Mapa mental
AWS Architect
Contenido del mapa
AWS Architect
EC2
- On-Demand
- Reserved Instances
- Convertible
- Saving Plan
- Spot Instance
- Dedicated Host
- Dedicated Instance
- Placement Groups
- Same RACK
- Max 7 per Group
- EBS
- EBS Encryption
- AES-256
- EBS Snapshot
- EC2 Instance Storage (ephemeral)
- Volumes
- gp1/gp2 (bootable)
- Io1/Io2 (bootable)
- Multi Attached
- st1 (HDD)
- sc1 (HDD)
- EBS Encryption
- EFS
- Only Linux
Elastic Load Balancer
- Classic
- HTTP/S, TCP,SSL
- Application
- Layer 7.HTTP/S, Websocket
- Assign Multiple subnets
- Network
- Layer 4. TCP, UDP, TLS
- One Static IP per AZ
- Gateway
- Layer 3. GENEVE Protocol
- Works with appliance
- Stick Session
- Works with Classic / ALB
- Cookie Names
- App Based Name
- Don't use AWS
- Duration cookie
- Generated by LB
- Uses AWSALB / AWSELB
- App Based Name
- Cross-Zone LB
- Enable by default for ALB
- Disable by default NLB / CLB
- No charges for ALB/CLB
- Server Name Indication
- Works with ALN/NLB
- Multiple listeners with multiple Certificates
- Classic
Auto Scaling Group
- Launch templates
- Dynamic Scaling Policy
- Target Scaling Tracking
- Use average metric
- Simple/Step Scaling
- Use between low and high metric
- Schedule Action
- Predictive scaling
- Uses forecast
- Target Scaling Tracking
RDS
- RDS Custom Oracle: 1521 /Microsoft SQL: 1433
- PostgreSQL: 5432 MySQL: 3306 Maria DB: 3306
- Aurora
- Backup Percone
- 15 replicas
- ports 5432 / 3306
- RDS Proxy
- Supports MySQL, PostgreSQL, MariaDB, Aurora
- Enforce IAM Authentication
- Cannot be accessed from internet
- Elastic Cache
- REDIS
- Multi-AZ
- Auth SSl
- Memcached
- Do not support IAM Auth
- REDIS
Route 53
- CNAME
- Alias
- Targets
- CloudFront / API Gateway / Beanstalk /S3 Web Sites VPC Interfaces End Points / Global Accelerator / Route 53 same zone
- Targets
- Health checks only public resources
- Routing Policies
- Simple
- Weighted
- Latency-Based
- Failover
- Geolocation
- Geo-proximity
- Multivalue
S3
- Storage Classes
- Standard
- S3-IA
- One-Zone IA
- Glacier Instant Retrieval: min 90 days
- Glacier Flexible Retrieval: min 90 days
- Restore tiers
- Expedited
- Standard
- Bulk
- Restore tiers
- Glacier Deep Archive: min 180 days
- Restore tiers
- Standard
- Bulk
- Restore tiers
- S3 Inteligent
- Tiers
- Frequent Access tier
- IA tier: 30 days
- Archive Instant Access tier: 90 days
- Archive Access tier: 90 to 700
- Deep Archive Tier: 180 to 700
- Tiers
- Requester Pay Bucket Requester must be auth in AWS
- S3 Event Notification
- Sends events: SNS, SQS, Lambda
- S3 Event Notification with EventBridge
- Advanced filtering JSON, Multi-Destinaton, Replay, Archive
- S3 Baseline Performance
- Mult-Part Upload, Transfer Acceleration
- S3 Byte Range Fetches
- Download partial data
- S3 Select & Glacier Select
- S3 does the select before
- S3 Batch Operation
- Perform Bulk operation
- S3 Security
- SSE-S3 Server Side
- key managed by AWS AES-256
- SSE-KMS KMS Server Side
- Audit key with CloudTrail
- SSE-C (works with SDK, CLI, S3 REST API)
- Key Managed by the customer outside AWS
- S3 does not store the key
- Encryption file provided in HTTP header
- Client Side Encryption
- Client encrypt/decrypt before send to S3
- SSE-S3 Server Side
- CORS - Cross-Origin Resource Sharing
- MFA
- S3 Access Logs
- Pre-Signet URLs
- S3 Glacier Vault Lock
- WORM model
- Compliance / Data Retention
- Can no longer be changed /deleted
- S3 Object Lock
- For each object
- Retendion Mode
- Compliance
- Version can't be deleted, root included. Can't changed / shortened
- Governance
- Legal Hold: Protect forever
- Compliance
- S3 Access Point
- Create access point to groups
- Allow access to groups
- S3 Object Lambda
- Lambda Function change the object before retrieved by caller
- Storage Classes
CloudFront
- Origins (S3 Bucket)
- Security with OAC (Origin Access Control)
- Custom Origin
- ALB, EC2, ELB, S3 WebSite, any HTTP backend
- Origin Access Control
- short-term credentials, rotations
- Comprehensive HTTP methods
- Supports SSE-KMS
- Access S3 all Regions
- CloudFront Geo Restriction
- Control Where can access
- Pricing
- Price Class All
- All Regions: Best performance, Most expensive
- Price Class 200
- Most Regions. Exclude most expensive
- Price Class 100
- Only the least expensive regions
- Price Class All
- Cache Invalidation
- Global Accelerator
- Two Global Static IP
- Performance
- tcp/udp
- Origins (S3 Bucket)
AWS Storage
- Snow Family
- Snowball Edge
- without cloud/internet
- Storage Optimized
- Compute Optimized
- Run EC2 offline
- Lambda
- Snowcone
- Edge
- Storage
- Data Transfer
- AWS DataSync
- Snowmobile
- truck
- Exabytes
- OpsHUB
- Manage Snow Family
- Snowball Edge
- Amazon FSx
- for Windows
- NTFS
- AD
- Quotas
- DFS
- for Lustre
- S3 integration
- SSD/HDD
- On-Premises (VPN/Direct Connect)
- for NetApp ONTAP
- NFS/SMB/iSCSI
- Windows/linux/MAC
- VMWare Cloud
- for OpenZFS
- all NFS
- windows/linux/mac
- instantaneous cloning
- for Windows
- Volume Gateway
- use iSCSI
- Cached volumes
- primary data into S3
- frequent data in local
- Storage volumes
- all data in local
- assync backup
- Tape Gateway
- AWS Virtual Tapes
- compress/encrypt data s3 tp glacier
- Glacier Flexible Retrieval
- Glacier Deep Archive
- Storage Gateway - Hardware
- works with
- File Gateway
- Volume Gateway
- Tape Gateway
- works with
- File Gateway
- S3 File Gateway
- bridge on-premises to s3 cloud
- SMB/NFS
- HTTPS / Direct Connect
- Use lifecycle policies
- Amazon Fsx File Gateway
- access Windows File Server
- cache
- SMB/NFS/AD
- Connects FSx for Windows
- S3 File Gateway
- AWS Transfer Family
- to S3/EFS
- FTP/SFTP/FTPS
- integrate with AD, LDAP, Okta, Cognito
- Data Sync
- Move large amount of data
- Transfer S3, FSx, EFS
- NFS/SMB permissions preserved
- use agent
- transfer any class s3 - include glacier
- Snow Family
Decoupling Applications
- SQS
- Standard
- Long Polling
- WaitTimeSeconds
- Message Visibility
- call ChangeMessageVisibility
- Security
- flight https, rest KMS, can use client side
- Retention
- Default 4 / max 14
- ASG
- CloudWatch Metric - Queue Length
- Long Polling
- FIFO
- queue ext. .fifo
- Producer/ Consumer
- Standard
- SNS
- Pub/Sub
- Publish email, SMS, HTTP, SQS, Labda, kinesis Data
- Receives CloudWatch Alarms, ASG, Lambda, S3 Events
- topic limit 100.000
- Topic Publish / Direct Publish
- Security
- flight https, rest KMS, can use client side
- FIFO
- SNS Message Filtering
- JSON policy
- Kinesis
- Realtime Streaming data
- Data Streams
- Data Firehose
- Active MQ
- for RabbitMQ and ActiveMQ
- runs on servers
- Multi-AZ
- HA
- needs EFS / MQ Broker
- SQS
Containers on AWS
- ECS
- EC2
- ECS Agent
- Fargate
- Task Definition
- IAM Roles
- EC2 Instance Profile
- logs to CloudWatch
- Task Role
- Defined in Task Definition
- EC2 Instance Profile
- Load Balancer
- ALB for both
- NLB
- for high throuput/AWS Private Link
- EFS
- for both
- S3 cannot be mounted
- Auto Scaling
- ECS Service Auto Scaling
- Target Tracking
- Step Scaling
- Schedule Scaling
- Diff from EC2 Auto Scaling
- EC2 Launch Type
- ASG
- ECS Cluster Capacity Provider
- ECS Service Auto Scaling
- EC2
- ECR
- Public https://gallery.ecr.aws
- Private
- EKS
- Supports EC2 / Fargate
- uses Public/Private ELB
- Node types
- Managed Node Groups
- EC2
- ASG
- On-Demand / Spot
- Self-Managed Nodes
- Created by you
- AMI
- On-Demand / Spot
- Fargate
- No managed
- Managed Node Groups
- Data Volumes
- StorageClass
- Suppots
- EBS / EFS / Fsx for Lustre / for NetApp
- AWS App Runner
- for Web App
- code / container
- Create/manage all
- Connects database/cache/message
- use cases API, web app, microsrv
- ECS
SERVERLESS
- Lambda
- short executions
- limits
- memory 128mb-10gb
- 15min
- env variables 4kb
- disk 10gb
- DynamoDb
- Standard/IA class
- data types
- scalar types/document types/set types
- modes
- on-demand
- provisioned
- DAX (memory cache)
- Global tables
- Must DynamoDB Streams
- import/export s3
- cognito
- API Gateway
- endpoints types
- edge-optimized
- regional
- private
- vpc endpoint (ENI)
- endpoints types
- s3
- sns/sqs
- aurora
- kenesis
- fargate
- cloudfront functions (millions) < 1ms
- javascript
- viewer request/resposnse
- lambda@edge (thousands) 5-10 sec
- nodeJS / python
- viewer request/response
- origin request/response
- needs VPC
- with RDS Proxy
- aws step funcrion
- visual
- Lambda
DATABASES
- RDS
- NoSQL
- DynamoDb
- modes
- provisioned capacity
- On-Demand
- modes
- Elastic Cache
- REDIS/Memcached
- provision EC2 instance
- REDIS/Memcached
- Neptune
- graph dataset
- DocumentDB
- JSON data
- HA
- automatically grows
- Keyspaces
- apache cassandra
- blockchain
- modes
- on-demand/ provision
- use cases: IoT infos/ time-series data
- DynamoDb
- object store s3/glacier
- Data Warehouse
- RedShift
- Athena
- EMR
- Search
- opensearch
- graph
- neptune
- Ledger
- Time Series
- timestream
- aurora
- serverless
- multi-master
- global
- machine learning
- perform ML using Segemaker & Comprehend
- s3
- tiers
- Standard/IA/Intelligent/Glacier+lifecycle
- performance
- multi-part/transfer acceleration, s3 select
- automation
- s3 event notification
- tiers
- QLDB
- financial records
- immutable system
- Timestream
- time series database
- SQL
- connect with
- QuickSight, SAgemakes, Grafana, JDBC
Data & Analytics
- Athena
- serverless
- Uses SQL language
- analyze data in S3
- Use Cases: BI, analytics, reporting
- Federation Query
- allow SQL
- relational, non-relational, object, custom datasources
- Results in S3
- allow SQL
- Redshift
- Based PosgreSQL
- need load data first
- Amazon Knesis
- Faster than athena
- cluster
- node
- lider
- compute
- one zone
- node
- snapshots/disaster recovery
- snapshot
- point in time
- stored in s3
- incremental
- snapshot
- spectrum
- query s3 data
- EMR Elastic MapReduce
- creates Hadoop Cluster
- Apache Spark, HBase, Presto
- use cases: data processing, ML, web indexing, big data
- node types
- Master node
- code node
- task node
- purchasing
- On-Demand
- ideal Master/Core Node
- Reserved
- Spot Instance
- ideal Task node
- On-Demand
- QuickSight
- Create Dashboard
- Use cases: analytics / Visualizations
- RDS, Aurora, Athena, Redshift, s3, jira
- import xlsx, csv, json
- standard
- internal users
- enterprise
- users + groups
- Lake Formation
- Centralized permissions
- Kinesis Data Analytics for Apache Flink
- does not read from firehose
- Read From Kinesis Data Streams / Amazon MSK
- MSK (Managed Streaming for Apache Kafka)
- Alternative for Kinesis
- multi-az
- sored EBS
- consumers
- Glues, Lamda, Kinesis
- Glue (ETL extract, transform and load service)
- prep/transform data for analytics
- convert into Parquet format
- Athena
Machine Learning
- Amazon Rekognition
- search in images and videos
- facial analysis
- Content Moderation
- detect inappropriate content
- Flag for manual review
- Amazon Transcribe
- speech into text
- identify many languages
- Remove Personal Identity
- Amazon Polly
- you choose the voice
- text into speech
- Lexicon (AWS turns Amazon Web Services)
- SSML (whispering, emphasizing words)
- Translate
- Amazon Lex & Connect
- Lex(bot) = Alexia
- for ASR (Automatic Speech Recognition)
- Connect
- connect to contact center
- Lex(bot) = Alexia
- Comprehend
- for NLP Natural Language Procesing
- extract key phrases, places
- Analyze emails
- for NLP Natural Language Procesing
- Comprehend Medical
- Analyze critical information in the text
- SageMaker
- Build ML models
- Forecast
- how many things you can sell in the future?
- Kendra
- Extract answers from within a document
- Personalize
- Personalize a recommendation based on what a user buy.
- Textract
- extract text from
- handwriting and data from scanned documents
- extract text from
- Amazon Rekognition
AWS Monitoring & Audit: ClaudWatch, CloudTrail & Config
- AWS CloudWatch Metrics
- for every service
- CloudWatch Logs
- destnation s3, kinesis
- CloudWatch Logs Metrics Filter
- find specific IP, Error
- CloudWatch Logs Insite
- query logs and send to CloudWatch Dashboard
- Cloud Watch Subscriptions
- CloudWatch Agent / CloudWatch Unified Agent(RAM, process)
- CloudWatch Alarms
- Targets EC2, ASG, SNS
- Composite Alarms
- EventBridge
- Receives from EC2, CodeBuild, S3
- Execute JObs based in events
- Schedule Cron Jobs based events
- CloudWatch
- Container Insights
- Lambda Insights
- Contributor Insights
- Metrics, top 10 Ip-address, URL, heaviest net user
- Application Insigths
- CloudTrail
- shows who does what
- put logs into CloudWatch/S3
- 3 types Log Events
- Management Events (conf. secutiry, rules, etc)
- Data Events (S3 obj-level events, Lambda activity)
- CloudTrail Insights Events (detect unusual activities)
- AWS Config
- Shows result auditing compliance
- is there unrestricted access to my sec. group?
- shows tags compliance or not
- Shows result auditing compliance
- AWS CloudWatch Metrics
Identity and Access Management (IAM)
- AWS Organizations
- Cognito
- give identity to interact with web/mobile apps
- cognito user polls
- integrated API Gateway/Load Balancer
- serverless database for users
- simple login, user name + passwd
- cognito Identity Pools
- Federated Identities
- temporary AWS credentials
- AWS IAM Identity
- One login for AWS accounts in AWS Organizations
- Business cloud app (Salesforce, BOx, Microsoft 365)
- SAML2.0-enable apps
- EC2 Windows Instances
- AWS Directory Services
- AWS managed Microsoft AD
- both replication AD AWS and On-Premises
- AD Connector
- like proxy, redirect user account to on-premises AD
- Simple AD
- AD only AWS
- Cannot be joined with on-premises AD
- AWS managed Microsoft AD
- AWS Control Tower
- Preventive Guardrail
- Detective Guardrail
AWS Security & Encryption: KMS, SSM parameter Store, CloudHSM, Shield, WAF
Información
- Descripción
- TI/Programação Mapa Mental sobre AWS Architect, creado por Claudio De Oliveira Toledo el 26/12/2022.
- Creado por
- Claudio De Oliveira Toledo
- Visitas
- 1
- Valoración