaker costs by up to 64%. Automatically apply SageMaker use regardless of instance family, size, component, or AWS region.
137
Q

Zero Trust Model

The Zero Trust model operates on the principle of “trust no one, verify everything.”
Malicious actors being able to by-pass conventional access controls demonstrates traditional security measures are no longer sufficient.

In the Zero Trust Model, Identity becomes the primary security perimeter.

A

What is the Primary Security Perimeter?
Primary or new security perimeter defines the first line of defense and its security controls that protect a company’s cloud resources and assests

Network-Centric: (Old-Way)
Traditional security focused on firewalls and VPNs since there were few employees or workstations outside the office or they were in specific remote offices.

Identity-Centric: (Neww-way): Bring-your-own-device, remote workstations is much more common, we can’t trust if the employee is in a secure location, we have identity-based secuity controls like MFA, or poroviding provisional access based on the level of risk from where, when, and what a user wants to access.
Identity-

138
Q

Zero Trust on AWS

Identity Security Controls: can implement on AWS to meet the Zero Trust Model.
AWS IAM
* IAM Policies
* Permission Boundaries
* Service Control Policies (organization-wide policies)
* IAM Policy Conditions
*aws:Sourcelp - Restrict on IP address
aws:RequestedRegion - Restrict on Region
aws:MultiFactorAuthPresent - Restrict if MFA is turned off
aws:CurrentTime - Restrict access based on time of day

AWS does not have a ready-to-use identity controls are intelligent, which is why AWS is considered to not have true Zero Trust offering for customers, and third-party services need to be used.

A

A collection of AWS Services can be setup to intelligent-ish detection of identity concerns but requires expert knowledge.

AWS CloudTrail: Tracks all API calls

Amazon GuardDuty: Detects suspicious or malicious activity (threats) based on CloudTrail and other logs.

Amazon Detective: Used to analyze, investigate and quickly identify security issues (can ingest findings from Guard Duty)

139
Q

Zero Trust on AWS with Third Parties

AWS does technically implement a Zero Tust Model but does not allow for intelligent identity security controls.

A

For example: Azure Active Directory has a Real-time and calculated risk detection based more data points than AWS eg: Device and application, time of day, location, MFA turned on, what’s being accessed; and the security controls, verifications or logic restriction is much more robust.

Third-Party Identity solutions with more intelligent security controls for real-time detection:
1. Azure Active Directory (Azure AD)
2. Google BeyondCorp
3. JumpCloud

These third-party services can be accessed on the cloud by using AWS Single Sign on (SSO) as the path to your AWS resources.

140
Q

Directory Service

Directory Servie: maps the names of network resources to their network addresses.

A

A directory service is shared information infrastructure for locating, managing, administering and organizing resources: volumes, folders, files, printers, users, groups, devices, telephone numbers, other objects.

A directory service is a critical component of network operating system.

A directory server (name server) is a server which provides a directory service.

Each resource on the network is considered an object by the directory server. Information about a particular resource is stored as a collection of attributes associated with that resource or object.

Well known directory services:
1. Domain Name Service (the directory service for the internet)
2. Microsoft Active Directory: Azure Active Directory
3. Apache Directory Server
4. Oracle Internet Directory (OID)
5. OpenLDAP
6. Cloud Identity
7. JumpCloud

141
Q

Active Directory:

Microsoft introduced Active Directory Domain Services in Windows 2000 to give organizations the ability to manage multiple on-premises infrastructure components and systems using a single identity per user.

A

It is organized into forest that contains domain linked to child domains that form the tree. Each child domain consist of organization units which contains multiple users.

142
Q
A
143
Q

Identity Providers (IdPs)

Identity Provider (IdP): a system that creates, maintains, and manages identity information for principals and also provides authentication services to applications within a federation or distributed network. A trusted provider of your user identity that lets you use authenticate to access other service. Identity Providers could be: Facebook, Amazon, Google, Twitter, Github, Linkedln.

A

Federated Identity: a method of linking a user’s identity across multiple separate identity management systems.

OpenID: Open standard and decentralized authentication protocol. Eg. be able to login into a different social medial platform using a Google or Facebook account. OpenID is about providing who are you.

OAuth2.0: Industry-standard protocol for authorization OAuth doesn’t share password data but instead uses authorization tokens to prove an identity between consumers and servies providers. Oauth is about granting acces to functionality.

SAML: Security Assertion Markup Language is an open standard for exchanging authentication and authorization between an identity provider and a service provider. An important use case for SAML is Single-Sign-On via web browser.

144
Q

Single sign-on (SSO)

SSO: an authentication scheme that allows a user to log in with a single ID and password to different system and software.

A

SSO allows IT departments to administrator a single identity that can access many machines and cloud services.

Azure Active Directory –SAML – SSO

Login for SSO is seamless, where once a user is logged into their primary directory, as soon as they utilitze this software they are not presented with a login screen.

145
Q

LDAP

Lightweight Directory Access Process (LDAP): an open, vendor-neutral, industry standard application protocol for accessing and maintaining distributed directory information services over an internet protocol (IP) network

A

A common use of LDAP is to provide a central place to store usernames and passwords

LAPD enables for same-sign on. Same sign-on allows users to single ID and password, but they have to enter it in every time they want to login.

Why use LDAP when SSO is more convenient?
Most SSO systems are using LDAP
LDAP was not designed natively to work with web-applications.
Some systems only support integration with LDAP and not SSO.

146
Q

MFA

Multi-Factor Authentication: security control where after you fill in your username/email and password you have to use a second device such as a phone to confirm that its you logging in.

A

MFA protects against people who have stolen your password.

MFA is an option in most cloud providers and even social media websites such as Facebook.

147
Q

Security Keys

Security Key: secondary device used as second step in authentication process to gain access to a device, workstation or application.

A

A security key can resemble a memory stick. When your finger makes contact with a button of exposed metal on the device, it will generate and autofill a security token.

A popular brand of security key is an Yubikey:
- works out of the box with Gmail, Facebook, and hundreds more
- supports FIDO2/WebAuthn, U2F
- waterproof and crush resistant
- USB-A and NFC dual connectors on a single key

148
Q

AWS IAM

AWS Identity and Access Management (IAM): create and manage AWS users and groups, and use permissions to allow and deny their access to AWS resources.

IAM Policies: JSON documents which grants permissions for a specific user, group or role to access services. Policies are attached to IAM Identities.

IAM Permission: API actions that can or cannot be performed. They are represented in the IAM Policy document.

A

IAM Identities:
IAM Users: End users who log into the console or interact with AWS resources programmatically or via clicking UI interfaces

IAM Groups: Group up your Users so they all share permission levels of the group eg. Administrators, Developers, Auditors

IAM Roles: Roles grant AWS resoures permission to specific AWS API actions Associate policies to a ROle and then assign it to an AWS resource.

149
Q

Anatomy of an IAM Policy

IAM Policies: written in JSON, and contain the permissions which determine what API actions are allowed or denied.

A
  1. Version policy language version
  2. Statement: container for the policy element you are allowed to have multiples
  3. Sid(optional): a way of labeling your statements
  4. Effect: Set whether the poliy will Allow or Deny
  5. Action: lost of actions that the policy allows or denies
  6. Principal: account, user, role, or federated user to which you would like to allow or deny access
  7. Resource: the resource to which the action(s) applies
  8. Condition (optional): circumstances under which the policy grants permission
150
Q

Principle of Least Privilege (PoLP)

PoLP: computer security concept of providing a user, role, or application the least amount of permissions to perform an operation or action.

A

Just-Enough-Access (JEA): Permitting only the exact actions for the identity to perform a task

Just-in-Time (JIT): Permitting the smallest length of duration an indentity can use permissions

ConsoleMe: an open-source Netflix projects to self-serve short-lived IAM policies so an end user can access AWS resources while enforcing JEA and JIT.

Risk-based adaptive policies: each attempt to access a resource generates a risk score of how likely the request is to be from a compromised source. The risk score could be based on many factors eg. device, user location, IP address what is being accessed and when.

AWS at the time of this recording does not have Risk-based adaptive policies built into IAM.

151
Q

AWS Account Root User

AWS Account: the account which hold all your AWS resources
AWS Account-Root User: a special account with full access that cannot be deleted
AWS Account-User: a user for common tasks that is assigned permissions

A

AWS Account Root User : special user who is created at the time of AWS account creation:
1. The Root User account uses an Email and Password to login. A regular user has to provide the Account ID/Alias, Username and Passoword
2. The Root User account cannot be deleted.
3. The Root User account has full permissions to the account and its permission cannot be limited. You cannot use IAM policies to explicitly deny the root user access to resources. You can only use an AWS Organizations service control policy (SCP) to limit permissions of the root user.
4. There can only be one Root user per AWS account.
5. The root user is instead for very specific and specialized tasks that are infrequently or rarely performed. An AWS Root Account should not be used for daily or common tasks.
6. Its strongly recommended to never use Root User Access Keys
7. Its strongly recommended to turn on MFA for the Root User.

152
Q

AWS Account Root User

Administrative Tasks that only the Root User can perform:

A
  1. Change your account settings - Includes the account name, email address, root user password, and root user access keys. Other account settings, such as contact information, payment currency preference, and Regions, do not require root user credentials.
  2. Restore IAM user permissions - If the only IAM administrator accidentally revokes their own permissions, you can sign in as the root user to edit policies and restore those permissions.
  3. Activate IAM access to the Billing and Cost Management console.
  4. View certain tax invoices
  5. Close AWS account
  6. Change or cancel AWS Support plan
  7. Regiser as a seller in the Reserved Instance Marketplace.
  8. Enable MFA Delete on an S3 Bucket.
  9. Edit or delete an Amazon S3 bucket policy that includes an invalid VPC ID or endpoint ID.
  10. Sign up for GovCloud
153
Q

AWS Single-sign On (AWS SSO)

AWS SSO: where you create, or connect, your workforce identities in AWS once and manage access centrally across your AWS organization.

A

1.Choose your identity source: AWS account, AWS applications, SAML applications.
2.Managed User Permissions Centrally: AWS account, AWS applications, SAML applications
3.Users get Single Click Access

154
Q

Appllication Integration

Application Integration: process of letting two independent applications to communicate and work with each other, commonly facilitated by an intermediate system.

A

Cloud workloads encourage systems and services to be loosely coupled and so AWS has many service for the specific purpose of application integration.

The common systems or design patterns utilized for Application Integration generally are:
queueing, streaming, pub/sub, API gateways, state machine, event bus.

155
Q

Queueing

Messaging system: used to provide asynchronous communication and decouple processes via messages / events. From a sender and receiver (producer and consumer)

Queueing system: a messenging system that generally delete messaes once they are consumed. Simple communication. Not real-time. Have to pull. Not reactive.

A

Simple Queueing Service (SQS): Fully managed queuing service that enables decoupling and scales microservices, distributed systems, and severless applications.
Use case: Need to queue up transaction emails to be sent. eg. Signup, reset password.

156
Q

Streaming

Streaming: a messenging system whereby multiple consumers can react to events (messages). Events live in the stream for long periods of time, so complex operations can be applied. Real-time. Eg. Amazon Kinesis

A

Amazon Kinesis: AWS fully managed solution for collecting, processing, and analyzing streaming data in the cloud.

157
Q

Pub/Sub

Publish-subscribe: pattern commonly implemented in messaging systems.
In a pub/sub system, the sender of messages (publishers) do not send their messages directly to receivers. Instead, they send their messages to an event bus which categorizes messages into groups. Then receivers of messages (subscribers) subscribe to these groups. Whenever new messages appear within their subscription the messages are immediately delivered to them. Use case: a real-time chat system. A web-hook system.

A

Publisher have no knowledge of identity of scubscribers

Subscribers do not pull for messages

Messagers are instead automatically and immediately pushed to subscribers.

Messages and events are interchangeable terms in pub/sub.

158
Q

Pub/Sub: SNS

Simple Notification Service (SNS): Highly available, durable, secure, fully managed pub/sub messaging service that enables you to decouple microservices, distributed systems, and severless applications.

A
  1. Publishers: AWS SDK, AWS CLI, CloudWatch, AWS Service
  2. Event bus: SNS topics, message filtering & fanout
  3. SUbscribers: Lambda, SQS, Email, HTTP/S
159
Q

API Gateway

API Gateway: program that sits between a single-entry point and multiple backends. API Gateway allows for throtting, logging, routing logic or formatting of the request and response.

A

Amazon API Gateway: creating secure API in cloud environment at any scale. Create APIs that act as front door for applications to access data, business logic, or functionality from back-end-services.

160
Q

State Machines

State machine: an abstract model which decides how one state moves to another based on a series of conditions. Think of a state machine like a flow chart.

A

AWS Step Functions:
-Coordinate multiple AWS services into a severless workflow
-A graphical console to visualize the components of application as a series of steps
-Automatically triggers and tracks each step, and retries when there are errors, so your application executes in order and as expected, every time
-Logs the state of each step, so when things go wrong, one can diagnose and debug problems quickly

161
Q

Event Bus

Event bus: receives events from a source and routes events to a target based on rules.

EventBridge is a serverless event bus service that is used for application integration by streaming real-time data to your applications. It was formerly called Amazon CloudWatch Events.

A

Event Bus: Holds event data, defines rules on an event bus to react to events.
Default Event Bus: AWS account has a default event bus
Custom Event Bus: Scoped to multiple accounts or other AWS accounts
SaaS Event Bus: Scoped with Third party SaaS Providers

Producers: AWS services that emit events

Partner Sources: Are third-party apps that can emit events to an event bus

Events: Data emitted by services, JSON objects that travel (stream) within the event bus.

Rules: Determines what events to capture and pass to targets. (100 Rules per bus)

Targets: AWS Services that consume events (5 targets per rule)

162
Q

Application Integration Services

  1. SNS: pub-sub messaging system that sends notifications via various formats such as plain-text email, http/s (webhooks) SMS (text messages), SQS and lambda. Push messages which then are sent to subscribers
  2. SQS: queueing messaging service. Send events to a queue. Other applications pull the queue for messages. Commonly used for background jobs.
  3. Step Functions: a state machine service that coordinates multiple AWS service into serverless workflows. Easily shares data among lambda and have a goup of lambdas wait for each other. Create logical steps. Also works with Fargate Tasks.
  4. EventBridge (CloudWatch Events) : serverless event bus that makes it easy to connect application together from own application, third-party services and AWS services.
  5. Kinesis: real-time streaming data service. Creates producers which send data to a stream. Multiple consumers can consume data within a stream. Use for real-time analytics, click streams, ingesting data from a fleet of IOT Devices.
  6. Amazon MQ: managed message broker service that uses Apache ActiveMQ
  7. Managed Kafka Service (MSK): fully manged Apache Kafka service. Kafka is an open-source platform for building real-time streaming data pipelines and applications. Similar to kinesis, more robust.
  8. API Gateway: fully-manged service for developers to create, publish, maintain, monitor, and secure APIs. Can create API endpoints and route them to AWS services.
  9. AppSync: Fully managed GraphQL service. GraphQL is an open-source agnostic query adaptor that allows you to query data from many different data sources.
A
163
Q

VMs vs Container

VMs do not make best use of space. Apps are not isolated which could cause conflicts, security problems, or resource hogging.

Containers allow running of multiple apps which are virtually isolated from each other. Launch new containers and configure OS dependies per container.

A

VM use hypervisor, containers use docker deamon

164
Q

Monolithic Architecture vs Microservices Architecture

A

Monolithic Architecture: one app which is responsible for everything. Functionality is tightly coupled.

Microservice Architecture: multiple apps which are each responsible for one thing. Functionality is isolate and stateless.

165
Q

Kubernetes

Kubernetes: an open-source container orchestration system for automating deployment, scaling and management of containers. Originally created by Google and now maintained by the Cloud Native Computing Foundation (CNCF)

A
  1. Kubernetes is commonly K8; The 8 represent the remaining letters “ubernete”
  2. The advantage of Kubernettes over Docker is the ability to run containers distributed across multiple VMs
  3. A unique component of Kubernettes are Pods. A pod is a group of one more containers with shared storage, network resources and other shared settings.
  4. Kubernettes is ideally for microservice architectures where a company has tens to hundreds of services they need to manage.
166
Q

Docker

Docker: a set of platform as a service (PaaS) products that use OS-level virtualization to deliver software in packages called containers.

A

Docker was the popularized open-source container platform. When people think of container, they think of Docker.

Docker CLI - CLI commands to download, upload, build, run and debug containers
Dockerfile - a configuration file on how to provision a container
Docker Compose - a tool and configuration file working with multiple containers
Docker Swarm - an orchestration tool for managing deployed multi-containers architectures
Dockerhub - public online repository for containers published by the community for download.

The Open Container Initiative (OCI): an open governance structure for creating open industry standards around container formats and runtime. Docker established the OCI and it is now maintained by the Linux Foundation.

Docker has been losing favor with developers due to their handling of introducing a paid open-source model and alternative like Podman are growing.

167
Q

Podman, Buildah and Skopeo

Podman: a container engine that is OCI-compliant and a drop-in replacement for Docker.

Podman is daemon-less where Docker uses a containered deamon
Podman allows you to create pods like K8, Docker does not have pods
Podman only replaces one part of Docker. Podman is to be used alongside Buildah and Skopeo

Buildah: a tool used to build OCI images

Skopeo: a tool for moving containing images between different types of container storages.

A
168
Q

Container Services.

Primary services, provisioning & deployment, supporting services

A

Primary Services:
1. Elastic Container Service (ECS): No cold starts, self-managed EC2
2. AWS Fargate: More robust than lambda, scale to zero cost, AWS-Managed EC2
3. Elastic Kubernetes Services (EKS): Open source; avoid vendor lock-in
4. AWS Lambda: Only think about code, short running tasks, can deploy custom containers

Provisioning & Deployment:
1. Elastic Benstalk(EB): ECS on training wheels, platform as a service
2. App Runner: Platform as a service, specifically for container
3. AWS Copilot CLI: build, release and operate production ready containerized applications on AWS App Runner, Amazon ECS, and AWS Fargate.

Suppoting Services:
1. Elastic container registry (ECR): Repos for your docker images.
2. X-ray: Analyze and debug between microservices
3. Step Functions: Stitch together lambdas and ECS tasks

169
Q

Organizations and Accounts:

AWS Organizations: allow the creation of new AWS accounts. Centrally manage billing, control access, compliance, security, and share resources across your AWS accounts.

A

Root Account User: a single sign-in-identity that has complete access to all AWS services and resources in an account. Each account has a Root Account User.

Organazation Units: a group of AWS accounts within an organization which can also contain other organization units - creating a heirachy

Service Control Policies: give central control over the allowed permissions for all accounts in your organization, helping to ensure your accounts stay within your organization’s guidelines

AWS Organizations must be turned on, once turned it cannot be turned off. One can create as many AWS accounts as possible, one account will be the Master/Root Account

AWS account is not the same as a User Account.

170
Q

AWS Control Tower

AWS Control Tower helps Enterprises quickly set-up a secure, AWS multi-account. Provides a baseline environment to get started with a multi-account architecture.

A

Landing zone: A landing zone is a baseline environment following well-architected and best practices to start launching production ready workloads. Eg. AWS SSO enabled, central logging for AWS CloudTrail, cross-account security auditing

Account Factory:
-automates provisioning of new accounts in your organization
-standardize the provisioning of new accounts with pre-approved account configurations
-configure your account factory with pre-approved netwok configuration and region selections
-enable self-service for your builders to configure and provision new accounts using AWS Service catalog.

Guardrails: pre-packaged governance rules for security, operations, and compliance that customers can select and apply enterprise-wide or to specific groups of accounts.

AWS control tower is the replacement for retired AWS Landing Zones.

171
Q

AWS Config

AWS Config: a compliance-as-code framework that allows us to manage change in your AWS accounts on a per region basis.

A

Change management in the context of cloud infrastructure: is the formal process to monitor, enforce and remediate changes.

Complian-as-code (CaC): is when we utilize programming to automate the monitoring, enforcing, and remediating changes to stay compliant with compliance programs or expected configuration

When should AWS Config be used?
-Resource to stay configured a specific way for compliance
-Keep track of configuration changes to resources.
-A list of all resources within a region
-Analyze potential security weakness, you need detailed historical information.

172
Q

AWS Quick Starts

AWS Quick Starts: prebuilt templates by AWS and AWS partners to help deploy wide range of stacks. Reduce hundreds of manual procedures into few steps

A

A Quick Start is composed of 3 parts:
1. A reference architecture for the deployment
2. AWS CloudFormation templates that automates and configure the deployment
3. A deployment guide explaining the architecture and implementation in detail.

Most QuickStart reference deployments enable you to spin up a fully functional architecture in less than an hour!

173
Q

Tagging

Tagging is a key value pair that one can assign to AWS resources.

A

Tag allos you to organize resources in the ff ways:
1. Resources management: specific workloads, environments eg. Developer Environments
2. Cost management and optimization: cost tracking, budgets, alerts
3. Operations management: Business commitments and SLA operations eg. Mission-critical services
4. Security: classification of data and security impact
5. Governance and regulatory compliance
6. Automation
7. Workload optimization

Tag Examples:
Dept = Finance
Status = Approved
Team = compliance
Environment = production
Project = enterprise
location = Canada

174
Q

Resources Groups

Resource groups are a collection of resources that share one or more tags

A

Helps you organize and consolidate information based on your project and the resources that you use.

Resource groups can display detailes about a group of resource based on metrics, alarms, configuration settings.

At any time, one can modify the settings of your resources groups to change.

Resource Groups appears in the Global Console Header and under Systems Manager.

175
Q

Business Centric Services

A

Amazon Connet: virtual call center service. Can create workflow to route callers, record phone calls, manage a queue of callers. Based on the same proven system used by the Amazon customer service teams.

Workspaces: virtual remote desktop serivice. Secure manage service for provisioning either Windows of Linux desktops in just few minutes which quickly scales up to thousands of desktops.

WorkDocs: shared collaboration service. A centralized storage to share content and files. Similar to Microsoft Sharepoint. Think of it as a shared folder where the company has ownership.

Chime: video-confrence service. It is similar to zoom or skype. One can screenshare, have multiple poeple on the call. It is secure by default and can show you a calendary of upcoming calls.

WorkMail: managed business email, contacts, and calendar service with support for existing desktop and mobile client applications. (IMAP). SImilar to Gmail or Exchange.

Pinpoint: a marketing campaign management service. It is used for sending targeted email via SMS, push notifications, and voice messages. One can perform A/B testing or create journeys (complex email response workflows)

Simple Email Service (SES): transactional email service. You can integrate SES into your application to send emails. Can create common template, track open-rates, keep track of your reputatuon.

Quicksight: a Buisiness Intelligence (BI) service. Connect multiple data sources and quickly visualize data in the form of graphs with littel to no programming knowledge.

176
Q

Provisioning Services

Provisioning is the allocation or creation of resources and services to customer. AWS Provisioning Services are responsible for setting up and then managing those AWS Services.

A

Elastic Beanstalk (EB): a platform as a service (PaaS) to easily deploy web-applications. EB provision varios AWS services including EC2, S3, SNS, CloudWatch, EC2, Autoscaling groups, and ELB. If you’ve ever used Heroku, it is the AWS equivalent.

AWS OpsWorks: configuration management service that also provides managed instances of the open-source configuration managed software chef and puppet.

CloudFormation: infrastructure modeling and provisioning service. Automate the provisioning of AWS services by writing CloudFormation templates in either JSON or YAML files. This is known as infrastructure as code (IaC).

AWS Quickstarts: pre-made packages that can launch and configure AWS compute, network, storage and other service required to deploy a workload on AWS.

AWS Marketplace: digital catalogue of thousands of software listings from independent software vendors one can use to find, buy, test and deploy software.

AWS Amplify : a mobile and web-application framework that will provision multiple AWS service as your backend.

AWS app runner: A fully managed service that makes it easy for developers to quickly deploy containerized web applications and APIs at scale with no prior infrastructure experience required.

AWS Copilot: a CLI that enables customers to quickly launch and easily manage containerized applications on AWS.

AWS CodeStar: provides a unified user interface, enabling you to easily manage your software development activities in oneplace. Easily launch common types of stacks eg. LAMP

AWS Cloud Development kit (CDK): infrastructure as code (IaC) tool. Allows you to use your favoritye programming language. Generates out CloudFormation as the means for IaC.

177
Q

AWS Elastic Beanstalk

PaaS allows customers to develop, run and manage applications without the complexity of building and maintaining the infrastructure typically associated with developing and launching an app

Elastic Beanstalk: PaaS for deploying web-applications with little-to-no knowledge of the underlying infrastructure so you can focus on writing application code instead of setting up an automated deployment pipeline and DevOps tasks. Choose a platform, upload your code and it runs with little knowledge of the infrastructure. Not recommended for “production” applications.
Production refers to enterprise, large companies by AWS.

Elastic Beanstalk is powered by a Cloudformation setups for ELB, autoscaling groups, RDS, EC2, EC2 instance preconfigured (or custom) platforms, monitoring (cloudwatch, SNS), in-place and blue/green deployment methodologies, security (rotates passwords), can run dockerized environments.

A
178
Q
A

AWS (3 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions