GoConqr has a new look! Let us know what you think.

Sign up free

Flashcards

AWS practices and key words

Kavyashree Mohankumar AWS Training and Development Manager English 120 cards

Cards in this deck (120)

  1. 1Types of EC2 instancesOn demand- pay by second, short-term and unpredictable traffic, most expensive but highest flexibility.
    Reserved Instances(RI): You commit to 1 or 3 years and get a big discount (up to 75%). For steady and commited workloads. Apps that run 24/7. Standard RI- cheapest, but fixed instance type/region. Convertible RI: can change instance family/type.
    Spot instance: Use unused EC2 capcity(90% off). AWS can terminate your instance at any time with 2 minutes notice. Fault-tolerant workloads, batch jobs, ML jobs, CI/CD pipeline. A company doing big data analysis at night when computing is cheaper.
  2. 2Disaster recovery scenarios(deploy application in multiple availability zones)something
  3. 3Recovery time objective(RTO)How fast you need to recover your service after a disruption. RTO = 4 hours → You must restore operations within 4 hours of failure.
  4. 4Tag Policy- not same as taggingSo you want to arrange things. Tag policy is like a policy or rule to arrange the things. For example if you want to arrange tops, the tag policy involves that the dresses should be tagged of "crop", "full sleeve" , "sleeveless", "blue" etc. So the policy is that when you tag something you need to include the type of top and the color. A Tag Policy in AWS Organizations is like a rule that helps you organize and manage your resources (like servers or databases) by tagging them with labels (like "Environment" or "Owner"). It ensures that everyone uses the same tagging system, so things are easier to find, manage, and track. Ex: environment rag must have value of dev, prod, test.
  5. 5HPC in AWS high performance computing(OVERVIEW)HPC: Solve compute-heavy problems fast using distributed nodes.Run complex things. High throughput: process high volumes of data. Handles a lot of data.
    High I/O: Needs high access to data. Applications needing fast disk access. Maximize read/write speed for databases
  6. 6Types of S3 bucketsxsomething
  7. 7NAT instanceA EC2 instance configured to allow private subnets to access the internet, without exposing them to inbound internet traffic. NAT instance is configured in a public subnet and private subnet instances can access the internet through the NAT instance. Private subnet instance sends traffic to internet via NAT instance. NAT instance forwards it to internet and returns response. Inbound traffic is blocked unless it's a response to a request. NAT gateway is better cuz it's fully managed, scalable. But the instance requires manual scaling, slower performance, custom routing. For failover, you need HA(high availability-different availability zones) configured.
  8. 8private/public subnets- attach a route table to the subnet(best practice) or default main route table will be attached.Subnets are within your VPC(your own virtual private cloud) in AWS. Public subnet has a route that allows you to access the internet. Private subnet does not have a route to the internet- layer of security that protects you from the outside world. In the public subnet, you can put your web applications that access the internet, while in the private subnet, you can put your database that is secured.
    You have resources within the subnet. Configure a load balancer and attach to two public subnets which is the only way to talk to private subnet instances.
  9. 9Security groups-statefulLike a virtual firewall that controls traffic to and from your EC2 instance. Only have allow rules. Default security group is "nothing is allowed" unless you have added rules that allow traffic. up to 5 SG for one service.
    Basically these are rules that you can apply to AWS services or organizations, roles, users that controls who can access the service. Usually in JSON format that has things like allows and denies.
    A ssh security group only allows ssh traffic. HTTP + TLS = HTTPS(ssh)
  10. 10Classic Load Balancer (CLB)- not recommeded by AWSCLB (Classic Load Balancer) is like an old-school helper who hands out treats, but isn't as fancy or fast as ALB and NLB. The older version of the load balancer in AWS. It can distribute both HTTP/HTTPS and TCP/TLS traffic, but it's not as smart or efficient as ALB or NLB.
  11. 11Domain name system, Internet protocol(IP) addressIP address is a unique identifying number assigned to every physical device and website connected to the internet and allows devices to send and receive data on the internet or a local network. Its basically an identity for computers which they can use to talk, like a phone number. If you want to talk to your friend, you contact their phone using their phone number(IP address). Domain name is a readable address used to access website on the internet. You don't have to remember IP address, but can just type the domain name. Domain name system converts the domain name to its IP address. Now, when you access a website, that website is hosted on a server(device). Your device needs to talk to that server. That server has an IP address. You simply type the domain name(ww.google.com) and the DNS resolver converts the domain name to IP address by checking its records and data. https://www.amazon.com/gp/cart/view.html?ref_=nav_cart First the domain name(amazon.com) is routed to correct website, then the server goes to actual information needed by user.
    IPv4 - 4 sets of octects(bits)
  12. 12Virtual computers or machineAWS has physical servers which has a lot of hardware computers and machines. When you launch an EC2 instance connected to your region and its availability zones. Availability zones have the hardware where virtual computers are hosted or launched. Now this hardware that AWS has can host multiple virtual computers. So basically you have you own virtual computer "A" launched in the actual hardware named "lipid" but then "lipid " also hosts another virtual computer "B" which is used by another user. Multiple people are using the same hardware, but they have their own virtual machine. Well, I have my mac, why do I need to use a virtual computer? You might need to test your code in a different operating system other than macOS. You can specify the virtual computer to have Windows and test your code on that operating system. "This creates a computer within a computer". You can also excecute code or run softwares in a virtual environment without affecting your main hardware.
  13. 13virtual machines part 2You can also run multiple of these softwares or code in one of your hardware by launching different instances. A website can be hosted in a virtual computer.
  14. 14RegionsPhysical locations around the world that contain multiple AZs. Regions are used to Deploy applications in specific geographic locations for compliance and regulatory needs Minimize latency by choosing regions closer to end-users Isolate workloads to prevent failures in one region from affecting another. geographic points around the world and when a user requests something then the request usually goes to the closest region.
  15. 15Edge LocationsSmaller data centers located in cities around the world that are used to cache and deliver content. Edge locations are designed to reduce latency and improve the performance of services like Amazon CloudFront. These are not related to regions. They are in big cities because a lot of content is usually accessed in the big cities and to deliver things faster and lower latency(delay), AWS has edge locations where data is cached(stored) and quickly delivered.
  16. 16Availability ZonesRegions contains a lot of availability zones in them and these zones are isolated and have independent power, cooling, and networking. AZs are designed to provide fault tolerance(if one thing fails, this is the ability of the the big thing to keep operating)and resilience so that services can continue running if one zone experiences an outage. So regions has multiple availability zones in them and these availability zones are equipped in a way that if something in one availability zone stops working or crashed, the region will still be working because of the other availability zones. HAS DATA CENTERS, COMPUTE HARDWARE, STORAGE AND NETWORKING RESOURCES,
  17. 17Content delivery network (CDN)A Content Delivery Network (CDN) is a network of servers distributed across the globe that helps deliver internet content (like images, videos, web pages, and files) to users more quickly and reliably. CDNs have servers at various locations and these servers store or cache data or website information so it can be accessed quickly. Traffic is spread across multiple servers, reducing strain on the origin server and improving reliability. You request something, it goes to the nearest CDN and if the thing you requested is stored there then you get your content immidiately, if not then it fetches from orgin server and caches it for later use. It also reduces latency and prevent DDoS(Distributed denial of service).
  18. 18HyperText Markup Language(HTML)NOT A PROGRAMMING LANGUAGE, but you can structure your website using this language. It basically is a language that tells how to structure a website. HTML can use JavaScript to create websites.
  19. 19How do you use a virtual computer hosted on AWS physical server.First, you go to the AWS website and log into your account. This is like walking into the computer shop and showing your membership card. AWS offers a service called EC2 (Elastic Compute Cloud). Once you pick your virtual computer, Choose the operating system (like Windows or Linux), and Select the size. When you click Launch, AWS sets up your computer on one of its physical servers. You connect to your virtual computer from your own device. Use a program like SSH (Secure Shell) for Linux or Remote Desktop Protocol (RDP) for Windows to open your virtual computer. Once connected, you can use the virtual computer just like a regular one: Install software. Run programs. Host a website. Learn to code without affecting your original computer. Now your original computer might not have the capabilities of running a specific software, but launching the virtual computer which is a computer within the computer will let you run the software. You don't have to buy a new computer just to run the software.
  20. 20key pair EC2 instance ssh -i "key.pem" root@ec2-12-233-243-93.us-east-1.compute.amazonaws.com lets you connect to the EC2 instance from your terminal(note that you are on your directory containing the pem file) Also update permissions by using chmod 400 key.pemThe key pair in an EC2 instance is a security mechanism that allows you to securely connect to your Amazon EC2 virtual machine (instance). It ensures that only people with the correct private key file can access the instance. Public Key: Stored on your EC2 instance by AWS when you create or launch it. Private Key: Downloaded as a .pem file when you create the key pair. This is stored securely on your computer. When you create a key pair, it gets downloaded as a file in your computer(only one time downloadable). Then when you create and launch an instance, it asks for key access, you select the key pair that you just created. Then when accessing your virtual server(instance) thru your own computer, you have to use the private key(file) which the computer checks if it matches with the public key, then you have access to the instance.
  21. 21Type of attack: Distributed Denial of Service(DDos)A type of cyberattack where a network, website, or online service is overwhelmed with an enormous amount of traffic, making it unavailable to legitimate users. Attackers hack millions of peoples of devices to create a botnet(a network of internet-connected devices that are controlled by a hacker to perform malicious activities). Then without the person's knowledge the hacker is able to control the device. The hacker sends requests to target website or software from all these millions of devices overwhelming it and making it unavailable for actual users. Note that attacks come from many devices. Volumetric attacks- Flood the target with massive amounts of data to consume bandwidth. Protocol Attacks: Exploit vulnerabilities in protocols like TCP, HTTP, or DNS to exhaust server resources. Application-Layer Attacks- Target specific applications like websites or APIs to overload them.
  22. 22Domain name system(DNS) and on premises DNS integrationDNS is converting domain name to its IP address so two devices can talk. If you work with public networks, then you can easily access application by just typing the domain name(and AWS route 53 will get you the application). If you want to access a domain inside a VPC, but you are not connected to a VPC, then you have to set rules in route 53 resolver to allow DNS queries from your device only. For example, you have a hybrid infrastructure and you want your on-premises servers to access resources from AWS(in VPC). To do this, you use route 53 resolver to forward DNS queries from on-premises to VPC. You can also do vice versa by sending DNS queries from VPC to on-premises thru route 53 resolver.
  23. 23Protocol(HTTP,HTTPS,SSH) *so if I am messaging my friend, HTTP is like English language I use to message then API is Snapchat(the app I use or how I message)*Cloud protocols involve a lot of protocols for different cloud communications. A specific type of cloud protocol is HTTP which is commonly used for web applications, APIs, and data exchange. When this transfer is secured with SSH/SSL, it becomes HTTPS(secure transfer). So you want to know the menu a hotel. You click the menu symbol in your phone. The API gets this signal or input which is in HTTP formal. THE SIGNAL IS IN HTTP FORMAT meaning that it says UGA.getMenu() in HTTP formal which is like the one endpoint that it sends to the server and gets back the data(menu) in HTTP format and gives it to you. The communication between the device and server is done with API using HTTP(language like). Instagram pic upload:HTTP carries the picture from your phone to Instagram's servers. The picture is data. It can also give you websites from URL. The URL you type then sends a request to google servers but the request is in HTTP formal(kind of like a language for communication) then the google server responds back in HTTP back. So HTTP is like a syntax or language that carries information
  24. 24API(Application programming interface)*so if I am messaging my friend, HTTP is like English language I use to message then API is Snapchat(the app I use or how I message)*A set of rules and tools that allows different software applications to communicate with each other. Enable software to send and receive data without knowing each other's inner workings. Different for each software as they communicate. For example, the weather bureau's software system contains daily weather data. Tells how two software talks like go from A to B. APIs define how one program (client) should interact with another program (server)The weather app on your phone "talks" to this system via APIs and shows you daily weather updates on your phone. REST API- The client sends requests to the server as data. The server uses this client input to start internal functions and returns output data back to the client. REST defines a set of functions like GET, PUT, DELETE, etc. that clients can use to access server data. Clients and servers exchange data using HTTP. get.somethingFromData(); Another type of API is graphQL- It prioritizes giving clients exactly the data they request and no more.
  25. 25VPC peeringVPC peering: Two VPC's can communicate with each other only when there is a direct connection(peering) between them. No transitive routing as one cannot access another an intermediate VPC. For example, there is connection between VPC A and VPC B. There is also a connection between VPC B and VPC C. But, VPC B cannot act as a transitor(intermediator) between A and C as they are not peered(connected) with each other. So VPC A and VPC C can't communicate.
  26. 26Recovery point objectives(RPO)How much data loss (in time) you can tolerate during a failure. RPO = 15 minutes → You can afford to lose only the last 15 minutes of data.
  27. 27pilot light disaster recovery strategy- $, MINS-HOURSTakes minutes to hours and a minimal version of the environment is always running and lower cost than a standby. Exsisting on prem application is replicated in the cloud and is used for recovery when the on prem fails. Ex: Recreate the application hosting environment on AWS using EC2 instances. When on prem application fails, direct 100 % of the application traffic to the AWS cloud.
  28. 28warm standby disaster recovery strategy- mins recovery and high cost(minimal running instance always in place) - $$$, MINSA scaled-down version of the full environment is always running. In a dR, you scale up. Exsisting on prem applications and database are also hosted in the AWS cloud. Some of the traffic continiously goes to AWS cloud(like 10-20 percent) while the other goes to the on prem applications. Ex: Recreate the application hosting environment on AWS using EC2 instances. Direct 10 % of the application traffic to the EC2 instances that are running in the AWS cloud. When the on prem application fails, direct 100 % of the traffic to EC2 instance on the cloud.
  29. 29multi-site disaster recovery-seconds recovery- $$$$$, SECFull production systems are running in multiple AWS regions or AZs and Traffic is actively served from all sites.
  30. 30Data backup and restoration AWS(Disaster recovery scenario)- $Data is backed up regularly into s3, RDS. It can take hours to days to complete. Cost effective, but slow backups and Instances needs to be created when on-prem fails. HOURS OR DAYS
  31. 31snapshots for recoveryA point-in-time backup of data, typically used to create backups or replicate data across different regions or environments. Snapshots capture the state of a resource at a specific moment, which you can later use to restore the resource or create a new one. You can create a snapshot of EBS, Aurora, Redshift, RDS, EC2(via AMI), FSx, EFS. Snapshots can be encrypted.
  32. 32Multi account event notification(event driven architecture )x
  33. 33continuous integration/continuous deliveryx
  34. 34Disaster recovery solutions on AWSx
  35. 35AWS savings plansEC2 type option where you commit to a certain dollar amount per hour for compute over 1 or 3 years. Compute Savings Plan – Apply to any compute type (EC2, Lambda, Fargate)
    EC2 Instance Savings Plan – Apply to specific EC2 family/region.
    More flexible than Reserved Instances and
    For companies using multiple AWS services.
    Expect questions comparing RIs vs Savings Plans. Savings Plans are newer and more flexible.
  36. 36Connectivity among VPCVPC peering
  37. 37encryption practices for data at restAWS KMS, S3, EBS allows data at
  38. 38encryption practices for data on transitAWS certificate manager using TLS, SSL, SSH
  39. 39AWS service endpointsYou have resources in your VPC's subnet and you want them to access things that cannot be hosted in VPC. You first create a VPC endpoint to connect the resources to a service endpoint like www.s3.amazonaws.com. An service endpoint is like a DNS name or a public endpoint to your connecting service.
  40. 40service quotas and limitsx
  41. 41All storage options on AWSx
  42. 42Instance families and usescompute optimized- for high compute performance.(supports more operations and speed)
    GPC: graphic performance compute- best for 3d models and computing
    general purpose: for general use and it usually have low CPU and memory
    memory optimized: lot of memory storage
    If you want to change instance type (from t2.micro to t2.small) then you have to stop it first then chnage it and restart it.
  43. 43Storage tieringx
  44. 44Portfolio assessment(OVERVIEW)x
  45. 45seven migration strategiesx
  46. 46migration assessmentx
  47. 47S3 transfer accelerationx
  48. 48volume gatewayVolume Gateway lets you use AWS as cloud-backed hard drives (called volumes) for your on-premises servers. "I want to keep using my local server, but I also want to back it up to the cloud in case something bad happens (like a crash or fire)."
    Local App
    ↓
    iSCSI volume (looks like a local disk)
    ↓
    Volume Gateway (VM on-prem)
    ↓
    AWS Cloud (S3 or EBS snapshots)
  49. 49Networking and data transfer costx
  50. 50Data replication methodsx
  51. 51instance fleetsA group of instanes that might be launched togeather.
  52. 52service level agreement(SLA)x
  53. 53edge computing services/ processingx
  54. 54patching practicesx
  55. 55backup practicesx
  56. 56disaster recovery planningx
  57. 57VMware Cloud on AWSx
  58. 58AWS shared responsibility modelx
  59. 59SQL injectionmalicious queries in your database to manipulate your database.
  60. 60NAT gateways(types)A NAT gateway are gateways that are attached to the public subnets. Internet traffic can come from internet gateway to the VPC and come to your public subnet, but if you want any traffic FROM the private subnet to go to the internet then you would use a NAT gateway setup in public subnet. Specific outbounds from private subnet goes to the NAT gateway in public subnet, and then the NAT gateway from public subnet goes out through internet gateway to access the internet.
  61. 61Stateless vs stateful workloadx
  62. 62Horizontal vs vertical scalingx
  63. 63Edge acceleratorsx
  64. 64Disaster recovery strategy: Active-active failover(Most expensive)A high-availability setup where multiple environments (usually in different AWS Regions or AZs) are actively serving traffic simultaneously. Both sites (or more) are live, handle real user traffic. Load balancers or DNS (e.g., Route 53 latency-based routing) split traffic. Automatically shifts load if one site fails.
  65. 65Amazon RDS proxyx
  66. 66read intense vs write intense data accessx
  67. 67Capacity planning for launching instance: Capcity units, provisioned IOPSx
  68. 68Homogeneous migrationSource and target databases are the same engine and version, or mostly compatible. AWS DMS, no SCT.
    Oracle → Oracle
    MySQL → MySQL
    PostgreSQL 12 → PostgreSQL 15
  69. 69Heterogeneous migrationSource and target databases are different engines, with different data types, functions, or syntax. AWS DMS, AWS SCT
    Oracle → Amazon Aurora PostgreSQL
    SQL Server → MySQL
    MongoDB → DynamoDB
  70. 70Database replication: Read replicasDatabases often have both compute instances and databases. The compute instances help with the read and write operations that needs to be done to the database. So you we a separation of layers like storage and compute. There will be one primary write instance and multiple read replicas. The read replicas literally have everything as the primary instances, so they can be promoted when a primary instance fails. The main purpose is for availability. Multiple read replicas separate work loads and you can separate the replicas to multiple AZ for fault tolerance.
  71. 71MySQL vs progreSQL ACID compliance(good for transactions)- Guarantees Atomicity, Consistency, Isolation, and Durability for transactions. mySQL(E-commerce: simple query, cost-effecive, reliable transaction) progreSQL(financial institutions: complex query, analysis, full ACID compliance, strcutured/semi-structured)mySQL and progreSQL are both types of relational databases that uses SQL for query. mySQL is mainly used for data in E-commerce platform(order, transactions, customer info) and for content management system(wordpress) where information is stored in tables. An online store uses mySQL to store products and customers data in table as it is cost-effective and highly used for e-commerce.
    progreSQL is more advanced as it supports complex database storage and complex SQL queries. It is FULL ACID compliant meaning best for banks, financial systems that needs high accuracy and for applications with complex analytical queries. A bank needs precise transaction management so it uses progreSQL with full ACID compliance, complex queries, and JSON support.
  72. 72Data ingestion pattern: frequencyx
  73. 73Global hybrid vs multi-tierx
  74. 74Cost allocation tagsx
  75. 75multi-account billingx
  76. 76S3 bucket with Requester Pays object storagex
  77. 77Block storage options: HDD, SSD- EBS supports both of themHDD- hard disk drive(simple and old school). Like CD and cheaper and slower. Large storage with less frequent access. ex: st1, sc1.
    SSD- Like new and fast USB stick. Speed and performance preference. Frequent read and writes, running applications. ex: gp3, io2.
  78. 78Cold tiering for object storagex
  79. 79S3 object lifecycleThe S3 Object Lifecycle feature in Amazon S3 lets you automatically manage the lifecycle of your objects — from creation to archival and eventual deletion — saving time, effort, and costs. An S3 Lifecycle Rule is a set of actions that tell Amazon S3 what to do with objects over time. You can create the lifecycle rules like delete data after a year in S3 glacier deep archieve.
  80. 80Hibernation scaling strategyx
  81. 81Compute: MicroservicesInvolve breaking an application into smaller, independent services. Each service often has its own database to ensure loose coupling and independence. For example, a e-commerce platform is broken into user service(register/log in users and has user database), product/inventory service(search products from its database), order service(place, update and track order), payment service(process payment). API Gateway can act as an entry point for clients to access all services, and routes to appropriate service. User Service uses DocumentDB.
    Product Service uses DynamoDB.
    Order Service uses aurora serverless.
  82. 82Internet gatewayA fully managed gateway that allows communication between instances in your VPC and the internet.Needed for public internet access (both inbound and outbound traffic). EC2 instances can access the internet (e.g., for updates). Publicly accessible services (like web servers in public subnet) can receive internet requests. Performs NAT(like NAT gateway and instance) for public IP addresses. IGW is required for internet access from a VPC.
  83. 83Production workloads vs non-production workloadsx
  84. 84Database types: time series format, columnar formatx
  85. 85site-to-site VPNYour Data Center
    |
    [ Customer Gateway ] CGW
    ↕ (IPSec over Internet)
    [ Virtual Private Gateway ]
    |
    [ Your AWS VPC ]
    All traffic is encrypted using the IPsec protocol.
    AWS has a VGW and you would have a customer gateway(CGW) connecting these two we create two tunnels using IPsec protocol. Even if one tunnel goes down we have another.
  86. 86AWS Client VPNWhen remote workers want to connect to AWS, first they connect to their company's network using a VPN. AWS has a client VPN endpoint and users can use OPEN VPN clients that to connect to the organization's AWS managed network.
    managed client-based VPN service that allows you to securely access your AWS and on-premises networks. It provides secure connectivity from any location using an OpenVPN-based client.
  87. 87AWS network firewallx
  88. 88How Content delivery network(CDN) worksTime to live(TTL)- how long the content is cached for. A user clicks a link or tries to access a webpage. The browser goes through a DNS lookup and finds its corresponding IP address. A CDN client is the user requesting the data. PoPs(like edge locations placed in urban areas that cache content in data servers and serve it to users). A user clicks on a link(https://cdn.example.com/image.jpg) and the domain(cdn.example.com) is what is in the edge locations. Specific information is retrived after accessing the domain. An authoritative DNS server finds the anycast IP address for this domain. This IP address is hosted in all edge locations and it finds the nearest edge location and routes the user to the nearest edge location where if the information is cached, it is directly served, if not it is cached from origin and served.
  89. 89Simple routing(route 53 routing policies)This is a default routing policy. When you only have one server for your domain name. Route 53 searches through DNS records and it sees that for (www.example.com)'s domain name, there is only one IP address(one server) so route 53 directs all users to that server. If you have a single server or resource for your domain (e.g., one EC2 instance or an ELB), Route 53 will direct traffic to that server.
  90. 90Weighted routingThis is used to route traffic to multiple resources or services in specified proportions(45%, 55%). For example, if users type in your domain name, then you can specify route 53 to route 45 percent of your traffic to one server and 55 percent of the traffic to another server. Specified like www.tusk.com- 45% traffic(23.34.4544), 55% traffic(34.45.4545)
  91. 91Latency routing policyRoutes traffic to the region with the lowest delay(latency) or the closest location. You have different servers hosting your application in every region. If your user accesses your website from california. Then route 53 queries the DNS records and finds different IP addresses for different regions and since you specified to direct traffic to nearest region's server, route 53 will take the user request to that IP address.
  92. 92Failover routing policyIn the event of a resource failure, Route 53 reroutes traffic to a backup resource to maintain service availability. You have to define a primary resource and a backup resource. If user types in your domain name. Route 53 searches DNS records and finds that you use failover routing policy. It has two IP addresses and based on health checks knows that your primary IP address does not work so it directs user to secondary or backup.
  93. 93Geolocation routingRoutes traffic based on the geographic location of the user. If a user is in a specific country or region, Route 53 directs them to a resource located near them, potentially serving localized content or ensuring better performance. So if a user types www.amazon.com from India then route 53 goes through domain names and finds a specific IP address in the region of India and directs you to a location to that server in India. That server has Indianized content so the user gets localized content.
  94. 94Client IP CIRD routingRoute 53 allows you to define DNS routing based on the CIDR block of the user's IP address. With CIDR-based routing, Route 53 evaluates the IP address of the user making the request, and if it falls within a specified CIDR block, it routes the traffic to a specific resource. For example, you create a hosted zone for your domain then you create a policy specifying that traffic from 192.168.0.0/24 IP address should go to server A and traffic from 10.0.0.0/16 should be routed to server B. Similar to geolocation routing where you set a policy that IP addresses between 103.0.0.0/24(CIRD specific to asia) go to the asia server.
  95. 95Classless Inter-Domain Routing block(CIRD blocks)This is a way to specify a range of IP addresses using a network prefix and a subnet mask. It defines the size of the network and the range of the IP addresses in that range. CIDR notation is written as an IP address followed by a forward slash ("/") followed by a number. The number after the slash specifies the number of bits used for the network portion of the address. 192.168.0.0/24- This means that out of the 32 bits, 24 are for the network and 8 are for hosts. The higher the number after the slash, the smaller range of IP address available. 192.168.0.0/24 defines a block of 256 IP addresses from 192.168.0.0 to 192.168.0.255.
  96. 96Hosted zoneA hosted zone has a collection of DNS records that define how to route traffic for that domain. After you create your domain, the hosted zone allows you to define how you want to route traffic coming to your domain. So you can basically say your domain should follow the CIRD routing policy and point to certain servers. Two hosted zones:
    public hosted zone: has DNS records for domains accessible through the internet. (www.google.com) points to google's IP address.
    Private IP address: Has a list of DNS records where the domain LIST is only accessible when the user is connected to the corresponding VPC. To access internal.example.com, the user needs to be connected to a specific VPC. Unless the user is connected to a specific VPC, they can't even search the private hosted zone.
  97. 97Transit Getaway route tableComponent of AWS transit getaway. It helps control how traffic is routed between your VPCs, on-premises network and other connected resources.
  98. 98Transitive routingNetwork traffic can flow indirectly between multiple networks or routers through intermediary networks or routers. Usually used in AWS transit gateway and VPN connections. AWS transit gateway enables VPCs and on-premises networks to communicate through transit gateway. The transit gateway acts as a hub where VPC's and VPN's can all connect to the gateway and can talk to each other. If VPC A is connected to the Transit Gateway, and VPC B is also connected to the same Transit Gateway, then VPC A can communicate with VPC B even if there is no direct peering between them.
  99. 99relational database AWS services include: relational database service(RDS), aurora, redshift, keyspacesSTRUCTURED data with tables, columns, and rows. It represents strict relationships between data and allows complex queries. Has a schema(blueprint for how relational database is structured). Examples include mySQL(Open-source relational database that supports SQL), progreSQL(Advanced, open-source relational database with support for complex queries and custom functions), and oracle database. Scales vertically as data is added. An online store uses MySQL to store user accounts, orders, and inventory. A fintech app uses PostgreSQL to manage banking transactions and financial reports. products: Stores product details like name, price, stock in table. Stores user information in table. Tracks account details like balance in tables.
  100. 100Non-relational database AWS services include: dynamoDB, documentDB, neptune, elastiCacheUNSTRUCTURED DATA that uses noSQL and is flexible. Data can be stored in various formats, including key-value pairs, documents, graphs, or columnar structures. Has no schema or blueprint and scales horizontally. Is usually stored using JSON or key-value. Real time analysis and cahching. Examples include MongoDB(Document-oriented database that stores JSON-like data), DynamoDB(Fully managed key-value and document database designed for high throughput and scalability.), Cassandra, Redis. A blogging platform uses MongoDB to store blog posts with varying formats and embedded metadata. An online marketplace uses DynamoDB for fast retrieval of product listings and user sessions. Posts: Stores documents with fields like title, author, content, and tags in collection.
  101. 101Content management System(CMS)A software application used to create, manage, and modify digital content(website, blogs, articles, videos). Examples include wordPress, Drupal. They use mySQL database to store relational data. Everything is stored in this database like Pages, blog posts, and articles. For example, the table named "users" includes columns of id, username, password, email, roles. "comments" table stores comments with columns of id, author, comment text.
  102. 102point-in-time recoverythe ability to restore data in a system, usually a database, to a specific point in the past, allowing users to recover from accidental deletions or corrupted data by reverting to a previous state at a chosen time. Point to a time before you accidently deleted something big, and you can get your database at that specific time. Amazon Keyspaces, Amazon DynamoDB, Amazon Relational Database Service (Amazon RDS), and AWS Backup, AWS aurora
  103. 103Amazon Aurora ➢ MySQL ➢ MariaDB ➢ Oracle ➢ Microsoft SQL Server ➢ PostgreSQLAurora- relational data base managed by AWS. compatible with progreSQL and mySQL and gives faster performance. Cloud based.
    mySQL-open source relational database- owned by oracle(backend storage database for SAP applications). Slower performance(complex read/write scenarios).
    mariaDB- open source relational database that is Another updated version of mySQL
    oracle DB- commercial use relational database. complex and expensive.
    progreSQL- another open-source relational database.
  104. 104Application load Balancer(ALB)- Most commonly tested and rich featureHTTP/HTTPS traffic. Traffic is routed based on url paths such as "api" or "login". Routed based on domain names or query strings, headers, cookies. It works with EC2, ECS, lambda. Uses TCP/TLS through HTTP and HTTPS. For example HTTP and HTTPS uses TCP and only HTTPS uses TLS. Default sets up load balancer in multiple AZs. healthy threshhold: How many checks to pass before its healthy.
    Unhealthy threshold: How many checks before its unhealthy.
  105. 105Network load Balancer(NLB)- low latency, high HPC uses, non HTTP, preserve client IP Raw TCP and TLS is used by NLB.Sends within network and stuff. Has listeners and if is correct then it sends traffic to a target group. TCP, ULP, TLS. High performance and handles millions of requests per second. Good for real time applications like gaming and IoT. ROUTES TRAFFIC BASED ON IP. AND IF YOU WANT IP TO BE STORED. TCP, TLS, and HTTP.
  106. 106Gateway Load Balancer(GWLB)- security appliances and network packet inspection.Routes traffic to firewalls, IDS/IPS and deep package inspection tools. Integration with VPC endpoints. Sits at the edge of your VPC,
    Intercepts traffic (inbound or outbound)
    Forwards it to your security appliances before it reaches your resources
  107. 107transmissions protocol HTTPS = HTTP + TLS TCP: Reliable transport (default) UDP: Fast, no reliability TLS: Encrypted transport (can terminate at NLB)TCP- transmission control protocol(Most commonly used protocol). Web browser, emails and ssh. ex: http, https, ssh.
    USD- user datagram protocol(cannot guarantee delivery of message). Used for gaming, IoT. speed > reliability(DNS, VoIP, gaming).
    TLS- transport layer security: encryption protocol. For transferring data.
  108. 108NACL(network access control list)NACL are attached to subnet when you create the subnet. It serves like a firewall that allows/denies traffic in and out of the subnet. ALLOW/DENY rules.
  109. 109Stateful vs stateless in firewallA stateful firewall only checks for coming in traffic not for coming out traffic. A stateless firewall checks for an allow for incoming traffic and an allow for outgoing traffic.
  110. 110Types of IP addressesPrivate IP address is compared to a nickname where it is used to identify resources on a private network. Can't reach from internet.
    public IP address is compared to a phone number where anyone can reach you with, but it is temporary as you can get a new one. This is accessible through the internet. When you stop and restart the instance, you get a different public IP address.
    Elastic public/private IP address is compared to a SSN number. Uniquely identifies you and doesn't change. The instance will have the same IP when you start/stop the instance. You are charged for the time elastic IP is not in use. (when its not associated with EC2 or EC2 stopped)
  111. 111Instance stagesRunning: EC2 instance running
    stop: stop the instance
    start: restart instance(public IP lost)
    reboot: restart the instance(public IP address is not lost )
    terminate: completely terminate the instance.
  112. 112BootstrappingInstall OS patches or software when an EC2 instance is launched. Do this using user data which runs scripts before launching an EC2 instance.
    To configure the user data we need to stop the instance and start it up again.
    This causes boot up time and delays, so we need to create an AMI so all the software patches are already downloaded.
  113. 113TaggingWhen you want to add key-value metadata to your services like EC2, s3, IAM roles, and lambda function then you can tag things. Tagging involves key value pair data. You will have to give a key and then a value. Key can be like name and value can be like myEC2
  114. 114Termination protection for InstanceIf you turn on termination protection for your instance then people cannot automatically terminate your instance from the management console. But the instance can still be terminated if a OS shutdown is down from the instance terminal, or if ASG is associated with the instance and it terminates it or if it a spot instance.
  115. 115SCP(service control policy)SCP can be attached to any account or organizational unit and its formatted in JSON and defines the actions of what can be done by the account, role OU. deleteObject --> "deny" that type. Security groups are network level allowance attached to resources for inbound and outbound traffic.
  116. 116Protocols:There are three layers: Application(where you do things like make API calls), transport layer, and then networking layer. Application layer uses HTTP, HTTPS(secure version), SMTP(for email transfer) to make calls, requests. Then transport layer is used which has TCP(ensure that things go accross), TLS(ensure that transport is safe), UDP(for real-time applications)
    Network layer: IP(IP) not reliable fast transport
  117. 117Dedicated Hostsx
  118. 118Route 53 resolverA DNS service for VPCs that enables DNS resolution between AWS and on-premises networks. Allow on-premises DNS queries to resolve AWS resources (e.g., EC2 private IPs in VPC). Allow AWS resources in a VPC to resolve on-premises domain names. Create rules to forward DNS queries to specific IPs (e.g., forward .corp.local to on-prem DNS). IAM policies control who can configure endpoints and rules. Use Route 53 Resolver endpoints to bridge DNS between AWS and on-prem in hybrid architectures. Key exam topics include inbound/outbound endpoints and rule-based DNS forwarding.
  119. 119Route 53 round robin method, Route 53 records: CNAME, CNIME, A recordA-record: Maps a domain name to an IPv4 address (e.g., example.com → 192.0.2.1). AAAA-record: Like an A record, but maps to IPv6 addresses. CNAME record: Maps a domain alias to another domain name (e.g., app.example.com → www.example.com). Only used for subdomains, not root domains. ALIAS record: Points to AWS resources (e.g., CloudFront, S3 static website, ELB). Round Robin method: Simple routing policy that distributes DNS responses across multiple A or AAAA records. Rotates IP addresses. Like if there are three servers, then each response rotates between three servers. No health checks.
  120. 120BGP(Border gateway protocol)routing protocol of the internet. It controls how data is routed between different networks (Autonomous Systems).This protocol is Used when AWS or your on-premises network needs to talk to other networks over the internet or Direct Connect. Route Advertisement: A network tells others, “I know how to reach this IP range.” Path Selection: BGP chooses the best path based on route metrics and policy rules. Autonomous System Number (ASN): A unique number for a network using BGP (AWS ASN is usually 64512 by default).

Information

Description
Training and Development Manager AWS Flashcards on AWS practices and key words, created by Kavyashree Mohankumar on 24/12/2024.
Views
1
Rating

Feedback

What is it about?

What do you think of the new look?

How do you like it?