Download AWS Certified Cloud Practitioner 2022/2023 Study Guide and more Exams Nursing in PDF only on Docsity!
Guide
ECS - - โ
โ
โ
Elastic Container Service
- Launch Docker containers on AWS
- You MUST provision & maintain the infrastructure (the EC2 instance)
- AWS takes care of starting/stopping containers
- Has integrations w/the app load balancer Fargate - - โ
โ
โ
- Launch Docker containers on AWS -DOES NOT need to provision EC -SERVERLESS Offering
- AWS just runs containers for you based on the CPU/RAM you need ECR - - โ
โ
โ
Elastic Container Registry
- Private docker registry on AWS
- this is where you store your docker images so they can be run by ECS or Fargate What's serverless? - - โ
โ
โ
- new paradigm in which the developers don't have to manage servers anymore
Guide
- they just deploy code or functions!
- initially FaaS (Fx as a service)
- serverless was pioneered by AWS Lambda but now also includes anything that's managed :DB, msg, storage, etc Serverless AWS services - - โ
โ
โ
Amazon S3, DynamoDB, Fargate, Lambda Lambda - - โ
โ
โ
Virtual functions - no servers to manage! Limited by time - short executions Run on -demand Scaling is automated EC2 vs Lambda Serverless Thumbnail creation & CronJob - - โ
โ
โ
image created in S3 then pushed to Lambda Fx creating a Thumbnail, then pushed to new thumbnail in S3 and Metadata in DynamoDB, ALL serverless integrations. CRON allows you to define schedule and run script, runs on Linux AMI. CloudWath Events EventBridge, trigger every hr for Lambda fx to perform a task
Guide
Use Cases:
- simple web applications
- simple websites
- Dev/Test env Elastic Beanstalk - - โ
โ
โ
Platform as a service for developers to only deploy code, end to end management of web application
- Health monitoring suite available within the service pushes metrics to CloudWatch.
- Also checks for app health, publishes health events AWS CodeDeploy - - โ
โ
โ
Deploy apps automatically Works w/EC2 and also on-prem servers is a "HYBRID" service AWS CodePipeline - - โ
โ
โ
Orchestrate the diff steps to have the code automatically pushed to production
- code ->Build->Test->Provision->Deploy
- Basis for CICD (Continuous integration & continuous Delivery)
Guide
Benefits: fully managed and compatible with Code xxx AWS Code Artifact - - โ
โ
โ
Storing and retrieving dependencies called "artifact management"
- SW packages depend on each other to be built (code dependencies) and new ones are created CodeArtifact is a secure, scalable and cost-effective management for software development
- Developers and codebuild can retrieve dependencies straight from CodeArtifact AWS CodeStar - - โ
โ
โ
One stop shop for SW development management
- Unified UI to easily manage SW development activities in one place via dashboard AWS Cloud9 - - โ
โ
โ
a cloud IDE (Integrated Development Environment) for writing, running and debugging code
- looks like a code editor
- can be used within a web browser
Guide
Route 53 - - โ
โ
โ
1) simple routing policy, No health checks. Traditional routing process
- Weighted routing policy, traffic is divided based on the weight set for each server (e.g., 70%, 20%, 10%) 3)Latency routing policy: reroute to closest servers by looking at user's location
- failover routing policy, DR: Route 53 health checks on primary and if fails, it routes to Failover server DIFFERENCE BETWEEN Load balancing vs. Route 53 ELB = traffic distribution among multiple AZs Route 53= traffic distribution among multiple regions AWS CloudFront - - โ
โ
โ
A content delivery network (CDN). High performance due to caching content near where your users are and lowers latency. An origin is the location that a distribution sources content from, can be an EC2 instance, public S3 bucket, HTTP. DDoS protection (cuz worldwide), integration w/Shield, AWS Web App Firewall.
Guide
S3 Transfer Acceleration - - โ
โ
โ
Increase transfer speed by transferring file to an AWS edge location which will forward the data to the S3 bucket in the target region AWS Global Accelerator - - โ
โ
โ
is a networking service that improves the availability and performance of the applications that you offer to your global users AWS Global Accelerator vs CloudFront - - โ
โ
โ
- they both use the AWS global network and its edge locations around the world
- both services integrate w/AWS Shield for DDoS protection -CloudFront = Content Delivery Network, used to cache content and served at the edge location -Global Accelerator: no caching, proxying packets at the edge to apps running in one or more AWS Regions. Make your request go faster via internal private network, not internet AWS Outposts - - โ
โ
โ
"server racks" that offers the same AWS infra, services, APIs & tools to build your own apps on-premises just as in the cloud.
Guide
Amazon SNS - - โ
โ
โ
Simple Notification Services, Pub/sub
- the "event" publisher only sends msg to one SNS topic
- as many "event subscribers" as we want to listen to the SNS topic notifications
- each subscriber to the topic will get all the msg Amazon Kinesis - - โ
โ
โ
real-time big data streaming Amazon MQ - - โ
โ
โ
A managed message broker service for Apache ActiveMQ that makes it easy to set up and operate message brokers in the cloud. CloudWatch Metrics - - โ
โ
โ
Monitor the performance of AWS services and billing metrics CloudWatch Logs - - โ
โ
โ
collect logs file. Can be collected from:
- Elastic Beanstalk: logs from application
- ECS: from containers
- Lambda: from function logs
Guide
- CloudTrail based on filter -CloudWatch log agents: on EC2 machines or on-prem servers CloudTrail - - โ
โ
โ
- Provides governance, compliance and audit for your AWS account
- enabled by default
- Get an history of events/API calls made w/in AWS account by console, SDK, CLI, AWS services
- trail can be applied to all regions or a single region
- if a resource is deleted in AWS, investigate cloudtrail first! CloudTrail Events - - โ
โ
โ
1) Management Events: operations that are performed on resources in your AWS account
- Data Events
- CloudTrain Insights Events: enable to detect unusual activity (need to pay) in your account CloudTrail Events Retention - - โ
โ
โ
- Events are stored for 90 days in CloudTrail
Guide
Public and Private Subnets - - โ
โ
โ
Public subnet = Internet Gateways allows access to the internet Private subnet: NAT Gateways & NAT Instances allow instances in private subnets to access the internet via NAT Gateway placed in public subnet. Network ACL (NACL) - - โ
โ
โ
A firewall that controls traffic from and to submit within VPC Can have ALLOW and DENY rules attached at the Subnet level Stateless: return traffic must be explicitly allowed by rules Security Groups - - โ
โ
โ
A firewall that controls traffic to and from an ENI/an EC2 Instance Can have only ALLOW rules Stateful: return traffic is automatically allowed, regardless of any rules VPC Flow Logs - - โ
โ
โ
Capture information about IP traffic going into your interfaces = VPC, Subnet, Elastic Network Interface flow logs
Guide
Helps to monitor and troubleshoot connectivity issues between subnets, to and from internet Captures network info from AWS managed interfaces such as ELB, ElastiCache, RDS, Aurora, etc... VPC Peering - - โ
โ
โ
- connect two VPCs, privately using AWS' network
- make them behave as if they were in the same network
- must not have overlapping CIDR (IP range)
- VPC peering connection is not transitive (transferrable) Site to Site VPN & Direct Connect - - โ
โ
โ
S2S VPN: connect on-prem VPN to AWS, connection is encrypted but security concerns still exist as it goes over the public internet Direct Connect (DX): physical connection between on-prem and AWS. It's private, secure and fast but expense. Takes a month to establish. AWS Shield - - โ
โ
โ
AWS Shield is a managed Distributed Denial of Service (DDoS) protection service that safeguards web applications running on AWS
Guide
AWS Secrets Manager - - โ
โ
โ
-Newer service, meant for storing secrets -capability to force rotation of secrets every x days -automate generation of secrets on rotation (uses Lambda) -Integration w/RDS (MySQL, PosgreSQL,Aurora) -secrets are encrypted using KMS Amazon GuardDuty - - โ
โ
โ
โข Intelligent Threat discovery to Protect AWS Account โข Uses Machine Learning algorithms, anomaly detection, 3rd party data
- VPC Flow logs+CloudTrail logs+DNS Logs will feed into GuardDuty, it will analyze and import events to CloudWatchEvent, then will either go into Lambda or SNS Amazon Inspector - - โ
โ
โ
-Automated Security Assessments for EC instances -Analyze the running OS against known vulnerabilities -Analyze against unintended network accessibility -AWS inspector Agent must be installed on OS in EC2 instances -After the assessment, a report is provided with list of vulnerabilities
Guide
AWS Config - - โ
โ
โ
--helps w/auditing and recording compliance of your AWS resources -helps record configurations and changes over time -possibility of storing the configuration data into S3 (analyzed by Athena) -NOT free service -can view CloudTrail API calls if enabled
- e.g., is there restricted SSH? AWS Macie - - โ
โ
โ
-fully managed data security and privacy service that uses machine learning and pattern matching to discover and protect sensitive data in AWS -help identify and alert you to sensitive data such as PII ex) S3 Bucket --> Macie analyzes and identifies PII --> notify cloudwatch events (eventbridge) --> integrates with SNS or Lambda GuardDuty vs Macie - - โ
โ
โ
Threat detection vs auto discovery/secure content at scale
Guide
Amazon Kendra - - โ
โ
โ
-Fully managed document search service powered by ML -Extract answers from within a document -natural language search capabilities
- Incremental learning AWS Control Tower - - โ
โ
โ
-Easy way to set up and govern a secure and compliant multi-account AWS environment based on best practices Benefits:
- automate setup of your env in a few clicks
- automate ongoing policy mgmt using guardrails -detect policy violations and remediate them -monitor compliance through an interactive dashboard AWS control tower runs on top of AWS organizations:
- it automatically sets up AWS organizations or organize accts and implement SCPs (service control policies)
Guide
Savings Plan - - โ
โ
โ
EC2 Savings Plan: up to 72% discount compared to on- prem, commit to usage of individual instance families in a region (e.g., C5 or M5) regardless of AZ, size, OS or tenancy Compute Savings Plan: up to 66% discount, regardless of family, region, size, OS and compute options (e.g., EC2, Fargate, Lambda) Setup from the AWS cost explorer console Support Plans - - โ
โ
โ
Basic, Developer, Business, Enterprise Know the details for the exam! AWS Global Services - - โ
โ
โ
- IAM
- Route
- CloudFront -WAF (web application firewall) AWS Region-scoped services - - โ
โ
โ
- Amazon EC2 (IaaS) -Elastic Beanstalk (PaaS) -Lambda (FaaS)
- Rekognition (SaaS)
