S.A.A. Flashcards
CH 1
PG 5
Three models of cloud computing
IaaS- Customer manages** Application Runtime Security Database AWS manages** Servers Virtualization Server Hardware Storage Networking
PaaS
Customer manages**
Application
AWS manages everything else
SaaS
AWS manages everything
CH1
PG5
What are the three cloud computing Deployment Models?
What are the numbers of:
Regions?
AZ’s?
Edge locations?
The 3 deployment models are: All in cloud, Hybrid, and On premise Cloud
Regions QTY 18
AZ’s QTY 53
Edge locations QTY 18
CH1
Pg 9
What are the important industry certifications AWS has earned?
- SOC 1/SSAE 16/ISAE 3402/ (formerly SAS 70)
- SOC 2
- SOC 3
- FISMA, DIACAP, and FedRAMP
- DOD CSM Levls 1-5
- PCI DSS Level 1
- ISO 9001/ ISO 27001
- ITAR
- FIPS 140-2
- MTCS
- Level 3
- Cloud Security Alliance (CSA)
- Family Educational rights and Privacy ACT (FERPA)
- Criminal Justice Information Services (CJIS)
- Health Insurance Portability and Accountability Act (HIPAA)
- Motion Picture Association of America (MPAA)
CH1
PG11
Compute:
Amazon Elastic Compute Cloud (EC2)
Amazon EC2 Auto Scaling
AWS Lambda
EC2 container service
EC2 = virtual instances, up to 30 different types: Compute, memory, GPU optimized.
EC2 autoscaling = helps automatically scale EC2 instances up or down. Creates high availability architecture. Also ensures you are always running with the desired instance number
AWS lambda = enables you to run code without provisioning or managing any servers or infrastructure. Scales automatically, only pay when the code is running.
EC2 container service = allows you to run Docker’s containers on Amazon EC2 instances. Managed with API calls. ECS, you don’t have to install, scale or operate your own cluster management infrastructure
CH1
PG12
Compute:
Elastic Beanstalk?
LightSail?
Batch?
Elastic beanstalk = lets you run and manage web applications without worrying about the underlying infrastructure. Use ECS to deploy web applications and Elastic Beanstalk automatically handles deployment, load balancing, auto scaling, and application health monitoring.
Lightsail = great for SMB, developers, students, and anyone who needs a Simple Virtual private Server (VPS) solution. Lightsail provides storage, networking capacity, and compute capabilities to manage and deploy web sites and web applications in the cloud. One stop shop to launch your project instantly.
Batch = allows you to run thousands of batch computing jobs on AWS. Batch dynamically provisions the optimal type and quantity of compute resources such as memory optimized instances, CPU intensive instances, or storage optimized instances.
CH1
PG 12
Networking:
Virtual Private Cloud?
Route 53?
Elastic Load Balancing?
Direct Connect?
Virtual Private Cloud = allows you to isolate cloud resources within your own private virtual network. VPC is your own data center in the cloud.
Route 53 = is a Domain Name System web services. SLA 100% uptime. Its IPv4 and IPv6
Elastic Load Balancing = allows you to automatically distribute the local across multiple Amazon EC2 instances. Supports load balancing of HTTP, HTTPS, and TCP traffic to EC2 instances. Can be integrated with Auto Scaling
Direct Connect = establishes a private dedicated network connectivity from your data center to AWS
CH1
PG13
Security and Compliance:
Identity and Access Management?
Inspector
Certificate Manger
Directory Service
Identity and Access Management = (IAM) is used to create users, groups, and roles. It is also used to mange and control access to AWS services and resources. It can also be federated with other systems, thereby allowing existing identities (groups user, and roles) of your enterprise to access AWS resources.
Inspector = is an automated security assessment service that helps you to identify the security vulnerabilities in you application when it is being deployed as well as when it is running in a production system. Also assess if an application is deviating from best practices.
Certificate Manager = I sued to manage secure sockets layer (SSL) certificates to use with AWS services. With ACM you can provision, manage and deploy SSL/Transport Layer Security (TLS) certificates. Also used to obtain, renew and import certificates.
Directory Service = is a managed directory service built on MS Active Directory, it can be used to manage AD in the cloud. It enables single sign on and policy management
CH1
PG13
Security and Compliance:
Web Application Firewall?
Shield?
Web Application Firewall = (WAF) is a web application firewall that detects malicious traffic targeted at the web applications. WAF can be used to create rules to protect against SQL injection and scripting
Shield = is a managed service that protects against distributed denial of service (DDoS) attacks targeted at the web applications.
Standard – is free and protects against most commonly occurring DDoS
Attacks
Advanced - includes additional protection for Elastic Load
Balancer, Amazon CloudFront, and Amazon Route 53
CH 1
PG 14
Storage and Content Delivery:
Simple Shared Storage (S3)?
Glacier?
Elastic Block Storage?
Elastic File System?
S3 = It is the storage for the internet, also used as an object store. Lets you store and retrieve any amount of data, at any time, from anywhere on the Web. It is highly scalable, reliable and secure. Each file cant exceed 5TB
Glacier = is a low cost cloud storage that is mainly used for data archiving and long-term back up purposes. No limit to amount stored. Cheaper than S3, and pay only for what you use.
Elastic Block Storage = choose from either magnetic or SSD. EBS are automatically replicated within their AZ’s to provide fault tolerance and high availability. Can create snapshots using EBS.
Elastic file system = is a fully managed service that provides easy, scalable, shared file storage with Amazon Ec2 instances.
CH1
PG 15
Storage and Content Delivery:
Storage Gateway?
Import/Export Options?
Cloud Front?
Storage Gateway = helps integrate on-premise storage with AWS cloud storage. Its delivered in a virtual machine installed in an on-premise data center. Can be connected as a file server or can connect it as a local disk. Can be integrated with Amazon S3, Amazon EBS, and Amazon Glacier.
Import/Export Options = can be done with Snowball 80TB or 50TB version. Another option is Direct Connect.
Cloud Front = is the global content delivery network (CDN). It helps to accelerate the delivery of the static content of your web sites including photos, videos, or any other web assets. Can also be used to deliver dynamic content.
CH1
PG 16
Database:
Relational Database Service?
Dynamo DB?
Redshift?
ElasticCache?
Aurora?
Relational Database Service = is a fully managed relational database service. RDS supports mySQL, Oracle, SQL Server, PostgretSQL and Maria DB. Also supports Amazons own database Aurora. Can scale up or down.
DynamoDB = is a fully managed NoSQL database service of AW. It is highly scalable, durable, and highly available and is capable of handling any data volume. It delivers single digit millisecond latency at any scale. No need for database administration. Great fit for mobile, web, gaming, Internet of Things (IoT)
Redshift = is a fully managed peta-byte scale data warehouse service. Stores data in column format providing better I/O efficiency. Continuously backed up on S3
ElasticCache = is a service that helps in deploying an in-memory engines: Redis and Memcached. Since its managed AWS will take care of patching, monitoring, failure recovery and back up. Can also be integrated with CloudWatch and SNS
Aurora = is Amazons relational database built for the cloud. It supports two open source RDBMS engines: MySQL and PostegreSQL it supports database up to 64TB. By default its mirrored into 3 AZ’s and 6 copies of the data are kept. You can create up to 15 read replicas.
CH1
PG 17
Analytics:
Athena?
EMR?
ElasticSearch Service?
CloudSearch?
Data Pipeline?
Athena = is a severless interactive query service that enables users to easily analyze data in S3 using standard SQL. No need for infrastructure setup or management required for end users. Uses Presto with full standard SQL support that works with a variety of standard formats JSON, ORC, CSV, ARVO and Apache Parquet
EMR = is a web service that enables users, businesses, enterprise, data analysist, researchers and developers to process enormouse amounts of data. Utilizes hosted Hadoop freamework running on the web-scale infrastructure of Amazon S3 and Amazon EC2
Elasticsearch Service = is a fully managed web service that makes it easy to create operate and deploy and scale ElastichSearch clusters
CloudSearch = is a fully managed web service that allows you to search solutions for your applications or web site. Supports 34 languages
CH!
PG 18
Analytics:
Kinesis?
QuickSight?
Kinesis= is a fully managed service that collect, analyze, and process retime streaming data. This enables users to get timely insights and react quickly to new information
Quicksight = is a could powered, fully managed business analytics service that makes it east to build visualizations, perform ad hoc analysis, and quickly get insight from your data.
CH1
PG 18
Application Services:
Amazon API Gateway?
Step Function?
Simple Workflow Service?
Elastic Transcoder?
API Gateway = is a fully managed service that provides developers with scalable, flexile, pay as you go service that handles all aspects of building, deploying and operating robust API’s for application back-end services such as code
Step Function = is a fully managed service that enables users to efficiently and securely coordinate various components of distributed applications and microservices using visual workflows. Service provides a graphic interface for users to visualize and arrange the components of their applications, making it easy to run and build multiple layered step applications
Simple Workflow Service = SWF is a web abased cloud service that coordinates work across distributed applications components. It enables applications for a rance of use cases, including web applications back ends, media processing, business process workflows and data. Analytics pipeline to be designed as a coordination of jobs and tasks.
Elastic Transcoder = it converts (or transcode) video and audio files from their source format into the output format of their choice that they can play back on various devices such as smartphones, desktops televisions, tablets and PC’s
CH1
PG 19
Developer Tools:
CodeCommit?
CodePipeline?
CodeBuild?
CodeDeploy?
CodeCommit = is a fully managed source control service that host highly scalable private GIT repositories.
CodePipeline = is a fully managed continuous integration and continuous delivery service for quick reliable application and infrastructure updates. Codepipeline builds, tests, and deploy code every time the code is modified, update and checked in based on the release process models you define.
CodeBuild = is a fully managed build service that builds and compiles source code, run tests, and products software packages that are ready to deploy, eliminating the need to provision manage and scale build servers.
CodeDeploy = is fully managed service that automates code deployments to any instance or servers, including Amazon EC2 instances and servers running on premises.
CH1
PG20
Management Tools:
CloudFormation?
ServiceCatlog?
OpsWorks?
CouldWatch?
CloudFormation = helps automate resource provisioning using declarative templates and deploying resource stacks. It gives developers and systems administration an easy way to create and manage collections of related AWS resources, provisioning, and updating them in an orderly and predictable fashion.
Service Catalog = allows IT administrators to create, manage and distribute catalogs of approved products to end users, who can then access the products they need in a personalized portal.
OpsWorks = for Chef automated provides a fully manage Chef server and suite of automation tools that gives you workflow automation for continuous deployment automated testing for compliance and security and user interace that gives you visibility into your nodes and their status.The Cehf server gives you full stack automated by handling operational tasks suchas software and operating system configurations package installations database setups and more.
CloudWath = is a monitoring service for AWS cloud resources and the applications you run on AWS. It is used to collect and track metrics collect and monitor log files and set alarms. It is used to get systemwide visibility into resource utilization, application performance, and operational health.
CH!1
PG 21
Management Tools:
AWS Config?
AWS Cloud Trail?
AWS Config = is a fully managed service that provides you with an AWS resource inventory configuration history and configuration change notifications to enable security and governance. It enables compliance auditing, security analysis, resources change tracking, and troubleshooting.
AWS Cloudtrail = is a managed web service that records AWS API calls and user activity in your account and delivers log files to you via Amazon S3. Provides visibility into user activity by recording API calls made on your account.
CH1
PG 21
Messaging:
Simple Notification Service?
Simple Email Service?
Simple Queue Service?
Simple Notification Service = is scalable, flexible and cost effective web service that makes it easy to configure operate and send notifications from the cloud
Simple Email Service = SES is a way to publish messages from an application and immediately deliver them to subscribers or other applications.
Simple Queue Service = SQS is a managed web service that gives you access to messages queues to store messages waiting to be processed
CH1
PG 22
Migration:
Application Discovery Service?
Database Migration Service?
Snowball?
Server Migration Service?
Application Discovery Service = enables you to quickly and reliably plan applications migration projects by automatically identifying applications running in on premise data centers and mapping their association dependencies and their performance profiles.
Database Migration Service = helps you migrate database to AWS reliably and securely. The source database remains fully operational during the migration, minimizing downtime. Data can be migrated homogenously or heterogeneously.
Snowball = helps transform a petabyte-scale amount of data into and out of the AWS cloud.
Server Migration Service = SMS is an agentless service that helps coordinate, automate, Schedule, and track large scale server migrations.
CH1
PG 22
Artificial Intelligence:
Lex?
Polly?
Rekogntion?
Machine Learning?
Lex = is a fully managed service for building conversational chatbot interfaces using voice and text. Provides high-quality language understanding capabilities and speech recognition?
Polly = converts text into lifelike speech. It enables existing applications to speak and create the opportunity for entirely new categories of speech-enabled products, including chatbots, cars, mobile apps, devices and web applications
Rekognition = is a fully managed easy to use reliable and efficient image rekognition service powered by deep learning. Its API’s detects thousands of scenes and objects, analyze faces, compares faces, to measure similarity and identifies face in a collect of faces
Machine Learning= is a fully managed machine service that allows you to efficiently build predictive applications, including demand forecasting fraud detection and click prediction
CH1
PG 23
Internet of Things:
IoT Platform?
IoT Greengrass?
IoT Button?
IoT Platform = is a fully managed cloud platform that lets connected devices interact with cloud applications and other devices securely and efficiently.
IoT Greengrass = is a software solution that lets you run local compute, messaging and data caching for connected IoT devices in an efficient and secure way. It enables you to run Lambda functions, keep data in sync and communicate with other devices securely, even when Internet connectivity is not possible.
IoT Button = is a programable button based on the Amazon Dash button hardware. This simple wifi device is easy to configure and designed for developers to get started with AWS IoT, AWS Lambda, Amazon DynamoDB,
CH 1
PG 24
Mobile services:
Cognito?
Mobile Hub?
Device Farm?
Mobile Analytics?
Cognito = Is a web service lets you add users to sign up and sing into your mobile and web apps fast and reliability. It lets you authenticate users through social identity provides such as Twitter, Facebook, or Amazon SNS and many other Amazon web services without writing device specific code
Mobile Hub = lets you can select and configure features to add toyour mobile app. AWS Mobile Hub features help intergrate various AWS services, client SDK’s and client integration code to quickly and easily add new features and capabilities to your mobile app
Device Farm = lets you test mobile apps on real mobile devices and tablets
Mobile Analytics = enables you to measure the app usage and revenue. It helps you track key trends and patterns such as new users versus returning users, user retention, app revenue
CH2
PG 29
Storage:
Advantages of Simple storage Service?
Simple – intuitive graphic web based console. Also has a mobile app used to manage S3. For easy 3rd part integration S3 provides REST API’s and SDK’s
Scalable – can store unlimited data
Durable – only service that provides 99.99999999 percent durability
Secured – supports encryption and the data Is automatically encrypted once uploaded. Supports SSL and IAM
High Performance – lets you choose the AWS region to store data to end user to reduce latency. Also integrated with CloudFront
Available – has 99.99 availability annually give the following potential unavailability
Daily: 8.6 seconds
Weekly: 1 minute and .5 seconds
Monthly: 4 minutes and 23 seconds
Yearly: 52 minutes and 35.7 seconds
Easy integration – can be easily integrated with third party tools as a result it is easy to build an application on top of S3
CH2
PG30
Usage of Amazon S3 in Real Life?
Backup – popular for backup files since its durability is 99.999999999. Also provides versioning capacity
Tape Replacement – S3 replaced magnetic tapes
Static web stie hosting – S3 is scalable and can handle any amount of traffic, and you can store unlimited data
Application hosting – used for hosting mobile and internet based-apps. You can access and deploy website from anywhere in the world
Disaster recovery – S3 supports cross region replication you can automatically replicate each S3 object to a different bucket in a different region
Content distribution – S3 often used to distribute content over the internet. The content can be anything such as files or photos media and so on. Also be used as a software delivery platform. Can be distributed through S3 or Cloud Front.
Data Lake – is a central place for storing massive amounts of data that can be processed, analyzed and consumed by different business units in an organization. S3 is often used with EMR, Redshit, Redshift Spectrum, Athena, Glue and Quick sight for running big data alalytics
Private Repository – using amazon S3 you can create your own private repository like with GIT YUM or Maven
CH2
PG32
S3 basic concepts?
Bucket – is actually a container for storing objects. Cannot have two buckets with the same name even across multiple regions. Buckets serve the following purposes
• Organizes S3 namespace at the highest level
• Identifies the accounts responsible for charges
• Plays a role in access control
• Serves as the unit of aggregation for usage reporting
By default the data of a bucket is not replicated to any other region unless you do it manually or by using cross region replication. The object stored in the reion never leaves the region unless you explicitly transfer it to a different region.
S3 is accessible through API, which allows developers to write applications on top of S3. The fundamental interface is Representation State Transfer (REST) API. S3 does support SOAP over HTTP but its depreciated. Use REST API over SOAP.
Using REST API you can create , read , update, delete and list.
HTTPS is better over HTTP since its secure.
Verbs
• GET = Read
• PUT = Create
• DELETE = Delete
• POST = Create
CH2
PG 35
Steps for installing AWS Command Line Interface?
S3 Data Consistency Model?
Steps for installing AWS Command Line Interface = is primarily distributed on Linux, Windows, and macOS in pip. A package manager for Python that provides ane easy way to install python packages and their dependencies
S3 Data Consistency Model = S3 is intended to be a “write once read many times” storage. Therefore infrastructure is different from traditional SAN architecture. The entire architecture is redundant.S3 Standard uses a minimum of 3 AZ’s to store the data.S3 does not support object locking, which means If there are request to update the same file concurrently (PUT request), the request with the latest time stamps wins.
Name of an S3 bucket is unique and by the combining the bucket name and object name (key), every object can be identified uniquely across the globe.
CH2
PG 40
Encryption in Amazon S3:
SSE with Amazon S3 Key Management (SSE-SE)?
SSE with customer-provided keys (SSE-C)?
SSE with AWS Key Management Service KMS (SSE-KMS)?
Side notes: If you upload the data using HTTPS and use SSL-encrypted endpoints the data is automatically secure for all the uploads and downloads, and the data remains encrypted during transit.
SSE with Amazon S3 Key Management (SSE-SE) = In this case, Amazon S3will encrpt your data at rest and manage the encryption keys for you.
• Each object is encrypted using a per object key
• The per object key is encrypted using a master key
• The master key is managed using S3 management
• Can be turned on through S3 console or command line interface or SDK
SSE with customer-provided keys (SSE-C) = Amazon will encrypt your data at rest using the custom encryption keys that you provide. To use SSE-C simply include your custom encryption key in your upload request, and Amazon S3 encrypts.the objects using the key and securely stores the encrypted data at rest.
SSE with AWS Key Management Service KMS (SSE-KMS)= with this there are separate permissions for the user of the master key , providing an additional layer of control as well as protection against unauthorized access to your object. KMS provides an audit trail so you can see whop used your key to access which object and when. As well as view failed attempts to access data from users without permission
CH2
PG 44
Amazon S3 Storage Class:
S3 standard?
S3 standard Infrequent Access (IA)?
S3 Reduced Redundancy Storage (RRS)?
S3 One Zone-Infrequent Access (S3 One Zone IA)?
Glacier?
S3 standard = is the default for frequently accessed data. Most common usage for web sites, content storage, and big data analytic, mobile applications. This is designed for durability 99.(11x9)%. Supports SSL encryption of data
S3 standard Infrequent Access (IA) = for data accessed less frequently. Had the same durability but its availability is 99.9 percent over a given year. Cost is much cheaper than S3 standard, which makes it economical for long term storage, back up, and disaster recovery
S3 Reduced Redundancy Storage (RRS) = is used to store noncritical, nonproduction data. It is often used for storing data that can be easily reproduced. RRS has 99.99 durability and availability. It is designed to sustain the loss of data in a single facility.
S3 One Zone-Infrequent Access (S3 One Zone IA) = is for data access less frequently but requires rapid access when needed. Same high durability and through put and low latency of S3 standard but cost 20% less
Glacier = is the storage class mainly used for data archiving. Provides 99.99999999 durability of objects and used for archiving data.
• Expedited retrieval: 1-5 minutes
• Standard retrieval: 3-5 hours
• Bulk retrieval: 5-12 hours
CH2
PG46
Versioning of Objects in Amazon S3?
Amazon S3 Object Lifecycle Management?
Amazon S3 Cross Region Replication?
Versioning of Objects in Amazon S3 = is like insurance policies; you know that regardless of what happens your file is safe. Once you enable versioning you cant disable it. However you can suspend versioning to stop the versioning of objects.
Amazon S3 Object Lifecycle Management =
• Transition Action- the means you can define when the opbjects can be transitioned to another storage class. For Example you may want to cope all older log files after another seven days to S3 IA
• Expiration action- in this case you define what is going to happen when the objects expire. For example if you delete a file from S3 whare are you going to do that file.
Amazon S34 Cross Region Replication = if you automatically copy the files from one region to another, you need to enable cross-regional replication. If you don’t enable versioning you wont be able to do cross-region replication. You Will get an error. CRR copies only the new objects. If you have preexisting files in the bucket you must copy them manually.
CH2
PG51
Static Website Hosting in Amazon S3?
Amazon Glacier:
Magnetic tape replacement?
HealthCare/Life scientific data storage?
Media assets archiving/digital preservation?
Compliance archiving/long-term backup?
Static Website Hosting in Amazon S3 = Lab
Magnetic tape replacement = has zero addition, these is no maintenance overhead like with magnetic tape, and you get the same durability as S3
HealthCare/Life scientific data storage = with the advancement in life sciences such as genomic data, a single sequence of genomes can take up to a terabyte of data
Media assets archiving/digital preservation = Media assets such as video of news coverage and game coverage can grow to several petabytes quickly.
Compliance archiving/long-term backup = many organization have a compliance requirements to achieve all the data that is x years old. Amazon glacier vault lock, helps you set compliance controls to meet your compliance objectives. You will learn more about Amazon Glacier Vault Lock in the next section.
CH2
PG 53
Amazon Glacier Key Terminology?
Accessing Amazon Glacier?
Uploading Files to amazon Glacier?
Amazon Elastic Block Store?
Amazon Glacier Key Terminology = items stored in glacier are considered archived, you can aggregate your files using ZIP or TAR. No limit on how many files you can store each item cant be higher than 40TB. Items are write once but wont be able to modify it. You can use IAM and create the vault-level access policies. You can create up to 1,000 vaults per account per-region. WORM (write once read many)
Accessing Amazon Glacier =
• can access it directly via the Amazon Glacier API or SDK.
• S3 lifecycle integration
• Via third party tools and gateways
Uploading Files to amazon Glacier = can upload direct connect, or snowball. You need to create a vault and an access policy. The next step is to crate the archives upload them
Amazon Elastic Block Store = are highly available, highly reliable volumes that can be leveraged as an Amazon EC2 instances boot partition or attached to running Amazon EC2 instances as a standard block device. EBS considered the harddrive, and multiple can be attached to EC2. Only one EBS can be attached to an EC2 at time. EBS provides the ability to create apoin-in-time consistent snapshot of your vomues that are then stored in amazon S3 and automatically replicated across multi availability zones.
CH2
PG56
Features of Amazon EBS:
Persistent storage?
General Purpose?
High Availability and reliability?
Encryption?
Variable Size?
Easy to use?
Designed for resilience?
Persistent storage =as discussed before the volume lifetime is independent of any particular Amazon EC2 instance
General Purpose = Amazon EBS volumes are raw unformatted block devices that can be used from any operating system
High Availability and reliability = EBS volumes provide 99.999 percent availability and automatically replicate within their availability zones to protect your application from component failure. It is important to note that EBS volumes are note replicated across multiple AZ’s rather they are replicated within different facilities within the same AZ
Encryption = Amazon EBS encryption provides support for the encryption of data at rest and data in transit within the same AZ
Variable Size = Volumes sizes range from 1GB to 16TB and are allocated in 1GB increments
Easy to use = Amazon EBS volumes can be easily created, attached, backed up, restored and deleted.
Designed for resilience = The annual failure rate (AFR) of Amazon EBS is between .1 percent to .2 percent
