EC2
Fargate
S3 bucket
***********************************************************
AWS Certification tiers7
Practitioner Tier / Foundational:
Certified Cloud Practitioner
Associate Tier :
Certified Solutions Architect Associate,
Certified Developer Associate ,
Certified Sysops Administrator Associate
Professional Tier :
Certified Devops Professional,
Certified Solutions Architect Professional
Specialty Tier :
Data Analytics,
Security,
Advanced Networking,
Database,
Alexa Skill Builder ,
Machine Learning
https://skillbuilder.aws/
IAM & S3
EC2
Databases
Advanced IAM
Route 53
VPC
HA Architecture
Applications
Security
Serverless
Exam Blueprint
130 minutes in length
60 questions
Multiple choice
Aim for 70 %
Certified Cloud Practitioner Exam blue print
Total of 4 domains in Exam Blueprint
Cloud Concepts - 26%
Security and Compliance - 25%
Technology -33%
Billing and Pricing -16%
AWS Global Infrastructure
Region : 19 Regions as of Dec 2018. A region is a geographical area. Each Region consists of 2 (or more) Availability zones (AZ).
Availability zones (AZ) : 57 AZ as of Dec 2018. Availability zones is a Data Center.AZ could be two are three data centers which are couple of miles
Edge Locations : Edge Locations are endpoints for AWS which are used for caching content. Typically this consists of CloudFront, Amazon's Content Delivery Network(CDN). There are many more Edge Locations than Regions.
Highlevel AWS Service
Analytics
Management and Governance
Migration and Transfer
Desktop and App Streaming
Machine Learning
Core AWS Services
Compute (EC2, Lamda)
Storage (S3)
Databases (RDS, DynamoDB Redshift)
Network and content Delivery (Route 53, VPC)
Security, Identity and Compliance (Identity access)
AWS Services :
We have 130 AWS services which can be categorized them like below and we have more
Security, Identity and Compliance
Compute Services
Compute Services
Storage Services
Database Services
Analytics Services
Network Services
Management Services
Application Services
Development Services
Compute Services
Elastic Compute Cloud (EC2)
Auto Scaling
Lambda
Elastic Load Balancer (ELB)
Elastic Container Service (ECS)
Analytics Services
Elastic MapReduce (EMR/ Hadoop Service)
Kinesis (Real time data/video streaming)
Athena ( Interactive Query Engine)
QuickSight (Business Intelligence)
Glue (ETL Service)
Storage Services
EBS (Elastic Block Storage)
S3 ( Simple Storage Service)
EFS (Elastic File system)
Database services
RDS (Relational Database service)
DynamoDB (AWS NoSQL database)
Redshift (Data warehousing)
Elasticache ( Fast and Flexible Caching)
Network Services
VPC (Virtual Private Cloud)
Route53 (AWS DNS Service)
Direct Connect (dedicated Network)
CloudFront (Content Delivery Network)
Management Services
CloudWatch (Application & Infrastructure monitoring)
CloudFormation (Provision Infrastructure as a Code)
Elastic Beanstalk(Application Orchestration Service)
Opswork ( Infrastructure Configuration Management)
Application Services
API Gateway(Managed REST and Websocket APIs)
SQS(Simple Queue Service)
SNS (Simple Notification Service)
SES ( Simple Email Service)
Cognito (User Management for Web Mobile Apps)
Development Services
CodeCommit (hosted GIT Repository by AWS)
CodeBuild (Continuous Integration Service)
CodeDeploy (Automated Deployments)
Code Pipeline(Continuous Delivery Service)
Code Star (
IAM --> Identity Access Management
KMS --> Key Management Services
ACM --> Amazon certificate manager
WAF --> Web Application firewall
AWSInspector
Route53 is like DNS
EBS
S3, Dynamo DB, EC2, RDS, EBS
S3, Dynamo DB, EC2, RDS, EBS
Scaling will be of two types
Vertical scaling
Horizontal scaling
******************************************************************
Identity Access Management
IAM allows you to manage users and their level of access to the AWS console.
IAM offers following features
Centralized control of your AWS account
Shared access to your AWS account
Granular Permissions
Identity Federation (including Active directory, Facebook, LinkedIn etc)
Multifactor Authentication
Provide temporary access for users/device and services where necessary
Allows you to set up your own password rotation policy
Integrates with many different AWS services
Support PCI DSS compliance (when we collect credit card details we need to compliance with local government)
IAM key terminology
1. Users : End users such as people, employees of an organization etc.
2. Groups : A collection of users. Each user in the group will inherit the permissions of the group.
3. Policies : Policies are made up of documents, called Policy documents. These documents are in a format called JSON and they give permissions as to what a User/Group/Role is able to do.
4. Roles : You create roles and then assign them to AWS Resources.
IAM we have learnt so far
1. IAM is universal. It does not apply to regions at this time.
2. The "root account" is simply the account created when first setup your AWS account. It has complete Admin access.
3. New Users have No Permissions when first created
4. New Users are assigned Access Key Id & secret Access Keys when first created.
To get Billing Notification we need to go to Cloud Watch which is under Management & Governance
S3 ( Simple Storage Service )
S3 provides developers and IT teams with secure, durable, highly-scalable object storage. Amazon S3 is easy to use, with a simple webservices interface to store and retrieve any amount of data from anywhere on the web.
S3 is a safe place to store your files.
Basics of S3 are as follows
It is Object-based storage - i.e. allows you t upload files.
Files can be from 0 Bytes to 5 TB. There is unlimited storage.
Files are stored in Buckets. Bucket is basically a folder. Per account by default we can have 100 S3 buckets .
The data is spread across multiple devices and facilities.
S3 is a universal namespace. That is, names must be unique globally.
Not suitable to install an operating system on. It is just used to store files.
You can turn on MFA Delete
When you upload a file to S3, you will receive a HTTP 200 code if the upload was successful.
S3 is Object based. Think of Objects just as files.
Object/ S3 Key Fundamentals consist of the following :
1. Key (this is simply the name of the Object)
2. Value(this is simply the data and is made up of sequence of bytes).
3. Version ID (Important for versioning)
4. Metadata(Data about data you are storing)
5. Subresources
Access Control Lists
Torrent
How does data consistency work for S3?
Read after write consistency for PUTS of new Objects
Eventual Consistency for overwrite PUTS and DELETES ( can take some time to propagate)
In other Words:
If you write a new file and read it immediately afterwards, you will be able to view that data
If you update AN EXISTING file or delete a file and read it immediately, you may get the older version, or you may not. Basically changes to objects can take a little bit of time to propagate.
S3 has the following guarantees from Amazon:
Built for 99.99% availability for the S3 platform
Amazon Guarantee 99.9% availability
Amazon guarantees 99.99999999% durability for S3 information .(Remeber 11* 9s).
S3 has following features
Tiered Storage Available / Storage Classes
Lifecycle Management
Versioning
Encryption
MFA Delete
Secure you data using Access Control Lists and Bucket Policies
S3 Storage Classes/Tiers
S3 Standard
S3 -IA
S3 One Zone -IA
S3 - Intelligent Tiering
S3 Glacier
S3 Glacier Deep Archive
S3 Standard
99.99% availability 99.999999999% durability, stored redundantly across multiple devices in multiple facilities, and is designed to sustain the loss of 2 facilities concurrently.
S3 -IA (Infrequently Accessed)
For data that is accessed less frequently, but requires rapid access when needed. Lower fee than S3,but you are charged a retrieval fee.
S3 One Zone - IA(Infrequently Accessed)
For where you want a lower-cost option for infrequently accessed data, but do not require the multiple Availability zone data resilience.
Before S3 One Zone - IA we have S3-Reduce Redundancy storage (RRS) this service still exists but it been phase out.
S3 - Intelligent Tiering
Designed to optimize costs by automatically moving data to the most cost-effective access tier, without performance impact of operational overhead
S3 Glacier
S3 Glacier is a secure, durable and low-cost storage class for data archiving. You can reliably store any amount of data at costs that are competitive with or cheaper than on-premises solutions. Retrieval times configurable from minutes to hours.
S3 Glacier Deep Archive
S3 Glacier Deep Archive is Amazon S3's lowest-cost storage class where a retrieval time of 12 hours is acceptable.
S3 - charges are in following ways
Storage
Requests and Data Retrievals
Storage Management Pricing
Data Transfer Pricing
Transfer Acceleration
Cross region Replication Pricing
Not suitable to install an Operating system on or database on
Key Fundamentals of S3 are
Key (this is simply the name of the object)
Value (This is simply the data and is made up of a sequence of bytes)
Version ID (Important for versioning)
Metadata (Data about data you are storing)
Subresources
Access Control Lists
Torrent
Amazon S3 faqs
https://aws.amazon.com/s3/faqs/
When you view your buckets you view them globally but you can have buckets in individual regions.
You can replicate the contents of one bucket to another bucket automatically by using cross region replication.
You can change storage classes and encryption of your objects on the fly.
What makes up the cost of S3?
Storage
Request and Data Retrievals
Data Transfer
Management & Replication
Restricting Bucket Access
Bucket Policies - Applies across the whole bucket
Object Policies - Applies to individual files
IAM Policies to Users & Groups - Applies to Users & Groups
By default, all newly created buckets are PRIVATE. You can setup access to your buckets using
Bucket Policies
Access Control Lists
Encryption in Transit is achieved by
SSL/TLS
Encryption At Rest (Server Side) is achieved by ( SSE - Server side Encryption)
1. S3 Managed Keys - SSE-S3
2. AWS key Management Service, Managed Keys - SSE -KMS
3. Server Side Encryption With Customer Provided Keys - SSE-C
Client side Encryption
Using Versioning with S3
- Stores all versions of an object (including all writes and even if you delete an object)
- Great backup tool
- Once enabled, Versioning cannot be disabled, only suspended.
- Integrated with Lifecycle rules
- Versioning's MFA Delete capability, which uses multi-factor authentication, can be used to provide an additional layer of security
Every version we need to make is public to view publicly
Lifecycle Management with S3
- Automates moving your objects between the different storage tiers.
- Can be used in conjunction with versioning
- Can be applied to current versions and previous versions.
S3 Object Lock and Glacier Vault Lock
We can use S3 Object Lock to store objects using a Write Once, Read Many (WORM) model. It can help you prevent objects from being deleted or modified for a fixed amount of time or indefinitely.
We can use S3 Object Lock to meet regulatory requirements that require WORM storage or add an extra layer of protection against object changes and deletion
S3 Object Lock Modes
Governance Mode
Compliance Mode
Governance Mode
In Governance Mode, users can't overwrite or delete an object version or alter its lock settings unless they have special permissions. With governance mode, you protect objects against being deleted by most users, but you can still grant some users permission to alter the retention settings or delete the object if necessary.
Compliance Mode
In compliance mode , a protected object version can't be overwritten or deleted by any user, including the root user in your AWS account. when an object is locked in Compliance mode ,its retention mode can't be changed and its retention period can't be shortened. Compliance mode ensures an object version can't be overwritten or deleted for the duration of the retention period.
Retention Periods
A retention period protects an object version for a fixed amount of time. When you place a retention period on an object version, amazon S3 stores a timestamp in the object version's metadata to indicate when the retention period expires. After the retention period expires, the object version can be overwritten or deleted unless you also placed a legal hold on the object version.
Legal holds
S3 Object lock also enables you to place a legal hold on an object version. Like a retention period, a legal hold prevents an object version from being overwritten or deleted. However , a legal hold doesn't have an associated retention period and remains in effect until removed. Legal holds can be freely placed and removed by any user who has the s3:putObjectLegalHold permission.
Glacier Vault Lock
S3 Glacier Vault Lock allows you to easily deploy and enforce compliance controls for individual S3 Glacier vaults with a Vault Lock policy. You can specify controls, such as WORM, in a vault lock policy from future edits. Once locked, the policy can no longer be changed.
S3 Prefixes
Middle bit between bucket name and object name is called S3 Prefixes
mybucketname/folder1/subfolder1/myfile.jpg > /folder1/subfolder1
mybucketname/folder2/subfolder1/myfile.jpg > /folder2/subfolder1
mybucketname/folder3/myfile.jpg > /folder3
mybucketname/folder4/subfolder1/myfile.jpg > /folder4/subfolder1
S3 Performance
S3 has extremely low latency. You can get the first byte out of S3 with 100- 200 milliseconds.
Yu can also achieve a high number of requests :
3,500 PUT/COPY/POST/DELETE and
5,500 GET/HEAD requests per second per prefix.
We can get better performance by spreading your reads across different prefixes. For example, if you are using two prefixes, you can achieve 11,000 requests per second
If we use all four prefixes in the last example, you would achieve 22,000 requests per second.
S3 Limitations when using KMS
If y
S3 Performance: Uploads
Multipart Uploads
- Recommend for files over 100 MB
- Required for files over 5GB
- Parallelize uploads (increase efficiency)
S3 Performance: Downloads
S3 Byte-Range Fetches
- Parallelize downloads by specifying byte ranges.
- If there's a failure in the download, it's only for a specific byte range.
S3 Select
S3 Select enables applications to retrieve only a subset of data from an object by using simple SQL expressions. By using S3 Select to retrieve only the data needed by your application, you can achieve drastic performance increases - in many cases, you can get as much as a 400 improvement.
Let's assume all your data is stored in S3 in a zip files that contains CSV files. without S3 Select, you would need to download, decompress, and process the entire CSV to get the data ou needed.
Glacier Select
Companies which are highly regulated e.g. financial services, healthcare and others write data directly to Amazon Glacier to satisfy compliance needs like SEC Rule 17a-4 or HIPAA. Many S3 users have lifecycle policies designed to save on storage costs by moving their data into Glacier when they n longer need to access it on a regular basis.
Glacier Select allows you to run SQL queries against Glacier directly.
AWS organizations
AWS Organizations is an account management service that enables you to consolidate multiple AWS accounts into an organization that you create and centrally manage.
and Consolidated Billing
3 different ways to share S3 buckets across accounts
- Using Bucket Policies & IAM (applies across the entire bucket). Programmatic access Only.
- Using Bucket ACLs & IAM (individual objects).Programmatic Access Only.
- Cross-account IAM Roles. Programmatic and Console access
*************************************************************************
DigitalOcean Cloud
Three important characteristic of cloud Computing
On-demand and Self serviced [Any time launch without manual intervention]
Elasticity [Can scale up and down anytime]
Measured Service [Pay what you use ]
Types of Cloud Computing models
Software as a Service(SaaS) --> Google Docs, Office 365
Platform as a Service(PaaS) --> Google App Engine
Infrastructure as a Service(IaaS) --> AWS, DigitalOcean, Azure, GCP, Linode
Content Delivery Network (CDN) : It acts as a proxy which
receives the request and then forwards it to the backend systems.CDN's
comes with feature likeDistributed Denial of System (DDoS) Protection,
Web Application Firewall (WAF), Caching and others.
Elastic Compute Cloud (EC2) - To launch a server in AWS we will use this service
Virtual Private Cloud (VPC) - VPC spans all of the Availability Zones in a Region.
Internet Gateway (IGW) -
Elastic Load Balancer (ELB) - It allows us to distribute incoming traffic to multiple instances similar to what a traditional load balancer does.
Access Control List (ACL) -
Cloud Watch - Monitoring service for our AWS Cloud Resources and Applications.
Simple Notification Service(SNS) - Fully managed messaging an mobile notification service for delivering messages to the subscribed endpoints.
AWS Lamda - Serverless compute service that lets you run code without provisioning or managing servers.
AWS cloud Formation vs Terraform : Both are Infrastructure As A Code (IAAC) but AWS cloud Formation is specific to AWS where Terraform is not vendor specific
AWS Polly : Is a service that turns text into lifelike speech.
AWS WorkMail : Is a secure and managed business email service
Route 53: Is a highly available and scalable cloud Domain Name System(DNS) web service provided by amazon. for on primises Bind use to be DNS configured prior to AWS.
Amazon Cloud Front : It provides CDN features by Amazon.
Relation Database Service (RDS) : Relational Database Amazon have Aurora
For NoSQL we have DynamoDB
For Graph Nepune
AWS CodeCommit : Git repository in AWS
AWS Code Build
AWS Code Deploy
AWS Code Pipeline
AWS Fargate : Serverless
AWS Service Catalog
AWS AppStream : To access the applications with out deploying on the client
AWS Comprehend : It is used to read the
AWS Lightsail : we will get Service in low cost with basic service
AWS Partner Network (APN) : Is a group of external vendors that have received endorsement from AWS regarding thier expertise in building and implementing solutions for AWS. we have two types of APN first is APN consulting Partners and second is APN Technology Partners
Identity Access Management (IAM) :
***************************************************
Dumps
No comments:
Post a Comment