AWS - Understanding the AWS Environment - Chapter#4

AWS - Understanding the AWS Environment - Chapter#4

1. Domain

   • Security and Compliance
     • 2.1 Understand the AWS shared responsibility model
   • Cloud Technology and Services
     • 3.2: Define the AWS global infrastructure
     • 3.1: Define methods of deploying and operating in the AWS Cloud

2. Globally Based Services

   • You see, some AWS resources are not visibly tied to any one region. Even if those resources are, technically, running on hardware that must exist within a single region, AWS presents them as global. As a rule, their global status will generally make sense from a structural perspective.
   • AWS Identity and Access Management (IAM)
   • Amazon CloudFront
   • S3 is nevertheless considered a global service
     • While Amazon S3 buckets must, as we mentioned earlier, exist within a single region, S3 is nevertheless considered a global service (open the S3 Console page and look at the region indicator).

3. AWS Global Infrastructure: Availability Zones

   • An AWS region encompasses at least two distinct availability zones (AZs) connected to each other with low-latency network links. Although, for security reasons, Amazon zealously guards the street addresses of its data centers, we do know that a single AZ is made up of at least one fully independent data center that's built on hardware and power resources used by no other AZ.
   • subnets
     • AWS, as a matter of fact, permits up to 200 subnets per AZ.
   • Availability Zones and High Availability
     • A resource running without backup is known as a single point of failure.
   • Edge Locations
     • An edge location is a site where AWS deploys physical server infrastructure to provide low-latency user access to Amazon-based data.
     • Edge Locations and CloudFront
       •  Let's say you're hosting large media files in S3 buckets. If users would have to retrieve their files directly from the bucket each time they were requested, delivery—especially to end users living continents away from the bucket location—would be relatively slow. But if you could store cached copies of the most popular files on servers located geographically close to your users, then they wouldn't have to wait for the original file to be retrieved but could be enjoying the cached copy in a fraction of the time.
     • other AWS services that make use of edge locations
       • Amazon Route 53
       • AWS Shield
       • AWS Web Application Firewall (WAF)
       • Lambda@Edge
     • Regional Edge Cache Locations
       • In addition to the fleet of regular edge locations, Amazon has further enhanced CloudFront functionality by adding what it calls a regional edge cache. The idea is that CloudFront-served objects are maintained in edge location caches only as long as there's a steady flow of requests. Once the rate of new requests drops off, an object will be deleted from the cache, and future requests will need to travel all the way back to the origin server (like an S3 bucket).
       • addition to the fleet of regular edge locations
         • The idea is that CloudFront-served objects are maintained in edge location caches only as long as there's a steady flow of requests
           • Once the rate of new requests drops off, an object will be deleted from the cache
       • there are currently 13 worldwide

4. AWS Global Infrastructure: Extending the Cloud

   • AWS Outposts
     • AWS Outposts is a fully managed service that brings native AWS infrastructure and services to customers' on-premises data centers or colocation facilities. It allows customers to run AWS services, APIs, and tools locally, providing a consistent hybrid cloud experience. Outposts are actual physical AWS-installed and maintained servers that can be located within your organization's premises. This lets your organization run applications that require low latency, local data processing, or data residency requirements, while still enjoying full integration with your resources running in the AWS cloud.
     • a fully managed service that brings native AWS infrastructure and services to customers' on-premises data centers or colocation facilities
   • AWS Local Zones
     • They're designed to serve specific cities or metropolitan areas with ultra-low latency access to services running in Local Zone data centers.
     • Local Zones currently exist in 33 global locations, with around half in the United States and the other half spread through the rest of the world
   • AWS Wavelength
     • AWS Wavelength also addresses the need for ultra-low latency and high-bandwidth connections to mobile devices and users. However, rather than extending traditional network and compute infrastructure beyond mainstream cloud infrastructure, Wavelength brings AWS compute and storage services to the 5G cellular network. With Wavelength, AWS actually colocates their physical infrastructure within the facilities of telecommunications providers. By deploying AWS Wavelength Zones at the edge of the network, developers can run their applications in proximity to 5G base stations, reducing network latency. This can make the difference for edge-based machine learning applications and augmented reality (AR) or virtual reality (VR) deployments.
     • also addresses the need for ultra-low latency and high-bandwidth connections to mobile devices and users
     • Wavelength brings AWS compute and storage services to the 5G cellular network.

5. The AWS Shared Responsibility Model

   • The AWS cloud—like any large and complex environment—is built on top of a stack of rules and assumptions. The success of your AWS projects will largely depend on how well you understand those rules and assumptions and on how fully you adopt the practices that they represent. The AWS Shared Responsibility Model is a helpful articulation of those rules and assumptions, and it's worth spending some time thinking about it. Amazon distinguishes between the security and reliability of the cloud, which is its responsibility, and the security and reliability of what's in the cloud, which is up to you, the customer. The cloud itself consists of the physical buildings, servers, and networking hardware used by AWS data centers. AWS is responsible for making sure that its locations are secure, reliably powered, and properly maintained. AWS is also on the hook for patching, encrypting (where relevant), and maintaining the operating systems and virtualization software running its physical servers and for the software running its managed services.
   • Amazon distinguishes between the security and reliability of the cloud
   • responsibility, and the security and reliability of what's in the cloud, which is up to you, the customer.
   • on-premises deployments
     • Application code, Security, Database, OS, Virtualization, Networking, Storage hardware, Server hardware
   • IaaS
     • Application code, Security, Database, OS
     • (Provider: Virtualization, Networking, Storage hardware, Server hardware)
   • PaaS (Platform as a Service)
     • Application code
     • (Provider: Security, Database, OS, Virtualization, Networking, Storage hardware, Server hardware)
   • SaaS (Software as a Service)
     • (Provider: Application code, Security, Database, OS, Virtualization, Networking, Storage hardware, Server hardware)
   • Managed Resources
     • will “hide” all or some of the underlying configuration and administration work needed to keep things running
     • if you can edit it, you own it.
   • Unmanaged Resources
     • When you launch an EC2 instance, you're expected to care for the operating system and everything that's running on it exactly the way you would for a physical server in your on-premises data center
   • Service Health Status
     • AWS makes regularly updated, region-by-region reports on the status of its services publicly available
     • Any service outages that could affect the performance of anyone's workload will appear on Amazon's Service Health Dashboard (https://health.aws.amazon.com/health/status)
   • AWS Acceptable Use Policy
     • Because they're so easy to scale up, cloud computing services are powerful tools for accomplishing things no one had even dreamed of just a couple of decades ago. But for that same reason, they're also potential weapons that can be used to commit devastating crimes. The AWS Acceptable Use Policy (https://aws.amazon.com/aup) makes it abundantly clear that it does not permit the use of its infrastructure in any illegal, harmful, or offensive way. Amazon reserves the right to suspend or even terminate your use of its services should you engage in illegal, insecure, or abusive activities (including the sending of spam and related mass mailings). Even running penetration testing operations against your own AWS infrastructure can cause you trouble if you don't get explicit permission from Amazon in advance.
     • The AWS Acceptable Use Policy (https://aws.amazon.com/aup) makes it abundantly clear that it does not permit the use of its infrastructure in any illegal, harmful, or offensive way