AWS SAA-03 Part. 3

Spot Instances

Найдешевші EC2 instances, але AWS може перервати їх; вибирай для stateless, fault-tolerant, retryable, batch workloads.

On-Demand Instances

EC2 без commitment; гнучко, але дорожче для постійного 24/7 workload.

Reserved Instances

Знижка для predictable long-running EC2 usage; добре для production 24/7.

Savings Plans

Гнучка знижка за commitment на compute spend; часто альтернатива Reserved Instances.

Capacity Reservations

Гарантують EC2 capacity у конкретній AZ; головний benefit availability of capacity, не discount.

Stateless retryable workload + lowest cost

Spot Instances.

Production EC2 24/7 + cost optimization

Reserved Instances або Savings Plans.

Need guaranteed EC2 capacity

Capacity Reservations.

Auto Scaling Group

Автоматично додає/прибирає EC2 instances за demand; часто з ALB.

Launch Template

Шаблон конфігурації EC2 для ASG: AMI, instance type, security group, user data.

Lifecycle Hook

Дозволяє виконати дії під час launch/terminate EC2 в ASG.

ALB

Application Load Balancer; Layer 7 HTTP/HTTPS, path/host-based routing.

NLB

Network Load Balancer; Layer 4 TCP/UDP/TLS, very high performance/static IP support.

GWLB

Gateway Load Balancer; для third-party firewall/IDS/IPS appliances і packet inspection.

Firewall appliance / IDS / IPS / packet inspection

Gateway Load Balancer.

HTTP routing by path or host

Application Load Balancer.

TCP/UDP high-performance load balancing

Network Load Balancer.

ECS

Managed container orchestration by AWS; простіше для AWS-native containers.

EKS

Managed Kubernetes control plane; вибирай коли потрібен Kubernetes ecosystem.

Fargate

Serverless compute for containers; не керуєш EC2 instances.

ECS on Fargate

Low operational overhead для containers без Kubernetes.

EKS managed node group

Managed EC2 worker nodes for Kubernetes workloads.

EKS private endpoint + nodes in private subnets

VPC endpoints for EKS/ECR/STS/S3 may be needed so nodes can join and pull images.

Lambda

Serverless function compute; підходить для event-driven, short-running, scaling from zero.

API Gateway + Lambda

Public/serverless API pattern.

Lambda + RDS problem

Багато concurrent Lambda connections можуть перевантажити DB; часто потрібен RDS Proxy.

RDS Proxy

Керує DB connection pooling для Lambda/applications до RDS/Aurora.

Placement group cluster

Low-latency/high-throughput network між EC2 instances в одній AZ.

Placement group spread

Розносить instances по різних hardware для fault isolation.

Placement group partition

Розносить instances по partitions; добре для big distributed systems.

Amazon RDS

Managed relational DB: MySQL, PostgreSQL, MariaDB, Oracle, SQL Server, Db2.

Amazon Aurora

AWS-optimized relational DB, MySQL/PostgreSQL-compatible; high performance, HA, replicas.

RDS vs Aurora

RDS = standard managed engine; Aurora = MySQL/PostgreSQL-compatible with better AWS-native HA/performance.

Existing SQL Server without schema conversion

RDS for SQL Server.

Existing Oracle without engine change

RDS for Oracle.

MySQL/PostgreSQL + high performance/HA

Aurora MySQL-compatible або Aurora PostgreSQL-compatible.

RDS Multi-AZ

High availability/failover for primary DB; not for scaling reads.

RDS Read Replica

Scales read/reporting workload; can be same-region or cross-region depending engine.

Multi-AZ vs Read Replica

Multi-AZ = HA failover; Read Replica = read scaling.

Aurora Replica

Read replica in Aurora cluster; can offload reads/reporting and can be promoted.

Aurora Global Database

Cross-region disaster recovery and low-latency global reads.

Aurora Serverless

Serverless relational capacity for variable/unpredictable workloads.

DynamoDB

Serverless NoSQL key-value/document DB with millisecond latency.

Key-value + massive scale + unpredictable traffic

DynamoDB.

Apache Cassandra-compatible managed DB

Amazon Keyspaces.

MongoDB-compatible managed DB

Amazon DocumentDB.

Graph relationships / fraud / social graph

Amazon Neptune.

Time-series IoT metrics / telemetry

Amazon Timestream.

Data warehouse / BI SQL analytics

Amazon Redshift.

Millisecond operational reads/writes

DynamoDB, not Redshift.

Redis/Memcached cache

Amazon ElastiCache.

Durable Redis-compatible primary DB

Amazon MemoryDB.

DMS

AWS Database Migration Service; use when migration/replication is explicitly asked, not as target architecture.

SCT

Schema Conversion Tool; helps convert schema between different DB engines.

VPC

Private isolated network in AWS.

Subnet

Range of IPs inside a VPC, tied to one Availability Zone.

Public subnet

Subnet with route to Internet Gateway and resources with public IPs.

Private subnet

Subnet without direct inbound internet route.

Internet Gateway

Allows VPC resources with public IPs to access/be accessed from internet.

NAT Gateway

Allows private subnet resources outbound internet access; does not allow inbound initiation.

Route table

Controls where network traffic goes; targets include IGW, NAT GW, TGW, VGW, VPC peering.

Security Group

Stateful firewall attached to ENI/instances/load balancers; allow rules only.

NACL

Subnet-level stateless firewall; allow and deny rules.

Stateful

Reply traffic is automatically allowed.

Stateless

Must explicitly allow inbound and outbound traffic.

VGW

Virtual Private Gateway; connect one VPC to VPN/Direct Connect.

TGW

Transit Gateway; hub for many VPCs/VPNs/DX Gateway with transitive routing.

VPC Peering

Private connection between two VPCs; no transitive routing.

One VPC to on-prem via VPN

Virtual Private Gateway.

Many VPCs centralized routing

Transit Gateway.

Two VPCs simple private connection

VPC Peering.

Need transitive routing

Transit Gateway.

Direct Connect

Dedicated private network connection from on-prem to AWS.

Direct Connect Gateway

Connects Direct Connect to VGW or TGW; useful for sharing DX across VPCs.

Many VPCs share Direct Connect

Direct Connect Gateway + Transit Gateway.

Site-to-Site VPN

IPSec encrypted tunnel over internet; quick and low-cost.

Low-cost short-term backup for Direct Connect

Site-to-Site IPSec VPN.

Gateway VPC Endpoint

Private access from VPC to S3/DynamoDB without internet/NAT.

Interface VPC Endpoint

PrivateLink ENI endpoint for AWS services/APIs in VPC.

PrivateLink

Private connectivity to AWS services or endpoint services through interface endpoints.

Private access to S3 from VPC

Gateway VPC Endpoint.

Private access to AWS service APIs

Interface VPC Endpoint.

API Gateway to private VPC backend

VPC Link.

VPC Link

Connects API Gateway privately to NLB/ALB/resources in VPC.

Private API Gateway

API Gateway accessible only through VPC interface endpoint.

CloudFront

CDN for caching and global delivery of content.

CloudFront + S3 private origin

OAC/OAI to prevent direct S3 access.

CloudFront + ELB origin bypass prevention

Restrict ELB security group to CloudFront IP ranges or use origin verification patterns.

OAI

Legacy CloudFront identity for private S3 access.

OAC

Recommended newer CloudFront origin access control for private S3 access.

OAI/OAC do not work with

ELB/ALB/EC2 custom origins; they are for S3 origins.

Route 53 weighted routing

Splits DNS responses by weight; useful for gradual DNS-level migrations.

Route 53 latency routing

Routes users to lowest-latency region.

Route 53 failover routing

Routes to secondary endpoint when health check fails.

AWS Organizations

Manage multiple AWS accounts, OUs, consolidated billing, SCPs.

OU

Organizational Unit; grouping of AWS accounts inside AWS Organizations.

SCP

Service Control Policy; maximum permissions boundary for accounts/OUs; does not grant permissions.

SCP vs IAM policy

SCP limits what can ever be allowed; IAM policy grants actual permissions.

AWS Control Tower

Sets up and governs multi-account landing zone with best practices.

Landing Zone

Preconfigured multi-account AWS foundation with accounts, logging, identity, guardrails.