![AWS IAM Policy Elements
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "Stmt1453690971587",
"Action": [
"ec2:Describe*",
"ec2:StartInstances",
"ec2:StopInstances”
],
"Effect": "Allow",
"Resource": "*",
"Condition": {
"IpAddress": {
"aws:SourceIp": "54.64.34.65/32”
}
}
},
{
"Sid": "Stmt1453690998327",
"Action": [
"s3:GetObject*”
],
"Effect": "Allow",
"Resource": "arn:aws:s3:::example_bucket/*”
}
]
}
IAM Policy](https://image.slidesharecdn.com/awsfundamentals-170905074140/85/AWS-Fundamentals-Back2School-by-CloudZone-87-320.jpg)
AWS Fundamentals @Back2School by CloudZone
- 1. AWS Fundamentals Teacher: Eran Ayash, Tech Team Leader Welcome!
- 2. About CloudZone End-to-end Cloud Solutions • Migration • Security • DevOps • Big Data • DR & more Full Service Package • Consulting • Managed Services • Professional Services Years of Experience Largest partner in Israel Our Goal: To ensure our customers adopt the most advanced technologies at a minimal cost
- 3. What We Do… FinOps DevOps Well Architected • Architecture schematics • TCO • SOW Full Service Package • Consulting • Managed Services • Professional Services Continues Integration and Deployment
- 4. Our Professional Services Cloud Migration DevOps Disaster Recovery Big Data & Bi Analytics Dev &TestSecurity Cost Optimization Cloud Extension
- 5. Customer Success Unit (FinOps) Design for Maximal Cost Reduction Leverage the Power Of the Cloud Find and Eliminate Waste Implement Government Polices Helping you save thousands on your monthly bill! • Billing Analytics • RI Utilization • Data Analytics • Automate Optimization • Asset Management • Consumption Management Cloud Resource ManagementTool
- 6. Hybrid Cloud Solutions • Architecture & deployment of Private Hybrid clouds based on VMware vRA or OpenStack • Configuration Management: Chef, Puppet, Ansible & Salt • Public Cloud DevOps & Automation • OpenShift, Cloud Foundry based, Kubernetes, DCOS and More. Cloud Containers DevOps
- 7. Objectives This course teaches you how to: • Recognize terminology and concepts as they relate to the AWS platform and navigate the AWS Management Console. • Understand the foundational services, including Amazon Elastic Compute Cloud (EC2), AmazonVirtual Private Cloud (VPC),Amazon Simple Storage Service (S3), and Amazon Elastic Block Store (EBS). • Understand the security measuresAWS provides and key concepts of AWS Identity and Access Management (IAM). • Understand AWS database services, including Amazon DynamoDB and Amazon Relational Database Service (RDS). • Understand AWS management tools, includingAuto Scaling, Amazon CloudWatch, Elastic Load Balancing (ELB), and AWSTrusted Advisor.
- 8. Agenda • Introduction toAWS • Foundational Services – Amazon EC2, AmazonVPC, Amazon S3,Amazon EBS • Security, Identity, and Access Management - IAM • Databases – Amazon DynamoDB and Amazon RDS • AWS Elasticity and ManagementTools – Auto Scaling, Elastic Load Balancing, Amazon CloudWatch, andAWSTrustedAdvisor • Wrap-Up
- 9. 2,420 AWS Direct Connect AWS Elastic Beanstalk AWS GovCloud (US) AWS CloudTrail AWS CloudHSM Amazon WorkSpaces Amazon Kinesis Amazon AppStream Amazon SNS AWS Identity and Access Management Amazon Route 53 AWS Import/Export Amazon SWF Amazon Redshift Amazon DynamoDB Amazon CloudSearch AWS Data Pipeline AWS Certificate Manager AWS KMS AWS Config Amazon RDS for Aurora Amazon WorkDocs AWS Directory Service AWS CodeCommit AWS CodePipeline AWS Service Catalog Amazon CloudWatch Logs Amazon EFS Amazon API Gateway Amazon Machine Learning AWS Device Farm AWS WAF Elasticsearch Service Amazon QuickSight AWS Import/Export Amazon RDS for MariaDB Amazon Inspector AWS IoT Amazon EC2 Container Registry Amazon ElastiCache AWS CloudFormation Amazon Mobile Analytics AWS Mobile Hub AWS Storage Gateway AWS OpsWorks Amazon Elastic Transcoder Amazon SES Amazon EC2 Container Service Amazon Cognito AWS CodeDeploy Amazon Glacier Amazon WorkMail AWS Lambda As of 1 August 2016 Services and Features
- 10. Advantages and Benefits of AWS Cloud Computing Trade capital expense for variable expense. Benefit from massive economies of scale. Stop guessing capacity. Go global in minutes. Increase speed and agility. Stop spending money on running and maintaining data centers.
- 11. AWS Core Infrastructure and Services Security Network Security Network Security Groups NACLs Access Mgmt VPCVPC EC2 “Classic” “Public” ELB On-Demand Provision Traditional Infrastructure Amazon Web Services Servers AMI Amazon EC2 InstancesOn-Premises Servers Security Security Groups Network ACLs AWS IAMFirewalls ACLs Administrators Storage and Database RDBMSDAS SAN NAS Amazon EBS Amazon EFS Amazon S3 Amazon RDS Networking VPCELBRouter Network Pipeline Switch
- 12. Infrastructure Regions Edge LocationsAvailability Zones Foundation Services Compute (Virtual, Auto-scaling and Load Balancing) Networking Applications Virtual Desktops Collaboration and Sharing Platform Services AWS Cloud Computing Databases Relational NoSQL Caching Analytics Cluster Computing Real-time Data Warehouse Data Workflows App Services Queuing Orchestration App Streaming Transcoding Email Search Deployment and Management Containers Dev/ops Tools Resource Templates Usage Tracking Monitoring and Logs Mobile Services Identity Sync Mobile Analytics Notifications Storage (Object, Block and Archive)
- 13. Compute Network Storage Security & Identity Applications AWS Foundation Services Amazon EC2 AWS Lambda Amazon EC2 Container Service AWS Elastic Beanstalk Elastic Load Balancing Amazon VPC AWS Direct Connect Amazon Route 53 Amazon S3 Amazon CloudFront Amazon Elastic File System Amazon Glacier AWS Storage Gateway AWS Import/Export AWS Identity and Access Management AWS Directory Service AWS Cloud HSM AWS KMS AWS WAF Amazon WorkDocs Amazon WorkSpaces Auto Scaling Amazon WorkMail
- 14. Databases Analytics App Services Management Tools Developer Tools Mobile Services Internet of Things AWS Platform Services Amazon RDS Amazon DynamoDB Amazon ElastiCache Amazon Redshift Amazon EMR AWS Data Pipeline Amazon Kinesis Amazon Machine Learning Amazon Elasticsearch Service Amazon API Gateway Amazon AppStream Amazon CloudSearch Amazon Elastic Transcoder Amazon SES Amazon SQS Amazon SWF Amazon CloudWatch AWS CloudFormation AWS CloudTrail AWS Config AWS OpsWorks AWS Service Catalog AWS CodeCommit AWS CodeDeploy AWS CodePipeline AWS Device Farm Amazon Mobile Analytics Amazon Cognito Amazon SNS Mobile Hub AWS IoT Trusted Advisor AWS Database Migration Service AWS Certificate Manager
- 15. AWS Global Infrastructure Regions • Geographic locations • Consist of at least two Availability Zones Availability Zones • Clusters of data centers • Isolated from failures in other Availability Zones
- 17. AWS Global Infrastructure • 50+ AWS Edge locations - local points of presence commonly supporting AWS services like: • Amazon Route 53 • Amazon CloudFront
- 19. Amazon Elastic Compute Cloud (EC2)
- 20. Amazon Elastic Compute Cloud (EC2) • Resizable compute capacity • Complete control of your computing resources • Reduced time required to obtain and boot new server instancesAmazon EC2
- 21. Amazon EC2 Facts • Scale capacity as your computing requirements change • Pay only for capacity that you actually use • Choose Linux or Windows • Deploy across AWS Regions and Availability Zones for reliability • Use tags to help manage your Amazon EC2 resources
- 22. Launching an Amazon EC2 Instance via the Management Console 1. Determine the AWS Region in which you want to launch the Amazon EC2 instance. 2. Launch an Amazon EC2 instance from a pre-configured Amazon Machine Image (AMI). 3. Choose an instance type based on CPU, memory, storage, and network requirements. 4. Configure network, IP address, security groups, storage volume, tags, and key pair.
- 23. Amazon Machine Image (AMI) Details An AMI includes the following: • A template for the root volume for the instance (for example, an operating system, an application server, and applications). • Launch permissions that control which AWS accounts can use the AMI to launch instances. • A block device mapping that specifies the volumes to attach to the instance when it is launched.
- 24. Instances and AMIs Select an AMI based on: • Region • Operating system • Architecture (32-bit or 64-bit) • Launch permissions • Storage for the root device AMI Instances Instance Launch instances of any type Host computer Host computer
- 25. Amazon EC2 Instances OS, Applications, and Configuration AMI Running or StoppedVM Instances AZ VPC Region EBS S3 EBS Snapshots S3 Buckets EBS EBS EBS EBS EBS AZ Instances Instances
- 26. Instance Lifecycle AMI pending Launch runningrebooting Reboot Start terminated shutting-down Terminate Terminate EBS-backed instances only Stop stopping stopped
- 27. AWS Marketplace – IT Software Optimized for the Cloud • Online store to discover, purchase, and deploy IT software on top of the AWS infrastructure. • Catalog of 2700+ IT software solutions including Paid, BYOL, Open Source, SaaS, and free-to-try options. • Pre-configured to operate on AWS. • Software checked by AWS for security and operability. • Deploys to AWS environment in minutes. • Flexible, usage-based billing models. • Software charges billed to AWS account. • Includes AWSTest Drive. https://aws.amazon.com/marketplace
- 28. AWS Marketplace
- 29. Choosing the Right Amazon EC2 Instance • AWS uses Intel® Xeon® processors to provide customers with high performance and value. EC2 instance types are optimized for different use cases, workload requirements and come in multiple sizes. • Consider the following when choosing your instances: • Core count • Memory size • Storage size and type • Network performance • CPU technologies
- 30. X1 Instance -Tons of Memory • The X1 instance: • Features up to 2TB of memory and 100 vCPU. • Uses Intel E7 v3 Haswell processors. • Is designed for demanding enterprise workloads, including production installations of SAP HANA, Microsoft SQL Server, Apache Spark, and Presto.
- 31. AWS EC2 Instances with Intel®Technologies AWS Instance Type High Memory X1 Compute- Optimized C4 Storage- Optimized D2 General Purpose M4 Memory- Optimized R3 IO- Optimized I2 Graphics- Optimized G2 Burstable Performance T2 Intel Processor Intel Xeon E7- 8880 v3 Custom Intel Xeon E5- 2666 v3 Custom Intel Xeon E5-2676 v3 Custom Intel Xeon E5-2676 v3 Intel Xeon E5- 2670 v2 Intel Xeon E5- 2670 v2 Intel Xeon E5- 2670 Intel Xeon Family Intel AVX AVX 2.0 AVX 2.0 AVX 2.0 AVX 2.0 Yes Yes Yes Yes Intel AES-NI Yes Yes Yes Yes Yes Yes No No Intel Turbo Boost Yes Yes Yes Yes Yes Yes Yes Yes Intel TSX Yes No No No No No No No Per core P- and C-state control No Yes (8xlarge only) No No No No No No SSD Storage EBS Optimized by default EBS Optimized by default No EBS Optimized by default Yes Yes Yes EBS only
- 32. Current Generation Instances Instance Family Some Use Cases General purpose (t2, m4, m3) • Low-traffic websites and web applications • Small databases and mid-size databases Compute-optimized (c4, c3) • High performance front-end fleets • Video-encoding Memory-optimized (r3) • High performance databases • Distributed memory caches Storage-optimized (i2, d2) • Data warehousing • Log or data-processing applications GPU instances (g2) • 3D application streaming • Machine learning
- 33. Instance Metadata • Is data about your instance. • Can be used to configure or manage a running instance.
- 34. Retrieving Instance Metadata • To view all categories of instance metadata from within a running instance, use the following URI: • http://169.254.169.254/latest/meta-data/ • On a Linux instance, you can use: • $ curl http://169.254.169.254/latest/meta-data/ • $ GET http://169.254.169.254/latest/meta-data/ • All metadata is returned as text (content type text/plain).
- 35. Instance User Data • Can be passed to the instance at launch. • Can be used to perform common automated configuration tasks. • Runs scripts after the instance starts.
- 36. Adding User Data • You can specify user data when launching an instance. • User data can be: • Linux script – executed by cloud-init • Windows batch or PowerShell scripts – executed by EC2Config service • User data scripts run once per instance ID by default.
- 37. User Data Example Linux #!/bin/sh yum -y install httpd chkconfig httpd on /etc/init.d/httpd start User data shell scripts must start with the #! characters and the path to the interpreter you want to read the script. Install Apache web server Enable the web server Start the web server
- 38. User Data ExampleWindows <powershell> Import-Module ServerManager Install-WindowsFeature web-server, web-webserver Install-WindowsFeature web-mgmt-tools </powershell> Import the Server Manager module for Windows PowerShell. Install IIS Install Web Management Tools
- 39. Retrieving User Data • To retrieve user data, use the following URI: http://169.254.169.254/latest/user -data • On a Linux instance, you can use: $ curl http://169.254.169.254/latest/user-data/ $ GET http://169.254.169.254/latest/user-data/
- 40. Amazon EC2 Purchasing Options On-Demand Instances Pay by the hour. Reserved Instances Purchase, at a significant discount, instances that are always available 1-year to 3-year terms. Scheduled Instances Purchase instances that are always available on the specified recurring schedule, for a one-year term. Spot Instances Bid on unused instances, which can run as long as they are available and your bid is above the Spot price. Dedicated Hosts Pay for a physical host that is fully dedicated to running your instances. Dedicated Instances Pay, by the hour, for instances that run on single- tenant hardware.
- 42. AmazonVirtual Private Cloud (VPC) • Provision a private, isolated virtual network on the AWS cloud. • Have complete control over your virtual networking environment.Amazon VPC
- 43. VPCs and Subnets • A subnet defines a range of IP addresses in yourVPC. • You can launch AWS resources into a subnet that you select. • A private subnet should be used for resources that won’t be accessible over the Internet. • A public subnet should be used for resources that will be accessed over the Internet. • Each subnet must reside entirely within one Availability Zone and cannot span zones.
- 44. AmazonVPC Example Virtual PrivateCloud AWS Cloud Public Subnet Private Subnet VPN Only Subnet DB Server Web Server Customer Network R Internet App Server VPC NAT Gateway Internet Gateway Web Server App Server DB Server Virtual Private Gateway
- 45. Security inYourVPC • Security groups • Network access control lists (ACLs) • Key Pairs Subnet 10.0.1.0/24 Internet GatewayVPN Gateway VPC Router 10.0.0.0/16 Security Group Security Group Network ACL Network ACL Routing Table Routing Table instance instance instance instance Subnet 10.0.0.0/24 Security Group Security Group
- 46. VPN Connections VPN Connectivity option Description AWS Hardware VPN You can create an IPsec hardware VPN connection between your VPC and your remote network. AWS Direct Connect AWS Direct Connect provides a dedicated private connection from a remote network to your VPC. AWS VPN CloudHub You can create multiple AWS hardware VPN connections via your VPC to enable communications between various remote networks. Software VPN You can create a VPN connection to your remote network by using an Amazon EC2 instance in your VPC that’s running a software VPN appliance.
- 47. Storage Services Amazon S3 and Amazon EBS
- 48. Amazon Simple Storage Service (S3) • Storage for the Internet • Natively online, HTTP access • Storage that allows you to store and retrieve any amount of data, any time, from anywhere on the web • Highly scalable, reliable, fast and durable Amazon S3
- 49. Amazon S3 Facts • Can store an unlimited number of objects in a bucket • Objects can be up to 5TB; no bucket size limit • Designed for 99.999999999% durability and 99.99% availability of objects over a given year • Can use HTTP/S endpoints to store and retrieve any amount of data, at any time, from anywhere on the web • Is highly scalable, reliable, fast, and inexpensive • Can use optional server-side encryption using AWS or customer- managed provided client-side encryption • Auditing is provided by access logs • Provides standards-based REST and SOAP interfaces
- 50. • Storage and backup • Application file hosting • Media hosting • Software delivery • Store AMIs and snapshots Common Use Scenarios
- 51. Amazon S3 Concepts • Amazon S3 stores data as objects within buckets • An object is composed of a file and optionally any metadata that describes that file • You can have up to 100 buckets in each account • You can control access to the bucket and its objects Amazon S3 Bucket with Objects Bucket Object
- 52. Object Keys An object key is the unique identifier for an object in a bucket. http://doc.s3.amazonaws.com/2006-03-01/AmazonS3.html Bucket Object/Key
- 53. Amazon S3 Security • You can control access to buckets and objects with: • Access Control Lists (ACLs) • Bucket policies • Identity and Access Management (IAM) policies • You can upload or download data to Amazon S3 via SSL encrypted endpoints. • You can encrypt data using AWS SDKs.
- 54. • Protects from accidental overwrites and deletes with no performance penalty. • Generates a new version with every upload. • Allows easily retrieval of deleted objects or roll back to previous versions. • Three states of an Amazon S3 bucket • Un-versioned (default) • Versioning-enabled • Versioning-suspended Amazon S3Versioning Versioning Enabled Key: photo.gif ID: 121212 Key: photo.gif ID: 111111
- 55. • Lifecycle management defines how Amazon S3 manages objects during their lifetime. Some objects that you store in an Amazon S3 bucket might have a well-defined lifecycle: • Log files • Archive documents • Digital media archives • Financial and healthcare records • Raw genomics sequence data • Long-term database backups • Data that must be retained for regulatory compliance Amazon S3 Object Lifecycle
- 56. • Pay only for what you use • No minimum fee • Prices based on location of your Amazon S3 bucket • Estimate monthly bill using the AWS Simple Monthly Calculator • Pricing is available as: • Storage Pricing • Request Pricing • DataTransfer Pricing: data transferred out ofAmazon S3 Amazon S3 Pricing
- 57. • Long term low-cost archiving service • Optimal for infrequently accessed data • Designed for 99.999999999% durability • Three to five hours’ retrieval time • Less than $0.01 per GB/month (depending on region) Amazon Glacier
- 58. Storage Class Durability Availability Other Considerations Amazon S3 Standard 99.999999999% 99.99% Amazon S3 Standard - Infrequent (IA) 99.999999999% 99.9% • Retrieval fee associated with objects • Most suitable for infrequently accessed data Glacier 99.999999999% 99.99% (once restored) • Not available for real-time • Must restore objects before can access them • Restoring objects can take 3-5 hours Amazon S3 Storage Classes
- 60. • Persistent block level storage volumes offer consistent and low-latency performance. • Stored data is automatically replicated within its Availability Zone. • Snapshots are stored durably in Amazon S3. Amazon Elastic Block Store (EBS) Amazon EBS
- 61. Amazon EBS Lifecycle Vast amounts of unused space Create Call CreateVolume 1 GiB to 16TiB Attach Call AttachVolume to affiliate with one Amazon EC2 instance Attached and In Use • Format fromAmazon EC2 instance OS • Mount formatted drive CreateSnapshot Snapshot to Amazon S3 Detach Call DetachVolume Deleted Call DeleteVolume
- 62. • SSD-backed volumes are • Optimized for transactional workloads that involve frequent read/write operations with small I/O size. • Dominant in IOPS performance. • HDD-backed volumes are • Optimized for large streaming workloads. • Dominant in throughput (measured in MiB/s). Amazon EBSVolumeTypes
- 63. Amazon EBSVolumeTypes SSD HDD Volume Type General Purpose SSD (gp2) Provisioned IOPS SSD (io1) Throughput Optimized HDD (st1) Cold HDD (sc1) Description Balances price and performance for a wide variety of transactional loads. Highest- performance SSD volume designed for mission-critical applications. Low-cost HDD designed for frequently accessed, throughput-intensive workloads. Lowest cost HDD designed for less frequently accessed workloads. Volume Sizes 1 GiB – 16 TiB 4 GiB – 16 TiB 500 GiB – 16 TiB 500 GiB – 16 TiB Dominant Performance Attribute IOPS IOPS MiB/s MiB/s
- 64. • EBS is recommended when data must be quickly accessible and requires long-term persistence. • You can launch your EBS volumes as encrypted volumes – data stored at rest on the volume, disk I/O, and snapshots created from the volume are all encrypted. • You can create point-in-time snapshots of EBS volumes, which are persisted to Amazon S3. Amazon EBS Facts
- 65. • OS: Use for boot/root volume, secondary volumes • Databases: Scales with your performance needs • Enterprise applications: Provides reliable block storage to run mission-critical applications • Business continuity: Minimize data loss and recovery time by regularly backing up using EBS Snapshots • Applications: Install and persist any application Amazon EBS Use Cases
- 66. • Pay for what you provision: • Pricing based on region • Review Pricing Calculator online • Pricing is available as: • Storage • IOPS Amazon EBS Pricing * Check Amazon EBS Pricing page for current pricing for all regions.
- 67. Amazon EBS Scope Amazon EBS volumes are in a single Availability Zone Availability Zone A EBSVolume 1 Availability Zone B EBSVolume 2 Volume data is replicated across multiple servers in an Availability Zone.
- 68. Amazon EBS and Amazon S3 Amazon EBS Amazon S3 Paradigm Block storage with file system Object store Performance Very fast Fast Redundancy Across multiple servers in an Availability Zone Across multiple facilities in a Region Security EBS Encryption – Data volumes and Snapshots Encryption Access from the Internet? No (1) Yes (2) Typical use case It is a disk drive Online storage (1) Accessible from the Internet if mounted to server and set up as FTP, etc. (2) Only with proper credentials, unless ACLs are world-readable
- 69. • Is local, complimentary direct attached block storage. • Includes availability, number of disks, and size based on EC2 instance type. • Is optimized for up to 365,000 Read IOPS and 315,000 First Write IOPS. • Is SSD or magnetic. • Has no persistence. • Automatically deletes data when an EC2 instance stops, fails or is terminated. Amazon EC2 Instance Storage
- 70. • Amazon EBS • Data stored on an Amazon EBS volume can persist independently of of the instance. • Storage is persistent. • Amazon EC2 Instance Store • Data stored on a local instance store persists only as long as the alive. • Storage is ephemeral. Amazon EBS vs. Amazon EC2 Instance Store
- 71. Reboot vs. Stop vs.Terminate Characteristic Reboot Stop/Start (EBS-backed instances only) Terminate Host computer The instance stays on the same host computer. The instance runs on a new host computer. Public IP address No change New address assigned Elastic IP addresses (EIP) EIP remains associated with the instance. EIP remains associated with the instance. EIP is disassociated from the instance. Instance store volumes Preserved Erased Erased EBS volume Preserved Preserved Boot volume is deleted by default. Billing Instance billing hour doesn’t change. You stop incurring charges as soon as state is changed to stopping. You stop incurring charges as soon as state is changed to shutting- down.
- 72. • Q: What AWS service would help support your web application to offload serving static assets and store user uploaded images and video off-instance? • Q: How would an EC2 instance find its private and public IP addresses? • Q: What acts as an additional layer of security at the subnet level in aVPC? • True or False: S3 limits the amount you can store. Knowledge Check False Retrieve the instance metadata. http://169.254.169.254/latest/meta-data/ Amazon S3 Network ACLs
- 73. Security, Identity, and Access Management
- 74. AWS Shared Responsibility Model AWS Foundation Services Compute Storage Database Networking AWS Global Infrastructure Regions Availability Zones Edge Locations Client-side Data Encryption Server-side Data Encryption NetworkTraffic Protection Platform,Applications, Identity, and Access Management Operating System, Network, and Firewall Configuration Customer Applications & ContentCustomers Customers are responsible for security IN the cloud AWS is responsible for the security OF the cloud
- 75. • 24/7 trained security staff • AWS data centers in nondescript and undisclosed facilities • Two-factor authentication for authorized staff • Authorization for data center access Physical Security
- 76. • Automated change-control process • Bastion servers that record all access attempts • Firewall and other boundary devices • AWS monitoring tools Hardware, Software, and Network
- 77. Certifications and Accreditations ISO 9001, ISO 27001, ISO 27017, ISO 27018, IRAP (Australia), MLPS Level 3 (China), MTCS Tier 3 Certification (Singapore) and more …
- 78. SSL Endpoints VPC SecureTransmission Use secure endpoints to establish secure communication sessions (HTTPS). Instance Firewalls Use security groups to configure firewall rules for instances. SSL Endpoints Security Groups Network Control Use public and private subnets, NAT, and VPN support in your virtual private cloud to create low-level networking constraints for resource access. SSL Endpoints
- 79. Security Groups SSL Endpoints Security Groups Instance Firewalls Use security groups to configure firewall rules for instances. VPC SecureTransmission Use secure endpoints to establish secure communication sessions (HTTPS). Network Control Use public and private subnets, NAT, and VPN support in your virtual private cloud to create low-level networking constraints for resource access.
- 80. HTTP Ports 80 and 443 only open to the Internet SSH/RDP Engineering staff have SSH/RDP access to Bastion Host AWS Multi-Tier Security Groups Bastion All other internet ports blocked by default
- 81. AmazonVirtual Private Cloud (VPC) VPCSSL Endpoints Security Groups Network Control Use public and private subnets, NAT, and VPN support in your virtual private cloud to create low-level networking constraints for resource access. Instance Firewalls Use security groups to configure firewall rules for instances. SecureTransmission Use secure endpoints to establish secure communication sessions (HTTPS).
- 82. AWS Identity andAccess Management (IAM) AWS IAM 3 Manage federated users and their permissions 2 ManageAWS IAM roles and their permissions 1 ManageAWS IAM users and their access
- 83. • Authentication • AWS Management Console • User Name and Password AWS IAM Authentication IAM User
- 84. • Authentication • AWS CLI or SDK API • Access Key and Secret Key AWS IAM Authentication Access Key ID: AKIAIOSFODNN7EXAMPLE Secret Access Key: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY Java Python .NET AWS SDK & APIAWS CLI IAM User
- 85. AWS IAM User Management - Groups User D DevOps Group User C AWS Account TestDev Group User BUser A
- 86. • Authorization • Policies: • Are JSON documents to describe permissions. • Are assigned to users, groups or roles. AWS IAM Authorization IAM User IAM Group IAM Roles
- 87. AWS IAM Policy Elements { "Version": "2012-10-17", "Statement": [ { "Sid": "Stmt1453690971587", "Action": [ "ec2:Describe*", "ec2:StartInstances", "ec2:StopInstances” ], "Effect": "Allow", "Resource": "*", "Condition": { "IpAddress": { "aws:SourceIp": "54.64.34.65/32” } } }, { "Sid": "Stmt1453690998327", "Action": [ "s3:GetObject*” ], "Effect": "Allow", "Resource": "arn:aws:s3:::example_bucket/*” } ] } IAM Policy
- 88. AWS IAM Policy Assignment IAM User IAM Group Assigned Assigned IAM Policy
- 89. AWS IAM Policy Assignment IAM User IAM Group IAM Roles Assigned Assigned Assigned IAM Policy
- 90. • An IAM role uses a policy. • An IAM role has no associated credentials. • IAM users, applications, and services may assume IAM roles. AWS IAM Roles IAM Roles
- 91. AWS IAM Policy Assignment IAM User IAM Group IAM Roles Assigned Assigned Assigned IAM Policy IAM User Assumed Assumed AWS Resources
- 92. • Python application hosted on an Amazon EC2 Instance needs to interact with Amazon S3. • AWS credentials are required: • Option 1: Store AWS Credentials on the Amazon EC2 instance. • Option 2: Securely distribute AWS credentials to AWS Services and Applications. Example:Application Access to AWS Resources IAM Roles
- 93. AWS IAM Roles - Instance Profiles Amazon EC2 App & EC2 MetaData Service http://169.254.169.254/latest/meta-data/iam/security-credentials/rolename Amazon S3 1 2 3 4 Create Instance SelectIAMRole ApplicationinteractswithS3
- 94. AWS IAM Roles – Assume Role IAM Restricted Policy IAM User A-1 AWS Account A IAM Admin RoleIAM Admin Policy Assigned Assume Assigned 1 2 IAM User B-1 AWS Account B Amazon S3 Assume 4 Access 53 Access 1
- 95. • Use Cases • Cross account access • Federation • Mobile Users • Key rotation forAmazon EC2-based apps Session Access Key ID Secret Access Key Session Token Expiration Temporary Security Credentials 15 minutes to 36 hours Temporary Security Credentials (AWS STS)
- 96. ApplicationAuthentication AWS IAM Application No Support No Support OS
- 97. • Authentication • AWS Management Console • User Name and Password • AWS CLI or SDK API • Access Key and Secret Key • Authorization • Policies AWS IAM Authentication and Authorization IAM User IAM Group IAM Roles
- 98. • Delete AWS account (root) access keys. • Create individual IAM users. • Use groups to assign permissions to IAM users. • Grant least privilege. • Configure a strong password policy. • Enable MFA for privileged users. AWS IAM Best Practices
- 99. • Use roles for applications that run on Amazon EC2 instances. • Delegate by using roles instead of by sharing credentials. • Rotate credentials regularly. • Remove unnecessary users and credentials. • Use policy conditions for extra security. • Monitor activity in your AWS account. AWS IAM Best Practices (cont.)
- 100. • Records AWS API calls for accounts. • Delivers log files with information to an Amazon S3 bucket. • Makes calls using the AWS Management Console, AWS SDKs, AWS CLI and higher-level AWS services. AWS CloudTrail AWS CloudTrail Amazon S3 Bucket Logs
- 101. • Q:Your web application needs to read/write an Amazon DynamoDB table and an Amazon S3 bucket.This operation requires AWS credentials and authorization to use AWS services.What IAM entity should be used? • User • Group • Role • Policy Knowledge Check
- 102. Instructor Demo IAM
- 103. Databases 2
- 104. SQL and NoSQL Databases SQL NoSQL Data Storage Rows and Columns Key-Value Schemas Fixed Dynamic Querying Using SQL Focused on collection of documents Scalability Vertical Horizontal ISBN Title Author Format 9182932465265 Cloud Computing Concepts Wilson, Joe Paperback 3142536475869 The Database Guru Gomez, Maria eBook SQL NoSQL { ISBN: 9182932465265, Title: “Cloud Computing Concepts”, Author: “Wilson, Joe”, Format: “Paperback” }
- 105. • No one size fits all. • Analyze your data requirements by considering: • Data formats • Data size • Query frequency • Data access speed • Data retention period Data Storage Considerations
- 106. AWS Managed Database Services Compute Storage AWSGlobal Infrastructure Database App Services Deployment and Administration Networking Amazon DynamoDB Amazon ElastiCache Amazon RDS Amazon Redshift AWS Database Migration Service
- 107. • Cost-efficient and resizable capacity • Manages time-consuming database administration tasks • Access to the full capabilities of Amazon Aurora, MySQL, MariaDB, Microsoft SQL Server, Oracle, and PostgreSQL databases Amazon Relational Database Service (RDS) Amazon RDS
- 108. • Simple and fast to deploy • Manages common database administrative tasks • Compatible with your applications • Fast, predictable performance • Simple and fast to scale • Secure • Cost-effective Amazon RDS
- 109. • DB Instances are the basic building blocks of Amazon RDS. • They are an isolated database environment in the cloud. • They can contain multiple user-created databases. DB Instances
- 110. • Automatic Backups: • Restore your database to a point in time. • Are enabled by default. • Let you choose a retention period up to 35 days. • Manual Snapshots: • Let you build a new database instance from a snapshot. • Are initiated by the user. • Persist until the user deletes them. • Are stored in Amazon S3. How Amazon RDS Backups Work
- 111. • Are a copy of a database snapshot stored in a different AWS Region. • Provide a backup for disaster recovery. • Can be used as a base for migration to a different region. Cross-Region Snapshots
- 112. • Run your DB instance in an AmazonVPC. • Use IAM policies to grant access to Amazon RDS resources. • Use security groups. • Use Secure Socket Layer (SSL) connections with DB instances (Amazon Aurora, Oracle, MySQL, MariaDB, PostgreSQL, Microsoft SQL Server). • Use Amazon RDS encryption to secure your RDS instances and snapshots at rest. • Use network encryption and transparent data encryption (TDE) with Oracle DB and Microsoft SQL Server instances. • Use the security features of your DB engine to control access to your DB instance. Amazon RDS Security
- 113. A SimpleApplicationArchitecture Amazon RDS database instance Amazon EC2 Application Servers Elastic Load Balancing load balancer instance DB snapshots in Amazon S3
- 114. • With Multi-AZ operation, your database is synchronously replicated to another Availability Zone in the same AWS Region. • Failover to the standby automatically occurs in case of master database failure. • Planned maintenance is applied first to standby databases. Multi-AZ RDS Deployment
- 115. A Resilient, Durable ApplicationArchitecture Amazon RDS database instances: Master and Multi-AZ standby Application, in Amazon EC2 instances Elastic Load Balancing load balancer instance DB snapshots in Amazon S3
- 116. • Monitor your memory, CPU, and storage usage. • Use Multi-AZ deployments to automatically provision and maintain a synchronous standby in a different Availability Zone. • Enable automatic backups. • Set the backup window to occur during the daily low in WriteIOPS. • To increase the I/O capacity of a DB instance: • Migrate to a DB instance class with high I/O capacity. • Convert from standard storage to provisioned IOPS storage and use a DB instance class optimized for provisioned IOPS. • Provision additional throughput capacity (if using provisioned IOPS storage). • If your client application is caching the DNS data of your DB instances, set a TTL of less than 30 seconds. • Test failover for your DB instance. Amazon RDS Best Practices
- 117. • Allows you to store any amount of data with no limits. • Provides fast, predictable performance using SSDs. • Allows you to easily provision and change the request capacity needed for each table. • Is a fully managed, NoSQL database service. Amazon DynamoDB Amazon DynamoDB
- 118. DynamoDB Data Model Table: Music Items Attributes (name-value pairs) Artist Song Title Album Title Year Genre
- 119. Primary Keys Partition Key Sort Key Table: Music Partition Key: Artist Sort Key: SongTitle (DynamoDB maintains a sorted index for both keys) Table: Music Artist Song Title Album Title Year Genre
- 120. • You specify how much provisioned throughput capacity you need for reads and writes. • Amazon DynamoDB allocates the necessary machine resources to meet your needs. ProvisionedThroughput
- 121. • Query: • Query a table using the partition key and an optional sort key filter. • If the table has a secondary index, query using its key. • It is the most efficient way to retrieve items from a table or secondary • Scan: • You can scan a table or secondary index. • Scan reads every item – slower than querying. • You can use conditional expressions in both Query and Scan operations. Supported Operations
- 122. SimpleApplicationArchitecture Elastic Load Balancing Amazon EC2 app instances Clients Amazon DynamoDB Business logic
- 123. Amazon RDS and Amazon DynamoDB Factors Relational (Amazon RDS) NoSQL (Amazon DynamoDB) ApplicationType •Existing database apps •Business process–centric apps • New web-scale applications • Large number of small writes and reads Application Characteristics •Relational data models, transactions •Complex queries, joins, and updates •Simple data models, transactions •Range queries, simple updates Scaling Application or DBA–architected (clustering, partitions, sharding) Seamless, on-demand scaling based on application requirements QoS • Performance–depends on data model, indexing, query, and storage optimization • Reliability and availability • Durability • Performance–Automatically optimized by the system • Reliability and availability • Durability
- 124. Database Considerations IfYou Need Consider Using A relational database service with minimal administration Amazon RDS • Choice of Amazon Aurora, MySQL, MariaDB, Microsoft SQL Server, Oracle, or PostgreSQL database engines • Scale compute and storage • Multi-AZ availability A fast, highly scalable NoSQL database service Amazon DynamoDB • Extremely fast performance • Seamless scalability and reliability • Low cost A database you can manage on your own Your choice of AMIs on Amazon EC2 and Amazon EBS that provide scale compute and storage, complete control over instances, and more.
- 125. • Q:What are the basic building blocks ofAmazon Relational Database Service (RDS)? • True or False: Amazon DynamoDB allows you to store any amount of data with no limits. • True or False: Scan is the most efficient way to retrieve items from a DynamoDB table. • Q:You are creating a resilient, durable application using Amazon RDS. In addition to Amazon RDS’s automatic backups, what feature should you use to ensure that your backups are durable retained? Knowledge Check Manual Snapshots True DB Instances False
- 126. AWS Elasticity and Management Tools
- 127. Triad of Services Latency Utilization CloudWatchAuto Scaling Elastic Load Balancing Auto Scaling group Execute AS Policy
- 128. • Distributes traffic across multiple EC2 instances, in multiple Availability Zones • Supports health checks to detect unhealthy Amazon EC2 instances • Supports the routing and load balancing of HTTP, HTTPS, SSL, andTCP traffic to Amazon EC2 instances Elastic Load Balancing Elastic Load Balancing
- 129. • Register instances with your load balancer. Classic Load Balancer - How ItWorks Availability Zone A Availability Zone B load balancer X
- 130. Target Group /mobile • Register instances as targets in a target group, and route traffic to a target group. Application Load Balancer – How It Works load balancer Listener ListenerRule Rule Rule Target Group Target Group /api Target Target Target Target Target Target Target Health Check Health Check Health Check
- 131. Click to edit Master title style Load Balancer Comparison• Classic Load Balancer benefits include support for: • EC2-Classic. • VPC. • TCP and SSL listeners. • Sticky sessions. • ALB benefits include support for: • Path-based routing. • Routing requests to multiple services on a single EC2 instance. • Containerized applications. • Monitoring the health of each service independently.
- 132. • A monitoring service for AWS cloud resources and the applications you run on AWS • Visibility into resource utilization, operational performance, and overall demand patterns • Custom application-specific metrics of your own • Accessible via AWS Management Console, APIs, SDK, or CLI Amazon CloudWatch Amazon CloudWatch
- 133. • Monitor other AWS resources • View graphics and statistics • Set Alarms Amazon CloudWatch Facts
- 134. Amazon CloudWatch Architecture AWS resources that support CloudWatch Amazon CloudWatch Amazon CloudWatch Alarm SNS Email Notification Auto Scaling Available Statistics StatisticsConsumerAWS Management Console CloudWatch Metrics CPUUtilization StatusCheckFailed Custom Application- Specific Metrics PageViewCount
- 136. • Scale your Amazon EC2 capacity automatically • Well-suited for applications that experience variability in usage • Available at no additional charge Auto Scaling Auto Scaling
- 137. Auto Scaling Benefits Better Cost Management Better Availability Better Fault Tolerance
- 138. • A launch configuration is a template that an Auto Scaling group uses to launch EC2 instances. • When you create a launch configuration, you can specify: • AMI ID • Instance type • Key pair • Security groups • Block device mapping • User data Launch Configurations
- 139. • Contain a collection of EC2 instances that share similar characteristics. • Instances in an Auto Scaling group are treated as a logical grouping for the purpose of instance scaling and management. Auto Scaling Groups Auto Scaling group Minimum size Desired capacity Maximum size Scale out as needed
- 140. • You can create a scaling policy that uses CloudWatch alarms to determine: • When yourAuto Scaling group should scale out. • When yourAuto Scaling group should scale in. • You can use alarms to monitor: • Any of the metrics that AWS services send toAmazon CloudWatch. • Your own custom metrics. Dynamic Scaling
- 141. Auto Scaling Basic Lifecycle instances Auto Scaling group Scale Out Amazon CloudWatch Scheduled Event Scale In Amazon CloudWatch Scheduled Event Launch Instance Attach to Group Detach from Group Terminate Instance X
- 142. • Best practice and recommendation engine. • Provides AWS customers with performance and security recommendations in four categories: • Cost optimization • Security • Fault tolerance • Performance improvement. AWSTrusted Advisor AWS Trusted Advisor
- 143. • Amazon EC2 Reserved Instance Optimization • Low-utilization Amazon EC2 Instances • Idle load balancers • Underutilized Amazon EBS volumes • Unassociated Elastic IP addresses • Amazon RDS idle DB instances Cost Optimization
- 144. • Security groups • AWS IAM use • Amazon S3 bucket permissions • MFA on toot Account • AWS IAM password policy • Amazon RDS security group access risk Security
- 145. • Amazon EBS Snapshots • Load balancer optimization • Auto Scaling Group Resources • Amazon RDS Multi-AZ • Amazon Route 53 name server delegations • ELB connection draining FaultTolerance
- 146. • High-utilization Amazon EC2 instances • Service limits • Large number of rules in EC2 security group • Over-utilized Amazon EBS magnetic volumes • Amazon EC2 to EBS throughput optimization • Amazon CloudFront alternate domain names Performance Improvement
- 147. • True or False: Auto Scaling helps you ensure that you have the correct number of EC2 instances available to handle the load for your application. • Q:What feature would you use with an auto scaling policy to determine when your auto scaling group should scale out/in? • Q:You have an application composed of individual services and need to route a request to a service based on the content of the request. What type of load balancer should you use? • Q:Which AWS service serves as a best practice and recommendation engine? Knowledge Check AWS Trusted Advisor Amazon CloudWatch alarms True Application Load Balancer
- 148. Bootcamp Wrap-Up
- 149. Learning Path AWS Introduction • TheAWS Cloud • History • Global Infrastructure • AWS Management Consoled AWS Foundational Services • Compute: • Amazon EC2 • Networking: • AmazonVPC • Storage: • Amazon EBS • Amazon S3 • Security • IAM • Databases: • Amazon DynamoDB • Amazon RDS AWS Management Tools • Triad of Services: • Auto Scaling • ELB • Amazon CloudWatch • AWSTrustedAdvisor
- 150. ExpandYour Cloud Skills with AWS Certification aws.amazon.com/certification Validate your proven technical expertise with the AWS platform and gain recognition for your skills Online videos and labs aws.amazon.com/training/ self-paced-labs Start working with an AWS service in minutes with free online instructional videos and labs aws.amazon.com/training Instructor-led courses Learn how to design, deploy, and operate highly available, cost-effective, and secure applications on AWS
- 151. • Learn an individual AWS Service topic • Follow a Learning Quest by AWS Service Area or Use Case • Practice working with AWS as you prepare for an exam Self-Paced Labs For more information, see aws.amazon.com/training/self-paced-labs/.
- 152. AWS ILTTraining Courses AWSTechnical Essentials 1 day Architecting on AWS 3 days Developing on AWS 3 days Systems Operations on AWS 3 days Big Data on AWS 3 days Advanced Architecting on AWS 3 days DevOps Engineering on AWS 3 days Security Operations on AWS 3 days Data Warehousing on AWS 3 days Taking AWS Operations to the Next Level 1 day Building a Recommendation Engine on AWS 1 day Securing Next-Gen Applications at Cloud Scale 1 day Running Container-Enabled Microservices on AWS 1 day
- 153. AWS Certification AWS Certified Solutions Architect - Professional AWS Certified Developer - Associate AWS Certified SysOps Administrator- Associate AWS Certified Solutions Architect - Associate AWS Certified DevOps Engineer - Professional For more information, see aws.amazon.com/certification.
- 154. Benefits of AWS Certification Individual • Demonstrate expertise • Stand out • Industry visibility • Customer visibility • Peer recognition • Credibility with customers Employer • Baseline bar on AWS skills • Identify expert talent • Leverage best practices • Reduce operational risk • Increase business advantage • MaximizeAWS efficiencies • Common vocabulary • Accelerate time to cloud
- 155. Preparing for AWS Certification Practice ExamsSelf-Paced Labs on qwikLABS AWSWhitepapers & FAQs AWS Documentation & Reference Architectures For resources to help you prepare for the certification exam, see aws.amazon.com/certification. Exam Guides & SampleQuestions AWS-Authored Study Guide AWSTechnicalTraining
- 156. AWS Support
- 157. Support Options The Technical Account Manager provides... A dedicated voice within AWS to serve as your advocate. Proactive guidance and insight into ways to optimize AWS through business and performance reviews. Orchestration and access to the full breadth and depth of technical expertise across the full range of AWS. Access to resources and best practice recommendations. Infrastructure Event Management provides... A common understanding of event objectives and use cases through pre-event planning and preparation. Resource recommendations and deployment guidance based on anticipated capacity needs. Dedicated attention of the your AWS Support team during your event. The ability to immediately scale down resources to normal operating levels post-event.
- 158. Support Options AWS Trusted Advisor provides... Insight into how and where you can get the most impact for your AWS spend. Opportunities to reduce your monthly spend and retain or increase productivity. Guidance on getting the optimal performance and availability based on your requirements. Confidence that your environment is secure. The Concierge Service provides... A primary contact to help manage AWS resources. Personalized handling of billing inquiries, tax questions, service limits, and bulk reserve instance purchases. Direct access to an agent to help optimize costs, and identify underutilized resources.
- 159. Support Comparison Enterprise Business Developer Basic Customer Service 24x7x365 Support Forums Documentation, White Papers, Best Practice Guides AWS Trusted Advisor Full Checks Full Checks Basic Checks Basic Checks Access to Technical Support Phone, chat, email, live screen sharing, TAM (24/7) Phone, chat, email, live screen sharing Email (local business hours) Support for Health Checks Primary Case Handling Sr. Cloud Support Engineer Cloud Support Engineer Cloud Support Associate Technical Customer Service Associate Users who can create Technical Support cases Unlimited (IAM supported) Unlimited (IAM supported) 1 (account credentials only) Case Severity/Response Times Critical:< 15 minutes Urgent:< 1 hour High:< 4 hours Normal:< 12 hours Low:< 24 hours Urgent:< 1 hour High:< 4 hours Normal:< 12 hours Low:< 24 hours Normal:< 12 hours Low:< 24 hours Architecture Support Application Architecture Use case guidance Building blocks Best Practice Guidance Client-Side Diagnostic Tools AWS Support API Third-Party Software Support Infrastructure Event Management Available at additional cost AWS Concierge Direct access to Technical Account Manager (TAM) Prioritized Case Routing Management Business Reviews
- 161. Module 1 Appendix AWS Introduction and History
- 163. • Cloud computing is on-demand delivery of IT resources and applications via the Internet with pay-as-you-go pricing. What is cloud computing?
- 164. Essential Characteristics of Cloud Computing On-Demand Self Services Broad Network Access Resource Pooling Rapid Elasticity Measured Service
- 165. • User provisions computing resources as needed. • User interacts with cloud service provider through an online control panel. • Clear solutions are available through a variety of network-connected devices and over varying platforms. On-Demand Self Services & Broad Network Access InternetClient Mobile Client
- 166. • Securely separate resources to service multiple customers. Resource Pooling
- 167. • Resources are quickly scalable and flexible based on business needs. Rapid Elasticity
- 168. • Pay for services as you go. Measured Service Electrical services analogy
- 169. What Does My AWS Cloud Look Like?
- 170. Module 2 Appendix AWS Foundational Services
- 171. Data Center Design Models
- 172. Application Design Model One-Tier Model Clients Mainframe Two-Tier Model SQL Client Database Servers Three-Tier Model Client Application Server Database Servers SQL, ODBC, JDBC HTTP, RPC N-Tier Model Client Application Servers Web Server Middleware Database Servers
- 173. Web Services Model Web Server Application Server Database Server Serves web pages • Implements business logic • Manipulates data • Data mining • Accesses data store • High transaction rate • High bandwidth • Low latency
- 174. Amazon EC2
- 175. AMITypes - Storage for the Root Device Characteristic Amazon EBS-Backed Amazon Instance Store-Backed Boot time Usually < 1 minute Usually < 5 minutes Size limit 16 TiB 10 GiB Data persistence The root volume is deleted when the instance terminates. Data on any other Amazon EBS volumes persists after the instance is terminated. Data on any instance store volumes persists only during the life of the instance. Charges Instance usage, Amazon EBS volume usage, and storing your AMI as an Amazon EBS snapshot. Instance usage and storing your AMI in Amazon S3. Stopped state Can be stopped. Cannot be stopped.
- 176. Storage Concepts and Solutions
- 177. Block and File Level Storage Block Level Storage File Level Storage Block File
- 178. StorageTechnologies DAS NAS SAN Client Server Server Client NAS Storage Client Server Client DAS StorageDAS Storage Server Server Server FC Switch Client Client SAN Storage RAID 1 RAID 2
- 179. Amazon S3
- 180. • Organize the Amazon S3 namespace at the highest level. • Identify the account responsible for storage and data transfer charges. • Play a role in access control. • Serve as the unit of aggregation for usage reporting. • Have globally unique bucket names, regardless of the AWS region in which they were created. Amazon S3 Buckets
- 181. • Amazon S3 creates a bucket in the region you select. • You can choose a region to: • Optimize latency • Minimize costs • Address regulatory requirements • Objects stored in a region never leave the region unless you explicitly transfer them to another region. Amazon S3 Region Considerations
- 182. • Objects are the fundamental entities stored in Amazon S3. • When using the console, you can think of them as files. • Objects consist of data and metadata.The data portion is opaque to Amazon S3.The metadata is a set of name-value pairs that describe the object. • Default metadata such as the date last modified • Standard HTTP metadata such as Content-Type • Custom metadata at the time the object is stored • A key that uniquely identifies as object within its bucket Amazon S3 Objects
- 183. Amazon S3 + Amazon Glacier S3 Lifecycle policies allow you to delete or move objects based on age and set rules per S3 bucket. bucket with objects 30 Days Glacier archive 365 Days
- 184. Amazon EBS
- 185. • EBS Magnetic • 40-200 IOPS • EBS General Purpose SSD • SSD backed • 3 IOPS / GB • Burstable to 3,000 IOPS and up to 10,000 IOPS • EBS Provisioned IOPS SSD • SSD backed • Up to 20,000 IOPS consistently • Up to 320 MB/s throughput EBS Performance
- 186. Amazon CloudFront
- 187. • Easy and cost effective way to distribute content to end users • Low latency, high data transfer speeds • Deliver your entire website, including static, dynamic, and streaming content using a global network of edge locations Amazon CloudFront Amazon CloudFront
- 188. HowYou Configure CloudFront to Deliver Your Content Developer S3 bucket or HTTP server 1 Objects/data 2 Web distribution CloudFront 3 http://d111111abcdef8.cloudfront.net Edge locations Your distribution’s configuration 4
- 189. How CloudFront Delivers Content toYour Users Amazon S3 server or HTTP server User Website example.com 1 3a Edge location Object/data 3b Object/ data 3/3c 2
- 190. Networking Concepts
- 191. • A network is two or more computers linked to share resources, exchange files, or allow electronic communications. • NetworkTypes: • Local Area Network (LAN) • Wide Area Network (WAN) • Virtual Private Network (VPN) What is a Network? WAN LAN LAN VPN
- 192. • A physical topology defines how the systems are physically connected. • A logical topology defines how the systems communicate across the physical topologies. Physical vs. LogicalTopology
- 194. Amazon VPC
- 195. • You can use the following components to configure networking in yourVPC: • IP addresses • Elastic network interfaces • Route tables • Internet gateways • Network AddressTranslation (NAT) • Dynamic Host Configuration Protocol (DHCP) options sets • Domain Name System (DNS) • VPC peering Networking inYourVPC
- 196. Module 3 Appendix Security, Identity, and Access Management
- 197. Data Center Security
- 198. • Lock your data center. • Only provide access to those who need it. • Keep track of access. • Mount servers on racks with locks. • Have redundant utilities. • Build your data center with security in mind. Physical & Environmental Security
- 199. • Identification & Authentication • Firewalls • Patching • Virus Protection • Encryption Network Security
- 201. • Are an alternative to IAM and supported by some services. • Grant cross-account access to your resources. • Use a principal to uniquely identify accounts in the policy. • Supported AWS services include : • Amazon S3 Bucket Policy • Amazon SNSTopic Policy • Amazon SQS Queue Policy • AmazonGlacierVault Policy • AWS OpsWorks Stack Policy • AWS Lambda Function Policy AWS Resource-Based Policies
- 202. • Temporary Security Credentials • SecurityToken Service • AssumeRole • AssumeRoleWithSAML • AssumeRoleWithWebIdentity Access to AWS Resources
- 203. • AWS CLI on Amazon EC2 • AWS CloudTrail logs to Amazon S3 • Amazon ElasticTranscoder access to Amazon S3 • AWS Elastic Beanstalk access to AWS services • AWS Lambda code access to AWS services • Many more … AWS Services support for IAM Roles
- 205. • Allow access to IP address ranges or Amazon EC2 instances you specify. • UseVPC security groups to control access to a DB instance inside a VPC. Security Groups
- 206. • DB parameter groups: • Contain engine configuration values that can be applied to one or more DB instances of the same instance type. • Are applied by Amazon RDS by default when you create DB instance, which contains defaults for the specific database engine and instance class of the DB instance. • DB option groups: • Tools that simplify database • management. • Currently available for Oracle, • Microsoft SQL Server, and MySQL 5.6 • DB instances. DB Parameter & Option Groups
- 207. • Table Operations: • Create, update, and delete tables. • After creation, you can increase or decrease provisioned throughput. • Retrieve the table’s status, the primary key, and when the table was created. • List all tables in your account for a region. • Item Operations: • Add, update, and delete items from a table. • Add, update, and delete existing attributes from an item. • Perform conditional updates. • Retrieve a single item or multiple items. Supported Operations
- 208. Local Secondary Index Partition Key Sort Key LSI Table: Music Partition Key: Artist Sort Key: Song Title LSI: Album Title Table: Music Artist Song Title Album Title Year Genre
- 209. Global Secondary Index Choose which attributes to project (if any) Table: Music Partition Key: Artist Sort Key: Song Title GSI: MusicGSI Partition Key: Genre Sort Key: Year Table: Music Artist Song Title Album Title Year Genre Genre Year Song Title
- 210. Module 5 Appendix AWS Elasticity and Management Tools
- 212. Scaling Plans Auto Scaling Minimum Health Check monitors running instances within an Auto Scaling group. If an unhealthy instance is found, it can be replaced. Manual Scaling Specify a new minimum for your Auto Scaling group. Manually invoke Auto Scaling policies. Scheduled Scaling Scaling functions are performed as a function of time and date. On Demand Scaling You create a policy to scale your resources. Define when to scale using CloudWatch Alarms.
- 213. Elastic Load Balancing Advanced Concepts
- 214. Load BalancerTypes Availability Zone A Availability Zone B EC2 instancesEC2 instances Internet-Facing Load balancer EC2 instancesEC2 instances HTTPS SSL handler/load balancer HTTPS traffic Availability Zone BAvailability Zone AAvailability Zone B EC2 instancesEC2 instances Internal Load balancer private subnetprivate subnet public subnet public subnet EC2 instance EC2 instance Availability Zone A
- 215. Request Routing client DNS server Load Balancer Routing Algorithm Auto Scaling group security group EC2 instance Auto Scaling group security group EC2 instance EC2 instance IP Addresses elb.example.org
- 216. • A listener is a process that checks for connection requests. • Front-end connections are: • Client to load balancer connections. • Configured with a protocol and a port. • Back-end connections are: • Load balancer to back-end instance connections. • Configured with a protocol and a port . • ELB supported protocols: • HTTP • HTTPS • TCP Listeners
- 217. • Health checks • Security groups • Subnets • Register • De-register instances Back-end Instances forYour Load Balancer
- 219. CloudWatch Alarms
- 220. Supported AWS Services Auto Scaling Amazon CloudFront Amazon CloudWatch Amazon CloudSearch Amazon DynamoDB Amazon EC2 Amazon ElastiCache Amazon EBS Elastic Load Balancing Amazon EMR Amazon Kinesis Amazon EC2 Container Service AWS OpsWorks Amazon Redshift Amazon RDS Amazon Route 53 Amazon SNS Amazon SQS Amazon SWF Amazon S3AWS Storage Gateway Amazon WorkSpaces Amazon Machine Learning AWS Lambda AWS WAF
- 221. Module 6 Appendix Course Wrap-Up
- 222. AWS Support
- 223. Case Severity & ResponseTimes Critical Urgent High Normal Low Enterprise Plan (24 x 7) 15 minutes or less 1 hour or less 4 hours or less 12 hours or less 24 hours or less Business Plan (24 x 7) 1 hour or less 4 hours or less 12 hours or less 24 hours or less Developer Plan (Business hours) 12 hours or less 24 hours or less
- 224. Pricing Basic Developer Business Enterprise Included $29/month -or- 3% of monthly AWS spend Greater of $100 -or- 10% of monthly AWS usage for the first $0-$10K 7% of monthly AWS usage from $10K- $80K 5% of monthly AWS usage from $80K- $250K 3% of monthly AWS usage over $250K Greater of $15,000 -or- 10% of monthly AWS usage for the first $0- $150K 7% of monthly AWS usage from $150K-$500K 5% of monthly AWS usage from $500k-$1M 3% of monthly AWS usage over $1M
- 225. Pricing Examples Business Pricing Example For $85K in AWS monthly usage: $10,000 x 10% = $1,000 (10% of the first $0 - $10K of usage) + $70,000 x 7% = $4,900 (7% of usage from $10K - $80K) + $5,000 x 5% = $250 (5% of usage from $80K - $250K) + $0 x 3% = $0 (3% of usage over $250K) Total: $6,500 EnterprisePricing Example For $1.2M in AWS monthly usage: $150,000 x 10% = $15,000 (10% of the first $0 - $150K of usage) + $350,000 x 7% = $24,500 (7% of usage from $150K - $500K) + $500,000 x 5% = $25,000 (5% of usage from $500K - $1M) + $200,000 x 3% = $6,000 (3% of usage over $1M) Total: $70,500