Udemy course - Sections 1-10 Flashcards
2 Benefits of private cloud
-complete control of the entire stack
-security - in a few cases, organizations may need to keep all or some of their applications and data in house
3 benefits of public cloud
-variable expense, instead of capital expense
-economies of scale
-massive elasticity
what is a hybrid cloud
where a private cloud and public cloud are connected together where you might be connected with either the internet or a private link.
Three things the multi cloud can connect?
-private cloud (vmWare, openstack)
-public cloud (aws, azure)
-organization
what is a region
physical locations in the world and independent of others and within a region, there are availability zones (az)
what are the different zones with subnets that you can use to connect to a region
-Local Zone
-outpost
-wavelength (5g/mobile)
what does cloudfront do
deliver content like videos through edge locations
what is aws responsible for in the responsibility model?
Software
-compute
-storage
-datebase
-networking
Hardware
-regions
-availability zones
-edge locations
what is the customer responsible for in the responsibility model?
-platform, applications, identity & access management
-operating system, network & firewall configurations
-client-side data encryption & data integrity authentication
-server-side encryption (filesystem and/or data)
-networking traffic protection (encryption, integrity, identity)
three ways to access cloud services
-aws management console (ui)
-command line
-software development kit (ide)
example of public services and what does that mean
-means you are connecting to services via a public address
-examples: dynamoDB, S3 (storage), route 53, cloudFront
what are some private services and what does this mean?
-vpc where you have subnets with resources that can be either private or public
-examples: EC2 instance, amazon rds, elastic file system
6 advantages of cloud computing
-trade capital expense for variable expense
-benefits from massive economies of scale
-stop guessing capacity
-speed and agility
-stop spending money running and maintaining data centers
-go global in minutes
3 types of cloud computing model
-iaas (MANAGED TO OS)
-PAAS(managed to code)
-saas (pure consumption)
4 types of cloud deployment
1) public
2) hybrid cloud
3) private cloud
4) multicloud (combo of private/hybrid/etc)
fundamentals of pricing
-compute
-storage
-outbound data transfer
aws global infrastructure is made up of:
AWS REGIONS
-region is a geographical area
-each region consists of 2 or more AZ (availability zones)
-isolated from other AWS Regions
Availability Zones (data centers)
-AZ are sep from each other
-AZs span one or more data centers
-each AZ is designed as independent failure zone
Local Zones (fairly new and may not come up on exam
-place compute, storage, db, and other services closer to end user
-extension of aws region where you can run your latency sensitive applications
edge locations and regional edge caches
shared responsibility model
aws responsible for security of the cloud
-run underlying infrastructure
-hardware,software
user responsible for security in cloud
ec2 includes network level security, etc…
what is IAM
-identity and access management is a web service that helps you security control access to aws services
What does IAM control?
who is authenticated and authorized to use resources
what are users?
individual accounts you log in with
what permissions do users have by default
none
what are groups used for?
organizing users and applying policies
what do users log into the aws management console with?
user name and password
what are access keys used for?
programmatic access (think CLI/API)
what do access keys consist of?
access key id and secret access key
what is a root user?
user that created the account
what permissions do root users ahve?
full permissions that cannot be restricted
What does multi-factor authentication use?
a second factor in addition to a password (typically code generated on a device)
what are service control policies (SCPs)
feature of aws organization and they control the max available permissions in aws account and they do not grant permissions
IAM best practices (8)
-locck away your aws account root user access keys
-create individual iam users
-use groups to assign permissions to IAM users
-grant least privileges
-get started using permission with aws managed policies
-use customer managed policies instead of inline policies
-use access levels to review IAM permissions
-configure a strong password policy for your users3
-enable mfa
-use roles for applications that run on amazon ec2 instances
-use roles to delegate permissions
-do not share access keys
-rotate credentials regularly
-remove unnecessary credentials
-use policy conditions for extra security
-monitor activity in aws account
what does ARN stand for?
Amazon Resource Name
what IAM entity can be used to delegate permissions?
role
what is elastic compute cloud?
EC2 that lets you run web services in the cloud (virtual servers)
what operating system can EC2 run?
all: linux/windows/mac
AMI is used to launch what?
amazon machine image launches an EC2 instance (consists of ebs snapshot, permissions and configurations)
what is user data?
data supplied by the user at instance launch in the form of a script
what is instance metadata
data about your instance that you can use to configure or manage the running instance
are user data/metadata encrypted?
no
how can you view meta data?
instance http: address
what are access keys used for?
gain permissions to other AWS services
how are access keys stored?
plain text
what is preferred method over access keys?
iam role and because they are not stored
what does aws batch do?
enables developers, scientists, and engineers to easily and efficiently run hundreds of thousands of batch computing jobs
what does aws batch provisions?
optimal quantity and type of computer resources
what are some perks about amazon lightsail
great for users who don’t have deep tech expertise to provision compute services
-provides pretty much everything you need in cloud
-best suited for projects that require a few dozen instances or fewer
-simple management interface
-good for blogs, website, web applications, e-commerce etc
-can deploy load balancers and attach block storage
What is ECS?
elastic compute service
what is a task also known as?
containers
what is ECS used for?
running docker containers in the cloud
EC2 launch types?
managed (you control) unmanaged (fargate- serverless)
what is elastic container registry?
private container image registry
do ebs volumes data persists?
yes, independently of the lift of the instance
Do EBS volumes need to be attached to an instance?
nope
Can multiple EBS volumes be attached to an instance?
yes
Can you attached multiple instances to a volume?
sort of through multi-attach but has constraints
Can EBS volumes be in different AZs as the instances they are attached to?
No, false, they have to be in same AZ
what is deleted on termination by default
the root ebs volumes, but any extras you connected will not be.
what are snapshhots?
captures point-in-time of an instance
where are snapshots stored?
s3
what happens with the snapshots as you make periodic snapshots of a volume?
they are incremented
Is EBS volumes AZ or region specific?
AZ
is snapshots AZ or region speecific?
region
What is DLM and what does it do?
data lifecycle manager, automates the creation, retention, and deletion of EBS snapshots and EBS-backed AMI
What does DLM help with?
-protects data by enforcing reg back up schedule
-creates standardized AMIs that can be refreshed at intervals
-retains backups as required by auditors and internal compliance
-recue storage costs by deleting outdated backups
-create disaster recovery backup policies that back up data to isolated accounts
what are instance store volumes?
high performance local disks physically attached to host comp on which ec2 instance runs
is instant stores persistent?
no, they are ephemeral (data lost without power)