3. [H] AWS Fundamentals

AWS Public vs Private Services

• AWS services have two main categories which are public and private services
• The terms AWS public and private services are related to networking only
• Public services are accessed using public endpoints including S3, simple storage service
• S3 is accessible from anywhere with an internet connection
• Private AWS services reside within a VPC (Virtual Private Cloud)
• Only resources within the VPC or connected to it can access private services
• Both public and private services involve permissions and networking for access control
• In public cloud environments there are two network types which are internet, and private networks
• AWS has private zones known as Virtual Private Clouds (VPCs)
• VPCs are isolated; unable to communicate unless configured
• Private networks cannot be reached from the the internet and must be configured for access
• Services like EC2 instances can be placed in VPCs
• When accessing AWS public services with a public internet connection, communication uses the public internet to transit to and from the AWS public zone
• Private networks can connect via configuration with VPNs or Direct Connect
• Attaching an internet gateway to a VPC provides private zone resources access to the public internet if the EC2 instance is assigned a public IP address
• Data communicates with the public service via the AWS public zone and does not touch the public internet

AWS Global Infrastructure

• AWS is built as a global cloud platform which is really a collection of infrastructure groups which are connected using a global highspeed network
• Solutions architects can use this to design resilient, highly available systems
• Infrastructure components include AWS regions, edge locations, and availability zones
• Regions are geographic areas selected by AWS that contain full deployments of AWS infrastructure which have compute, storage, database products and AI analytics
• Regions are all geographically separate so they can withstand global disasters
• Interacting with most AWS services means interacting with that service inside a specific region
• Amazon's Elastic Compute Cloud in Northern Virginia is separate from Elastic Compute Cloud in Sydney
• AWS also provides edge locations in areas where deploying regions is not possible
• Edge locations are smaller, contain content distribution services and some edge computing, and there are more of them than regions
• Regions and edge locations are commonly used by a solutions architect in a system
• Regions are where infrastructure runs while content can be stored in the many edge locations to be delivered at higher speeds
• It is possible to visualize the global AWS network on the AWS website
• The AWS console presents regions and with EC2, users must select a region
• Global services like IAM or Route 53, do not require this region selection
• Regions are separated geographically and are isolated fault domains which means disaster in one region does not affect others
• Benefits of regions include that the country the region is located in has geopolitical or governance separation
• You can choose a region that conforms to your political system or governance
• If data is placed in one region, AWS guarantees it will not leave without your configuration
• This allows you to place data in the region where your audience lives
• Regions provide location control so you can locate infrastructure closer to customers
• Regions are not the only level of granularity available for solutions architects, there are others within regions

Regions and AZs

• Each region has a region code and region name
• Sydney's region code is ap-southeast-2 and its region name is Asia Pacific Sydney
• Region provide resilience and if infrastructure in the Sydney region fails the mirror won't be affected in North Virginia
• Every region comes with multiple availability zones (AZs) which could be 2, 3, 4, 5, or even 6
• Sydney has three availability zones ap-southeast-2a, 2b, and 2c
• Availability zones give you isolated infrastructure inside a region
• They are isolated compute, storage, networking, power and facilities within a region
• You can design solutions across multiple Availability Zones for resilience
• Virtual private cloud, or VPC, can work across multiple AZs for resilience
• Globally resilient services are relatively few inside AWS
• A globally resilient service operates globally with a single database and data replicates across multiple regions allowing the service to keep running
• Examples of globally resilient services are IAM and Route 53 where you don't have to select a region and tolerate failure of multiple regions
• Region resilient services are services that operate in a single region with one set of data per region where databases could exist
• They often replicate data to multiple availability zones allowing the service to keep running if an AZ fails
• AZ resilient services are run from a single availability zone and will fail if that AZ fails

AWS Default Virtual Private Cloud (VPC)

• A virtual private cloud (VPC) is a private network inside AWS used to connect AWS private networks or connect AWS private networks to your on-premises networks
• A VPC is within a single AWS account and region
• VPCs are private and isolated by default unless you decide otherwise
• They are also regionally resilient and operate from multiple availability zones
• VPCs by default are private and isolated including from the public AWS zone and internet
• There are two VPC types which are default and custom where there is a maximum of one default VPC per region
• Custom VPCs are custom and offer the ability to configure them as long as the rules and limits of VPCs are followed
• Also, they require end-to-end configuration and are 100% private by default
• They are used for serious AWS deployments where specific configurations are used; they can be configured in numerous forms; and linked to other VPCs, cloud platforms, and on-premises networks
• Unlike custom VPCs, AWS creates default VPCs with one per region
• They are pre-configured in a specific that AWS handles but they are less flexible as a result
• VPCs are created within an AWS account specifically that a region can have multiple custom VPCs inside where VPCs must be configured for communication outside the private network
• Every VPC has an allocated IP address range known as a VPC CIDR
• Everything within a VPC uses the CIDR range of that VPC, from which all connections will originate
• Custom VPCs can have multiple CIDR ranges while default VPCs only have one that is 172.31.0.0/16
• VPCs subdivide into subnets which are short for subnetworks, where every subnet resides in a single availability zone
• Default VPCs are pre-configured to have one subnet in every availability zone in the region
• Each subnet uses part of the VPC's CIDR range that must not overlap
• VPCs are resilient by deploying into a region and breaking down into subnets and if the availability zone containing the subnet it also fails but other subnets in other availability zones will operate normally
• Default VPC facts include there only being one per region that can be removed and recreated and that default VPC CIDR is always 172.31.0.0/16
• Subnets contain a /20 in every AZ and there is an internet gateway and security group and provides public IPv4 addresses
• Because services assume the default VPC is always there, leaving the default VPCs is a best practice as long as they are not used for anything production related

Elastic Compute Cloud (EC2) Basics

• EC2 provides virtual machines known as EC2 instances
• EC2 is a service that uses Instances as its base component
• It runs in the AWS private zone running, by default in VPC subnets
• EC2 instance launches must have configured public access that its VPC can support
• launching an instance in a specific availability zone makes EC2 AZ resilient
• CPU, Memory Disk and Networking define the EC2 instance
• You should only be charged for resources that are used while the instance is operational
• Instances use several storage types (the Elastic Block Store)
• EC2 instances have a defined lifecycle and go through states known as running, stopped, and terminated where you are charged for a running instance
• Terminated instances do not incur charges but are a non-recoverable action
• The only way to ensure no future EC2 costs is to terminate the instance and delete local resources
• An Amazon Machine Image (AMI) is an image of an EC2 instance used to create EC2 instances like a server image used to create virtual machines
• AMIs have attached permissions that control which accounts can use the AMI
• An AMI can be set as public for everyone, private for the owner, or explicit for specific AWS accounts
• AMIs include the boot volume of the instance(C: Drive) to store the OS
• Block Mapping Device configures links the volumes to create an instance and how they interface with the operating system

Connecting to EC2

• To connect to launched e2 instances, you must know that EC2 instances can run different operating systems like Linux and Windows
• Windows instances connect using RDP port 3389 while Linux Instances Use SSH protocol which runs on 22
• Linux instances authenticate to the instance using SSH key pairs
• SSH key pairs come in two parts with 1 private that you download once when creating the instance
• And the Public component which is kept safe in AWS to authenticate
• In Windows, use the private key to access the administrator password using remote desktop protocol

Simple Storage Service (S3) Basics

• S3 is a global storage platform that is regional and based-resilient
• It is a public service and can accept unlimited data for multiple users, and is economical and can be accessed via UI/CLI/API/HTTP
• S3 can store Objects and Buckets
• Runs from all AWS regions; can be accessed anywhere with internet
• Its regional based data is stored in specific AWS region at rest
• S3 is regionally resilient and meaning data is replicated across availability zones in that region so it tolerates failure of an AZ with ability to replicate data between them
• AWS Users select a region when you create an S3 bucket
• S3 is the default starting point, unless your requirement isn't delivered by S3 and you can cope with unlimited data amounts
• Objects are data that resides in an S3 bucket
• An Object contains an object key (filename) identifying object in a bucket where bucket and key uniquely access the object
• An object value is the value of objects which varies in size zero bytes up to five terabytes in size
• Objects also have a version ID, metadata, access control, as well as resources
• Buckets must be created in a specific AWS regions which affects data sovereignty, and also provides blast radius of failure for an error
• Bucket names must be globally unique across all regions and accounts of AWS, no IAM user can be called the same name across multiple AWS buckets
• Buckets can hold unlimited number of objects and objects themselves range from zero to five terabytes of size which essentially means unlimited bytes can be stored making it infinitely scalable
• S3 buckets have no complex structure as the system is flat and all objects reside at the same level, despite emulated file system appearances implemented with "/" characters as folder and file names
• Common S3 problems include AWS tricks questions, where it tests knowledge when you try to create a bucket a lot of the time, because somebody else already has that bucket name
• S3 buckets also have name length restrictions, lowercase restrictions, and period or ip formatting restrictions that must be followed
• bucket have a soft limit of 100 and a hard limit, So you can increase all the way up to this hard limit using support requests. And this hard limit is 1000

S3 Patterns and Anti-Patterns

• Don’t use bucket per user for data retention because it violates limitations on bucket availability and potentially thousands of system requests

• If your system needs bucket use prefixes or those folders that aren't really folders so there is multiple user in a one bucket

• Zero to infinite objects with 0 bytes to 5 tbs

• Remeber the key a objects

• You don't have to remember now

• S3 should be your default thought for any of things

• and for offloading things

• The 2 components are key an value and you don't have to remember them now this worth noting down an make it flaschcards and use them later in your studies

• S3 object store- it’s not

• file

• Block

• Great for large scale data storage or Distribution

• you can't mount data

• it is for large scaled data for data

• S3 SHOULD be your default for any things input and for many Aws

CloudFormation (CFN) Basics

• CloudFormation is a tool that lets you create, update and delete infrastructure in AWS in a consistent and repeatable way using templates instead of manually creating and editing

• CloudFormation relies on templates to work

• AWS infrastructure is created using cloudformation from the selected templates

• templates can be updated and reapplied causing CloudFormation to update existing infrastructure and can be used to delete said infrastructure entirely

• CloudFormation templates are written in YAML or JSON, to achieve the same thing and can be converted easily between the two

• All templates have resource at lead 1. And It's the resources section

• Then CloudFormation what if resouce are delete to it,

• If resources are delete from a template and are Applied with what there physical Resource are deleted.

• The Resource section of a template the only mandatory what makes sense withour the template woudn't actualu do anything

• Use example has resource defined on it

• The Discription this lets know what are the description

• Now the only restricted which you need to both description and both template force.

• Now Meta data this is what you woudn't want to task abut Meta data has some pretty a function

CloudWatch (CW) Basics

• CloudWatch is a core infrastructure product that has operational magenment and monitoring as well as performs 3 main jobs

• CloudWatch collects and manages operational data

• CloudWatch produces metrics aws product apps on premise

• CloudWatch logs aws product apps and on the on premises

• CloudWatch Events - aws servcies and schedule.

• CloutWatch is a management of the on your behalf

• The operation data is the data geterated by anv enviorment and any data for

• you can think of CloutWatch it collect metrci and montior action

• metric Aws prodcut for applicatins

• cloud watch this is a puvlic service or it is called metric

• One aspect of a cloutWath that any native

• if

• some typer of what softwARE to DO with this is exmapler outside

• will you