AWS_CPE_Terms (1).docx
What is Cloud?
- Cloud computing is the on-demand delivery of IT resources through a cloud services platform over the Internet with pay-as-you-go pricing
* In short, it is quick access to flexible, low-cost IT resources
Cloud Service Models
- Infrastructure as a Service (IaaS) delivers infrastructure and resources to its users
- Platform as a Service (PaaS) delivers a software creation platform to its users
- Software as a Service (SaaS) delivers applications over the Internet to its users
Cloud Deployment Models
- Cloud deployment is a model in which resources are cloud-native or migrated to the cloud
- Hybrid deployment is a model in which cloud resources and on-premises resources are used together
- On-premises deployment is a model in which on-premises resources are used exclusively
Cloud Advantages
- Variable cost structure
* Economies of scale
* Capacity handling
* Speed and agility
* Less infrastructure investment
* Global reach
Global Infrastructure
- A region is a geographic area that hosts two or more availability zones
* Organizing level for AWS - An availability zone (AZ) is a physically isolated group of data centers
- AZs connected in-region by a fast, low-latency network (makes synchronous replication of data possible)
Interfaces
- The AWS Command Line Interface (CLI) is a unified tool to manage AWS
- The AWS Management Console is a simple web interface for AWS
- AWS Tools and Software Development Kits (SDKs) is a framework that integrates code with AWS
Analytics Services
- Amazon Athena is an interactive query service
* Analyze data in S3 using SQL - Amazon Kinesis is a stream processing service
* Collect, process, and analyze streaming data and videos
* Amazon Kinesis Data Firehose loads streams into data stores
* Amazon Kinesis Data Analytics analyzes data streams
* Amazon Kinesis Data Streams captures data streams - Amazon QuickSight is a BI service
* Create and publish dashboards - AWS Glue is an ETL service
* Catalog, clean, enrich, and move data between data stores
* Automatic data discovery, data profiling, and code generation
* AWS Glue Data Catalog stores metadata to make data searchable, query-able, and available for ETL - Amazon Elastic MapReduce (EMR) is a MapReduce service
* Run and scale a managed Hadoop framework
* MapReduce is a method to process vast sums of data in parallel - AWS CloudSearch is a search engine service
* Search structured and unstructured data in applications - AWS Data Pipeline is an orchestration service
* Schedule data movement and data processing activities - Amazon Elasticsearch Service is an Elasticsearch service
* Search, analyze, and visualize log data
* Elasticsearch is a search and analytics engine
Application Integration Services
- Amazon Simple Queue Service (SQS) is a message queuing service
* Send, store, and receive messages between pieces of software without losing messages or requiring other services to be available - AWS Step Functions is a component coordination service
* Design and run workflows that stitch together services - Amazon Simple Notification Service (SNS) is a notification service
* Pub/sub (publisher/subscriber), mobile push, and SMS
* Coordinate and manage messages to subscribing endpoints
Business Application Services
- Amazon Chime is a communication service
* Meet, chat, and place business calls - Amazon WorkDocs is a content collaboration service
* Create, edit, and share business content - Amazon WorkMail is an email and calendar service
* Access business email, contacts, and calendars from client applications (e.g., Outlook)
Computing Services
- Amazon Elastic Compute Cloud (EC2) is a computing service
* Obtain and configure computing capacity
* An instance is a virtual server
* An instance type is a configuration of CPU, memory, storage, and networking capacity for an instance
* Instance type options include general purpose, compute optimized, storage optimized, and memory optimized
* A tag is metadata that can be assigned to an instance
* A key pair is a public-private key combination for secure login
* An instance store is a storage volume for temporary data when an instance is stopped or terminated, operation systems, no personal info should be stored here
* An Elastic IP address is an IPv4 address that can be attached to an instance
* An On-Demand Instance is an instance used on demand
* Charged per hour/second
* Short term
* Unpredictable workloads
* A Spot Instance is an unused instance reserved in advance for flexible workloads, (i.e., workload can handle interruptions)
* Spare AWS capacity for up to 90% discount
* Apps with flexible start and end times
* Urgent computing needs for large amounts of capacity
* A Reserved Instance (RI) is an instance reserved in advance for continuous workloads (standard, convertible, and scheduled)
* Discount for 1-3 year commitments
* Apps with steady state usage
* A Scheduled Instance is an instance reserved in advance for scheduled, noncontinuous workloads
* A Dedicated Instance is an instance that allows the use of software licenses from other vendors and is physically isolated at the hardware level
* Dedicated host is a physical server dedicated to you
* Apps with specific cloudce requirements
* A security group is a set of firewall rules for inbound and outbound instance traffic
* An Amazon Machine Imagine (AMI) is a template that contains the software configuration required to launch an instance
* Can self-host a relational database instead of using RDS
* Linux/Ubuntu instances bill by second, all others bill by hour rounded up (e.g., 4.5 hours of compute = 5 hours billed) - Amazon EC2 Auto Scaling is a scaling service
* Scale EC2 in or out to handle application load
* Scheduled scaling scales activity based on known traffic patterns
* Dynamic scaling scales activity based on current traffic patterns
* Predictive scaling scales activity based on predicted traffic patterns
* An Auto Scaling Group is a logical grouping of instances for a desired level of capacity
* A launch configuration is a configuration template used to launch an instance - AWS Lambda is a serverless computing service, without managing servers you can run code
* Write event-driven code without overhead considerations
* Supports many programming languages
* A Lambda function is the uploaded code - Amazon Lightsail is a private computing service
* Preconfigured bundles of compute, storage, and networking capacity for a low, predictable price
* Ideal for developers, students, and inexperienced cloud users - AWS Batch is a batch computing service
* Plan, schedule, and run batch workloads - AWS Elastic Beanstalk is a web application service
* Deploy, monitor, and scale applications quickly and easily
* Emphasis on writing code, so many application stacks and programming languages are supported
Container Services
- Amazon Elastic Container Service (ECS) is a container management service
* Run containerized applications
* A container is a standard unit of software that packages code with its dependencies - Amazon Elastic Container Registry (ECR) is a container registry service
* Store, manage, and deploy container images (e.g., Docker)
* Docker is a containerization platform - Amazon Elastic Kubernetes Service (EKS) is a Kubernetes service
* Deploy, scale, and manage containerized applications
* Kubernetes (K8s) is a container orchestration service - AWS Fargate is a serverless compute service for containers
* Build applications and deploy them with ECS or EKS
Cost Management Services
- AWS Budgets is a budgeting service
* Get alerts when cost or usage budgets are exceeded - AWS Cost & Usage Reports is a cost and usage reporting service
* Access granular reports on cost and usage - AWS Cost Explorer is a cost exploration service
* Visualize, understand, and manage cost and usage over time
* Forecast costs based on past usage
* Savings Plans is a flexible pricing model on compute usage - The Total Cost of Ownership (TCO) Calculator allows customers to evaluate the savings from using AWS products and services
* Match your current infrastructure to the most cost-effective AWS offering
* Considers indirect cost of datacenter operations, such as cooling and power consumption, physical space, real estate, labor, and IT costs - The AWS Pricing Calculator estimates the cost of AWS products and services
* Model solutions and explore price points
* Also known as the AWS Simple Monthly Calculator
Customer Engagement Services
- Amazon Simple Email Service (SES) is an email messaging service
- Amazon Connect is a contact center service
Database Services
- Amazon Aurora is a relational database engine service
* Akin to a custom fork of RDS with an optimized storage layer
* Supports MySQL and PostgreSQL
* Open source simplicity with commercial grade performance
* Amazon Aurora Serverless is an on-demand, auto-scaling configuration of Amazon Aurora - Amazon DynamoDB is a non-relational database service
* Supports key-value and document data models
* Ideal for high-performance, Internet-scale applications
* Global Tables are tables replicated across desired regions for globally distributed applications
* DynamoDB Accelerator (DAX) is an in-memory cache that reduces response time to microseconds
* Point-in-time recovery (PITR) provides continuous backups of tables and protects data against accidental changes - Amazon ElastiCache is an in-memory caching service
* Retrieve information quickly from in-memory data stores
* Querying a database is always slower and more expensive than locating a copy of that data in a cache
* Supports Redis and Memcached - Amazon Neptune is a graph database service
- Amazon Redshift is a data warehouse service
* Query structured data using familiar SQL clients and BI tools
* A data warehouse is a repository of organized, processed data from many sources - Amazon Relational Database Service (RDS) is a relational database service
* A DB instance is a database environment with specified compute and storage resources
* DB instance type options are general purpose, memory optimized, and burstable performance
* Supports MySQL, PostgreSQL, MariaDB, SQL Server, Oracle, and Aurora
Developer Services
- AWS CodeCommit is source control service
* Version code in secure repositories - AWS CodeBuild is a continuous integration service
* Automate build and test processes
* Continuous integration (CI) is a software development practice where developers regularly merge their code changes into a central repository - AWS CodeDeploy is a continuous deployment service
* Automate the release process
* Continuous deployment (CD) is a software development practice where code changes are automatically prepared for a release to production - AWS CodePipeline is a CI/CD service
* Automate build, test, and release processes
* Combination of CodeCommit, CodeBuild, and CodeDeploy - AWS X-Ray is a distributed tracing service
* Debug and monitor distributed applications
* Distributed tracing is a diagnostic technique for understanding how a set of services coordinate to handle user requests
* A distributed application is software that is executed or run on multiple computers within a network
End User Computing Services
- Amazon AppStream 2.0 is an application streaming service
* Deliver desktop applications to any computer - Amazon WorkSpaces is a desktop delivery service
* Provision virtual desktops
Machine Learning Services
- Amazon Lex is a conversational interface service
* Build voice and text chatbots - Amazon Polly is a speech-enablement service
* Turn text into lifelike speech - Amazon Rekognition is an image and video recognition service
* Identify objects and perform visual analysis - Amazon SageMaker is a ML service
* Build, train, and deploy ML models
Management & Governance Services
- AWS Config is a configuration monitoring service
* Simplify compliance auditing, security analysis, change management, and operational troubleshooting - AWS Service Catalog is a catalog management service
* Create and use standardized products - Amazon CloudWatch is a resource monitoring service
* Collect data across resources in the form of logs, metrics, and events, and visualize it with dashboards
* Alarms and automated actions trigger on predefined thresholds or anomalous behavior in metrics
* Use cases include application monitoring, log analytics, infrastructure monitoring, and resource optimization - AWS CloudFormation is a resource modeling service
- allows you to use programming languages or a simple text file to model and provision, in an automated and secure manner, all the resources needed for your applications across all regions and accounts.
* Provision resources as code in templates
* A stack is a collection of resources managed as a single unit - AWS Organizations is a management and governance service
* Control billing, account resources, and security and compliance
* Consolidated billing aggregates billing, payment, and usage for multiple accounts which allows the sharing of volume discounts, Savings Plans, and RI discounts - AWS CloudTrail is an activity logging service
* Track user and account activity
* Event history allows for simpler auditing and troubleshooting - AWS Trusted Advisor is a resource optimization service
* Provision resources following AWS best practices
* Performance, security, fault tolerance, service limits, and cost recommendations - AWS Systems Manager is a systems management service
* Gain operational insights and take action on resources
* A resource group is a collection of resources that can be managed as a single unit (i.e., tagging or CloudFormation stack) - AWS Managed Services is a resource implementation service
* Get experts to operate and manage enterprise resources - AWS Personal Health Dashboard is a remediation guidance tool
* Get personalized views of health, proactive notifications, and detailed troubleshooting information - AWS OpsWorks is a configuration management service
* Supports Chef and Puppet
* Use code to automate server configuration
Media Services
- Amazon Elastic Transcoder is a media transcoding service
* Convert audio and video files into formats for supported devices
Migration & Transfer Services
- AWS Database Migration Service (DMS) is a database migration service
- AWS Server Migration Service (SMS) is a server migration service
- AWS Snowmobile is an exabyte-scale data migration service
* Move massive amounts of data physically via shipping container - AWS Snowball is a petabyte-scale data transfer service
* Move data with physical storage appliances - AWS Snowball Edge is a data transfer service for edge computing
* Move data with physical storage appliances and support local workloads in remote or offline environments
* Edge computing is computing done at or near the data source
* Good when data generation is decentralized, data volumes are significant, and network connectivity is intermittent - AWS Application Discovery Service (ADS) is an application discovery service
* Discover on-premises resources, group into applications, and plan migrations - AWS Migration Hub is an application migration service
* Track all resources in migrations from a single location
Mobile Services
- AWS Device Farm is an application testing service
* Test applications across browsers and devices - Amazon Pinpoint is a user engagement service
* Communicate with end users and measure engagement across channels (e.g., A/B testing, campaign management, etc.)
Networking & Content Delivery Services
- Amazon Route 53 is a DNS service
* Route end users to applications, purchase domain names, and monitor endpoint health
* A domain name system (DNS) connects URLs with IP addresses - Amazon Global Accelerator is a global networking service
* Improve application availability and performance and route users to optimal endpoints - AWS VPN is a VPN service
* Set up secure connections to VPC or on-premises networks - Amazon CloudFront is a CDN service
- Deliver content across massively scaled and globally available network
* Deliver content quickly and securely to end users
* Use cases include static asset caching, live and on-demand video streaming, customizable content delivery, security, software distribution, and dynamic content and API acceleration
* A content delivery network (CDN) is a distributed network of servers and data centers
* An edge location is a localized cache that lives close to end users
* Lambda@Edge is a feature that allows code to run closer to end users (i.e., in response to CDN events) - Amazon Virtual Private Cloud (VPC) is a private networking service
- My personal space within the aws cloud can put single or multiple AZ , within those AZ carve out subnets: collection of available space within VPC , subnet where create instances ( subnets can be public or private)
* Provision a logically isolated section of the cloud to launch and manage resources
* A subnet is a subset of a VPC network which can house isolated resources
* An Internet gateway is the VPC side of an Internet connection
* A network access control list (NACL) is a layer of security for VPC that acts as a firewall for inbound and outbound subnet traffic - AWS Direct Connect is a network connection service
* Establish a direct network connection on-premises to AWS - Amazon API Gateway is an API service
* Create, maintain, and secure APIs - Elastic Load Balancing (ELB) is a traffic distribution service
* The Load Balancer serves as the point of contact for client requests, routing traffic across multiple targets
* The Listener forwards requests to targets with the appropriate protocol and port configurations
* The Network Load Balancer routes traffic for applications with performance requirements or volatile traffic patterns
* The Application Load Balancer routes traffic for modern application architectures
* The Classic Load Balancer routes traffic for legacy options (i.e., EC2 instances launched prior to VPC)
Security, Identity & Compliance Services
- Amazon Inspector is a security assessment service
* Analyzes applications for exposure, vulnerabilities, and deviation from best practices - Amazon Cognito is an application identity management service
* Add user sign-up, sign-in, and access control to applications - AWS Artifact is a compliance reporting service
* Access compliance reports, accreditations, and agreements (e.g., ISO certifications, NDAs, etc.) - AWS Shield is a DDoS protection service
* Protect resources against web traffic overflows
* A distributed denial of service (DDoS) is a malicious attempt to crash an application, service, or network with excessive traffic - AWS Firewall Manager is a firewall management service
* Simplify WAF administration and security rules across resources - AWS Key Management Service is a key management service
* Create and control keys to encrypt or digitally sign data - Amazon Cloud Directory is a directory service
* Organize and manage application resources and relationships between them - AWS Secrets Manager is a secret management service
* Rotate, manage, and retrieve database credentials and API keys - AWS Certificate Manager is a certificate management service
* Provision, manage, and deploy digital certificates (i.e., SSL/TLS)
* A digital certificate creates a secure link between a web browser and a web server - AWS CloudHSM is an HSM service
* Generate and use encryption keys
* A hardware security module (HSM) provides secure key storage and cryptography on a tamper-resistant hardware device - AWS Web Application Firewall (WAF) is a firewall security service
* Create security rules to block common attack patterns and exploits (e.g., SQL injection) - AWS Identity and Access Management (IAM) is a resource access service
* Control resource authentication and authorization
* A user is an operator with permanent credentials
* A group is a collection of users
* A role is an operator with temporary credentials
* A policy document is attached to a user, group, or role and defines permissions via JSON
* Multi-factor authentication (MFA) is a best practice that adds another layer of security to a username and password
* Least privilege is a best practice in which users are granted only the permissions necessary to do particular tasks
* An access key is a long-term credential that allows for programmatic access to the AWS CLI or AWS API - Security bulletins notify customers of security and privacy events
- Penetration testing is the practice of testing a network or web application for security vulnerabilities
* Allowed by the client on eight select services without permission (e.g., Elastic Beanstalk)
Storage Services
- Amazon Simple Storage Service (S3) is an object storage service
- Unlimited storage (buckets)
- Single object limited to 5 TB
- Common Scenarios: backup and store, application hosting, media hosting, software delivering
* Retrieve any amount of data from anywhere via Internet
* Foundational for serverless computing, user-driven content, backup and recovery, and data lakes
* A data lake is a repository of raw, unstructured data
* Object storage stores data in distinct units consisting of the data itself, associated metadata, and a unique identifier
* A bucket is a container for objects
* Transfer acceleration enables fast and secure bucket transfers using CloudFront edge locations
* Cross-region replication enables the copying of objects across buckets in different regions
* S3 Standard is a storage class for frequently accessed data, replicated over all AZ if 3+ AZ
* S3 Intelligent-Tiering is a storage class for data with changing or unknown access patterns
* S3 Reduced Redundancy is a storage class for frequently accessed, non-critical data
* S3 Standard-IA/One Zone-IA is for long-lived, infrequently accessed data - Amazon Elastic Block Store (EBS) is a block storage service
- If building database applications use EBS and high throughput volumes , faster than s3
* Mount a storage volume (i.e., hard disk) to an instance
* Foundational for mission-critical systems, such as databases, enterprise applications, and operating systems
* Encryption occurs on both data-at-rest and data-in-transit
* Block storage stores data as fixed-size units, each with a unique address
* A snapshot is an incremental backup
* EBS Provisioned IOPS is an SSD volume type for latency-sensitive transactional workloads
* EBS General Purpose is an SSD volume type for a wide range of transactional workloads
* EBS Throughput Optimized is an HDD volume type for frequently accessed, throughput-intensive workloads
* EBS Cold is an HDD volume type for less frequently accessed workloads - Persistent block storage for instances (EC2)
- Protected through replication
- Different Drive Types : SSD (faster, perform better) and HDD (physical media)
- Scale up or down in minutes
- Pay for only what provision still pay for storage in EBS
- Snapshot functionality
- Encryption available
- Amazon Elastic File System (EFS) is a file storage service
* Set up a Linux file system - Amazon S3 Glacier is a data archiving and long-term backup service
* Store infrequently accessed data inexpensively
* Expedited Retrieval returns data in a 1-5 minutes
* Standard Retrieval returns data in 3-5 hours
* Bulk Retrieval returns data in 5-12 hours - AWS Storage Gateway is a hybrid storage service
* Get on-premises access to virtually unlimited cloud storage
Shared Responsibility Model
- The Shared Responsibility Model states that security and compliance are shared responsibilities between AWS and the customer
* Security in the cloud is the responsibility of the customer
* Security of the cloud is the responsibility of AWS
* Shared Controls apply to the infrastructure layer and customer layer (e.g., awareness and training)
* Inherited Controls include physical and environmental controls
* Customer Specific Controls include service and communication protection and zone security - Under the shared responsibility model, AWS is responsible for the hardware and software that run AWS services. This includes patching the infrastructure software and configuring infrastructure devices. As a customer, you are responsible for implementing best practices for data encryption, patching guest operating system and applications, identity and access management, and network & firewall configurations.
Pricing
- Storage is paid at the GB level
- Inbound data transfer is free
- Outbound data transfer is paid at the GB level
- Compute is paid by the minute or hour
- In general, pay only when you use, pay less when you reserve, and pay less as you use more
Well-Architected Framework
- Operational excellence
* Perform operations as code
* Annotate documentation
* Make frequent, small, reversible changes
* Refine procedures frequently
* Anticipate failure
* Learn from operational failures - Security
* Implement a strong identity foundation
* Enable traceability
* Apply security at all layers
* Automate security best practices
* Protect data in transit and at rest
* Prepare for security events - Reliability
* Test recovery procedures
* Automatically recover from failure
* Scale horizontally to reduce single points of failure
* Stop estimating capacity
* Manage change in automation - Performance efficiency
* Consumed advanced technologies as services
* Go global in minutes
* Use serverless architectures
* Experiment more often
* Align the approach to the desired results - Cost optimization
* Adopt a consumption model
* Measure overall efficiency
* Eliminate datacenter spend
* Analyze and attribute expenditures
* Use managed and application level services
Support Plans
- The Basic plan is free and offers support for account and billing questions, service quota increases, documentation, and forums
- The Developer plan offers additional features, such as best practice guidance, basic architecture support, and AWS IAM
- The Business plan offers additional features, such as use-case guidance, AWS Trusted Advisor, the AWS Support API, and third-party software support
* The AWS Support API is an interface for programmatic case management - The Enterprise plan offers additional features, such as a technical account manager, infrastructure event management, in-depth architectural and operational guidance with SMEs, the AWS Abuse Team, and the AWS Support Concierge Team
* A technical account manager (TAM) is a technical point of contact with AWS expertise
* Infrastructure event management (IEM) provides strategic planning assistance before major events (e.g., launches)
* a short-term engagement with AWS Support, included in the Enterprise-level Support product offering, and available for additional purchase for Business-level Support subscribers.
* The AWS Abuse Team provides assistance when AWS resources are compromised by abusive or illegal means
* The AWS Support Concierge Team provides assistance with account and billing subjects
Miscellaneous Services
- AWS Marketplace is a digital catalog service
* Find, test, buy, and deploy AWS-compatible software - AWS Quick Starts is an accelerated deployment service
* Get automated, gold-standard enterprise solutions
* A reference deployment includes an architectural outline, CloudFormation templates, and an implementation guide
AWS Partner Network (APN)
- APN Consulting Partners are professional services firms that help customers design, build, and manage their workloads on AWS
- APN Technology Partners provide hardware, connectivity services, or software solutions that or hosted on or integrated with AWS
Extra
______________________________________________________________
Patching—updates to operating system to fix bug or security issue (client responsibility) (operating system level) except if a managed service
Hypervisor – allows multiple virtual instance to run on physical server through code.
Customer Inherit from AWS – Physical and Environment Controls
EC2 pricing:
EC2 instance pricing varies depending on many variables:
- The buying option (On-demand, Reserved, Spot, Dedicated)
- Selected AMI
- Selected instance type
- Region
- Data Transfer in/out
- Storage capacity.
The 5 Pillars of the AWS Well-Architected Framework:
1- Operational Excellence: The operational excellence pillar includes the ability to run and monitor systems to deliver business value and to continually improve supporting processes and procedures.
2- Security: The security pillar includes the ability to protect information, systems, and assets while delivering business value through risk assessments and mitigation strategies.
3- Reliability: The reliability pillar includes the ability of a system to recover from infrastructure or service disruptions, dynamically acquire computing resources to meet demand, and mitigate disruptions such as misconfigurations or transient network issues.
4- Performance Efficiency: The performance efficiency pillar includes the ability to use computing resources efficiently to meet system requirements and to maintain that efficiency as demand changes and technologies evolve.
5- Cost Optimization: The cost optimization pillar includes the ability to avoid or eliminate unneeded cost or sub-optimal resources.
Tips
- Read the Questions thoroughly
- Try eliminate 2 answers then look to see if clues
- WizLab
- Practice Practice Practice
- Practice exams – 80-100% every time
AWS Organizations has five main benefits:
- Centrally manage access polices across multiple AWS accounts.
- Automate AWS account creation and management.
- Control access to AWS services.
- Consolidate billing across multiple AWS accounts.
- Configure AWS services across multiple accounts.
To estimate the costs of Amazon EBS consider the following:
1- Volume type.
2- Input/output operations per second(IOPS).
3- Snapshots.
4- Data Transfer.
To estimate the costs of an Amazon CloudFront distribution consider the following:
- Data Transfer Out.
- Traffic distribution.
- Number of requests.