3. [M] AWS Fundamentals

AWS Public vs Private Services

• AWS private services are accessible by instances or entities within a VPC or connected to that VPC.
• AWS public services can be accessed using public endpoints
• S3 is an example of a public service that can be accessed from anywhere with an internet connection.
• Even though S3 is a public service identities other than the account root user has no authorization to access that resource by default
• Permissions and networking are considerations when talking about service access and the networking is what matters.
• The Internet is the zone from which Internet-based services like online stores and Gmail operate.
• A home network is an example of a private network where access is limited to devices directly connected or those with the Wi-Fi password.
• There are actually three different network zones: the public Internet, the AWS public zone, and the AWS private zone (VPC).
• The AWS public zone is a network connected to the public Internet, but not part of it, and it sits between the public Internet and AWS private zone networks.
• If EC2 has an allocated public IP address, private zone resources can access the public Internet.
• Access to public AWS services such as S3 via an IGW still communicates through the AWS public zone.
• Communication to and from an AWS public service uses the public internet as transit before reaching the AWS public zone.
• EC2 instances can project into the public zone to become publicly accessible from the internet.
• Private networks can be connected together if allowed.

AWS Global Infrastructure

• AWS is a global cloud platform comprised of smaller infrastructure groupings connected by a high-speed network.
• This design allows for the creation of systems that are resilient to failure and highly available.
• AWS infrastructure concepts include AWS regions, edge locations, and Availability Zones.
• Resilience is categorized into globally resilient, regionally resilient, and zone resilient services.
• AWS regions and edge locations are the deployments used.
• A region does not directly correspond to a continent or country but is an area selected by AWS with full infrastructure deployment.
• AWS adds regions over time, and countries may have multiple regions based on customer requirements and size.
• Regions are geographically spread out to allow for design of systems capable of withstanding global-level disasters.
• Interacting with most AWS services means interacting with a specific region.
• Elastic Compute Cloud in Northern Virginia is separate from that in Sydney, for example.
• AWS provides edge locations which are smaller than regions.
• Edge locations have content distribution services, and some edge computing, located in more places than regions.
• Edge locations are useful for companies like Netflix, to store content closer to the customers.
• Edge locations allow for fast, efficient data transfer due to lower latency.
• Regions and edge locations are commonly used by solutions architects running infrastructure from multiple regions but using edge locations for content delivery at faster speeds.
• The AWS network can be visualized, showing fewer regions vs edge locations and how regions are connected via high speed networking links.
• AWS networking can be used for efficient system deployment.

AWS Regions

• Regions are presented in the AWS console, and EC2 requires region selection
• Some services are global, like IAM and Route 53, and don't require region selection
• Each region is geographically separated, providing fault isolation and preventing issues in one region from affecting others.
• It enables the ability to place infrastructure into a region knowing it will not be affected by faults in another.
• Regions are designed to be 100% isolated, enhancing fault tolerance.
• Selection of a region offers geopolitical or governance separation, impacting the laws and regulations affecting infrastructure storage.
• AWS commits to keeping data within a chosen region if not configured otherwise.
• Regions allow for location control and the ability to place infrastructure close to customers for performance
• Netflix uses infrastructure around the globe close to customers
• When referring to a region, either the region code or region name is used. The Sydney region has a region code of ap-southeast-2 and a region name of Asia Pacific (Sydney).

Regions and Availability Zones

• AWS defines a region as having the region code (ap-southeast-2) and the region name (Asia Pacific (Sydney)).
• A region provides resilience through infrastructure mirrored in other regions.
• Need exists for more granularity and this is available through availability zones.
• AWS provides multiple availability zones inside a region, with 3 in Sydney (ap-southeast-2a, 2b, 2c).
• Availability zones give isolated compute, storage, networking, power, and facilities inside a region.
• If a region experiences an isolated issue that only affects one zone, the other zones will continue to be fully functional.
• Solutions can be designed to distribute components across multiple Availability Zones for resilience.
• An Availability Zone is a logical construct within AWS and may consist of one or more data centers.
• AWS only guarantees zone isolation and connectivity.
• Services can be placed across multiple Availability Zones for fault tolerance using virtual private cloud.

Service Resilience

• How a service is defined by its level of resilience.
• Globally resilience occurs when a service operates with a single database replicated accross multiple regions, such as IAM and Route 53
• Region resilience occurs when services operates in a single region with separate sets of data, like an RDS database in Sydney versus one in Northern Virginia.
• Data is typically replicated to multiple availability zones and the service will continue to operate in if an AZ fails.
• If the whole region fails, so will this service.
• AZ resilient services run from a single availability zone.
• Failure of this AZ will cause failure of the service.
• These services include those that need resilient storage systems.

AWS Default Virtual Private Cloud (VPC)

• VPCs are virtual private networks within AWS, allowing creation of private networks for services to run.
• VPCs enable connections between AWS private networks and on-premises networks in hybrid environments.
• Private AWS networks can be connected to on-premise networks creating a hybrid environment.
• VPCs can connect to other cloud platforms for multi-cloud deployments.
• A VPC is a service which is within an AWS account and AWS region.
• VPCs are regional services, providing regional resilience and operating from multiple availability zones in a region.
• A VPC is private and isolated by default.
• Services in the same VPC can communicate, but the VPC is isolated from other VPCs, the public AWS zone, and the public Internet, but this can be changed through configuration.
• There are two types of VPCs: default VPC and custom VPC.
• Maximum of one default VPC per region.
• Can have several custom VPCs in a region.
• Custom VPCs are custom, to be configured as needed, following VPC rules/limits.
• Custom VPCs are 100% private by default and used in most AWS deployments.
• They can be configured to the sizes and structures, linked with other VPCs, and communicate with other cloud platforms or on-premises networks.
• One default VPC is automatically created by AWS in every region.
• Default VPCs come pre-configured via AWS and are less flexible than custom VPCs.
• VPC allows you to build an isolated private network and unless configured, there is no traffic out the the VPC border with the exception of allowing it.

VPC characteristics

• Every VPC has a range of IP addresses, which are called the VPC CIDR, which is a common range of IP addresses the VPC can use
• The CIDR is just the IP address range of the VPC
• DefaultVPC only gets 1 CIDR, which is 172.31.0.0/16
• This is a strength, that it's predictable
• A region has multiple availability zones, such as us-east-2a, 2b, 2c, each an independent infra pool
• To provide resilience, a VPC can be sub-divided into subnets, which is short for the network
• The a,b,c at the end defines the sub-network is located in one AZ.
• Each subnet will use part of the VPC"s range of IP addresses/CIDR Range
• THese ranges cannot be the same and can't overlap
• This is how a VPC is resilient, by each subnet will be in one AZ and if it fails, part of the VPC fails
• If the AZ that an instance is launched into fails, then the instance itself will likely fail

Default VPC Facts

• One per region and can be removed and recreated
• The VPC ranges is always 172.31.0.0/16
• Inside that range there are many /20 subnet to AZ
• Internet Gateway and Security Groups assign
• They come precongifured so they have v4 addressing

Elastic Compute Cloud (EC2) Basics

• EC2 is IAAS and provides virtual machines (instances)
• Unit of Consumption is the instance, just a OS with alocated resources
• Is a private service, so it means it runs in the private zone by default
• runs in a sinlge VPC subnet but needs VPC support
• Choose sizes and capabilities for the instance to determine resources,GPU and extra processes etc
• You menage the OS because it's IAAS and manage virtualization
• Billing per second/hour depending on what it's launched with
• Only pay for uptime
• In stopped state there are no CPU resources being consumed
• You'll still see bill with EBS

How to reduce instance costs

• The only way to truly have no ec2 costs for an instance is to terminate that EC2 instance.
• AMI is an image of an EC2 instance, AWS supplies with a image for every window/linus.
• An image is similar to server image but contains a USB device.

Access permissions for EC2

• AMI Permission
• Explicit permission
• Root volume for boot/ and contains block device mapping
• Connecting to ec2 instances
• Using RDP via port 3389 for windows
• Using SSH to port 22 for linus

Simple Storage Service (S3) Basics

• A global storage platform that is regional based and resilient
• A public service that can handle unlimited data and multi user based
• Ideal to store movies/photos and data sets
• Economical and accessed via UI/CLI/API/HTTP
• Uses objects and buckets
• In a specific AWS region when it's unused, it will never leave unless you configure it.
• It can tolerate failure of AZ
• Select region when you create a thing insude s3
• It can cope with multilated data ammounts/ multi user usage, millions of cat pictures
• The great thing is it sales at a massive scales
• 3 the default storage service in AWS.
• 2 main service it delivers like objects/buckets
• your cat picture is an object .g the migration og koala
• buckets are containers for objects
• Component of object there is value and value is the data or contents.
• Value of an object is an empty obkect or 5tbs
• Objects have a few components called version 1D, medatar,access control and the sub-reosources
• S3 buckets are created in a specific AWS REGIOUN with the use of sydney or ap-southeast-2 as example.

Characteristics of Buckets

• Data inside a bucket has a promary home region and if never leaves
• Bucket name must be global Unique
• They must be uinque all regions / accounts.

S3 buckets summary

• S3 bucket can hold UNLIMITED number of objects
• S3 bucket is flat
• Store a root level even when you create /old.data s
• They prefix it with the object names
• There's limit in terms of number of buckes to have with 100 as a hard / 100 asoft as a max limit on buckets
• S3 is an object store
• Good for ofload
• AWS service output

CloudFormation (CFN) Basics

• CloudFormation is a tool to create, update and delete infrastructure in AWS using templates.
• Templates are written in either YAML or JSON.
• All templates include a list of resources which CloudFormation uses to create, update, or remove physical resources.
• Description is a free text field for the template author to add details about the template and resources, and changes
• The AWS template format version isn't mandatory, but if description is also used as a parameter, description needs to directly follow the template format version
• The template format version is the avenue AWS uses for extending the template standards over time, and it is assumed if omitted.

Building templates and conditions

• Templates are added , and meta data is like a Ul but for those information
• Parameters and set of you can you add in fields.
• Templates can use mappings to lookup the data.
• There is a multi set of to set, such as to create a prod set
• Ouputs are used a set set set a set of outputs which are template and its is of

Logical and template resources and stacks

• Templates contains resource and the other stuff used with cloud
• Templates contains resource and the other stuff used with CloudFormation
• The resource section with a list resource where the in EC2, and used logical to exactly to create Aws.
• You take templates and intially give it to to cloud, will need to that be and that created

CloudWatch (CW) Basics

• CloudWatch collects data on behalf of you
• This includes operational or logging.
• CloudWatchs that are are or AWS.
• A AWS, or on other cloud you can take most to where that it will be

Agent gathering

• Is to AWS , log
• Cloud, actions

Namespace and dimesnions for cloudwatch

• Log action
• And state
• To

Shared Responsibility Model

• AWS helps with security for a piece of the cloud and the customer helps the security to the cloud.
• Location helps keep with those
• You
• To a point

HA / FT /DR

• HA - to minimise the number of outage
• FT - To operate though failure
• DR - when to use with those don't work
• HA is about fast and automatic recovery, it's not about perventing user disruption