Base Concepts Flashcards
AWS Regions
Isolated between each other
ends with a number (e.g. eu-west-1)
Have at least 2 AZ
Availability Zones
children of regions
include ONE or more data centers with redundant networking, power and connectivity
suffix with a b c (eu-west-1a)
connected with high bandwidth, ultra-low latency connections
Edge Locations
the places where data are cached to reduce latency
used by CloudFront to cache copies
Local Zones
An extension of AWS
Multi-tenants (used by multiple parties, not just one company like Outposts)
Global Services
IAM
CloudFront
Route 53
S3
AWS Outposts
Provide local access to AWS-managed infra
Build and run apps on-premises
Deploy on customer site
Managed by AWS
Wavelength Zones
Let developers build apps with ultra-low latencies to 5G and users
VPC
Virtual Private Cloud
Span across multiple availability zones but stay within on region
Internet Gateway
Connect a public subnet to the internet
Subnet
Public and private
Reside within an AZ
NAT
NAT gateway is Managed by AWS
NAT instances are managed by the user
Both allow a private subnet to connect to the interne
Security Group
Can only have ALLOW rule
Control access to EC2 or Elastic Network Interface (ENI)
A kind of firewall
Return traffic is automatically allowed, no matter the rules (Stateful)
Network Access Control List (NACL)
Can contain rules for IP only
can have ALLOW/DENY rules
Filter traffic in and out Subnet
Return traffic must be explicitly allowed
VPC Flow logs
Provides info about IP traffic in and out of interfaces
Can store in S3/CloudWatch logs
Must be enabled manually
VPC Peering
Connect two VPC
CIDR must not overlap
Only work with two VPC
VPC can be in different Regions
VPC Endpoints
Connect to AWS services using a private network
VPN CloudHub
operates on a simple hub-and-spoke model that you can use with or without a VPC
Use this approach if you have multiple branch offices and existing Internet connections and would like to implement a convenient, potentially low-cost hub-and-spoke model for primary or backup connectivity between these remote offices
Direct Connect
Physical connection from the on-premise server to AWS
Takes a long time to provision because AWS needs to build a physical line from on-premise to AWS cloud
Private & secure & Expensive
Site-to-Site VPN
Connect user’s on-premise VPN to AWS
Using internet connection (not private)
The on-premise server must have a Customer Gateway
AWS must use Virtual Private Gateway
Transit gateway
Transitive between many VPC
Connect, join all the above types of connect
