AWS Cloud Practitioner Term Practice

EC2 Instance

AMI (OS) + Instance Size (CPU + RAM) + Storage + security groups + EC2 User Data

Security Groups

• stateful

• operate at the EC2 instance level or ENI

• firewall attached to the EC2 Instance

EC2 User Data

Script launched at the first start of an instance

EC2 Instance Role

link to IAM roles

EBS Volumes

• network drives attached to one EC2 instance at a time

• mapped to an AZ

• can use EBS Snapshots for backups / transferring EBS volumes across AZ

AMI

create ready-to-use EC2 instances with our customizations

EC2 Image Builder

automatically build, test, and distribute AMIs

EC2 Instance Store

• high-performance hardware disk attached to our EC2 instance

• lost if our instance is stopped / terminated

EFS

network file system, can be attached to 100s of instances in a region

EFS-IA

cost-optimized storage class for infrequent accessed files

High availability

Having applications across multiple AZs

Vertical scalability

Increasing size of an instance

Horizontal scalability

Increasing number of instances

Elasticity

Ability to scale up and down based on command

Agility

Work faster because instances can be created and destroyed easily

Elastic Load Balancers (ELB)

• distribute traffic across backend EC2 instances

• supports health checks

Auto Scaling Groups (ASG)

• implement elasticity for your application, across multiple AZ

• scale EC2 instances based on the demand on your system, replace unhealthy

• integrated with ELB

(S3) Buckets vs Objects

• buckets are tied to a unique global name and to a region

• objects live in buckets

S3 security

• IAM policy

• S3 Bucket Policy (public access)

• S3 Encryption

S3 websites

Host a static site on Amazon S3

S3 versioning

• multiple versions for files

• precent accidental deletes

S3 replication

• same-region or cross-region

• must enable versioning

S3 Storage Classes

• standard

• IA (infrequent access)

• 1Z-IA (1 zone IA)

• intelligent tiering

• glacier (instant, flexible, deep)

Snowball

import data onto S3 through a physical device, edge computing

Storage Gateway

hybrid solution to extend on-premises storage to S3

Relational Databases - OLTP

• RDS & Aurora (SQL)

Multi-AZ vs Read Replicas vs Multi-Region

• read replicas

  • scale the read workload of your DB

  • can create up to 15

  • data is only written to the main DB

• multi-AZ

  • failover in case of AZ outage

  • data is only read/written to the main database

  • can only have 1 other AZ as failover

• multi-region (read replicas)

  • disaster recovery in case of region issue

  • load performance for global reads

  • replication cost

ElastiCache

• caches are in in-memory database (hint) with high performance, low latency

• managed

Key/Value Database

• DynamoDB (serverless) & DAX (cache for Dynamo DB, makes faster)

Warehouse - OLAP

Redshift (SQL)

Hadoop Cluster

EMR

Athena

Query data on Amazon S3 (serverless & SQL)

QuickSight

dashboards on your data (serverless)

DocumentDB

“Aurora for MongoDB” (JSON - NoSQL database)

Amazon Managed Blockchain

managed Hyperledger Fabric & Ethereum blockchains

Glue

Managed ETL (Extract Transform Load) and Data Catalog service

Database Migration

DMS

Neptune

Graph database

Timestream

time-series database

Docker

container technology to run applications

ECS

• run Docker containers on EC2 instances

• must provision infrastructure

Fargate

• run Docker containers without provisioning the infrastructure

• serverless offering (no EC2 instances)

ECR

private docker images repository

Batch

run batch jobs on AWS across managed EC2 instances

Lightsail

predictable & low pricing for simple application & DB stacks

Lambda

• serverless, functions as a service, seamless scaling, reactive

• supports many programming languages except (arbitrary) Docker

• invocation time: up to 15 min

• ex:

  • create thumbnails for images uploaded onto S3

  • run a serverless cron job

Lambda billing

• by the time run x by the RAM provisioned

• by the number of invocations

API Gateway

expose Lambda functions as HTTP API

CloudFormation

• AWS only

• Infrastructure as Code, works with almost all of AWS resources

• repeat across Regions & Accounts

• deploy stacks across accounts and regions

Beanstalk

• AWS only

• Platform as a Service (PaaS), limited to certain programming languages or Docker

• has health agent that pushed metric to CloudWatch

• Deploy code consistently with a known architecture

  • ex:

    • ALB + EC2 + RDS

CodeDeploy

• hybrid (AWS or on premises)

• deploy & upgrade any application onto servers

Systems Manager

• hybrid

• patch, configure, and run commands at scale

CodeCommit

store code in private git repository (version controlled)

CodeBuild

build & test code in AWS

CodeDeploy

Deploy code onto servers

CodePipeline

Orchestration of pipeline (from code to build to deploy)

CodeArtifact

store software packages / dependencies on AWS

AWS CDK

define you cloud infrastructure using a programming language

Route 53

• Global DNS

• great to route users to the closest deployment with least latency

• great for disaster recovery strategies

CloudFront

• Global Content Delivery Network (CDN)

• replicate part of your application to AWS Edge Locations → decrease latency

• cache common requests → improved user experience and decreased latency

S3 Transfer Acceleration

• accelerate global uploads & downloads into Amazon S3

AWS Global Accelerator

• improve global application availability and performance using the AWS global network

AWS Outposts

• deploy Outpost Racks in your own Data Centers to extend AWS services

AWS Wavelength

• brings AWS services to the edge of the 5G networks

• ultra-low latency applications

AWS Local Zones

• bring AWS resources (compute, database, storage, …) closer to your users

• good for latency-sensitive applications

SQS

• queue service in AWS

• multiple producers, messages are kept up to 14 days

• multiple consumers share the read and delete messages when done

• used to decouple applications in AWS

SNS

• notification service in AWS

• subscribers: email, Lambda, SQS, HTTP, mobile, …

• multiple subscribers, send all messages to all of them

• no message retention

Kinesis

real-time data streaming, persistence, and analysis

Amazon MQ

managed message broker for ActiveMQ and RabbitMQ in the cloud (MQTT, AMQP, other protocols)

CloudWatch

• Metrics: monitor the performance of AWS services and billing metrics

• Alarms: automate notification, perform EC2 action, notify to SNS based on metric

• Logs: collect log files from EC2 instances, servers, Lambda functions…

• Events (or EventBridge): react to events in AWS, or trigger a rule on a schedule

CloudTrail

• audit API calls made within your AWS account

• track API calls made by users within account

CloudTrail Insights

automated analysis of your CloudTrail Events

X-Ray

trace requests made through your distributed applications

AWS Health Dashboard

status of all AWS services across all regions

AWS Account Health Dashboard

AWS events that impact your infrastructure

VPC

Virtual Private Cloud

Subnets

Tied to an AZ, network partition of the VPC

Internet Gateway

• at the VPC level

• provide Internet access

NACL

stateless, subnet rules for inbound and outbound

VPC Peering

connect two VPC with non-overlapping IP ranges, non-transitive

Elastic IP

• fixed IPv4

• ongoing cost if not in-use

VPC Endpoints

Provide private access to AWS Services within VPC

PrivateLink

privately connect to a service in a 3rd party VPC

VPC Flow Logs

network traffic logs

Site to Site VPN

VPN over public Internet between on-premises data center and AWS

Client VPN

Open VPN connection from computer into your VPC

Direct Connect

direct private connection to AWS

Transit Gateway

connect thousands of VPC and on-premises networks together

Shield

automatic DDoS Protection + 24/7 support for advanced

WAF

firewall to filter incoming requests based on rules

KMS

encryption keys managed by AWS

CloudHSM

• hardware encryption

• we manage encryption keys

AWS Certificate Manager

provision, manage, and deploy SSL/TLS certificates

Artifact

get access to compliance reports such as PCI, ISO, etc…

GuardDuty

find malicious behavior with VPC, DNS, & CloudTrail logs

Inspector

find software vulnerabilities in EC2, ECR Images, and Lambda functions

Network Firewall

protect VPC against network attacks

Config

• track config changes and compliance against rules

• record all resources configs and compliance over time

Macie

find sensitive data (ex: PII data) in S3 buckets

AWS Security Hub

gather security findings from multiple AWS accounts