AWS Certified Cloud Practitioner Notes

February 20, 2023 (2y ago)

Scaling Amazon EC2

Scaling involves begining with only the resources you need and design your architecture to automatically respond to changing demand by scaling out or in

Dynamic scaling: respond to changing demand.

Predictive scaling: automatically schedules the right number of Amazon EC2 instances based on predictive demand.

⚠️ NOTE: To scale faster you have to use both. If you do not specify the desired number of Amazon EC2 instances in Auto Scaling Group, the desired capacity degaults to the minimum capacity.

AWS services and features

Analytics:

Application Integration:

Compute and Serverless:

Containers:

Database:

Developer Tools:

Customer Engagement:

Management, Monitoring, and Governance:

Networking and Content Delivery:

Security, Identity, and Compliance:

Storage:

The Cloud

An EC2 instance is a virtual server in the AWS client-server module.

You only pay for what you use.

Cloud computing is the on-demand delivery of IT resouces over the internet with pay-as-you-go pricing.

Cloud Deployment

Benefits of the Cloud

  1. Trade upfront expenses for variable expenses
  2. Stop spending money to run and maintain data centers.
  3. Stop guessing capacity
  4. Benefit from massive economics of scale (Lower pay-as-you-go prices)
  5. Increase speed and agility
  6. Go global in minutes.

Elastic Compute Cloud (Amazon EC2)

Highly flexible -> Cost effective -> Quick

Launch -> Connect -> Use

You have complete control of the instance

Multitenancy: Sharing underlying hardware between virtual machines

When you are using EC2, you are responsible for software patches /setting up scaling / High availabiligy

Types of EC2 Instances

Each instace type is grouped under an instance family.

  1. General Purpose: Good balance of compute/CPU and memory resources - Web servers and code repositories
  2. Compute Optimized: Compute instensive task - HPC/Gaming servers/scientific modelling.
  3. Memory Optimized: Memory intense tasks
  4. Accelerated Computing: Floating point number calculator / Graphic processing
  5. Storage Optimized: High performance for locally stored data

EC2 Pricing

  1. On-demand: Only pay for the duration you your instance runs for.
  2. Saving plan: USD 1 / hr - 1/3 year term commitment - 72% savings
  3. Reserved Instance: Discount on 1/3 year term. Offers Upfront, No upfront and portion payment to enjoy 75% discount
  4. Spot Instances: Spare EC2 instances - 90% discount. AWS can reclaim the instance anytime while giving you 2 minutes warning. No contracts needed.
  5. Dedicated Host: Pysically host dedicated EC2. Used for meeting compliance requirements and no one will share tenancy of the host.

Directing Trafic with Elastic Load Balancing

Global Infrastructure and Reliability

It is not good enough to have all your data stored in a single data centre. You need high availability and fault tolerance.

Regional Construct

  1. SNS
  2. SQS
  3. S3
  4. EFS

Edge Locations

CDN - Content Delivery Network. Caching a coppy close to the customer/user. Cloudfront is amazon's CDN.

Cloudfront : uses edge locations to help accelerate communications.

Amazon Route53 : Is a DNS server that can also be run on the edge location

AWS Outposts : Using AWS inside your own building (Data Center)

In AWS, everything is an API call

Managing AWS Resources

AWS Elastic Beanstalk : Helps you provision Amazon EC2 based environments

AWS CloudFormation : Infrastructure as code tool. It is a declarative way using JSON or YAML. Supports more than Just EC2 instances.

Messaging and Queueing

Amazon Simple Queue Service (Amazon SQS)

Amazon Simple Notification Service (Amazon SNS)

SQS SNS
Send messages, Store messages, Receive messages between software component at any volume. Publish/Subscribe module. Make use of SNS topics

Migration and Innovation

The AWS cloud adoption framework (AWS CAF) - organises guidance into six areas of focus that's call perspective.

Focus: Business Capabilities

  1. Business Perspective
  2. People Perspective
  3. Governance Perspective

Focus: Platform Capalilities

  1. Platform Perspective
  2. Security Perspective
  3. Operations Perspective

Migration Strategies

The six R's of Migration

AWS Snow Family

Innovatoin with AWS

Monitoring and Analytics

Amazon Cloudwatch : It's a {graphical dashboard}. It's a web service that enables you to monitor and manage various metrics and configure alarm actions based on data from those metrics.

AWS Cloud Trail : {Logs}. Trust but verify. API auditing tool. Every request gets logged in the cloud Trail engine.

AWS Trusted Advisor : {Auditing} Is a web service that inspects your AWS environment and provides real-time recommendations in accordance with AWS best practices.

BEST PRACTICES
  1. Cost Optimization
  2. Fault Tolerance
  3. Performance
  4. Security
  5. Service Limits

Networking

Amazon Virtual Private Cloud (VPC): It's a private network in AWS. Allows you to provision a logically isolated section of the AWS cloud where you can launch AWS resources in a virtual network that you define. The resource can be public subnet or private network.

Internet Gateway : Allows traffic to access your VPC

Private Gateway : allows you to create a VPN to your VPC

AWS Direct Connect : Allows you to establish a completely private, dedicated fiber connection from your data center to AWS.

Network Access Control List (NACL) Security Group
Stateless Stateful
Applies to all instances within a subnet Determines what trafic comes in(inboud traffic) to the instance and which one leaves(outbound traffic) the EC2 instance
Operates at the subnet level Operates at the Elastic Network Interface (ENI)
NACL rules are evaluated from Lowest to Highest. Lowest number, Highest priority It's a virtual firewall
Both Allow and Deny rules are possible Only have allow rules
Allows all traffic by default Blocks all traffic by default

Pricing and Support

AWS Free Tier

AWS Lambda : Free for 1 million invocations per month.

S3 : is free for 12 months

Lightsail : Offers 1 month trial of up to 750 hours of usage

Pay for what you use Pay less when you reserve Pay less with volume-based discounts when you use more
For each service, you pay for exactly the amount of resources that you actually use, without requiring long-term contaracts or complex licensing. Some Service offer reservation options that provides a significant discount compared to on-demand instance pricing Some service offer tiered pricing, so the per-unit cost is incrementally lower with increased usage

Billing

AWS Billing and cost Management Dashboard : to pay your AWS bill, monitor your usage analyze and control your costs.

Consolidated Billing : Enables you to receivea single bill for all AWS accounts in your organisation.

AWS Budget : You can create budgets to plan your service usage, service costs and instance reservations.

AWS Cost Explorer : Is a tool that enables you to visualize, understand and manage your AWS costs and usage over time.

AWS Support Plans : AWS offrs four different support plans to meet your company's needs.

  1. Basic Plan - Free and limited trusted adviser checks.
  2. Developer Plan
  3. Business Plan
  4. Enterprse Plan - TAM

AWS Market Place : It's a digital catalog that includes thousands of software listings from independent software vendors. You can use AWS marketplace to find, test and buy software that runs on AWS.

Security

With the shared responsibility model

Customer AWS
Security in the Cloud Security of the Cloud
Maintains control over your content Operates, manages and control the components at all layers of infrasture including (Host OS, Virtualization Layer, Physical Security of the Data Center)
Managing security requirements Global infrastructure
Access to content
how access rights are granted, managed and revoked

User Permissions and Access

AWS identity and Access Management (IAM) - by default IAM users have no permissions.

Least Privilege Principle : A user is granted access only to what they need.

Root user : Has complete access to all the AWS services and resources in the account. Do not use the root user for everyday tasks.

IAM Users : Is an identity that you create in AWS. It represents the person / application that interacts with AWS services and resources. Consist of names and credentials. - by default, when you create a new IAM user in AWS, it has no permissions associated with it.

BEST PRACTICE

We recommend that you create individual IAM users for each person who needs to access AWS.

IAM Policies : An IAM policy is a document that allows or denies permisions to AWS services and resoruces. Allows you to customize user level of access to resouces.

BEST PRACTICE

Follow the security principles of least privilege when granting permission

IAM Groups : Is a collection of IAM users. When you assign an IAM policy to a group, all users in the group are granted permissions specified by the policy. One way to manage your users and their permissoins is to organise them into IAM groups.

IAM Roles : Is an identity that you can assume to gain temporary access to permissions. Before an IAM user, application or service can assume an IAM role, they must be granted permission to switch to the role. When someone assumes an IAM role, they drop all previous permissions they had under a previous role and assume the premission of the new role.

BEST PRACTICE

IAM roles are ideal for situations in which access to services or resources needs to be granted temporarily instead of long-time.

AWS Organizations

A central location to mange multiple AWS accounts.

You cannot apply IAM policies to IAM users, groups or roles. You cannnot apply an IAM policy to the AWS account root user.

AWS Artifact

Is a service that provides on-demand access to AWS security and compliance reports and select online agreements. AWS artifacts consists of two main sections:

Denial of Service Attacks

Additional Security Services

AWS Key Management Service (KMS) : is used to manage cryptographic/encryption keys on AWS

Amazon Inspector : runs automated security accessment against your infrastructure

Amazon GuardDuty : It analyses contineous streams of metadata generated from your account and network activity.

Serverless

You cannot see or access the underlying infrastructure.

AWS Lambda is a serverless option suited for quick processing like web application backend.

Storage and Databases

- Block level storage - Hard Drive

Instance Store : are used to store temporary files and data that can be easily recreated without consequences.

Amazon Elastic Block Store (EBS) : Virtual hard drive or EBS volumes. Allows incremental backups called snapshots.

Amazon Simple Storage Service (S3) : Store and retrieve unlimited amount of data. Stores data as an object in buckets with mazimum size of 5TB.

Storage Types

S3 Standard

S3 Standard - Infrequent Access (S3 standard - IA)

Amazon S3 Glacier

S3 one zone-Infrequent Access (S3 one zone-IA)

S3 Intelligent-Tiering

S3 Glacier Deep Archive

Amazon Elastic File System (Amazon EFS)

It's a managed file system. Amazon takes care of the scaling andreplication of multiple instances accessing the data all the time. It's a true file system for Linux and not just a blank hard drive you can write to.

On-Premises servers can access Amazon EFS using AWS Direct Connect

Amazon Relational Database Service (RDS)

Lift-and-shift migration of databse in EC2 or use RDS to do the migration with added benefits which includes automate patching, backups, redundancy,failovers,disaster recovery

Amazon Aurora

Aurora is a managed relational database. Used for high availability. Entreprise class relational database.

Amazon DynamoDB

It's a serverless database which supports auto scaling. Non-relational (NoSQL) which uses key-value pair

Amazon Redshift

Data wearhousing service. Looks at historical analytics as suppose to operational analysis. It is scalable and offers data wear house as a service.

Amazon Database Migeration Service (DMS)

Migrates existing databse onto AWS in a secure fashion

Amazon DocumentDB

It's a document Database

Amazon Neptune

Used for Graph Databases

Amazon Quantum Ledger Database (QLDB)

All entries can never be deleted / removed from the audit

Amazon ElasticCache

Provides caching layers for DBS. Supports redis and memcached.

Amazon DynamoDB Accelerator (DAX)

Imporoves read times for non-relational data

The Cloud Journey

AWS Well-Architected Framework: helps you understand how to design and operate reliable, secure, efficient and cost effective systems in the AWS cloud.

Operatoinal Experience

Security

Reliability

Performance Efficiency

Cost Optimization

Benefits of the cloud

There are 6 main benefits of the cloud

  1. Trade upfront expenses for variable expense
  2. Benefit from massive economies of scale
  3. Stop guessing capacity
  4. Increase speed and agility
  5. Stop spending money running and maintaining data centers
  6. Go global in minutes

AWS Well-Architected and the Six Pillars

Framework Overview

The AWS Well-Architected Framework describes key concepts, design principles, and architectural best practices for designing and running workloads in the cloud. By answering a few foundational questions, learn how well your architecture aligns with cloud best practices and gain guidance for making improvements.

Operational Excellence Pillar

The operational excellence pillar focuses on running and monitoring systems, and continually improving processes and procedures. Key topics include automating changes, responding to events, and defining standards to manage daily operations.

Performance Efficiency Pillar

The performance efficiency pillar focuses on structured and streamlined allocation of IT and computing resources. Key topics include selecting resource types and sizes optimized for workload requirements, monitoring performance, and maintaining efficiency as business needs evolve.

Security Pillar

The security pillar focuses on protecting information and systems. Key topics include confidentiality and integrity of data, managing user permissions, and establishing controls to detect security events.

Reliability Pillar

The reliability pillar focuses on workloads performing their intended functions and how to recover quickly from failure to meet demands. Key topics include distributed system design, recovery planning, and adapting to changing requirements.

Cost Optimization Pillar

The cost optimization pillar focuses on avoiding unnecessary costs. Key topics include understanding spending over time and controlling fund allocation, selecting resources of the right type and quantity, and scaling to meet business needs without overspending.

Sustainability Pillar

The sustainability pillar focuses on minimizing the environmental impacts of running cloud workloads. Key topics include a shared responsibility model for sustainability, understanding impact, and maximizing utilization to minimize required resources and reduce downstream impacts.

About the Exams

Cloud Concepts - 26%

Security and Compliance - 25%

Technology - 33%

Billing and Pricing - 16%

65 questions | 90 minutes | 70% passing score | 50 Scoring questions

No penalty for quessing

Things you need to know

Set 1

Know the details of the following (not an exhaustive list):

Dynamo DB is serverless for NoSQL, IAM is used to manage identity and access control, S3 is a storage service, EC2 is a compute service, EBS is a block storage that can be attached to EC2 instances, EFS is serverless shared storage, Redshift is for data wearhousing, RDS is used to launch or migrate an existing relational database to AWS.

VPC: A web service for provisioning a logically isolated section of the AWS Cloud virtual network that you define. You control your virtual networking environment by selecting your own IP address range, creating subnets and configuring route tables and network gateways.

CloudFront, CloudFormation, CloudTrail, CloudWatch

CloudFront: An AWS content delivery service that helps you improve the performance, reliability, and availability of your websites and applications.

CloudFormation: A service for writing or changing templates that create and delete related AWS resources together as a unit.

CloudTrail: A web service that records AWS API calls for your account and delivers log files to you

CloudWatch: A web service that you can use to monitor and manage various metrics, and configure alarm actions based on data from those metrics.

AWS Security best practices such as IAM policies and KMS

KMS: A managed service that simplifies the creation and control of encryption keys that are used to encrypt data.

What are Region and Availability Zone (AZ) restrictions for different AWS services: Single AZ, Multi-AZ, Single Region, Multi-Region

Availability Zone: A distinct location within a Region that's insulated from failures in other Availability Zones, and provides inexpensive, low-latency network connectivity to other Availability Zones in the same Region.

Region: physical location

IAM, CloudFront, Amazon Route 53, WAF, Amazon Chime, DynamoDB, WorkDocs, WorkMail, WorkSpaces, WorkLink, Service Certificates

Security Groups, Auto Scaling, CloudFormation

EC2, S3, RDS, CloudFront, DynamoDB*, Glacier*, Lambda* *Does not automatically expire after 12 months

WIREE, WAF, Inspector, Route 53, EBS volumes, ELB

DynamoDB, Aurora, S3, SNS, SQS, Lambda, Fargate

S3, Lambda

REEDS — RDS, EFS, EBS, DynamoDB, Storage Gateway

Set 2

Dedicated Instances - You pay for the instances, but they get placed on whatever dedicated hardware Amazon decides.

Dedicated Host - You pay for the entire physical server and can, in effect, run instances on it as you please.

AWS Trusted Advisor - AWS Trusted Advisors provides recommendations that help you follow AWS best practices. Trusted Advisor evaluates your account by using checks. These checks identify ways to optimize your AWS infrastructure, improve security and performance, reduce costs, and monitor service quotas. You can then follow the check recommendations to optimize your services and resources.

Trusted Advisor can help you save cost, such as recommending you to delete unused or idle resources, or use reserved capacity.

Amazon CloudWatch - Amazon CloudWatch is a monitoring service and provides you with data and actionable insights to monitor your applications, respond to system-wide performance changes, and optimize resource utilization. CloudWatch collects monitoring and operational data in the form of logs, metrics, and events. You get a unified view of operational health and gain complete visibility of your AWS resources, applications, and services running on AWS and on-premises. You can use CloudWatch to detect anomalous behavior in your environments, set alarms, visualize logs and metrics side by side, take automated actions, troubleshoot issues, and discover insights to keep your applications running smoothly.

AWS Cost Explorer - AWS Cost Explorer has an easy-to-use interface that helps you visualize, understand, and manage your AWS costs and usage over a daily or monthly granularity. It has a default report that helps you visualize the costs and usage associated with your top five cost-accruing AWS services, and gives you a detailed breakdown of all services in the table view. The reports let you adjust the time range to view historical data going back up to twelve months to gain an understanding of your cost trends. It also lets you dive deeper using granular filtering and grouping dimensions such as Usage Type and Tags.

Amazon Inspector - Amazon Inspector is an automated security assessment service that helps improve the security and compliance of applications deployed on AWS. Amazon Inspector automatically assesses applications for exposure, vulnerabilities, and deviations from best practices. After performing an assessment, Amazon Inspector produces a detailed list of security findings prioritized by level of severity. These findings can be reviewed directly or as part of detailed assessment reports, which are available via the Amazon Inspector console or API.

AWS Service Health Dashboard - AWS publishes the most up-to-the-minute information on service availability in the Service Health Dashboard. You can visit any time to get the current status and availability information for each individual service. AWS Service Health Dashboard is available at this link: https://status.aws.amazon.com

AWS Personal Health Dashboard - The Personal Health Dashboard gives you a personalized view of the status of AWS services that power your applications. Use the Personal Health Dashboard to learn about specific operational issues that affect your account. For example, if you receive an event for a lost Amazon Elastic Block Store (EBS) volume associated with one of your Amazon EC2 instances, you can use the event to quickly view the status of your impacted resources, and then troubleshoot and determine remediation steps.

AWS Config - AWS Config enables you to assess, audit, and evaluate the configurations of your AWS resources. Config continuously monitors and records your AWS resource configurations and allows you to automate the evaluation of recorded configurations against desired configurations. With Config, you can review changes in configurations and relationships between AWS resources, dive into detailed resource configuration histories, and determine your overall compliance against the configurations specified in your internal guidelines.

AWS CloudFormation - AWS CloudFormation gives you an easy way to model a collection of related AWS and third-party resources, provision them quickly and consistently, and manage them throughout their lifecycles, by treating infrastructure as code. A CloudFormation template describes your desired resources and their dependencies so you can launch and configure them together as a stack. You can use a template to create, update, and delete an entire stack as a single unit, as often as you need to, instead of managing resources individually. You can manage and provision stacks across multiple AWS accounts and AWS Regions.

AWS CloudTrail - AWS CloudTrail monitors and records account activity across your AWS infrastructure, giving you control over storage, analysis, and remediation actions. With CloudTrail, you can log, continuously monitor, and retain account activity related to actions across your AWS infrastructure.

CloudTrail provides event history of your AWS Accounts. CloudTrail Events help you answer the questions of "who did what, where, and when?".  Let's say your S3 bucket was deleted by mistake. You can use AWS CloudTrail to see who deleted the bucket, when, and where (e.g. API Call or from the AWS Management console).

AWS Elastic Load Balancing - Elastic Load Balancing (ELB) is an AWS service that automatically distributes incoming application traffic across multiple targets, such as Amazon EC2 instances, containers, IP addresses, and Lambda functions, and ensures only healthy targets receive traffic. It can handle the varying load of your application traffic in a single Availability Zone or across multiple AZs, and supports the ability to load balance across AWS and on-premises resources in the same load balancer.

LinkedIn