Mind map

AWS Architect

Claudio De Oliveira Toledo TI/Programação English

Map content

AWS Architect

EC2
- On-Demand
- Reserved Instances
  - Convertible
- Saving Plan
- Spot Instance
- Dedicated Host
- Dedicated Instance
- Placement Groups
  - Same RACK
  - Max 7 per Group
- EBS
  - EBS Encryption
    - AES-256
  - EBS Snapshot
  - EC2 Instance Storage (ephemeral)
  - Volumes
    - gp1/gp2 (bootable)
    - Io1/Io2 (bootable)
      - Multi Attached
    - st1 (HDD)
    - sc1 (HDD)
- EFS
  - Only Linux
Elastic Load Balancer
- Classic
  - HTTP/S, TCP,SSL
- Application
  - Layer 7.HTTP/S, Websocket
  - Assign Multiple subnets
- Network
  - Layer 4. TCP, UDP, TLS
  - One Static IP per AZ
- Gateway
  - Layer 3. GENEVE Protocol
  - Works with appliance
- Stick Session
  - Works with Classic / ALB
  - Cookie Names
    - App Based Name
      - Don't use AWS
    - Duration cookie
      - Generated by LB
      - Uses AWSALB / AWSELB
- Cross-Zone LB
  - Enable by default for ALB
  - Disable by default NLB / CLB
  - No charges for ALB/CLB
- Server Name Indication
  - Works with ALN/NLB
  - Multiple listeners with multiple Certificates
Auto Scaling Group
- Launch templates
- Dynamic Scaling Policy
  - Target Scaling Tracking
    - Use average metric
  - Simple/Step Scaling
    - Use between low and high metric
  - Schedule Action
  - Predictive scaling
    - Uses forecast
RDS
- RDS Custom Oracle: 1521 /Microsoft SQL: 1433
- PostgreSQL: 5432 MySQL: 3306 Maria DB: 3306
- Aurora
  - Backup Percone
  - 15 replicas
  - ports 5432 / 3306
- RDS Proxy
  - Supports MySQL, PostgreSQL, MariaDB, Aurora
  - Enforce IAM Authentication
  - Cannot be accessed from internet
- Elastic Cache
  - REDIS
    - Multi-AZ
    - Auth SSl
  - Memcached
  - Do not support IAM Auth
Route 53
- CNAME
- Alias
  - Targets
    - CloudFront / API Gateway / Beanstalk /S3 Web Sites VPC Interfaces End Points / Global Accelerator / Route 53 same zone
- Health checks only public resources
- Routing Policies
  - Simple
  - Weighted
  - Latency-Based
  - Failover
  - Geolocation
  - Geo-proximity
  - Multivalue
S3
- Storage Classes
  - Standard
  - S3-IA
  - One-Zone IA
  - Glacier Instant Retrieval: min 90 days
  - Glacier Flexible Retrieval: min 90 days
    - Restore tiers
      - Expedited
      - Standard
      - Bulk
  - Glacier Deep Archive: min 180 days
    - Restore tiers
      - Standard
      - Bulk
  - S3 Inteligent
    - Tiers
      - Frequent Access tier
      - IA tier: 30 days
      - Archive Instant Access tier: 90 days
      - Archive Access tier: 90 to 700
      - Deep Archive Tier: 180 to 700
- Requester Pay Bucket Requester must be auth in AWS
- S3 Event Notification
  - Sends events: SNS, SQS, Lambda
- S3 Event Notification with EventBridge
  - Advanced filtering JSON, Multi-Destinaton, Replay, Archive
- S3 Baseline Performance
  - Mult-Part Upload, Transfer Acceleration
- S3 Byte Range Fetches
  - Download partial data
- S3 Select & Glacier Select
  - S3 does the select before
- S3 Batch Operation
  - Perform Bulk operation
- S3 Security
  - SSE-S3 Server Side
    - key managed by AWS AES-256
  - SSE-KMS KMS Server Side
    - Audit key with CloudTrail
  - SSE-C (works with SDK, CLI, S3 REST API)
    - Key Managed by the customer outside AWS
    - S3 does not store the key
    - Encryption file provided in HTTP header
  - Client Side Encryption
    - Client encrypt/decrypt before send to S3
- CORS - Cross-Origin Resource Sharing
- MFA
- S3 Access Logs
- Pre-Signet URLs
- S3 Glacier Vault Lock
  - WORM model
  - Compliance / Data Retention
  - Can no longer be changed /deleted
- S3 Object Lock
  - For each object
  - Retendion Mode
    - Compliance
      - Version can't be deleted, root included. Can't changed / shortened
    - Governance
      - Legal Hold: Protect forever
- S3 Access Point
  - Create access point to groups
  - Allow access to groups
- S3 Object Lambda
  - Lambda Function change the object before retrieved by caller
CloudFront
- Origins (S3 Bucket)
  - Security with OAC (Origin Access Control)
- Custom Origin
  - ALB, EC2, ELB, S3 WebSite, any HTTP backend
- Origin Access Control
  - short-term credentials, rotations
  - Comprehensive HTTP methods
  - Supports SSE-KMS
  - Access S3 all Regions
- CloudFront Geo Restriction
  - Control Where can access
  - Pricing
    - Price Class All
      - All Regions: Best performance, Most expensive
    - Price Class 200
      - Most Regions. Exclude most expensive
    - Price Class 100
      - Only the least expensive regions
- Cache Invalidation
- Global Accelerator
  - Two Global Static IP
  - Performance
  - tcp/udp
AWS Storage
- Snow Family
  - Snowball Edge
    - without cloud/internet
    - Storage Optimized
    - Compute Optimized
    - Run EC2 offline
    - Lambda
  - Snowcone
    - Edge
    - Storage
    - Data Transfer
      - AWS DataSync
  - Snowmobile
    - truck
    - Exabytes
  - OpsHUB
    - Manage Snow Family
- Amazon FSx
  - for Windows
    - NTFS
    - AD
    - Quotas
    - DFS
  - for Lustre
    - S3 integration
    - SSD/HDD
    - On-Premises (VPN/Direct Connect)
  - for NetApp ONTAP
    - NFS/SMB/iSCSI
    - Windows/linux/MAC
    - VMWare Cloud
  - for OpenZFS
    - all NFS
    - windows/linux/mac
    - instantaneous cloning
- Volume Gateway
  - use iSCSI
  - Cached volumes
    - primary data into S3
    - frequent data in local
  - Storage volumes
    - all data in local
    - assync backup
- Tape Gateway
  - AWS Virtual Tapes
  - compress/encrypt data s3 tp glacier
  - Glacier Flexible Retrieval
  - Glacier Deep Archive
- Storage Gateway - Hardware
  - works with
    - File Gateway
    - Volume Gateway
    - Tape Gateway
- File Gateway
  - S3 File Gateway
    - bridge on-premises to s3 cloud
    - SMB/NFS
    - HTTPS / Direct Connect
    - Use lifecycle policies
  - Amazon Fsx File Gateway
    - access Windows File Server
    - cache
    - SMB/NFS/AD
    - Connects FSx for Windows
- AWS Transfer Family
  - to S3/EFS
  - FTP/SFTP/FTPS
  - integrate with AD, LDAP, Okta, Cognito
- Data Sync
  - Move large amount of data
  - Transfer S3, FSx, EFS
  - NFS/SMB permissions preserved
  - use agent
  - transfer any class s3 - include glacier
Decoupling Applications
- SQS
  - Standard
    - Long Polling
      - WaitTimeSeconds
    - Message Visibility
      - call ChangeMessageVisibility
    - Security
      - flight https, rest KMS, can use client side
    - Retention
      - Default 4 / max 14
    - ASG
      - CloudWatch Metric - Queue Length
  - FIFO
    - queue ext. .fifo
  - Producer/ Consumer
- SNS
  - Pub/Sub
  - Publish email, SMS, HTTP, SQS, Labda, kinesis Data
  - Receives CloudWatch Alarms, ASG, Lambda, S3 Events
  - topic limit 100.000
  - Topic Publish / Direct Publish
  - Security
    - flight https, rest KMS, can use client side
  - FIFO
  - SNS Message Filtering
    - JSON policy
- Kinesis
  - Realtime Streaming data
  - Data Streams
  - Data Firehose
- Active MQ
  - for RabbitMQ and ActiveMQ
  - runs on servers
  - Multi-AZ
  - HA
    - needs EFS / MQ Broker
Containers on AWS
- ECS
  - EC2
    - ECS Agent
  - Fargate
    - Task Definition
  - IAM Roles
    - EC2 Instance Profile
      - logs to CloudWatch
    - Task Role
      - Defined in Task Definition
  - Load Balancer
    - ALB for both
    - NLB
      - for high throuput/AWS Private Link
  - EFS
    - for both
    - S3 cannot be mounted
  - Auto Scaling
    - ECS Service Auto Scaling
      - Target Tracking
      - Step Scaling
      - Schedule Scaling
      - Diff from EC2 Auto Scaling
    - EC2 Launch Type
      - ASG
      - ECS Cluster Capacity Provider
- ECR
  - Public https://gallery.ecr.aws
  - Private
- EKS
  - Supports EC2 / Fargate
  - uses Public/Private ELB
  - Node types
    - Managed Node Groups
      - EC2
      - ASG
      - On-Demand / Spot
    - Self-Managed Nodes
      - Created by you
      - AMI
      - On-Demand / Spot
    - Fargate
      - No managed
  - Data Volumes
    - StorageClass
    - Suppots
      - EBS / EFS / Fsx for Lustre / for NetApp
- AWS App Runner
  - for Web App
  - code / container
  - Create/manage all
  - Connects database/cache/message
  - use cases API, web app, microsrv
SERVERLESS
- Lambda
  - short executions
  - limits
    - memory 128mb-10gb
    - 15min
    - env variables 4kb
    - disk 10gb
- DynamoDb
  - Standard/IA class
  - data types
    - scalar types/document types/set types
  - modes
    - on-demand
    - provisioned
  - DAX (memory cache)
  - Global tables
    - Must DynamoDB Streams
  - import/export s3
- cognito
- API Gateway
  - endpoints types
    - edge-optimized
    - regional
    - private
      - vpc endpoint (ENI)
- s3
- sns/sqs
- aurora
- kenesis
- fargate
- cloudfront functions (millions) < 1ms
  - javascript
  - viewer request/resposnse
- lambda@edge (thousands) 5-10 sec
  - nodeJS / python
  - viewer request/response
  - origin request/response
  - needs VPC
  - with RDS Proxy
- aws step funcrion
  - visual
DATABASES
- RDS
- NoSQL
  - DynamoDb
    - modes
      - provisioned capacity
      - On-Demand
  - Elastic Cache
    - REDIS/Memcached
      - provision EC2 instance
  - Neptune
    - graph dataset
  - DocumentDB
    - JSON data
    - HA
    - automatically grows
  - Keyspaces
    - apache cassandra
    - blockchain
    - modes
      - on-demand/ provision
    - use cases: IoT infos/ time-series data
- object store s3/glacier
- Data Warehouse
  - RedShift
  - Athena
  - EMR
- Search
  - opensearch
- graph
  - neptune
- Ledger
- Time Series
  - timestream
- aurora
  - serverless
  - multi-master
  - global
  - machine learning
    - perform ML using Segemaker & Comprehend
- s3
  - tiers
    - Standard/IA/Intelligent/Glacier+lifecycle
  - performance
    - multi-part/transfer acceleration, s3 select
  - automation
    - s3 event notification
- QLDB
  - financial records
  - immutable system
- Timestream
  - time series database
  - SQL
  - connect with
    - QuickSight, SAgemakes, Grafana, JDBC
Data & Analytics
- Athena
  - serverless
  - Uses SQL language
  - analyze data in S3
  - Use Cases: BI, analytics, reporting
  - Federation Query
    - allow SQL
      - relational, non-relational, object, custom datasources
    - Results in S3
- Redshift
  - Based PosgreSQL
  - need load data first
    - Amazon Knesis
  - Faster than athena
  - cluster
    - node
      - lider
      - compute
    - one zone
  - snapshots/disaster recovery
    - snapshot
      - point in time
      - stored in s3
      - incremental
  - spectrum
    - query s3 data
- EMR Elastic MapReduce
  - creates Hadoop Cluster
  - Apache Spark, HBase, Presto
  - use cases: data processing, ML, web indexing, big data
  - node types
    - Master node
    - code node
    - task node
  - purchasing
    - On-Demand
      - ideal Master/Core Node
    - Reserved
    - Spot Instance
      - ideal Task node
- QuickSight
  - Create Dashboard
  - Use cases: analytics / Visualizations
  - RDS, Aurora, Athena, Redshift, s3, jira
  - import xlsx, csv, json
  - standard
    - internal users
  - enterprise
    - users + groups
- Lake Formation
  - Centralized permissions
- Kinesis Data Analytics for Apache Flink
  - does not read from firehose
  - Read From Kinesis Data Streams / Amazon MSK
- MSK (Managed Streaming for Apache Kafka)
  - Alternative for Kinesis
  - multi-az
  - sored EBS
  - consumers
    - Glues, Lamda, Kinesis
- Glue (ETL extract, transform and load service)
  - prep/transform data for analytics
  - convert into Parquet format
Machine Learning
- Amazon Rekognition
  - search in images and videos
  - facial analysis
  - Content Moderation
    - detect inappropriate content
    - Flag for manual review
- Amazon Transcribe
  - speech into text
  - identify many languages
  - Remove Personal Identity
- Amazon Polly
  - you choose the voice
  - text into speech
  - Lexicon (AWS turns Amazon Web Services)
  - SSML (whispering, emphasizing words)
- Translate
- Amazon Lex & Connect
  - Lex(bot) = Alexia
    - for ASR (Automatic Speech Recognition)
  - Connect
    - connect to contact center
- Comprehend
  - for NLP Natural Language Procesing
    - extract key phrases, places
  - Analyze emails
- Comprehend Medical
  - Analyze critical information in the text
- SageMaker
  - Build ML models
- Forecast
  - how many things you can sell in the future?
- Kendra
  - Extract answers from within a document
- Personalize
  - Personalize a recommendation based on what a user buy.
- Textract
  - extract text from
    - handwriting and data from scanned documents
AWS Monitoring & Audit: ClaudWatch, CloudTrail & Config
- AWS CloudWatch Metrics
  - for every service
  - CloudWatch Logs
    - destnation s3, kinesis
    - CloudWatch Logs Metrics Filter
      - find specific IP, Error
    - CloudWatch Logs Insite
      - query logs and send to CloudWatch Dashboard
    - Cloud Watch Subscriptions
    - CloudWatch Agent / CloudWatch Unified Agent(RAM, process)
    - CloudWatch Alarms
      - Targets EC2, ASG, SNS
- Composite Alarms
- EventBridge
  - Receives from EC2, CodeBuild, S3
  - Execute JObs based in events
  - Schedule Cron Jobs based events
- CloudWatch
  - Container Insights
  - Lambda Insights
  - Contributor Insights
    - Metrics, top 10 Ip-address, URL, heaviest net user
  - Application Insigths
- CloudTrail
  - shows who does what
  - put logs into CloudWatch/S3
  - 3 types Log Events
    - Management Events (conf. secutiry, rules, etc)
    - Data Events (S3 obj-level events, Lambda activity)
    - CloudTrail Insights Events (detect unusual activities)
- AWS Config
  - Shows result auditing compliance
    - is there unrestricted access to my sec. group?
  - shows tags compliance or not
Identity and Access Management (IAM)
- AWS Organizations
- Cognito
  - give identity to interact with web/mobile apps
  - cognito user polls
    - integrated API Gateway/Load Balancer
    - serverless database for users
    - simple login, user name + passwd
  - cognito Identity Pools
    - Federated Identities
    - temporary AWS credentials
- AWS IAM Identity
  - One login for AWS accounts in AWS Organizations
  - Business cloud app (Salesforce, BOx, Microsoft 365)
  - SAML2.0-enable apps
  - EC2 Windows Instances
- AWS Directory Services
  - AWS managed Microsoft AD
    - both replication AD AWS and On-Premises
  - AD Connector
    - like proxy, redirect user account to on-premises AD
  - Simple AD
    - AD only AWS
    - Cannot be joined with on-premises AD
- AWS Control Tower
  - Preventive Guardrail
  - Detective Guardrail
AWS Security & Encryption: KMS, SSM parameter Store, CloudHSM, Shield, WAF

Information

Description: TI/Programação Mind Map on AWS Architect, created by Claudio De Oliveira Toledo on 26/12/2022.
Created by: Claudio De Oliveira Toledo
Views: 1
Rating

AWS Architect

Map content

Information

Feedback

What do you think of the new look?