SAA-CO3 Grind

IAM

identity and access management for AWS tools, controls who can do what in three different ways (group, user, role) not the root user, adds policies

IAM User vs Role

iam users are specific users you want to add to ur aws account and give perms to, roles are temporary access keys for instances and other tools

IAM Policy

json perms document for iam users with allow/ deny → deny overrules allow always …

least privileged

always give users the least amount of permissions possible

iam role for ec2

attach via iam role so it gets temp perms automatically, never hard code access keys to an instance

aws sts

security token system, issues temporary credentials for role assumption, federation, cross acc access

aws organizations

manage multiple aws acc using one organization (billing, governing) just anything related to multi account environments

SCP

service control policy, sets the maximum permissions for member accounts, but doesn’t give permissions (remember denys always get upper hand)

aws control tower

sets up + governs secure multi acc environments using guardrails (max perms)

iam identity center

central sign on for multiple aws accounts (exam clue: aws central/ federated access for employees)

aws directory service

managed microsoft directory service (exam clue: integrate aws with microsoft ad)

aws RAM

resource access manager, share aws resources across accounts without having to duplicate them

aws service catalog

create and govern approved portfolios of all the aws product templates for your users (exam clue: let team only use approved configs of instances)

security group

stateful virtual firewall with only “Allow” attached to instances (exam: instance level outbound/ inbound filtering)

NACL

network access control list, virtual firewall stateless, allows and denies, lowest rule number checked first → must explicitly allow return traffic

security group vs nacl

sg is stateful and for resources

nacl is stateless and has denies (can be used to explicitly block)

aws kms

key management service, control and create encryption keys w aws services

aws managed / customer managed kms

aws → service managed (less control)

customer → u control policy, aliases, rotation, grants (choose for more control / auditing)

KMS envelope

data encrypted w/ data key which is encrypted w/ KMS key (to avoid sending too much data to KMS)

AWS CloudHSM

cloud hardware security model, single tenant hardware model you control, used for strict compliance and control of cryptographic keys, more management

KMS vs CloudHSM

kms → pre managed and integrated

CHsm → more operation and control work (choose if requires dedicated hsm)

aws secrets manager

security stores secrets like db passwords or api keys and has auto rotation (which means it auto updates as u edit the keys)

secrets manager vs parameter store

sm → secrets + built in rotation → higher cost

ps → config values but u have to auto update

ACM

AWS certification manager, provision and manage tls/ssl certs for aws services (exam clue: https certificate management)

aws cognito

identity of application users (sign in + access aws services) this is for ppl who are logging into whatever u created type

cognito user vs identity user

cognito → authenticate users and create user directories and tokens

identity → give users temporary credentials and access to aws resources

aws waf

web application firewall, filters https requests using rules (basically not allowing injections n shi)

aws shield

managed ddos (hacking by botting) protection

standard → auto baseline protection

advanced → enhanced protection for important workloads (when u need more)

waf vs shield

waf → filter out malicious attacks (injection/ bad url pattern)

shield → ddos protection (volumetric hacking)

aws firewall manager

manage and deploy all security protocols (waf, shield, firewalls) on multiple accounts

AWS network firewall

managed firewall for vpc attacks (choose if u need centralized advanced protection beyond sg/nacl)

Amazon GuardDuty

threat detection from AWS logs using Analytics and ML (ids basically) js detects threats

Amazon Inspector

automatic vulnerability management and scanning for EC2 and instances (exam clue: CVE/ software vulnerabilities)

Amazon Macie

discovers and classifies sensitive data in Amazon S3s using pattern matching n ML

(exam clue: find sensitive data in S3)

Amazon Detective

Investigates + analyses security findings to find root cause of data issues

AWS Security Hub

central dashboard that sorts data findings across AWS services

AWS Artifact

portal for downloading AWS compliance reports and agreements

AWS Audit Manager

automates collections of evidence for audits and maps frameworks to evidence

Amazon VPC

Virtual Private Cloud, service that lets you run AWS resources in a private isolated virtual network u create

Public vs Private Subnet

subnets are segments of a VPC IP address

public → can route to internet gateway

private → can not route to igw

it takes more than js a public IP to make a subnet public

IGW

internet gateway, horizontally scaled VPC Component that allows internet connection for resources if route table points to it

NAT gateway

network address translation, let’s resources in private subnets access internet while preventing unsolicited internet connections (place in public subnet)

IGW vs NAT gateway

igw → gives public subnet internet with public subnet

nat → gives private subnet internet without direct exposure

route table

rules determining where subnet traffic is directed (specific most matching route wins)

vpc endpoint

private access from vpc to supported services without igw or nat or internet

Gateway Endpoint

freestyle vpc endpoint for S3 and DynamoDB without NAT cost

Interface Endpoint

ENI with private IP address, powered by AWS private link and gives private access to AWS services across VCPs

Gateway vs Interface Endpoint

gateway is for s3 and dynamo db no cost

interface is for private stuff many service cost money

VPC peering

connection between two vpcs

AWS transit gateway

hub network to connect many vpcs centrally (hundreds)

site to site vpn

encrupted connection between on premise network and aws public

aws direct connect

dedicated private connection from premise to aws

vpn vs direct connect

vpn is encrypted over public internet, faster and cheaper setup

dir connect is private, consistent, slower creation, not encrypted by default

elb

elastic load balancing, distributes incoming traffic across AZs with less work (basically distributes things to less working things)

nlb

netwrok load balancer, super high performance, low latency, for millions of requests, static ib

gwlb

gateway load balancer, deploys third party virtual network appliances (fleet of network appliances)

alb vs nlb vs gwlb

alb http content routing

nlb extreme performance and static ip

gwlb distributes traffic thru virtual network appliances

ec2 auto scaling

auto adds and removes ec2 instances to match demand

elb vs auto scaling

elb distributes traffic to targets

autoscaling changes number and power of ec2

works tgr

ec2

resizable virtual machines for when you need custom softwares n shi

ec2 instance families

general purpose = everything

compute optimized = cpu heavy

memory optimized = ram optimized

storage optimized = lots of storage

accelerated = faster more gpu and acceleraters

ec2 on demand

pay as u go, no commitment, short term unpredictable

ec2 reserved instances

commit to specific usage for 1-3 years at discount, better for predictable steady work

ec2 savings paln

commit to consistent pay per hr for 1-3 years for discounts for ec2, lambda, fargate

ec2 spot instance

spare ec2 capacity that u rent, but can be interupted

ec2 dedicated host

physical ec2 server dedidcated to u for private, dedicated hosts if needed go for this

aws elastic beanstalk

upload code and aws handles capacity, scaling, and load balancing while u control resources

aws lambda

serveless event driven functions, awuto scales, pay per use, no servers, max execution duration is 15 minutes (short workloads)

aws fargate

serverless compute engines for ecs and eks containers to run containers without mannging ec2 servers (longer and containered workloads)

lambda vs fargate vs ec2

lambda = short event driven functions with no server

fargate = containrs of instances without server

ec2 = max control and long running and custoim workloads

amazon ecs

elastic container service, deployes organizes and scales containers

amazon eks

elastic kubernetes services, ecs but for kubernetes

ecs with ec2

u manage and choose servers

ecs with fargate

aws manages everything server related

container

basically an environment that packages everygthing to run in one unit and can be duplicated basicaly a package

aws ecr

elastic container registry, private warehouse for container templates → can use ecs or eks to deploy it, and can use ec2 and fargate to run it

amazon s3

regional object storage with high durability and scale, store objects in a bucket typa thing

s3 standard

general purpose frequesntly accessed data, can go multi az, low latency, no retrival fee, use when acvcess is frequest and unknown

s3 intelligent teiring

automatically moves objects among access teirs based on changing and unkown access patterns for a fee (for unpredictable access patterns)

s3 standard ia

when infrequestly accessed but needs immediate retrieval and mutli az resilleince → lower stoarge cost and minimum retrieval charges

s3 one zone ia

only in one AZ cheaper but not resilient if AZ goes down → use for recreatable non critical data

s3 glacier instant retrieeval

archive data used rarely but requies immediate retreival → low storage

s3 glacer flexible retrieval

archive data used rarely but requies hours to get retreival → low storage

s3 glacer deep archive

lowest cost, takes longgg time to retrieve, best for things required rarely

s3 lifecycle rule

auto transition objects to cheaper storage classes, or expre and delete them based on age (reduce long term storage cost automatically)

s3 versioning

keep multiple versions of an object, protects against accidental deleteion and is REQUIRED for replication

s3 replication

auto copies object to another bucket cross region → needs versions (not a complete back iup replacement)

s3 block public access

accouint and bucket controls designed to prevent accident public exposure (use if s3 can not be public)

s3 bucket policy

resource based json policy controlling access to an s3 bucket for cross acc access and potential endpoint restrictions

s3 object lock

regulatory immutable storage/ransomware protection. locks objects basically so nun can change it if hacked or smn

amazon ebs

elastic block store, block storage volumes for ec2, basically the block loives in one az and can persist independently of an instance (USE IF BLOCK STORAGE MENTIONED)

ebs gp3

general purpose ebs, default choice, performance can change independly of size

ebs io2

for mission critial intensive workloads and databases required high durability and consistency

ebs st1

optimized hdd for large and sequential workloads like bid data and log processing

ebs sc1

lowest cost ebs storage for infrequesnt access

ebs snapshot

incremental point in time backup of ebs volume stored by AWS can be copied across regions to create them again

amazon efs

elastic file storage, managed elastic shared file storage for LINUX workloads to share files

s3 vs ebs vs efs

s3 = stores objects

ebs = stores blocks for ec2 in one AZ

efs = stores files for linux across AZs

amazon rds

relational databases, managed by aws for common admin tasks → choose for sql, and structured relationships, acid transactions,

rds read replica

async replica primary for read scaling → apps direct reads to it