Mind map

AWS Services

Megan Ramage English

Map content

AWS Services

Global Services
- Identity and Access Management
  - AWS IAM
    - IAM Users
      - An entity that represents a person or service (could be root user). By default root has all permissions and IAM has none. Up to 5000 users per AWS account.
    - IAM groups
      - Collections of users with policies/permissions attached to them. Cannot nest groups. Use principle of least privilege.
    - IAM roles
      - Roles define sets of permissions.  With roles you can delegate permissions to users. No credentials associated with the roles, however.
    - IAM policies
      - Policies define permissions applied to users, groups, and roles. Written in JSON. All permissions are denied by default and use the principle of least privilege.
    - IAM Best Practices
      - Lock away root user access keys
      - Create individlal IAM users
      - Use groups to assign permissions to users
      - Least privilege
      - MFA
      - Use roles for applications that run on EC2 instances
- AWS Storage
  - Amazon S3
    - Object based storage
      - Object = file
        such as .jpeg, .word, etc.
        Objects consist of:
        Key
        Value
        Version ID
        Metadata
      - Upload objects into buckets
        Buckets created in regions (even though S3 is global)
        Bucket names must be unique globally!
    - 99.999999% durability
      - Extremely unlikely that data will be lost.
    - Typical use cases:
      - Backup and storage
      - Application hosting
      - Software delivery
      - Static website
    - 6 storage classes
      - S3 standard, S3 intelligent tiering, S3 standard-IA, S3 One Zone-IA, S3 Glacier, S3 Glacier Deep Archive
    - Versioning
      - Maintains multiple variants of an object in the same bucket. Can be enabled/suspended at any time.
    - Replication
      - Requires versioning
      - Cross-region replication
        Copy objects across Amazon S3 buckets in different regions
      - Same-region replication
        Copy objects across S3 buckets in the same region
      - Advantages:
        Minimize latency
        Back up
- AWS Networking
  - AWS Direct Connect
    - Pay for port hours
    - Outbound data transfer
    - High speed
    - High bandwidth
    - Private network connection from customer to AWS
- Content Delivery and DNS Services
  - Amazon Route 53
    - Domain Registration
      - .net
      - .com
      - .org
    - Health checks
      - On EC2 instances
    - Routing policy
      - Simple
        Simple DNS response providing the IP address associated with a name
      - Failover
        If primary is down (based on health checks), routes to secondary destination
      - Geolocation
        Uses geographic location you're in to route you to the closest region
      - Geoproximity
        Routes you to the closest region within a geographic region
      - Latency
        Directs you based on the lowest latency route to resources
      - Multivalue answer
        Returns several IP addresses and functions as a basic load balancer
      - Weighted
        Uses the relative weights assigned to resources to determine which to route to
  - Amazon CloudFront
    - Improves performance for accessing media files by caching them
    - Content Delivery Network (CDN)
      - Caches content at edge locations
        Regional Edge Cache
        located between origin web servers and global edge locations
        Larger cache
        Aim to get content closer to users
    - Benefits:
      - Fast distribution to customers
      - Built in security against DDoS attacks
      - Integrates with S3, EC2, ELB, Route 53, Lambda
    - Origin
      - The origin of the file that the CDN will distribute
      - S3 bucket
      - EC2 instance
      - Elastic Load Balancer
      - Route 53
      - Could also be external (non-AWS)
    - Distribution
      - Web distribution
      - RTMP distribution
  - AWS Global Accelerator
    - improves availability and performance
    - Provides static IP addresses
    - Endpoints can be on:
      - Application load balancers
      - Network Load Balancers
      - EC2 instances
    - Monitors endpoint health
    - Multiple copies of application running in different regions
    - Provides failover capability
- Cloud Governance and Security
  - AWS WAF & Shield
    - AWS WAF
      - Protects against:
        compromises in application availability
        compromises in security
        consuming excessive resources
      - Creates rules with Web ACLS
    - AWS Shield
      - Guards against DDoS attacks
      - Always on detection
      - Inline mitigations
      - Minimize downtime and latency
      - Standard and advanced tiers
        standard enabled for all at no cost
      - Integrated w/ CloudFront
  - AWS Artifact
    - Compliance programs by country and globally
    - Programs include:
      - Certifications/attestations
      - Laws, regulations, and privacy
      - Alignments/frameworks
    - Security reports and agreements
      - SOC reports, PCI reports
      - BAA, NDA, etc.
  - AWS Trusted Advisor
    - Real time guidance for provisioning resources
    - Optimizing environment
    - Advises on:
      - Cost optimization
      - Performance
      - Security
      - Fault tolerance
      - Service limits
  - AWS Personal Health Dashboard
    - Personalized view
    - Status of AWS services that affect you
    - Alerts and remediation guidance
    - Proactive notifications
      - Scheduled maintenace
  - AWS Service Health Dashboard
    - NOT personalized
    - What is happening right now
    - Service availability by region
    - NOT proactive
Regional Services
- AWS Compute
  - Amazon EC2
    - Virtual server running Windows or Lunux
    - Uses AMI to launch
    - Elastic Web-Scale computing
      - Can decrease/increase capacity within minutes
    - EC2 instance types
      - General Purpose
      - Compute Optimized
      - Memory Optimized
      - Accelerated Computing
      - Storage Optimized
      - IaaS
  - Amazon ECS
    - Container management service
      - Less to manage in a container than virtual instance.
    - Highly scalable
    - No need to install, operate, or scale on your own
    - 2 launch types
      - Amazon EC2 launch type
        You provision EC2 instances. You are responsible for upgrading, patching, cluster optimization, etc.
      - Amazon Fargate launch type
        Fargate automatically provisions resources, compute, cluster optimization, etc. Limited control because AWS does most. 
    - CaaS
  - AWS Lambda
    - Serverless!
    - Trigger executes code
    - Only pay for compute time
    - Continuous scaling
    - FaaS
  - Amazon LightSail
    - Good for non technical users
    - Provides everything required to deploy a database
- AWS Storage
  - Amazon EBS
    - Persistent block storage
    - Volume automatically replicated to protect from failure
    - Attached to instance
      - Not required
      - Can attach multiple EBS to one instance
      - Cannot attach EBS to multiple instances
    - EBS Volumes must be in same AZ as the instances they're attached to
    - Deleted on termination by default
    - EBS Snapshots
      - Stored on S3
      - Capture point in time state of instance
        Not granular. Not a replacement for backup software.
      - Region specific
        EBS snapshots are region specific even though EBS volumes are AZ specific.
      - Incremental
        Only the blocks that have changed since last snapshot are saved in new snapshot, "incremental". Snapshot deletion process will only retain most recent snapshot to restore volume.
    - Instance store volumes
      - Physically attached to the host computer. Run on EC2 and stored on S3
      - High performance local disks
      - Non-persistent
        Data is lost when powered off
      - Ideal for temporary storage
      - Cannot be detached/reattached
  - Amazon EFS
    - Fully managed
    - Big data and analytics, media processing, web servicing, etc.
    - Stored across multiple AZs within a region
    - Elasticity
    - Pay for what you use
      - No pre-provisioning required
    - Read after write consistency
  - AWS Storage Gateway
    - Hybrid cloud storage
      - On-premises access to virtually unlimited cloud storage
    - Connects on premises applications to cloud storage
    - Three types:
      - Tape Gateway
      - File Gateway
      - Volume Gateway
- Elastic Load Balancing and Auto Scaling
  - Elastic Load Balancing
    - Creates high availability
    - Fault tolerance
    - 3 types:
      - Application Load Balancer
        Layer 7
        Operates at the individual request level
        Supports IP addresses, Lambda functions, and containers as targets
        HTTP, HTTPS
        Routes traffic to targets within VPC
        Based on content of request
      - Network Load Balancer
        Layer 4
        TCP
        Operates at the connection level
        Routes traffic to targets within VPC
        Based on IP protocol data
        Static IP
        Elastic IP
        Ultra high performance
        low-latency
        Capable of handling millions of requests per second. While still having ultra-low latency.
      - Classic Load Balancer
        Old, being deprecated
        Operates at BOTH request and connection level
    - ELB will handle your load in one or two availability zones
    - Automatic scaling
    - Robust security
  - Auto Scaling
    - Horizontal scaling
      - Automated process of adding or removing EC2 instances based on traffic/demand
    - Elasticity
    - Auto scaling groups
      - Collections of EC2 instances. You can specify the minimum/maximum number.
    - Scaling policies
      - Determine when, if, and how the ASG scales and shrinks (on demand/dynamic/scheduled scaling)
    - Launch configuration
      - Template used to create new EC2 instances and includes: instance family, instance type, AMI, key pair and security groups
    - Automatically creates instances
- AWS Networking
  - Amazon VPC
    - You can have multiple VPCS
      - Each VPC has its own block of addresses
    - Virtual network dedicated to your AWS account
      - Isolated from other virtual networks in the AWS cloud
    - Provides complete control over virtual networking environment
      - Selection of IP ranges
        Requires IP ranges to be created when you create the VPC
        Public
        Private
        Elastic
      - Creation of subnets
      - Configuration of route tables and gateways
    - VPC spans all AZs in the region
    - Up to 5 by default
    - Security Groups
      - Can be applied to instances in different subnets. You attach instances to security groups.
      - "State-full"
      - Evaluates all rules
      - Operates at instance level
    - Network ACLS
      - Controls access to subnets, like a firewall. Only matters for traffic coming to and from subnet, not within.
      - "State-less"
      - Processes rules in order
      - Operates at subnet level
    - NAT INSTANCE
      - In order to achieve the same thing as a NAT gateway, you must use an EC2 instance with the NAT instance. Then you will be able to forward it out to the internet.
      - Managed by you
      - Scale manually
      - No high availability
      - Need to assign security group
      - Can use as bastion host
      - Elastic IP or Public IP
      - Can support port forwarding
    - NAT GATEWAY
      - EC2 sends traffic to gateway and the gateway then forwards it out to the internet.
      - Managed by AWS
      - Elastic scalability
      - High availability
      - Can be placed in multiple AZs
      - No security groups
      - Cannot access through SSH
      - Elastic IP
      - No port forwarding
    - Connecting to VPC
      - AWS managed VPN
        Fast to set up
      - AWS Direct Connect
        Fast bandwidth, low-latency but takes weeks to months to set up
        Alternative to the internet to connect to customers on-premise sites
        Can be used to create a hybrid cloud
        Benefits:
        Reduce cost with large traffic volume
        Increase reliability
        Predictable performance. You never get predictability over the internet because it is a public connection with many users.
        Increase bandwidth
        Decrease latency
      - VPN CloudHub
        Used for connecting multiple sites to AWS
      - Software VPN
        Use 3rd party software.
    - AWS Transit Gateway
      - Connects VPCs and on-premises networks through central hub
      - Puts an end to complex peering relationships
        Peering relationships are not transitive between VPCs. When you connect one VPC to another it is a 1 to 1 relationship.
      - Acts as a cloud router
      - Data is automatically encrypted. Never travels over public internet.
- Databases
  - Amazon RDS
    - Need traditional relational database
    - Data is well-formed and structured
    - Easy to set up and operate
    - Uses EC2 instances
      - Must choose an instance family/type
    - SQL databases
    - OLTP type database
      - Online Transaction Processing type database
    - Can use encryption with KMS
    - Supports:
      - SQL Server
      - Oracle
      - MySQL Server
      - PostgreSQL
      - Aurora
        Up to 5 times faster than other databases. Features a distributed, fault-tolerant, self-healing storage system that autoscales.
      - MariaDB
    - Scalability
      - Can only be scaled up by increasing instance size (compute and storage)
    - Fault tolerance and automatic failover
      - with Multi-AZ option
  - Amazon DynamoDB
    - NoSQL database
    - In-memory performance
    - High I/O needs
    - Dynamic scaling
    - Serverless
      - Fully managed, fault tolerant, service
    - Highly available
      - 99.99& availability SLA
    - Horizontal scaling
      - Seamless scalability to ay scale with push button or auto scaling
    - Dynamo-DB accelerator (DAX)
      - Fully managed in-memory cache that increases performance
    - Backup
      - Point-in-time recovery down to the second in last 35 days.
  - Amazon RedShift
    - Data warehouse for large volumes of aggregated data
    - Used to perform analytics queries using business intelligence tools
    - Fast, fully managed, cost-effective
    - SQL based
    - Uses OLAP
      - Online Analytics Processing type database
    - Uses EC2 instances
      - Must choose an instance family/type
    - Columnar data storage
    - Keeps 3 copies of your data
    - Continuous/Incremental backups
  - Amazon ElastiCache
    - Fast & temporary storage
    - Easy to deploy Memchached or Redis compliant server nodes in the cloud
      - Memcached:
        Simplest model
        Can run large nodes with multiple cores/threads
        Scaled in/out
        Can cache DBs
      - Redis:
        Complex model
        Supports encryption
        Master/slave replication
        Cross AZ
        Automatic failover
        backup/restore
    - In-memory caching
    - Run on EC2 instances
- Monitoring and Logging Services
  - Amazon CloudWatch
    - Collects metrics from other services
      - EC2 instances are sending metrics to CloudWatch such as traffic coming in, status checks, etc.
    - Can set alarms for CPU utilization
    - Performance monitoring
      - Includes application performance
  - AWS CloudTrail
    - Auditing
      - By default stored for 90 days
    - Records activity & delivers logs
    - API history
      - Enables security analysis, resource change tracking, and compliance auditing
- Notification Services
  - Amazon SNS
    - Set up, operate, and send notifications from the cloud
    - Building and integrating loosely-coupled, distributed applications
    - Instantaneous push-based delivery
    - Inexpensive, pay-as-you-go
    - No up front costs
    - Example: Send email when CloudWatch Alarm is triggered
  - Amazon SQS
    - Messaging queue
    - Store and forward patterns
    - Building distributed/decoupled applications
    - Pull based, not push based
    - reliable, highly-scalable, hosted queue
  - Amazon SWF
    - Combines automated system and human component
    - Sequential and parallel processing
    - Similar to step functions
  - Step Functions
    - Serverless, modern, most use cases
    - Visual workflow
    - JSON
- Migration and Transfer
  - Database Migration Service
    - Migrate from on-premises or EC2 or RDS
    - homogeneous and heterogeneous
      - Homogeneous (Oracle to Oracle)  Heterogeneous (Oracle to Aurora)
    - Continuous replication
      - Minimizes downtime
    - Fully managed
    - Pay based on compute resources used
  - Server Migration Service
    - Agentless
    - Migrating on-premises and cloud-based VMs to AWS
    - Server volumes replicated and saved as AMIs
      - Once server volumes are replicated and encrypted with TLS, they are saved as AMIs and can be launched as EC2 instances
    - Can be in groups and launched in CloudFormation stack
    - Up to 90 days
    - Automated, live server replication
  - AWS Snowball
    - Transfer hundreds of terabytes or petabyes from on-premises
    - Secure device for physical transport
    - Snowball Client
    - encrypted and tamper-resistant
    - Snowmobile
      - Exabyte scale
    - Snowball edge
      - Comes with onboard storage and compute capabilites
      - Data migration adn edge computing
      - 2 options:
        Snowball Edge Storage Optimized
        Proves block storage and Amazon S3-compatiable object storage (use for local storage and large-scale data transfer)
        Snowball Edge Compute Optimized
        52 VCPUs, block and object storage, and optional GPU for machine learning, full motion video analysis in disconnected environments
      - Environments with intermittent connectivity
      - Extremely remote locations such as military/maritime
        Physically shipped back to AWS
  - AWS DataSync
    - On-premises to the cloud
    - NAS can be NFS or SMB
    - Pay per GB transferred
    - Destination could be S3, EFS, FSx
- Cloud Governance and Security
  - AWS GuardDuty
    - Threat detection service
    - Monitors malicious activity
    - Third party intelligence and machine learning
    - Automate remediation
    - Can be integrated into workflows
  - AWS KMS
    - Key management service
    - Encrypting data at rest
    - Multi-tenant
    - Most use cases
    - Create, import, rotate, disable, delete, define policies for, and audit encryption keys
  - AWS CloudHSM
    - Hardware security module
    - Generate and use encryption keys
    - Single-tenant
    - High compliance requirements
  - AWS Inspector
    - Automated security assessment service
    - Looks for vulnerabilities or deviations from best practices
    - 2 types of assessments
      - Network
        Does not require agent
        Less expensive
        Network configuration analysis
      - Host
        Requires agent
        More expensive
        Vulnerable software, host hardening, and security best practices
  - AWS Config
    - Fully managed service
    - Stored in S3
    - Provides:
      - AWS Resource Inventory
      - Configuration history
      - Alerts via SNS
      - Compliance auditing
      - Security analysis
      - Troubleshooting
    - Point in time configuration details
  - AWS Service Catalog
    - Centrally managed IT service catalog
    - Consistent governance
    - Create and manage catalogs
      - For IT services such as: virtual machine images, servers, software, and databases
    - Quick deployment
    - View products
      - and provisioned products
  - AWS OpsWorks
    - Configuration management
    - Integrates with non-AWS services
      - Chef and Puppet
    - Used for:
      - Patching
      - Updating
      - Backups
      - Configuration
      - Compliance management
  - AWS Systems Manager
    - Safely manage resources at scale
    - View/Vizualize inventory data
    - Manage compliance patches
    - Several functions:
      - Run command
      - Patch command
      - State manager
      - Session manager
  - Amazon Macie
    - Uses machine learning
    - Protects sensitive data
    - Fully managed
    - Charged based on S3 buckets evaluated
- Automation and Platform Services
  - CloudFormation
    - Template-driven provisioning
    - Deploys using code
      - Can be used to deploy almost any AWS service
    - JSON or YAML
    - Can deploy Elastic Beanstalk
    - Similar to Terraform
  - Elastic Beanstalk
    - "Web apps made easy"
    - Deploys applications on EC2
    - PaaS
    - Web applications based on Java, .NET, PHP, Node.js, Python, Ruby, Go, and Docker
    - ZIP or WAR files
    - Cannot deploy using CloudFormation
    - Similar to Google App Engine

Information

Description: Mind Map on AWS Services, created by Megan Ramage on 25/02/2021.
Created by: Megan Ramage
Views: 5
Rating

AWS Services

Map content

Information

Feedback

What do you think of the new look?