Day1 Flashcards
Pillar of cloud computing
Operational excellence -run and monitor system
Perform operations as code, limit
human error
Small, frequent, reversible change
Anticipate failure
Refine operation procedures
Security
Implement strong identity foundation Enable traceability Automate security best practices Protect data in transit and at rest Keep people away from data Anticipate security failure and recovery procedures Reliability - mitigate and recover from disruptions Monitor KPI Test recovery procedures Scale horizontally Stop guessing Manage change via automation
Performance efficiency - use resources effectively
Go global in minutes
Utilize serverless architecture
Experiment often
Cost optimization
Implement cloud finance management
Adopt a consumption model
Measure overall efficiency
Stop spending money on heavy lifting
Analyze and attribute expenditure
Sustainability
Cloud computing
Pay as u go including compute (service), storage ,database and network
Allow consumers to trade capital expense for operation expense
Increase business speed, agility and availability
Customer responsibility
Secure data
Configuration of virtual infrastructure and systems
Configuration of managed services or 3rd party software
Benefits of cloud
Agility - increase agility of business
Pay as you go - trade capital expense for operating expense
Economy of scale- benefits from massive economies of scale
Global reach - go global in minutes
Security- shared responsibility model
Reliability-performs how you need it
Availability- accessible when needed
Scalability- Grows with demand
Elasticity - quickly add/remove resources
AWS global infrastructure
Regions -34
Availability zones - data center-108
Edge locations - a site used to cache copies of data for faster delivery to end users. Mostly used for cloud front services
5 tenets of aws architecture
High availability - multiple regions and availability zone
Scalability - vertical(scaling up - update resources) &horizontal scaling out
Elasticity - automatic add resources
Fault tolerance -failover, no single point failure
High Durability - ability to recover from disaster
RTO max time afford to be offline
RPO max data that can be lost
Tools to manage aws resources
Manage console
Software development kits
Command line interface
AWS acct
12 digits
AWS support case
Give other user access to you resources
Not root user
Access key
Access Key id
Secret access key
Same permission as the user they are attached to
Required to have programmatic access to AWS resource outside of the console
Can be deactivate and regenerate new ones for a user on demand
Main services -ec2 and lambda
EC2
AWS compute service to launch VM
Mason machine images ??are templates for creating EC2
Type:
General purpose
Compute optimized
Memory optimized
Accelerated optimized for ML
Storage optimized
Tenancy:
Shared- multiple AWS acts Dedicated instance - multiple VMs on one host Dedicated host- own physical server
Models:
On demand - pay as I go, hourly rate
Reserved instance - best for application having steady usage, can be standard or convertible, cheaper than pay as u go. Can pay upfront, partial or no upfront.
Can be shared between accounts and can be sold
Spot instances- can be interrupted , AWS can take it back
Auto scaling and load balancer
Auto scaling group- can automatically add or remove instances
Elb - application load balancer and network load balancer
VM and containers
VM utilize software to replicate using an actual server- Amazon light sail
Containers have everything an application needs to run on a server
ECS - support dockercontainers
ECS fargate- more hands-off container management service
Elastic kubernetes services- more hands-on container management service that utilize kubernetes
Serverless
No dedicated server
AWS lambda is the primary serverless compute model
AWS elastic beanstalk is a fully managed service to allow you to deploy serverless web application, based off of cloud formation template
Storage
EBS- block storage, compatible with EC2
EFS - file storage, multiple users need to access same drive folder
s3 -objects storage, offers virtually unlimited amounts of storage
AWS snow family- used to migrate data in or out of AWS cloud
S3 storage class
Standard- 99.99%, 11 9’s durability, replicated across at least three zones
S3 intelligent tiering - use ML to move objects to most appropriate storage class
S3 standard IA( infrequent access) - best if objects are accessed less than once a month, cheaper than standard but fast retrieval
S3 one zone IA- same as standard IA in one zone
S3 glacier - long term storage ideal for archives. Very cheap but data retrieval takes minutes to hours
S3 Glacier deep archive- same as glacier but cheaper and slower
AWS snow family
Physical device to move data in and out of AWS cloud
AWS snowcone - 8 tb for HDD, 14tb for SSD
AWS snowball-
edge optimized-80tb HDD
Compute optimized-28TB ssd
AWS snowmobile
Semi truck of storage
100pb or more
Elastic file system
Mount on ec2 or lambda
Options:
Standard
Standard IA
One zone
One zone IA
EBS- elastic block storage
Most useful for EC2
Can be attached to multiple instances but only one at a time
Options:
SSD based- general purpose and provisioned iops
HDD based - throughput optimized and cold storage
AWS database
Relational - rds
Amazon aurora- fully managed RDBS service
DynamoDB- non-sql db, extremely fast, guaranteed return in seconds
DocumentDB - non-sql primarily used for mongoDB
Redshift- data warehouse solution, similar to sql but run extremely large and complex query, for online analytical processing
Elasticache- baes off memcached and redis, in-memory data storage
Data migration service-
AWS networking
Security groups -
work at instance level
Implicitly deny all traffic
Work off of allow rule only( stateful)
NACL - network access control list
Work at subnet level
Virtual fire wall at the network level
Use allow and deny rules( stateless)
Deny rule overwrite allow rule
VPN and direct connect
VPN- (virtual private network) On- premise version of VPC
Can be established from on-premise resource to AWS
AWS direct connect- direct physical connection to AWS so you never touches public internet
AWS security
7 layers
Data
Application - app updated without vulnerability
Compute - controlled access to VM
Network
Perimeter - ddos
Identity and access
Physical
Encryption
Intransit- ssl/tls
At rest- s3 SSE, rds db
AES-256 most secure
AWS inspector
Run security benchmark against EC2