GoConqr hat ein neues Design! Sag uns, wie es dir gefällt.

Kostenlos registrieren

Karteikarten

aws solutions architect

Artur Lee Portugiesisch 171 Karten

aws solutions architect

Karten in diesem Stapel (171)

  1. 1Regionphysical location in the world that consists of two or more AZs
  2. 2Availability Zoneone or more data centers - housed in separate facilities
  3. 3Edge locationsendpoints for AWS that are used for caching content
  4. 4Shared Responsability Can you do this yourself in the console?Yes - you are responsible
    No - AWS is responsible
    Encryption - shared resposability
  5. 5S3 Standard99.99%
    AZ(s) >=3
    Suitable for most workloads
    websites, CDN, mobile, gaming apps, big data analytics
  6. 6S3 Standard-Infrequent Access99.9%
    AZ(s) >= 3
    Long-term, infrequently accessed critical data
    backups, data store for disaster recovery
  7. 7S3 One Zone-Infrequent Access99.5%
    AZ = 1
    Long term, infrequently accessed, non-critical data
  8. 8S3 Glacier99.9%
    AZ >= 3
    Long-term data archiving
    Needs to be accessed within a few hours or minutes
  9. 9S3 Glacier Deep Archive99.9%
    AZ >= 3
    Rarely accessed data archiving
    default retrieval time 12 hourse
    financial records for regulatory purposes
  10. 10S3 Intelligent Tiering99.9%
    AZ >= 3
    Unknown or unpredicatble access patterns
  11. 11Encrypting S3 objects- In Transit (SSL/TLS + HTTPS)
    - At Rest SSE
    - Client-Side Encryption
    - Enforce with Bucket Policy (x-amz-server-side-encryption in parameter header)
  12. 12Encryption at rest - S3 Bucket Server-side Encryption- SSE-S3 (S3 managed Keys)
    - SSE-KMS (key management service)
    - SSE-C (Customer provided Keys)
  13. 13EBS - gp2 (ssd)- Suitable for boot disks and general apps
    - Up to 16.000 IOPS per volume
    - 99.9% durability
  14. 14EBS - gp3 (ssd)- Suitable for high performance apps
    - Predictable 3.000 IOPS baseline performance and 125 MiB/s regardless of volume size
    - 99.9% durability
  15. 15EBS - io1 (ssd)- Suitable for OLTP and latency-sensitve apps
    - 50 IOPS/GiB
    - Up to 64.000 IOPS per volume
    -High Performance and most expensive
    - Up to 99.9%
  16. 16EBS - io2 (ssd)- Suitable for OLTP and latency-sensitve apps
    - 500 IOPS/GiB
    - Up to 64.000 IOPS per volume
    - Up to 99.999%
    - Latest Generation
  17. 17EBS - st1 (HDD) Throughput Optimized HDD- Suitable for big data, data warehouses, ETL
    - Max throughput is 500 MB/s per volume
    - 99.9% durability
    - Cannot boot volume
  18. 18EBS - sc2 (HDD) Cold HDD- Less frequetly accessed data
    - Max throughput is 250MB/s per volume
    - Lowest cost
    - 99.9% durability
    - Cannot boot volume
  19. 19How to Encrypt Volumes1. Create a Snapshot of the Volume
    2. Create a copy of the Snapshot enabling encryption
    3. Create an AMI of the snapshot
    4. Create new EC2 instances using AMI
  20. 20RDS- SQL Server
    - Oracle
    - MySQL
    -PostgreSQL
    - MariaDB
    - Amazon Aurora
  21. 21Aurora- MySQL and PostgreSQL
    - 2 copies in each AZ in 3 AZs
    - Sharable snapshot
    - 3 types of replicas
    - Automated backups by default
  22. 22DynamoDB- NoSQL Database
    - Spread into 3 geographically distinct data centers
    - Consistent reads (default)
    - Strongly Consistent Reads
  23. 23DynamoDB Transactions- All or Nothing
    - ACID (Atomic, Consistent, Isolated, Durable)
    - Financial Transactions
  24. 24DynamoDB Backups- Full backups at any time
    - Zero impact on performance
    - Consistent within seconds and retained until deleted
    - Same regions as the source table
  25. 25DynamoDB Point-in-Time Recovery (PITR)- Protects against accidental writes or deletes
    - Incremental backups
    - Not enabled by default
  26. 26DynamoDB Streams- Time-ordered sequence of item-level changes in a tableDynamoDB Streams
  27. 27DynamoDB Global Tables- Add Redundancy to DynamoDB
    - Must turn on DynamoDB Streams
    - Globally distributed apps
    - Replication latency under one second
  28. 28Amazon DocumentDB- Database for MongoDB
  29. 29Cassandra- AWS Keyspaces
    - Uses NoSQL
    - Big data solution
  30. 30Neptune- Graph database
  31. 31QLDB (Quantum Ledger Database)- Immutable databases
  32. 32Timestream- Time-Series Data
  33. 33Security Groups- Virtual firewalls
    - Stateful
  34. 34Network ACLs- Optional Layer of Security that acts like a firewall
    - Default: allows all inbound and outbound traffics
    - Custom: denies all inboUnd and outbound traffic
    - Subnets are associated with a network ACL
    - 1 subnet -> 1 ACl & 1 ACL -> n subnets
    - Block IP here (not in Security Groups)
  35. 35VPC endpoints- Privately connect your VPC to other supported AWS services
    - Connect AWS services without leaving Amazon internal network
    - Interface and gateway endpoints
  36. 36VPC peering- Connect 1 VPC with other via direct network route using private IP addresses
    - Peering is in a star configuration
    - Does not support transitive peering
    - Peer between regions
  37. 37AWS PrivateLink- Peering tens, hundreds to thousands of VPCs
    - Requires a Network Load Balancer and an ENI (on the customer VPC)
  38. 38Transit Gateway- Connects on-premises and VPCs through a central hub
    - Simplifies network topology
    - Acts as a cloud router
    - Can limit how VPCs talk to each other
  39. 39Direct Connect- Establish a private connectivity between AWS and your on-premise data center
    - Physical Ethernet connection
    - More fast, secure, reliable than VPNs
  40. 40VPN Cloudhub- Simplifies VPN Topology
  41. 41WavelenghtScenario about 5G increasing application speeds at the edge using mobile networks
  42. 42Route 53- Amazon DNS service
    - Allows you register domain names, create hosted zones, manage and create DNS records
  43. 43CNAME- Resolve one domain name to another
    - Cannot be used for naked domain names
  44. 44A Record/ Alias- Used by a computer to translate the name of the domain to an IP address
    - Can be used for naked domain names
  45. 45Simple Routing Policy Route53- Sends traffic at a random order
  46. 46Weighted Routing Policy Route 53- Send traffic based on weights (80% - 20%)
  47. 47Latency Routing Policy Route 53- Sends traffic based on latency
  48. 48Failover Routing Policy Route 53- Sends traffic based on Active/Passive
  49. 49Geolocation Routing Policy Route 53- Sends traffic us to us-east and eu to eu-west
  50. 50Geoproximity Routing Policy Route 53- Based on geographic location of users and resources
    - Must have Route 53 traffic flow
  51. 51Elastic Load Balancing- Distributes incoming application traffic across multiple targets
    - Multi Az
  52. 52Application Load Balancer- Operates at Layer 7
    - Listeners
    - Rules
    - Target Groups
    - Only support HTTP and HTTPS (with SSL)
  53. 53Network Load Balancer- Operate at Layer 4
    - Use where you need extreme performance
    - Protocols not supported by Application Load Balancers
    - Can decrypt traffic but needs certificate installed
  54. 54Classic Load Balancer- Uses layer 7 and 4
    - Legacy Load Balancers
    - X-Forwarded-For: see original ip address of the client
    - Error 504: application stopped responding
  55. 55Sticky Session- Bind user´s session to a specific EC2 instance
  56. 56Deregistration Delay- Enabled: keep connections open even if the EC2 instance becomes unhealthy
    - Disabled: immediately close connections to instances that are unhealthy
  57. 57CloudWatch- Monitoring and observability platform
    - Uses metrics
    - Best to create Alarms
  58. 58CloudWatch Logs- Monitor, store and access log files from a variety of sources
    - Agent Based
    - If are SQL logs -> CLoudWatch Logs Insight
  59. 59Grafana- Data visualizations that allows querying, correlating, and visualizing your metrics, logs and traces from different sources
    - AWS Managed
    - Use cases: Container Metrics visualizations, IoT, troubleshooting
  60. 60Prometheus- Used for securely monitoring container metrics at scale
    - Serverless
  61. 61Vertical Scaling- Resizing ec2 instances to match with demand
  62. 62Horizontal Scaling- Adding or removing instances to match up with the demand
  63. 63Auto Scaling Groups- Collections of EC2 instances that are treated as a collective group for purposes of scaling and management
    - Set up minimum, maximum and desired number
  64. 64Scale out- The act of adding more instances when needed
  65. 65Scale in- The act of removing instances when they are not needed
  66. 66RDS Scaling- Aurora serverless
    - Uses read replica (spread workload)
    - Scaling Storage (only able to scale up not down)
    - Vertical scaling (resizing database)
  67. 67Non-relational Database Scaling (DynamoDB)- AWS is responsible for scaling
    - Provisioned: predictable workload
    - On-demand: Sporadic workload
  68. 68SQS- Messaging queue that allows asynchronous processing of work
    - Default retention period: 4 days
    - Encrypted in transit by default (add at rest)
    - Not bi-directional
    - Long vs short polling (always prefer long)
  69. 69SQS FIFO- Guarantees messages ordering
    - No message duplication
    - Lower performance
    - More expensive
  70. 70SNS- Push-based messaging service
    - Delivers message to subscribed endpoints
    - Encryption in transit by default (add at rest)
    - If it fails, it will not try again (except http(s))
    - Loves Cloudwatch
    - Often used as alerts
  71. 71API Gateway- Fully managed AWS service that allows you to create, maintain, monitor and secure your API
    - Safe "front door" to your application
  72. 72AWS Batch- Run batch computing workloads (EC2 or ECS/Fargate)
    - Skip installation and maintance of batch computing
  73. 73Amazon MQ- Managed messagin broker
    - RabbiMQ or ActiveMQ (Always choose Amazon MQ)
    - JSM, AMQP 0-9-1, AMQP, MQTT, OPenWire, Stomp protocols -> Amazon MQ has to be in the answer
  74. 74AWS Step Functions- Serverless orchestration service
    - State Machine
    - Workflow decision requirements: condition checks, failure catches, wait periods
  75. 75Amazon AppFlow- Managed integration service to exchange data between SaaS appas and AWS services
    - Bi-directional data transfers
    - Managed and faster transfer of SaaS into AWS services
  76. 76Redshift- Fully managed, petabyte-scale data warehouse
    - Very large relational database
    - Only supports single-AZ deployments
  77. 77Elastic MapReduce (EMR)- Managed big data platform to process vast amounts of data using open-source tools
    - AWS ETL tool
    - Creates EC2 instances in your VPC
    - Open Source Cluster
  78. 78Kinesis- Ingets, process and analyze real-time streaming data
    - Two versions: Data streams and data firehose
    - Can be a queue (like SQS). Is faster than SQS and can store data up to a year (but sqs is easier)
  79. 79AWS Athena- Iteractive query service to analyze data in S3 using SQL
    - Serverless SQL
  80. 80AWS Glue- Serverless data integration that makes it easy to discover, prepare and combine data
    - Allows you to ETL workloads without managing Underlying servers
  81. 81AWS QuickSight- Fully managed BI data visualization service
    - Creates dashboards
    - Sharing data
  82. 82AWS OpenSearch (ElasticSearch)- Managed Service allowing to run search and analytics engines
    - Ingets, search and analyze data in your clusters
    - Used primarily for analyzing log files and various documents, especially within an ETL process
  83. 83AWS Data Pipeline- Managed ETL service to automate movement and transform your data
    - Data-driven workflows
    - Integrates with storage services and compute services
  84. 84Amazon Managed Streaming for PAache Kafka- Fully managed service for running data streaming apps that uses Apache Kafka
    - Provides control-plane operations
    - Push broker logs to CLoudWAtch, S3 or Kinesis Data Firehose
  85. 85Lambda- Serverless compute service to run code without provisioning or managing servers
    - 15 minutes of runtime
    - Lambda Triggers: S3, Kinesis, EventBridge (common triggers)
  86. 86Container- Standard unit of software that packages up code and its dependencies so apps runs quickly and reliably from one computing environment to another
    -
  87. 87ECS- Manage 1, 10, hundreds to thousands of containers
    - ELB integration
    - Easy to use
    - Role Integration
    - Always prefered over EKS
    - AWS Container management solution
  88. 88EKS- AWS managed Kubernetes management solution
    - Best used when you are not all in on AWS
    - More work to configure
  89. 89Fargate- Serverless compute engine for containers
    - Uses ECS or EKS
  90. 90Lambda x Fargate- Fargate when you have more consistent workloads
    - Lambda to unpredictable or incosistent workloads
    - Lambda to applications that can be expressed as a single function
  91. 91EventBridge- Serverless event bus
    - Pass events from a source to an endpoint
    - EventBridge is the glue: holds together serveless application to Lambda functions
  92. 92ECR- AWS Managed container image registry
    - Private
  93. 93ECS and EKS Anywhere- Orchestrates containers outside AWS
  94. 94Aurora Serverless- On-demand or Auto scaling database
    - Based on demand
  95. 95AWS X-Ray- Collects application data to gain insights about requests and responses of services
    - Traces and downstram response times
  96. 96DDos Layer 4 Attack- SYN Flood
    - Amplification attack
  97. 97DDos Layer 7 Attack- Get or POST flood
  98. 98CloudTrail- AWS service that increases visibility by recording API calls and Console actions (on a S3)
    - It´s like a CCTV
    - Identify which users and accounts called AWS
    - After incident investigation, real-time intrusion detection, industry and regulatory compliance
  99. 99AWS Shield- Protection from DDoS attackes on Layer 3 and 4
    - There is a paid version (Advanced) costs $3000 a month
  100. 100AWS WAF- Web Application Firewall that monitors HTTP and HTTPS requests
    - Filter what IP addresses are allowed
    - Operates at layer 7
    - Allow all requests except the ones you specify
    - Reject all request except the ones you specify
    - Count the requests that match properties that you specify
    - Can block DDoS Attacks as well
  101. 101AMazon GuardDuty- Threat detection service
    - Uses AI to monitor for malicious behavior
    - Analyzes unusual API calls, unauthorized deployments etc
    - 7-14 days to set a baseline
    - Monitors CLoudTrail logs, VPC Flow Logs and DNS logs
  102. 102Firewall Manager- Security management service in a single pane of glass
    - Centrally set up and manage firewall rules across AWS Organizations
  103. 103Macie- Uses AI to inspect data in S3
    - Finds PII, PHi and financial data
  104. 104Inspector- Automated security assessment service that helps improve security and compliance of apps deployed on AWS
    - Network assessments: VPC scan
    - Host assessments: EC2 scan
  105. 105KMS- Managed service that creates and control encryption keys used to encrypt your data
    - Centralized control over the lifecycle and permissions of your key
    - Have automatic Key rotation
  106. 106HSM- Hardware Security Module
    - Physical computing Device that safeguards and manages digital keys and performs encryption and decryption functions
  107. 107CloudHSM- Dedicated HSM
    - Full control of underlying hardware
    - No automatic key rotation
  108. 108Secrets Manager- Service that stores, encrypts and rotates your DB credentials and other secrets
    - Automaticaly rotates credentials (not by default)
    - When rotation is enabled, immediately rotates the secret (be careful)
  109. 109Parameter Store x Secrets Manager- If it depends of the costs choose parameter store
  110. 110Presigned URLS- Anyone who receives the presigned URL can access the object for a limited time
  111. 111ARN- arn:partition:service:region:account_id:resource_type/resource
    - arn:aws:iam:us-east-1:123456789012:table/orders
    - arn:aws:s3:::my_bucket/image.png
  112. 112IAM Policies- Explicit deny > everything else
    - AWS joins all applicable policies
    - Not explicitly allowed == impclicitly denied
  113. 113AWS Certificate Manager- Creates SSL certificates
    - Integrates with ELB, CloudFront, API Gateway
    - Free service
  114. 114Audit Manager- Continual Audit AWS usage to stay compliant with industry standars and regulations
    - HIPPA or GDPR -> think of this service
  115. 115AWS Artifact- DISTRACTOR
    - audtis and compliance reports
  116. 116Cognito- Authentications, authorization and user maangement
    - User pool: Authenticate and get tokens
    - Identity Pool: Use tokens to get AWS Credentials
  117. 117Amazon Detective- DISTRACTOR
    - Analyzes root cause of event
  118. 118AWS Network Firewall- managed service to easily deploy physical firewall protection across your VPCs
  119. 119Security Hub- View all security related alerts in a central place
  120. 120CloudFormation- Creates immutable architecture
    - Stateless is better than stateful
    - Can use Parameter store to help make you more flexible templates
  121. 121Elastic Beanstalk- Amazon PaaS
    - Single-stop application deployment model
    - Beanstalks should be u sed for simple one-stop solutions
  122. 122Systems Manager- Suite of tools designed to let you view, control and automate AWS architecure ans on-premises resources
    - Automation Documents: used to control AWS resources
  123. 123CloudFront- CDN that securely delivers data, videos, applications and APIs
    - Helps reduce latency using AWS edge locations
    - Defaults to HTTPS connections with ability to add SSL certificate (only way to add HTTPS to static S3 website)
  124. 124ElastiCache- Managed version of 2 open source technologies: Memcached and Redis
  125. 125Memcached- Simple database caching solution
    - Not a database by itself
    - No failover
    - No backups
  126. 126Redis- Supported as a caching solution
    - Functions as a standalone database
    - Failover
    - Supports backups
  127. 127DynamoDB Accelerator (DAX)- In-Memory Cache
    - Reduce DynamoDB response times
    - Highly available
  128. 128DAX x Elasticache- DAX only to DynamoDB
    - ElastiCache is more flexible
  129. 129Global Accelerator- Networking service that send users traffic through AWS infra
    - Helps to deal with IP Caching
    - Always saves two IP addresses
  130. 130AWS Organizations- Free governance tool that allows you to create and manage multiple accounts
    - Centralized logging
    - Easily create and destroy accounts
    - Consolidated Billing
    - Service Control Policies (only way to restrict root account)
  131. 131AWS Config- Inventory Management and Control tool
    - Shows history of our infra
    - Creates rules to make sure resources conforms to the best practices
    - this service = standards
  132. 132AWS RAM (Resource Access Manager)- Allows you to share resources with other accounts within your organization
    - same region -> use this service
    - different region -> use VPC Peering
  133. 133Cross-Account Role Access- Ability to set up temporary access
  134. 134Directory Service- AWS Fully managed version of Active Directory
    - Managed Microsoft AD: entire AD suite
    - AD Connector: tunnel between AWS and your on-premises AD
  135. 135Cost Explorer- Allows you to visualize your cloud costs
    - Generate reports based on variety of factors (resource tags)
  136. 136AWS Budgets- Plan and set exppectations around cloud costs
    - Create alerts to warn users about exceeding their allotted spend
  137. 137Compute Optimizer- Anaylzes configurations and utilization metrics of AWS resources
    - Reports current usage optimizations and potential recommendations
    - Can create graphs
  138. 138Trusted Advisor- Fully managed best-pratice auditing tool
    - Recommended best practices provided by AWS
    - Cost Optimization, Performance, Security, Fault Tolerance, Service Limits
    - Possible to automate a response
  139. 139AWS Control Tower- Set up and govern an AWS multi-account env
    - Automates account creation and security controls
    - Prevents governance drift with guardrails
    - Quickest way to create and manage a secure, compliant multi-account env
  140. 140Guardrails- High-Level rules providing continuous governance for AWS env
  141. 141Account Factory- Configurable acocunt template
  142. 142CloudFormation StackSet- Atuomated deployments of templates deploying repeated resources for governance
  143. 143Shared Accounts- Three accounts used by Control Tower created during landing zone creation
  144. 144Preventive Guardrail- Ensures accounts maintain governance by disallowing violating actions
    - Uses SCP
    - Supported in all regions
  145. 145Detective Guardrail- Detects and alerts on noncompliacnt resources
    - Uses AWS config rules
    - Only in certain regions
  146. 146License Manager- Simplifies Managing software licenses
    - Centrally manage licenses
    - Strictly used for licenses
  147. 147AWS Health- Visibility of resource performance and availability of AWS services or accounts
    - Have alerts
  148. 148AWS Catalog- Create and manage catalogs
    - AMIs, servers, software, databases
    - Are written in cloudformation templates
  149. 149AWS Proton- Creates and manages infrastructure and deployment tooling
  150. 150Snowcone- 8TB of storage, 4GB of memory and 2 vCPUS
    - IoT sensor integration
  151. 151Snowball Edge- 48Tb to 81Tb in storage
    - Storage, COmpute and GPU flavors
  152. 152Snowmobile- 100 PB of storage
    - Designed for exabyte scale data cente migration
  153. 153Storage Gateway- Hybrid cloud storage service that helps you merge on-premise resources with AWS
    - One time migrations or long-term pairing
  154. 154File Gateway- Uses NFS or SMB mount to connect to AWS cloud
    - Helps with migrations to AWS
  155. 155Volume Gateway- Uses iSCSI mount to connect to AWS cloud
    - Perfect for backup or migration
  156. 156Tape Gateway- Replace physical tapes
    - Doesnt change current workflow
  157. 157DataSync- Agent-based solution to migrate on-premises storage to AWS
    - Uses NFS and SMB shares
    - Is a migration solution
    - One time migration
    - Continuous Sync -> Storage Gateway
  158. 158Transfer Family- Move files in and out of S3 or EFS using SFTP, FTPS or FTP
    - Best way to change nothing
    - Trick old applications to use S3
    - Legacy Applications
  159. 159Migration Hub- Single place to track progress of your application migration
  160. 160Application Discovery Service- Helps to plan, simplify and track migration
    - Agentless and Agent Based discoveries
  161. 161AWS Application Migration Service- Also known as AWS MGN
    - Good RTO and RPO
    - Automated lif-and-shift service for expediting migration apps to aws
    - Used for physical, virtual or cloud servers
  162. 162Amazon Comprehend- Understand meaning and sentiment in your text
    - Positive or negative things about a comment
  163. 163Kendra- Intelligent search service
    - Uses ai to find different silos of information (in S3, file servers and websites)
  164. 164Textract- Extracts text, handwriting and data from scanned documents
  165. 165Amazon Forecast- Predict Time-series data
    - IoT, Analytics and DevOps Applications
  166. 166FraudDetector- Detect fraud in your data
    - Scenario where you are asked to build a fraud detection machine learning
  167. 167Amazon Transcribe- Convert Audio and Video files into text
    - Used to generate subtitles
  168. 168Lex- Build conversational interfaces in apps using natural language models
    - Used to automated bots
    - Virtual agents
  169. 169Polly- Turns your text into lifelike speech
    - What Alexa uses to speak more naturally
  170. 170Lex- Build conversational chatbots
    - Logic behind A-Lex-a
  171. 171SageMaker- Ground Truth: set up labeling jobs for traingin datasets
    - NOtebook: Managed Jupyter Notebook env
    - traning
    - Inference

Informationen

Beschreibung
Karteikarten am aws solutions architect, erstellt von Artur Lee am 19/08/2023.
Erstellt von
Artur Lee
Aufrufe
4
Bewertung

Feedback

Worum geht es?

Wie gefällt dir das neue Design?

Dein Eindruck