AWS Cloud Practitioner Essentials.pdf

AWS CLOUD PRACTITIONER ESSENTIALS MODULE 1: INTRODUCTION TO AMAZON WEB SERVICES INTRODUCTION What is a Client-Server Model? Basic Concept: o It’s a way of structuring how computer systems interact with each other. o Client: The device or software that makes a request f...

AWS CLOUD PRACTITIONER ESSENTIALS MODULE 1: INTRODUCTION TO AMAZON WEB SERVICES INTRODUCTION What is a Client-Server Model? Basic Concept: o It’s a way of structuring how computer systems interact with each other. o Client: The device or software that makes a request for information or services. o Server: The device or software that provides or serves the requested information or services. How It Works 1. Client: o Role: Initiates requests for information or services. o Examples: Web browsers (like Chrome or Firefox), desktop applications, mobile apps. o Action: Sends a request to the server for data or services (e.g., asking for a webpage or a video). 2. Server: o Role: Receives requests from clients and processes them. o Examples: Web servers, database servers, virtual servers like Amazon EC2. o Action: Provides the requested information or performs a service, then sends the response back to the client. Example Scenario Request: o Imagine you are using a web browser (client) and you want to read a news article. o Your browser sends a request to a server to get the article. Processing: o The server (which hosts the website) receives the request. o It looks up the news article, prepares it for delivery, and sends it back to the client. Response: o The browser (client) receives the article from the server. o You can now read the news article on your screen. Key Points Client: o Requests information or services. o Examples: Your web browser, a mobile app. Server: o Provides the requested information or performs a task. o Examples: A website server, an application server like Amazon EC2. In summary, the client-server model is a fundamental concept in computing where a client makes requests for data or services, and a server fulfills those requests by sending back the information or performing the requested action. CLOUD COMPUTING Cloud Computing Deployment Models 1. Cloud-Based Deployment All in the Cloud: Run everything on cloud services. Options: o Migrate Existing Apps: Move current applications to the cloud. o Build New Apps: Create new applications directly in the cloud. Types of Cloud Services: o Low-Level Infrastructure: Use basic virtual servers, databases, and networking that require more management. o High-Level Services: Use managed services that handle a lot of the infrastructure management for you. Example: A company builds an application with servers, databases, and networking all hosted in the cloud. 2. On-Premises Deployment Everything On-Site: All resources and applications are managed within your own data center. Virtualization: Use technologies to create virtual servers and manage resources efficiently. Private Cloud: This setup is similar to a traditional IT infrastructure but uses modern management tools to improve efficiency. Example: Applications run on physical servers and infrastructure within the company’s own data center. 3. Hybrid Deployment Mix of Cloud and On-Premises: Combines both cloud-based and on-premises resources. Integration: Connects on-premises infrastructure with cloud resources. Why Use It: o Keep certain legacy applications on-premises. o Comply with regulations that require data to be stored on-site. Example: A company uses cloud services for data processing while keeping older, critical applications in its own data center. Benefits of Cloud Computing 1. Trade Upfront Expense for Variable Expense Upfront Expense: Cost of buying and setting up physical servers and data centers before using them. Variable Expense: Pay only for what you use, like paying for cloud storage or computing power as needed. Benefit: Saves money upfront and allows spending based on actual usage. 2. Stop Spending Money to Run and Maintain Data Centers Old Model: Running data centers means ongoing costs for power, cooling, and maintenance. Cloud Benefit: Offload these responsibilities to the cloud provider and focus more on your business and applications. 3. Benefit from Massive Economies of Scale Economies of Scale: Cloud providers can offer lower prices because they serve many customers and buy resources in bulk. Benefit: Lower costs for cloud services compared to managing your own data center. 4. Increase Speed and Agility Speed: Cloud resources can be provisioned quickly, often in minutes. Agility: Allows you to experiment and develop applications faster without waiting for new hardware. Benefit: Accelerates development and deployment processes. 5. Go Global in Minutes Global Reach: Deploy applications to users around the world quickly. Low Latency: Cloud providers have data centers in many locations, ensuring fast access for global users. Benefit: Reach a global audience with minimal delays in application performance. In summary: Deployment Models: Choose between using only cloud resources, keeping everything on- premises, or combining both. Benefits: Save on costs, avoid maintenance headaches, enjoy lower prices due to scale, increase speed and flexibility, and deploy globally. MODULE 2: COMPUTE IN THE CLOUD INTRODUCTION What is Amazon EC2? Virtual Servers: Amazon EC2 provides virtual servers, called instances, that you can use in the cloud. Secure and Resizable: Instances are secure and can be resized to meet your needs. Flexible Pricing: You pay only for the time you use the instances, not when they are stopped or terminated. How It Compares to Traditional Servers Traditional Servers: o Upfront Costs: Buy and set up physical hardware. o Delivery and Setup: Wait for servers to arrive and then install them in your data center. o Configuration: Configure hardware and software manually. Amazon EC2: o Quick Launch: Create and start virtual servers in minutes. o Pay-as-You-Go: Only pay for the compute time you use. o On-Demand: Start or stop instances as needed, and only pay for the capacity you use. How Amazon EC2 Works 1. Launch: o Select a Template: Choose a pre-configured setup for your instance, including operating system and application. o Choose Instance Type: Pick the hardware configuration that fits your needs. o Set Up Security: Define rules to control network access to your instance. o Example: If you need a server for a new website, you select a template for a web server, choose the type of instance you want, and set security rules to protect it. 2. Connect: o Connection Methods: ▪ Programmatic Access: Your applications can connect directly to the instance. ▪ User Access: Log in to the instance to access its desktop and manage it. o Example: Once your instance is running, you can use tools or commands to connect to it and manage it from your computer. 3. Use: o Running Tasks: ▪ Install Software: Set up and run software on your instance. ▪ Manage Files: Copy, organize, and manage files on the instance. ▪ Add Storage: Increase storage capacity if needed. o Example: After connecting to your web server instance, you can install a content management system, upload your website files, and configure the server settings. In summary: Amazon EC2: Provides virtual servers in the cloud with flexible pricing and quick setup. Steps to Use: o Launch: Choose and set up your instance. o Connect: Access and manage your instance. o Use: Run applications, manage files, and customize your instance as needed. AMAZON EC2 INSTANCE TYPES 1. General Purpose Instances Balanced Resources: Provides a mix of CPU, memory, and network capabilities. Use Cases: o Application Servers: Running applications where resource needs are balanced. o Gaming Servers: Hosting multiplayer games. o Backend Servers: Supporting enterprise applications. o Small and Medium Databases: Handling databases that don’t need huge resources. When to Use: Choose these if your workload doesn’t have extreme requirements for any single resource (compute, memory, or networking). 2. Compute Optimized Instances High-Performance CPUs: Designed for tasks that need a lot of processing power. Use Cases: o High-Performance Web Servers: Serving web pages that require significant processing. o Compute-Intensive Application Servers: Running applications that need a lot of CPU power. o Dedicated Gaming Servers: Hosting games that need strong processing capabilities. o Batch Processing: Processing large volumes of data in groups (batches). When to Use: Choose these for applications that need powerful CPUs to perform complex calculations or handle a high volume of requests. 3. Memory Optimized Instances Large Memory Capacity: Provides a lot of RAM to handle large datasets quickly. Use Cases: o High-Performance Databases: Running databases that need to keep large amounts of data in memory for fast access. o Real-Time Data Processing: Handling big data or unstructured data that needs immediate processing. When to Use: Choose these if your application requires a lot of memory to work efficiently and process large amounts of data quickly. 4. Accelerated Computing Instances Hardware Accelerators: Uses specialized hardware (like GPUs) to speed up specific tasks. Use Cases: o Graphics Processing: Handling tasks like rendering images or videos. o Game Streaming: Streaming games that require high-performance graphics. o Application Streaming: Running applications that need fast processing of visual or complex data. When to Use: Choose these if your workload benefits from hardware acceleration to handle tasks like graphics processing or intensive computations faster. 5. Storage Optimized Instances High Storage Performance: Designed for applications that need fast access to large amounts of data. Use Cases: o Distributed File Systems: Managing files across multiple servers. o Data Warehousing: Storing and querying large volumes of data efficiently. o High-Frequency Online Transaction Processing (OLTP): Handling many transactions quickly. When to Use: Choose these for applications that require fast read and write access to large datasets, often measured in input/output operations per second (IOPS). In summary: General Purpose: Balanced resources for various tasks. Compute Optimized: Powerful CPUs for compute-heavy tasks. Memory Optimized: Large RAM for memory-intensive applications. Accelerated Computing: Specialized hardware for tasks needing fast processing. Storage Optimized: High-performance storage for data-heavy tasks. AMAZON EC2 PRICING 1. On-Demand Instances Description: Pay for compute capacity by the hour or second with no long-term commitment. Best For: o Short-term, unpredictable workloads. o Applications that cannot be interrupted. o Developing and testing applications. Cost: o Pay only for the time you use. o No upfront costs or minimum contracts. Use Case: If you have a temporary project that needs servers for a few weeks, On-Demand Instances are a good choice. 2. Reserved Instances Description: Pay a one-time upfront fee for a significant discount on instance usage over a 1-year or 3-year term. Types: o Standard Reserved Instances: ▪ Best for predictable workloads. ▪ Requires you to specify instance type, size, region, and operating system. ▪ Option to reserve capacity in a specific Availability Zone. o Convertible Reserved Instances: ▪ Offers more flexibility. ▪ Allows changes to instance types, sizes, or regions. ▪ Trade-off: Less discount compared to Standard Reserved Instances. Cost: o Upfront payment for a discount on hourly rates. o Longer terms (3 years) offer greater savings. Use Case: If you have a stable, long-term application that you run continuously, Reserved Instances can save you money. 3. EC2 Instance Savings Plans Description: Commit to a specific hourly spend for a 1-year or 3-year term to get a discount on any instance within a family and region. Best For: o Flexible instance usage. o Not needing to specify instance type, size, or region up front. Cost: o Pay based on committed usage with up to 72% savings compared to On-Demand rates. o Any usage beyond the commitment is billed at regular On-Demand rates. Use Case: If you use different types of instances within a family and need flexibility, Savings Plans offer a good way to save. 4. Spot Instances Description: Use unused EC2 capacity at reduced rates, with potential cost savings of up to 90% off On-Demand prices. Best For: o Workloads that can handle interruptions. o Flexible start and end times. Cost: o Very low cost compared to On-Demand Instances. Use Case: Ideal for background processing tasks or data analysis jobs where interruptions are acceptable and cost savings are crucial. 5. Dedicated Hosts Description: Physical servers dedicated solely to your use, allowing you to use your own software licenses. Best For: o Compliance with licensing requirements. o Applications requiring dedicated physical servers. Cost: o Typically more expensive than other options. o Available as On-Demand or via reservation. Use Case: Suitable for scenarios where you need to use your existing licenses and must ensure that a server is dedicated to only your use. In summary: On-Demand Instances: Pay-as-you-go for short-term or unpredictable needs. Reserved Instances: Discounted rates for long-term, steady-state applications with specified configurations. EC2 Instance Savings Plans: Flexible commitment for reduced rates on various instance types. Spot Instances: Cheapest option for flexible, interruptible workloads. Dedicated Hosts: Most expensive, provides physical servers dedicated to your use with licensing benefits. SCALING AMAZON EC2 What is Scalability? Scalability: The ability to adjust the number of resources (like servers) based on current demand. Goal: Start with only the resources you need and automatically add or remove resources as demand changes. Benefit: Pay only for the resources you use and avoid running out of capacity or paying for unused resources. Amazon EC2 Auto Scaling Purpose: Automatically adjusts the number of EC2 instances based on your application’s needs. Why Use It: Helps maintain high availability and performance by scaling resources up or down as needed. How Amazon EC2 Auto Scaling Works: 1. Auto Scaling Group: o Definition: A group of EC2 instances managed together to handle your application’s load.  oMinimum Capacity: The minimum number of instances that should always be running. o Desired Capacity: The number of instances you want to have running based on current demand. o Maximum Capacity: The maximum number of instances the Auto Scaling group can scale up to. 2. Scaling Approaches: o Dynamic Scaling: Adjusts the number of instances based on real-time demand. ▪ Example: Increase instances during traffic spikes and decrease when traffic drops. o Predictive Scaling: Uses historical data to predict future demand and adjusts the number of instances ahead of time. ▪ Example: Automatically add instances before a known peak time like a major sale event. Example of Setting Up Auto Scaling: Minimum Number of Instances: o Example: Set to 1, meaning there will always be at least one EC2 instance running. Desired Capacity: o Example: Set to 2, which means ideally, there will be 2 instances running. Maximum Capacity: o Example: Set to 4, meaning the Auto Scaling group can add instances up to a maximum of 4 if needed. Benefits: Cost-Effective: Only pay for the instances you use when you use them. Improved Performance: Automatically adjust to handle varying levels of demand. High Availability: Helps keep your application available and responsive even during unexpected spikes in demand. In summary: Scalability: Adjusts resources to match demand. Auto Scaling: Automatically manages the number of EC2 instances based on real-time or predicted needs. Configuration: Set minimum, desired, and maximum number of instances to optimize cost and performance. DIRECTING TRAFFIC WITH ELASTIC LOAD BALANCING What is Elastic Load Balancing (ELB)? Purpose: Automatically distributes incoming application traffic across multiple Amazon EC2 instances or other resources.  Function: Acts as a single point of contact for all incoming traffic, ensuring requests are spread evenly to avoid overloading any single resource. How Does Elastic Load Balancing Work? Single Point of Contact: All incoming traffic is directed to the load balancer first. Traffic Distribution: The load balancer then routes these requests to various EC2 instances based on factors like current load and health. Integration: Works with Amazon EC2 Auto Scaling to adjust the number of instances based on traffic demands. Example to Understand Elastic Load Balancing Low-Demand Period: o Scenario: A coffee shop with a few customers. o Registers (EC2 Instances): Few registers are open, matching the number of customers. o Function: No register is overburdened; each register handles a fair share of customers. High-Demand Period: o Scenario: More customers arrive at the coffee shop. o Registers (EC2 Instances): The shop opens more registers to handle the increased number of customers. o Load Balancer (Coffee Shop Employee): Directs customers to available registers, ensuring an even distribution so no single register gets overwhelmed. Benefits of Elastic Load Balancing Even Distribution: Ensures that no single EC2 instance gets overwhelmed with traffic. High Availability: Increases the reliability of your application by routing traffic to healthy instances and scaling as needed. Performance: Maintains application performance even during high traffic periods by balancing the load. Key Points Automatic Scaling: Works with Auto Scaling to manage instance numbers and balance traffic. High Performance: Ensures that application traffic is efficiently distributed across all available resources. Resilience: Helps maintain application uptime and performance by directing traffic away from failing instances. In summary: Elastic Load Balancing: Distributes incoming traffic across multiple EC2 instances. Low-Demand Example: Few registers handle traffic smoothly.  High-Demand Example: More registers open and traffic is balanced efficiently. Benefits: Ensures even load distribution, improves application availability, and maintains performance. MESSAGING AND QUEUEING Monolithic Applications vs. Microservices Monolithic Applications: o Definition: Applications where all components (like databases, servers, and user interfaces) are tightly integrated. o Issue: If one component fails, it can cause the whole application to fail. o Example: A single big coffee shop with only a few registers. If a register fails, the entire shop might struggle with customer service. Microservices: o Definition: Applications where components are loosely connected. Each component operates independently and communicates with others. o Benefit: If one component fails, others can continue to work, reducing the risk of total failure. o Example: A coffee shop with multiple registers and separate staff members for different tasks. If one register or staff member has issues, the rest of the shop continues to run smoothly. Amazon Simple Notification Service (Amazon SNS) Purpose: A service that allows you to send notifications to multiple subscribers using topics. Function: Publishers send messages to topics; subscribers receive messages based on their subscriptions. Example: Publishing Updates Single Topic: o Scenario: A coffee shop sends updates through a single newsletter that includes all topics like coupons and new products. o Subscription: All subscribers receive every update, regardless of their interests. Multiple Topics: o Scenario: The coffee shop now has separate newsletters for different topics: one for coupons, one for coffee trivia, and one for new products. o Subscription: Subscribers choose which newsletters they want, so they only get updates for topics they’re interested in. Amazon Simple Queue Service (Amazon SQS) Purpose: A message queuing service that enables you to send, store, and receive messages between application components without losing messages.  Function: Messages are placed in a queue, processed by a receiver, and then removed from the queue. Example 1: Fulfilling an Order Without a Queue: o Scenario: A cashier takes an order and gives it directly to the barista. o Issue: If the barista is busy or on a break, the cashier has to wait, causing delays. With a Queue: o Scenario: The cashier places orders into a queue. o Process: ▪ Customer Order: Customer places an order with the cashier. ▪ Order Queue: Cashier places the order into a queue (like an order board). ▪ Barista: The barista retrieves orders from the queue and prepares them. ▪ Completion: Barista removes the completed order from the queue. o Benefit: The cashier can continue taking new orders even if the barista is busy, improving efficiency. Summary Monolithic vs. Microservices: o Monolithic: Components are tightly coupled, causing potential total failure if one part fails. o Microservices: Components are loosely coupled, allowing independent operation and reducing risk of total failure. Amazon SNS: o Single Topic: All subscribers get all updates. o Multiple Topics: Subscribers choose specific updates they want. Amazon SQS: o Without Queue: Direct communication can cause delays if one part is busy. o With Queue: Messages are stored temporarily in a queue, allowing components to operate independently and improving overall efficiency. Additional Compute Services Serverless Computing Definition: A way to run code without managing servers. You only focus on writing and running your code. Benefits: o No Server Management: AWS handles the servers for you. o Automatic Scaling: The service adjusts resources based on demand. o Cost-Efficient: You only pay for the compute time you actually use. AWS Service for Serverless Computing: o AWS Lambda: ▪ Function: Runs your code without server management. ▪ How It Works:  1. Upload Code: Put your code into Lambda. 2. Set Triggers: Configure what events will run your code (e.g., file uploads, HTTP requests). 3. Run on Demand: Your code executes only when triggered. 4. Pay for Use: Charges apply only when your code runs. o Example: Resize images automatically when they are uploaded to the cloud. Lambda runs the resizing code only when a new image is uploaded, and you are billed for the compute time used during resizing. Containers Definition: A method to package your application code and its dependencies into a single unit that runs consistently across different computing environments. Benefits: o Consistency: The container ensures the application works the same way in different environments (e.g., development, testing, production). o Scalability: Containers make it easier to manage and scale applications. Example: o Single Host: Run multiple containers on one host to maintain a consistent environment. o Large Scale: Manage thousands of containers across many hosts. Scaling up involves handling many containers and hosts efficiently. AWS Container Services Amazon Elastic Container Service (Amazon ECS): o Purpose: Manages and scales containerized applications using Docker containers. o Features: ▪ Docker Support: Works with Docker containers, allowing for quick deployment and management. ▪ API Management: Use API calls to start and stop containers. Amazon Elastic Kubernetes Service (Amazon EKS): o Purpose: Manages Kubernetes clusters on AWS. o Features: ▪ Kubernetes Support: Handles the deployment and scaling of containerized applications using Kubernetes, a popular open-source system for container orchestration. ▪ Community-Driven: Integrated with the Kubernetes community for ongoing updates and features. AWS Fargate: o Purpose: A serverless compute engine for running containers. o How It Works: ▪ No Server Management: AWS Fargate handles the infrastructure, so you don’t need to manage servers. ▪ Focus on Code: Concentrate on developing and deploying applications without worrying about server management. ▪ Pay for Resources: You pay only for the computing resources used by your containers. Summary Serverless Computing: Allows you to run code without managing servers, automatically scales, and charges you only for the compute time used. AWS Lambda is a key service. Containers: Package code and dependencies together, ensuring consistent environments and scalable management. Examples include Amazon ECS (for Docker) and Amazon EKS (for Kubernetes). AWS Fargate: A serverless option for containers that eliminates server management and charges based on resources used. MODULE 3: GLOBAL INFRASTRUCTURE AND REALIBILITY Module 3 Introduction: Building a Global Footprint Concept: AWS’s global infrastructure is designed to ensure that services remain available and reliable even if there are issues in one part of the world. Analogy: Coffee Shop Chain Scenario: o Local Impact: If something disrupts one coffee shop location (e.g., a parade, flood, or power outage), customers can still get coffee from another nearby shop. o Backup Locations: Multiple coffee shops spread out in different locations ensure that customers always have access to coffee, regardless of issues at a single shop. How This Relates to AWS: AWS Global Infrastructure: o Similar Idea: Just like the coffee shop chain, AWS has multiple data centers around the world to handle disruptions and ensure services remain available. o Redundancy: If one AWS data center experiences problems, traffic can be redirected to other data centers in different regions. Key Points: Global Reach: AWS has data centers in various geographic locations to provide services globally. High Availability: Multiple locations help ensure that if one area faces an issue, others can continue to provide services. Disaster Recovery: Similar to having backup coffee shops, AWS’s global infrastructure helps in recovering quickly from unexpected events. In essence, AWS’s global infrastructure is built to keep services running smoothly no matter what happens at any single location, ensuring a reliable experience for users around the world. AWS Global Infrastructure: Selecting a Region When choosing an AWS Region for your services, data, and applications, consider the following four factors: 1. Compliance with Data Governance and Legal Requirements Data Regulations: Some companies must store data in specific locations due to legal or regulatory requirements. Example: If your company needs to keep data within the UK, you would choose the London Region. 2. Proximity to Your Customers Faster Delivery: Choosing a Region closer to your customers can speed up content delivery. Example: If your company is in Washington, DC, but your customers are in Singapore, you might run your infrastructure in Northern Virginia and your applications in Singapore to optimize performance. 3. Available Services Within a Region Service Availability: Not all AWS services are available in every Region. AWS regularly adds new services, but rollout can be gradual. Example: If you need to use Amazon Braket (AWS's quantum computing platform) and it's only available in certain Regions, you must select one of those Regions for your application. 4. Pricing Cost Variation: Service costs can vary between Regions due to factors like local taxes and operational costs. Example: Running applications in São Paulo might cost significantly more than in Oregon due to Brazil’s tax structure. Availability Zones Definition: An Availability Zone (AZ) is a data center or a group of data centers within a Region. Distance: AZs are located a few tens of miles apart to minimize latency but still protect against localized disasters. Example of Running Amazon EC2 Instances in Availability Zones 1. Single Availability Zone o Scenario: Running an EC2 instance only in the us-west-1a AZ of Northern California. o Risk: If us-west-1a fails, you lose your instance and potentially your application. 2. Multiple Availability Zones o Scenario: Running EC2 instances in both us-west-1a and us-west-1b AZs. o Best Practice: Distributing instances across multiple AZs ensures higher availability and resilience. If one AZ fails, your application can continue to run from the other AZ. In summary, choosing the right AWS Region involves balancing legal requirements, proximity to users, available services, and pricing. Using multiple Availability Zones within a Region enhances the reliability and availability of your applications. Edge Locations Edge locations help speed up the delivery of your content by storing copies closer to your customers. Here’s how they work: 1. Origin Definition: The original location where your data is stored. This could be a server, database, or storage system. Example: If your company’s data is stored in Brazil, that’s your origin. 2. Edge Location Definition: A site used by Amazon CloudFront to store cached copies of your content. These are spread out around the world. Function: Instead of making customers in distant locations fetch data from your origin, CloudFront caches copies of your content at edge locations closer to them. Example: If you have customers in China, an edge location near China will cache a copy of your content. 3. Customer Definition: The end-user who requests your content. Process: When a customer requests content, CloudFront checks if it’s available at the nearest edge location. If it is, CloudFront delivers it from there. Benefit: The content is delivered faster because it’s retrieved from a nearby edge location rather than traveling all the way from the origin in Brazil. Summary: Edge locations cache copies of your content close to where your customers are located, which speeds up content delivery and improves user experience by reducing latency. How to Provision AWS Resources Ways to Interact with AWS Services 1. AWS Management Console Definition: A web-based interface for managing AWS services. Features: o Access: Quickly access services you've used recently. o Search: Find other services by name, keyword, or acronym. o Wizards: Use step-by-step guides to simplify tasks. o Mobile App: Monitor resources, view alarms, and check billing information from your phone. Multiple accounts can be logged into the app simultaneously. 2. AWS Command Line Interface (CLI) Definition: A command-line tool for managing AWS services. Features: o Control: Execute commands to manage AWS services directly from your terminal. o Automation: Use scripts to automate tasks like launching EC2 instances or managing Auto Scaling groups. o Platforms: Available for Windows, macOS, and Linux. 3. Software Development Kits (SDKs) Definition: Libraries that simplify using AWS services in your applications. Features: o APIs: Provide language-specific APIs for interacting with AWS services. o Integration: Easily integrate AWS services into your existing applications or create new ones. o Languages: Support for various programming languages like C++, Java,.NET, and more. o Resources: Includes documentation and sample code to help you get started. AWS Elastic Beanstalk Definition: A service that simplifies application deployment and management. How It Works: o Provide Code: You upload your code and configuration settings. o Automatic Management: Elastic Beanstalk handles: ▪ Capacity Adjustment: Scales your application based on demand. ▪ Load Balancing: Distributes traffic across multiple instances. ▪ Scaling: Automatically scales resources up or down. ▪ Health Monitoring: Monitors application health and performance. AWS CloudFormation Definition: A service that allows you to manage your infrastructure as code. How It Works: o Infrastructure as Code: Write scripts to define and manage your environment. o Provisioning: Automatically provisions resources as specified in your code. o Safe Management: Handles resource management safely and automatically rolls back changes if errors occur. o Repeatable: Build and rebuild your infrastructure easily and consistently without manual intervention. Summary: AWS Management Console: Easy-to-use web interface. AWS CLI: Command-line tool for automation. SDKs: Libraries for integrating AWS into your code. Elastic Beanstalk: Automates deployment and management of applications. CloudFormation: Manages infrastructure using code for repeatable and safe deployments. MODULE 4: NETWORKING Connectivity to AWS Amazon Virtual Private Cloud (Amazon VPC) Definition: A service that allows you to create a private and isolated network within AWS. Purpose: Helps organize and control network traffic between your resources in the cloud. Components: o Virtual Network: Create your own virtual network in AWS, isolated from other networks. o Subnets: Divide your VPC into smaller sections to manage resources like Amazon EC2 instances. Internet Gateway Definition: A component that connects your VPC to the internet. Purpose: Allows resources in your VPC to communicate with the outside world. Analogy: Think of it like a doorway that customers use to enter a coffee shop. Without it, no external traffic can access your VPC. Function: o Public Access: Enables resources within your VPC to receive and send traffic to and from the internet. Virtual Private Gateway Definition: A component that allows secure access to your VPC from an external network.  Purpose: Connects your VPC to a private network, like an on-premises data center, using a VPN. Analogy: Imagine a road with a bodyguard protecting you. The road (the internet) is shared with others, but the bodyguard (VPN) keeps your traffic secure. Function: o Secure Traffic: Encrypts and secures your connection to the VPC from an external network. o VPN Connection: Provides a secure tunnel for data between your VPC and your private network. AWS Direct Connect Definition: A service that establishes a dedicated private connection between your data center and AWS. Purpose: Offers a private, high-bandwidth connection to AWS, bypassing the public internet. Analogy: Think of it like a private hallway from your apartment building directly to the coffee shop, exclusive to residents (your data center) without sharing the public road (internet). Function: o Dedicated Connection: Provides a secure, high-bandwidth link between your data center and AWS, reducing network costs and improving performance. Summary: Amazon VPC: Creates an isolated network in AWS for your resources. Internet Gateway: Connects your VPC to the internet for public access. Virtual Private Gateway: Provides secure access to your VPC from an external network using VPN. AWS Direct Connect: Establishes a private, high-bandwidth connection between your data center and AWS, bypassing the public internet. Subnets and Network Access Control Lists Subnets Definition: Sections within a Virtual Private Cloud (VPC) that help organize and manage resources based on their accessibility and security needs. Types: o Public Subnet: Contains resources that need to be accessible from the internet, like a website’s server. o Private Subnet: Holds resources that should not be directly accessible from the internet, such as databases with sensitive information. Purpose: o Public Subnet: Allows external users to interact with your resources, like a storefront. o Private Subnet: Keeps sensitive resources protected, accessible only through other resources or services, like a back office. Network Traffic in a VPC Packets: Units of data sent over the network. Flow: Packets enter the VPC through an internet gateway and are checked for permissions before reaching a subnet. Network Access Control Lists (ACLs) Definition: A virtual firewall that controls traffic to and from subnets. Function: o Checks Permissions: Determines whether to allow or block traffic based on predefined rules. o Analogy: Like passport control at an airport, where travelers (packets) are checked for approval to enter or exit. Default vs. Custom: o Default ACL: Allows all traffic by default but can be modified. o Custom ACL: Denies all traffic by default until rules are added to allow specific traffic. Stateless Filtering: o Definition: ACLs do not remember past traffic. Each packet is checked independently. Security Groups Definition: A virtual firewall that controls inbound and outbound traffic for Amazon EC2 instances. Function: o Checks Permissions: Determines whether traffic should be allowed based on rules. o Analogy: Like a door attendant who checks guests (packets) at the door, allowing them to enter but not checking again when they leave. Default Behavior: o Inbound Traffic: Denied by default; rules must be set to allow specific traffic. o Outbound Traffic: Allowed by default; rules must be set to block specific traffic. Stateful Filtering: o Definition: Security groups remember previous decisions. If you send a request, the response is automatically allowed if it matches the previous request. Summary of VPC Components Private Subnet: Isolates sensitive resources like databases. Virtual Private Gateway: Connects a VPC to a private network (e.g., corporate data center) via a VPN. Public Subnet: Hosts resources like a customer-facing website. AWS Direct Connect: Provides a dedicated private connection between your data center and AWS, bypassing the public internet. By understanding and using subnets, network ACLs, and security groups, you can better manage and secure your AWS resources. Global Networking Domain Name System (DNS) Purpose: DNS is like the internet's phone book. It translates easy-to-remember domain names (like www.example.com) into IP addresses (like 192.0.2.0) that computers use to locate each other. How It Works: 1. User Request: You enter a website address into your browser. 2. DNS Resolver: Your browser sends this request to a DNS resolver, which is like a middleman. 3. DNS Server Query: The DNS resolver asks a DNS server for the IP address associated with the domain name. 4. DNS Server Response: The DNS server responds with the IP address. 5. Access Website: Your browser uses this IP address to access the website. Amazon Route 53 Purpose: Amazon Route 53 is a DNS web service provided by AWS that helps direct users to the right internet resources. Key Features: o DNS Management: Handles the translation of domain names to IP addresses for websites and applications. o Domain Registration: You can register new domain names or transfer existing ones to Route 53. o Routing: Directs user requests to AWS resources (like EC2 instances or load balancers) or to resources outside AWS. How Amazon Route 53 and Amazon CloudFront Work Together 1. Customer Request: o A customer visits AnyCompany's website. 2. DNS Resolution: o Amazon Route 53 resolves the domain name (like www.anycompany.com) to an IP address (like 192.0.2.0). o This IP address is sent back to the customer’s browser. 3. Content Delivery: o The customer’s request is sent to the nearest edge location via Amazon CloudFront. Edge locations are distributed servers that cache content to improve access speed. 4. Connecting to Resources: o Amazon CloudFront forwards the request to an Application Load Balancer. o The Load Balancer directs the request to one of the Amazon EC2 instances running the application. In summary, DNS helps translate website names into IP addresses, Amazon Route 53 manages these translations and domain registrations, and Amazon CloudFront speeds up content delivery by caching it at locations closer to users. MODULE 5: STORAGE AND DATABASES Instance Stores vs. Amazon Elastic Block Store (Amazon EBS) Instance Stores Definition: Temporary block-level storage physically attached to an EC2 instance. Characteristics: o Temporary: Data is lost when the instance is stopped or terminated. o Lifespan: Tied to the lifespan of the EC2 instance. When the instance stops or is terminated, the data disappears. Example: o Step 1: An EC2 instance is running with an instance store attached. o Step 2: The instance is stopped or terminated. o Step 3: All data on the instance store is deleted. Amazon Elastic Block Store (Amazon EBS) Definition: Persistent block-level storage that can be used with EC2 instances. Characteristics: o Persistent: Data remains even if the EC2 instance is stopped or terminated. o Configuration: You can define the size, type, and performance of the EBS volume when creating it. o Attachment: Once created, you can attach an EBS volume to an EC2 instance. o Backup: Important to back up data on EBS volumes. This can be done using EBS snapshots. Amazon EBS Snapshots Definition: Incremental backups of EBS volumes. How It Works: o Initial Snapshot: Captures all the data on the EBS volume at that time. o Subsequent Snapshots: Only save the data blocks that have changed since the last snapshot, making it efficient in terms of storage and time. Advantages: o Efficient: Saves only the changes made since the last snapshot, not the entire volume. o Cost-Effective: Reduces storage costs compared to full backups since only incremental changes are stored. Summary Instance Stores: Provide temporary storage tied to the lifespan of an EC2 instance. Data is lost if the instance stops or is terminated. Amazon EBS: Offers persistent storage that survives instance stops or terminations. Data needs to be backed up with EBS snapshots. EBS Snapshots: Incremental backups that capture only the changes since the last snapshot, making backups efficient and cost-effective. Amazon Simple Storage Service (Amazon S3) Overview Definition: Amazon S3 is a service for storing files as objects in a bucket. Object Structure: Each object consists of: o Data: The actual file (e.g., image, video, text). o Metadata: Information about the data (e.g., file size, type). o Key: A unique identifier for the object. Storage: o Capacity: Unlimited storage space. o Maximum File Size: 5 TB per object. Features: o Permissions: Control who can access or view files. o Versioning: Track changes and keep multiple versions of objects. Amazon S3 Storage Classes Purpose: Choose a storage class based on how often you access your data and the level of availability needed. You pay only for what you use. 1. S3 Standard o Use Case: Frequently accessed data (e.g., websites, data analytics). o Availability: Stores data across at least three Availability Zones. o Cost: Higher cost, but provides high availability. 2. S3 Standard-Infrequent Access (S3 Standard-IA) o Use Case: Infrequently accessed data but needs high availability when accessed (e.g., backups). o Availability: Stores data across at least three Availability Zones. o Cost: Lower storage price, higher retrieval price compared to S3 Standard. 3. S3 One Zone-Infrequent Access (S3 One Zone-IA) o Use Case: Infrequently accessed data with lower storage costs, and where data can be easily recreated if lost (e.g., secondary backups). o Availability: Stores data in a single Availability Zone. o Cost: Lower storage cost than S3 Standard-IA. 4. S3 Intelligent-Tiering o Use Case: Data with unpredictable or changing access patterns.  o Function: Automatically moves data between frequent and infrequent access tiers based on usage. o Cost: Small monthly monitoring and automation fee per object. 5. S3 Glacier Instant Retrieval o Use Case: Archived data that needs to be accessed quickly. o Access Time: Retrieval within milliseconds, similar performance to S3 Standard. 6. S3 Glacier Flexible Retrieval o Use Case: Long-term data archiving where retrieval time is flexible. o Access Time: Retrieve data within minutes to hours. o Cost: Lower cost for storage compared to S3 Standard-IA and S3 Glacier Instant Retrieval. 7. S3 Glacier Deep Archive o Use Case: Long-term storage for data that is rarely accessed (e.g., regulatory archives). o Access Time: Retrieve data within 12 to 48 hours. o Cost: Lowest-cost storage class. 8. S3 Outposts o Use Case: Object storage on AWS Outposts for on-premises applications. o Function: Provides local data residency with durability and redundancy. o Benefit: Keeps data close to on-premises applications for performance needs. Summary Amazon S3 is ideal for storing and managing large amounts of data with flexibility in how data is accessed and stored. Storage Classes: Offer different levels of access frequency, cost, and retrieval times to suit various needs. Features: Include versioning, permissions, and integration with other AWS services for enhanced data management. Amazon Elastic File System (Amazon EFS) Overview Definition: Amazon EFS is a scalable file storage service that can be used with AWS Cloud services and on-premises resources. Characteristics: o Scalable: Automatically grows and shrinks as you add or remove files. o Capacity: Scales to petabytes of data without disrupting applications. o Shared Access: Multiple clients can access the same data concurrently. File Storage Basics File Storage: o Definition: Allows multiple clients (users, applications, servers) to access shared data through file paths.  o Use Case: Ideal for situations where many services or resources need to access the same data simultaneously. Comparison with Amazon EBS 1. Amazon EBS (Elastic Block Store) o Scope: ▪ Single Availability Zone: An EBS volume is located within one Availability Zone. ▪ Attachment: To use an EBS volume, both the Amazon EC2 instance and the EBS volume must be in the same Availability Zone. o Use Case: Suitable for single-instance applications where data needs to be stored locally to that instance. o Features: ▪ Persistent: Data remains available when the EC2 instance is stopped. ▪ Volume Size: Typically attached to individual EC2 instances. 2. Amazon EFS o Scope: ▪ Regional Service: Data is stored across multiple Availability Zones in a region. ▪ Access: Allows multiple instances and on-premises servers to access the same data concurrently across all Availability Zones. o Use Case: Ideal for applications that require shared access to files from multiple instances or locations. o Features: ▪ Scalable: Automatically adjusts to growing data needs. ▪ Concurrent Access: Supports simultaneous access from multiple clients. ▪ Integration: Can be accessed by on-premises servers using AWS Direct Connect. Summary Amazon EFS provides scalable, shared file storage that grows and shrinks automatically and can be accessed by multiple clients simultaneously across different Availability Zones. Amazon EBS offers block storage tied to a specific Availability Zone, suitable for applications needing local, persistent storage attached to individual EC2 instances. Amazon Relational Database Service (Amazon) Relational Databases Definition: A relational database stores data in a structured way where data is related to other data. Example: A coffee shop's inventory system where each record includes details like product name, size, and price. Data Querying: Uses Structured Query Language (SQL) to manage and retrieve data.  o Example Query: Find all customers whose most frequently purchased drink is a medium latte. ID Product Name Size Price 1 Medium roast ground coffee 12 oz $5.30 2 Dark roast ground coffee 20 oz $9.27 Amazon Relational Database Service (Amazon RDS) Definition: Amazon RDS is a managed service that allows you to run relational databases in the AWS Cloud. Features: o Managed Service: Automates tasks such as: ▪ Hardware provisioning ▪ Database setup ▪ Patching ▪ Backups o Integration: Works with other AWS services like AWS Lambda to enhance your applications. o Security Options: ▪ Encryption at Rest: Protects data while stored. ▪ Encryption in Transit: Protects data while being transmitted. Amazon RDS Database Engines Amazon RDS supports various database engines, each optimized for different needs: 1. Amazon Aurora o Description: Enterprise-class relational database. o Compatibility: Works with MySQL and PostgreSQL databases. o Performance: ▪ Up to 5 times faster than standard MySQL. ▪ Up to 3 times faster than standard PostgreSQL. o Features: ▪ Reduces database costs by minimizing unnecessary input/output (I/O) operations. ▪ Replicates data across 3 Availability Zones (6 copies). ▪ Continuously backs up data to Amazon S3. o Use Case: Ideal for high availability and performance needs. 2. PostgreSQL o Description: Open-source relational database known for its advanced features. o Use Case: Good for applications needing complex queries and data integrity. 3. MySQL o Description: Popular open-source relational database. o Use Case: Suitable for various applications including web-based and small to medium-sized business applications  4. MariaDB o Description: Fork of MySQL with additional features and performance improvements. o Use Case: Compatible with MySQL applications but offers more advanced features. 5. Oracle Database o Description: Enterprise-grade database with advanced security and performance features. o Use Case: Suitable for large-scale enterprise applications requiring complex transactions and high security. 6. Microsoft SQL Server o Description: Microsoft’s relational database management system. o Use Case: Ideal for applications running on Windows and integrating with Microsoft products. Summary Amazon RDS simplifies managing relational databases by automating administrative tasks. Amazon Aurora offers high performance and availability, making it a strong choice for demanding applications. Other RDS Engines include PostgreSQL, MySQL, MariaDB, Oracle Database, and Microsoft SQL Server, each serving different needs based on performance, compatibility, and features. Amazon DynamoDB Nonrelational Databases Definition: Nonrelational databases, also known as NoSQL databases, organize data in ways other than traditional rows and columns. Structure: o Tables: Store and query data. o Key-Value Pairs: Data is organized into items (keys) with attributes (values). o Attributes: Different features or pieces of information about the data. Flexibility: o Add/Remove Attributes: You can change attributes for items at any time. o Varied Attributes: Not all items need to have the same attributes. Key Value Name: John Doe 1 Address: 123 Any Street Favorite drink: Medium latte Name: Mary Major Address: 100 Main Street 2 Birthday: July 5, 1994 Amazon DynamoDB Definition: Amazon DynamoDB is a key-value and document database service designed for high performance and scalability. Features: o Serverless: ▪ No Server Management: You don’t need to provision, patch, or manage servers. ▪ No Software Maintenance: No need to install, maintain, or operate software. ▪ Benefit: Simplifies database management and reduces overhead. o Automatic Scaling: ▪ Adjusts Capacity: DynamoDB automatically scales up or down based on the size of your database and the amount of traffic it handles. ▪ Consistent Performance: Maintains performance even as database size or traffic changes. ▪ Benefit: Ideal for applications needing high performance and scalability without manual intervention. Summary Nonrelational Databases: Store data in flexible, non-tabular formats like key-value pairs. Amazon DynamoDB: A key-value and document database service that offers: o Serverless Operation: No need to manage servers or software. o Automatic Scaling: Adjusts to changes in database size and traffic while maintaining performance. Amazon RedShift Definition: Amazon Redshift is a data warehousing service designed for big data analytics. It helps you gather and analyze large volumes of data. Key Features: o Data Warehousing: ▪ Purpose: Centralizes data from various sources into one location for easier analysis. ▪ Data Collection: Collects and stores data from different systems and applications. o Big Data Analytics: ▪ Analyze Large Datasets: Allows you to run complex queries on massive amounts of data. ▪ Trends and Relationships: Helps in understanding patterns and relationships within the data. o Scalability: ▪ Handles Large Data Volumes: Designed to scale with increasing data sizes and workloads. ▪ Performance Optimization: Uses techniques like parallel processing and columnar storage to speed up data retrieval and analysis.  o Integration: ▪ Multiple Data Sources: Can integrate with various data sources and data lakes. ▪ Business Intelligence Tools: Works with tools that visualize and analyze data, such as dashboards and reporting tools. o Management: ▪ Easy to Manage: Provides tools for easy management, maintenance, and scaling. ▪ Automated Backups: Includes automatic backups and data recovery options to ensure data safety. Summary Amazon Redshift: A powerful data warehousing solution for big data analytics. o Centralizes Data: Collects data from various sources into one system. o Analyzes Large Data Volumes: Performs complex queries to uncover trends and insights. o Scalable and Integrated: Grows with your data needs and integrates with other tools for comprehensive analysis. AWS Database Migration Service (AWS DMS) Definition: AWS DMS is a service that helps you move data between databases. It supports various types of databases, including relational and non-relational ones. Key Features: o Data Migration: ▪ Source and Target Databases: You can migrate data from one database to another, even if they are different types. For example, from a MySQL database to an Amazon Aurora database. ▪ Minimized Downtime: The source database remains operational during migration, so applications that use the database do not experience downtime. o Use Cases: ▪ Development and Test Database Migrations: ▪ Purpose: Allows developers to use real data for testing applications. ▪ Benefit: Tests can be performed without affecting the live production environment. ▪ Database Consolidation: ▪ Purpose: Combines multiple databases into a single, unified database. ▪ Benefit: Simplifies management and reduces costs by having fewer databases to maintain. ▪ Continuous Replication: ▪ Purpose: Continuously copies data to other databases or storage locations. ▪ Benefit: Keeps data synchronized in real-time, ideal for backup or data redundancy. Summary AWS DMS: A service for migrating and synchronizing data between databases. o Moves Data: Transfers data from source to target databases with minimal downtime. o Supports Multiple Uses: Ideal for development testing, database consolidation, and continuous data replication. Additional Database Services Here’s a simple and detailed overview of additional AWS database services: 1. Amazon DocumentDB What It Is: A document database service. Supports: MongoDB workloads (MongoDB is a popular document database). Use Case: Ideal for applications that need to store and query JSON-like documents. 2. Amazon Neptune What It Is: A graph database service. Use Case: Suitable for applications that work with highly connected data, such as: o Recommendation Engines: Suggest products based on user behavior. o Fraud Detection: Identify suspicious patterns in financial transactions. o Knowledge Graphs: Manage and visualize complex relationships in data. 3. Amazon Quantum Ledger Database (Amazon QLDB) What It Is: A ledger database service. Use Case: Allows you to: o Review Data Changes: View a complete history of all changes made to application data. o Ideal For: Use cases that require an immutable, transparent record of changes. 4. Amazon Managed Blockchain What It Is: A service to create and manage blockchain networks. Blockchain Frameworks: Supports popular open-source frameworks. Use Case: Ideal for: o Distributed Ledger Systems: Multiple parties can transact and share data without a central authority. 5. Amazon ElastiCache What It Is: A caching service to speed up database read times. Supports: Two data stores: o Redis: A popular in-memory data structure store.  o Memcached: A high-performance, distributed memory caching system. Use Case: Enhances the performance of databases by storing frequently accessed data in memory. 6. Amazon DynamoDB Accelerator (DAX) What It Is: An in-memory cache for DynamoDB. Use Case: Improves response times for DynamoDB queries from single-digit milliseconds to microseconds. Summary Amazon DocumentDB: Manages MongoDB workloads for document-based storage. Amazon Neptune: Handles graph-based data for complex relationships. Amazon QLDB: Provides a complete and immutable history of changes. Amazon Managed Blockchain: Manages blockchain networks for decentralized data sharing. Amazon ElastiCache: Speeds up database queries using in-memory caching. Amazon DAX: Enhances DynamoDB performance with an in-memory cache. MODULE 6: SECURITY AWS Shared Responsibility Model The AWS Shared Responsibility Model outlines who is responsible for what when it comes to security in the AWS Cloud. Here’s a simple breakdown: Customer Responsibilities: Security in the Cloud You control your content: You decide what data to store on AWS, which services to use, and who can access your data. Security management: You manage things like: o Access control: Decide who has access to your data and services. o Operating systems: Choose, configure, and update the operating systems on Amazon EC2 instances. o Security settings: Set up security groups, manage user accounts, and handle other security configurations. Responsibility varies: The specific security steps depend on what AWS services you use and your company’s needs. AWS Responsibilities: Security of the Cloud Infrastructure control: AWS manages and secures the physical and virtual infrastructure, including: o Physical security: Protecting the data centers where AWS services run. o Hardware and software: Securing the physical servers and the software that operates them.  o Network security: Ensuring the network infrastructure is secure. o Virtualization: Managing the virtualization technology that allows multiple virtual servers to run on physical hardware. Global infrastructure: AWS protects the entire network of data centers and services, including AWS Regions, Availability Zones, and edge locations. Third-party audits: AWS gets reports from independent auditors to prove their security practices meet industry standards and regulations. In summary: You: Secure your data, manage access, and configure your services. AWS: Secures the physical data centers, hardware, network, and virtualization. User Permissions and Access in AWS Here’s a simple and detailed explanation of how AWS Identity and Access Management (IAM) works: AWS Identity and Access Management (IAM) Overview IAM helps you control who can access your AWS resources and what they can do with them. Features include managing IAM users, groups, roles, policies, and using multi-factor authentication (MFA). AWS Account Root User Root User: The initial account holder with full access to all AWS resources. Best Practice: o Use the root user only for account setup tasks (like creating IAM users). o For regular tasks, create IAM users and use them instead of the root user. IAM Users IAM User: Represents a person or application with its own name and credentials. Default Access: No permissions initially. Best Practice: o Create individual IAM users for each person needing access. o This improves security by giving each user their own unique credentials. IAM Policies IAM Policy: A document that specifies what actions are allowed or denied for IAM users. Example: You can create a policy that allows access to a specific Amazon S3 bucket but not others. Best Practice: o Follow the principle of least privilege—only give the minimum permissions needed.  o Example: If a user needs access to one S3 bucket, only allow access to that bucket. IAM Groups IAM Group: A collection of IAM users. You assign policies to the group, and all users in the group get those permissions. Example: o Create a “Cashiers” group with permissions for cash register tasks. o Add users to this group to give them the necessary access. Best Practice: o Use groups to manage permissions efficiently. o If an employee’s role changes, move them to a different group with appropriate permissions. IAM Roles IAM Role: A temporary identity that can be assumed to gain specific permissions. Example: o An employee switches between tasks (like cashier and inventory). They assume different roles to get the required access. Best Practice: o Use IAM roles for temporary or conditional access needs. o Users switch roles as needed, and permissions are applied based on the role they assume. Multi-Factor Authentication (MFA) MFA: Adds an extra layer of security by requiring something more than just a password. Example: o After entering your password, you also need to provide a code from a device (like a phone app or hardware token). Steps: 1. Sign In: Enter your IAM user ID and password. 2. MFA Code: Enter the code from your MFA device. By following these practices and understanding IAM features, you can manage access to your AWS resources more securely and effectively. AWS Organizations Overview AWS Organizations helps manage multiple AWS accounts from one central place. Here's a simple and detailed breakdown: What is AWS Organizations? Purpose: Consolidate and manage multiple AWS accounts. Root: The main container for all accounts in your organization. Service Control Policies (SCPs) SCPs: Control what services and actions can be accessed in each account. Function: Place restrictions on AWS services and individual actions. Organizational Units (OUs) OUs: Group accounts with similar needs (e.g., business or security). Policy Inheritance: Accounts in an OU automatically follow the OU's policies. Isolation: Separate accounts into OUs to manage specific requirements (e.g., regulatory compliance). Example of Using AWS Organizations Here’s how a company might use AWS Organizations: 1. Create the Organization o Scenario: Your company has separate AWS accounts for finance, IT, HR, and legal departments. o Action: Consolidate these accounts into one organization with a root. 2. Manage Accounts Separately o Finance and IT Accounts: ▪ Action: Keep these accounts separate because they have unique requirements. ▪ Benefit: Consolidated billing but no specific OU policies applied. 3. Group Accounts in OUs o HR and Legal Accounts: ▪ Action: Place these into one OU. ▪ Benefit: Apply common policies to both departments easily. Summary: AWS Organizations helps you manage multiple accounts centrally. SCPs control what can be accessed in each account. OUs group accounts for easier policy management. Example: Group HR and legal accounts together for shared policies, while keeping finance and IT separate. AWS Compliance Overview AWS Artifact and the Customer Compliance Center help manage and understand AWS compliance and security. AWS Artifact AWS Artifact provides access to compliance reports and agreements related to AWS services.  1. AWS Artifact Agreements o Purpose: Manage agreements with AWS, such as those needed for specific regulations. o What You Can Do: ▪ Review and Accept Agreements: For your individual account or all accounts in AWS Organizations. ▪ Types of Agreements: Include those for regulations like HIPAA (Health Insurance Portability and Accountability Act). 2. AWS Artifact Reports o Purpose: Access compliance reports from third-party auditors about AWS’s adherence to security standards. o What You Can Find: ▪ Reports Include: AWS ISO certifications, PCI (Payment Card Industry) reports, and SOC (Service Organization Control) reports. ▪ Use: Provide these reports to auditors or regulators as proof of AWS's security controls. Benefits: Stay Updated: Access the latest compliance reports. Verify Compliance: See how AWS meets various global and industry-specific standards. Customer Compliance Center Customer Compliance Center offers resources to help you understand and manage compliance with AWS. 1. Resources Available: o Customer Compliance Stories: Learn how companies in regulated industries handle compliance challenges. o Compliance Whitepapers and Documentation: Topics include: ▪ Answers to key compliance questions. ▪ Overview of AWS risk and compliance. ▪ Auditing security checklist. o Auditor Learning Path: Designed for auditors, compliance, and legal roles to understand how to use AWS Cloud for demonstrating compliance. Benefits: Learn from Others: Discover solutions from other companies. Gain Insights: Access detailed compliance guides and checklists. Training for Auditors: Get specialized training to manage compliance tasks. Summary:  AWS Artifact: Access agreements and compliance reports for AWS services. Customer Compliance Center: Find stories, guides, and training to manage and understand AWS compliance better. Denial-of-Service Attacks and AWS Shield Denial-of-Service (DoS) Attacks and Distributed Denial-of-Service (DDoS) Attacks can disrupt websites and applications. Here's a simple explanation: Denial-of-Service (DoS) Attacks What It Is: An attack designed to make a website or application unavailable to users. How It Works: o An attacker floods the target with excessive traffic or requests. o This overloads the website or application, making it unable to handle legitimate requests. Example: A prankster repeatedly calls a coffee shop to place orders but never picks up, blocking the cashier from helping real customers. Distributed Denial-of-Service (DDoS) Attacks What It Is: A more complex type of DoS attack using multiple sources. How It Works: o Multiple attackers or a single attacker with many infected computers (bots) flood the target with requests. o This makes it harder to block the attack and can overwhelm the target more effectively. Example: A prankster and friends repeatedly call the coffee shop from different phone numbers, making it hard to block all calls. AWS Shield AWS Shield is a service that helps protect against DoS and DDoS attacks. AWS Shield Standard Protection Level: Free for all AWS customers. How It Works: o Automatically protects AWS resources from common DDoS attacks. o Uses real-time analysis to detect and mitigate malicious traffic. Benefits: o Basic protection against frequent types of attacks. o No additional cost. AWS Shield Advanced Protection Level: Paid service with advanced features.  How It Works: o Provides detailed attack diagnostics and protection against more sophisticated attacks. o Integrates with services like Amazon CloudFront, Amazon Route 53, and Elastic Load Balancing. o Can be used with AWS WAF (Web Application Firewall) to create custom rules for complex attacks. Benefits: o Enhanced protection and detailed insights. o Helps with managing and mitigating more advanced DDoS attacks. Summary: DoS Attacks: Overload a website/application to make it unavailable. DDoS Attacks: Use multiple sources to increase the attack's impact. AWS Shield: Protects against these attacks with Standard (free) and Advanced (paid) levels of service. Additional Security Services in AWS Here’s a simple explanation of key AWS security services that help protect your data and applications: AWS Key Management Service (AWS KMS) What It Is: A service for managing and using cryptographic keys to secure your data. How It Works: o Encryption at Rest: Protects data when it’s stored. o Encryption in Transit: Protects data while it’s being transmitted. o Key Management: Create, manage, and control access to keys used for encrypting and decrypting data. Features: o Access Control: Specify who can manage or use the keys. o Control Keys: Temporarily disable keys or delete them if needed. o Secure Storage: Keys never leave AWS KMS. AWS WAF (Web Application Firewall) What It Is: A firewall that monitors and filters web traffic to your applications. How It Works: o Integration: Works with Amazon CloudFront and Application Load Balancer. o Web ACL: Uses rules to allow or block traffic based on criteria like IP addresses. Example: o Allow Requests: Configure rules to let legitimate traffic through while blocking malicious requests. o Deny Requests: Block requests from specific IP addresses known to be malicious. Amazon Inspector What It Is: A tool for automated security assessments of your applications. How It Works: o Automated Assessments: Checks for vulnerabilities and security best practices in your application. o Findings: Provides a list of security issues, prioritized by severity, with descriptions and recommendations. Features: o Security Best Practices: Identifies issues like open access or outdated software. o Recommendations: Offers steps to fix security problems, though it doesn’t guarantee complete resolution. Amazon GuardDuty What It Is: A service for threat detection and monitoring of your AWS environment. How It Works: o Enable: Turn on GuardDuty for your AWS account. o Monitoring: Continuously monitors network and account activity. o Analysis: Analyzes data from sources like VPC Flow Logs and DNS logs. o Findings: Provides detailed findings about potential threats. Features: o Automated Detection: Identifies and alerts you about suspicious activity. o Remediation: Review findings and optionally configure AWS Lambda to automatically respond to threats. Summary: AWS KMS: Manages encryption keys for securing data at rest and in transit. AWS WAF: Protects web applications by filtering and controlling incoming traffic. Amazon Inspector: Automates security assessments to identify vulnerabilities in applications. Amazon GuardDuty: Detects threats by monitoring and analyzing AWS environment activity. MODULE 7: MONITORING AND ANALYTICS Amazon CloudWatch Amazon CloudWatch is a service that helps you monitor and manage your AWS resources by tracking metrics and setting alarms. Key Features of Amazon CloudWatch: 1. Metrics o What It Is: Data points that represent the performance and health of your AWS resources.  oHow It Works: AWS services automatically send these metrics to CloudWatch. oUsage: CloudWatch uses metrics to create graphs showing how your resources' performance changes over time. 2. CloudWatch Alarms o What It Is: Notifications or actions triggered based on specific conditions related to your metrics. o How It Works: You set thresholds for metrics. When these thresholds are crossed (e.g., CPU usage too high or too low), CloudWatch performs predefined actions. o Example: ▪ Scenario: Developers leave Amazon EC2 instances running, leading to extra charges. ▪ Solution: Set up an alarm to automatically stop EC2 instances if CPU usage remains below a certain level for a set time. You can also receive notifications when this happens. 3. CloudWatch Dashboard o What It Is: A customizable interface where you can view all your metrics in one place. o How It Works: Provides an overview of various metrics like CPU utilization, request counts, and more from different AWS resources. o Usage: ▪ Example: Monitor CPU usage for EC2 instances, request counts for S3 buckets, and more, all from a single dashboard. ▪ Customization: Create different dashboards for various purposes, like tracking application performance or business metrics. Summary: CloudWatch Metrics: Track and visualize data about your AWS resources. CloudWatch Alarms: Set triggers and actions based on metric thresholds to automate responses and notifications. CloudWatch Dashboard: A single place to view and customize metrics from different AWS resources. AWS CloudTrail AWS CloudTrail is a service that records and monitors API calls made within your AWS account. It helps you track who did what, when, and from where. Key Features of AWS CloudTrail: 1. Record API Calls o What It Does: Logs API calls made to AWS services. o What It Records: Details include the API caller’s identity, the time of the call, the source IP address, and more. o Analogy: Think of CloudTrail like a trail of breadcrumbs or a detailed log of actions taken. 2. Event History o What It Shows: A complete history of user activity and API calls.  oUpdate Frequency: Events are typically updated within 15 minutes of an API call. oHow to Use: ▪ Filtering: You can filter events by time, date, user, or resource type. ▪ Example: ▪ Scenario: Coffee shop owner sees a new IAM user named Mary but wants to know more details. ▪ Solution: The owner uses CloudTrail to filter and find that on January 1, 2020, at 9:00 AM, IAM user John created Mary through the AWS Management Console. 3. CloudTrail Insights o What It Does: Automatically detects unusual API activities. o Example: ▪ Scenario: CloudTrail Insights detects an unusually high number of Amazon EC2 instances being launched. ▪ Action: You can review the event details to understand and address the unusual activity. Summary: CloudTrail Records: Keeps a log of all API calls, including who made them and when. Event History: Provides detailed logs that can be filtered by various criteria to track user actions. CloudTrail Insights: Detects and alerts on unusual activity patterns in your AWS account AWS Trusted Advisor AWS Trusted Advisor is a service that helps you optimize and improve your AWS environment by providing recommendations based on AWS best practices. Key Features of AWS Trusted Advisor: 1. Real-Time Recommendations o What It Does: Inspects your AWS environment and provides recommendations. o Categories Covered: ▪ Cost Optimization: Suggestions to reduce costs. ▪ Performance: Tips to improve performance. ▪ Security: Advice to enhance security. ▪ Fault Tolerance: Recommendations to improve reliability. ▪ Service Limits: Alerts when you’re close to service limits. 2. Dashboard Overview o Accessing: You can view Trusted Advisor recommendations on the AWS Management Console. o Indicators on Dashboard: ▪ Green Check: No problems detected. ▪ Orange Triangle: Recommended investigations needed. ▪ Red Circle: Recommended actions required.  3. Benefits of Using Trusted Advisor o Creation and Development: Helps during the creation of new workflows and development of new applications. o Ongoing Improvements: Assists in making ongoing improvements to existing applications and resources. Summary: Trusted Advisor: Provides real-time advice based on AWS best practices. Categories: Offers recommendations for cost, performance, security, fault tolerance, and service limits. Dashboard Indicators: Use green, orange, and red signals to guide actions and investigations. MODULE 8: PRICING AND SUPPORT AWS Free Tier AWS Free Tier lets you use certain AWS services without paying for a limited time or under certain conditions. Types of Free Tier Offers: 1. Always Free o What It Is: Offers that never expire and are available to all AWS customers. o Examples: ▪ AWS Lambda: 1 million free requests and up to 3.2 million seconds of compute time per month. ▪ Amazon DynamoDB: 25 GB of free storage per month. 2. 12 Months Free o What It Is: Offers that are free for the first 12 months after you sign up for AWS. o Examples: ▪ Amazon S3: Specific amount of free storage each month. ▪ Amazon EC2: Certain number of free compute hours each month. ▪ Amazon CloudFront: Amount of free data transfer out each month. 3. Trials o What It Is: Short-term free trials that start when you activate a particular service. The duration can vary. o Examples: ▪ Amazon Inspector: 90-day free trial. ▪ Amazon Lightsail: 750 free hours of usage over a 30-day period. Summary: Always Free: Ongoing, never expires; available to everyone. 12 Months Free: Free for the first 12 months after signing up. Trials: Short-term free trials with varying durations and usage limits. AWS Pricing Concepts AWS pricing operates on a pay-as-you-go model, but there are different ways to save money and manage costs effectively. Here’s a breakdown of how AWS pricing works: 1. Pay for What You Use Description: You only pay for the resources you actually use. There are no long-term contracts or complex licensing fees. Example: If you use 100 GB of storage in Amazon S3, you only pay for 100 GB, not for any additional storage or services you didn’t use. 2. Pay Less When You Reserve Description: Some AWS services offer discounts if you commit to using them for a longer term (like 1 year or 3 years) instead of using them on a pay-as-you-go basis. Example: If you use Amazon EC2 instances, you can save up to 72% by using EC2 Instance Savings Plans compared to the On-Demand pricing. 3. Pay Less with Volume-Based Discounts Description: The more you use a service, the lower the cost per unit might be. AWS offers tiered pricing for some services. Example: With Amazon S3, the more storage you use, the cheaper each GB becomes. AWS Pricing Calculator Description: A tool that helps you estimate the cost of using AWS services. You can enter details about your usage to get a cost estimate. Features: o Custom Estimates: Enter specifics like operating system, memory needs, and I/O requirements. o Comparison: Compare costs across different AWS Regions and instance types. o Share Estimates: Save and generate a link to share your cost estimates with others. AWS Pricing Examples 1. AWS Lambda Pricing: You are charged based on the number of requests and the time your functions take to run. Free Tier: 1 million free requests and up to 3.2 million seconds of compute time per month. Savings: Compute Savings Plans offer lower costs for committing to consistent usage over 1 or 3 years.  Example: If your Lambda usage in a month is within the free tier limits, you won’t pay anything for that month. 2. Amazon EC2 Pricing: You pay for the compute time while your instances are running. Savings: Use Spot Instances for up to 90% cost savings for interruptible workloads, or use Savings Plans and Reserved Instances for lower costs. Example: If your EC2 usage is within the free tier limits or you use Spot Instances, you might not have to pay for your EC2 usage in a given month. 3. Amazon S3 Pricing Components: o Storage: Pay for the amount of data stored and its duration. o Requests and Retrievals: Pay for requests made to your objects (e.g., adding or retrieving data). o Data Transfer: Costs apply for transferring data into and out of S3 (with some exceptions like transfers within the same AWS Region). o Management and Replication: Costs for features like inventory, analytics, and object tagging. Example: If your S3 usage (storage, requests, etc.) is under the free tier limits, you won’t incur charges for that month. Summary: AWS Pricing Models: Pay-as-you-go, reserved pricing for savings, and volume-based discounts. Tools: AWS Pricing Calculator helps estimate costs based on usage. Examples: AWS Lambda, Amazon EC2, and Amazon S3 have specific pricing structures and potential savings based on usage patterns. AWS Billing & Cost Management Dashboard The AWS Billing & Cost Management dashboard helps you manage and control your AWS expenses. Here’s a detailed look at what you can do with it: 1. Pay Your AWS Bill Description: You can pay your AWS bill directly through the dashboard. Details: This includes reviewing charges and making payments for the current billing period. 2. Monitor Your Usage Description: Track how much AWS resources you're using. Details: View current usage details to understand how your resources are being utilized. 3. Analyze and Control Your Costs Description: Get insights into your spending and manage your costs. Details: o Compare Current vs. Previous Month: See how your spending this month compares to last month. o Forecasting: Get an estimate of what your costs might be for the next month based on current usage patterns. 4. View Month-to-Date Spend by Service Description: See how much you’ve spent on each AWS service so far this month. Details: Break down your spending by individual services like EC2, S3, etc. 5. View Free Tier Usage by Service Description: Track how much of the Free Tier you’re using. Details: See which services you’re using within the Free Tier limits and how much you’ve used up. 6. Access Cost Explorer and Create Budgets Description: Use tools to explore and manage your costs. Details: o Cost Explorer: Analyze your spending patterns with detailed graphs and reports. o Budgets: Set up budgets to monitor and control your spending. Receive alerts if you approach or exceed your budget. 7. Purchase and Manage Savings Plans Description: Buy and manage Savings Plans to save on long-term AWS usage. Details: View and manage your Savings Plans to get discounts on specific AWS services. 8. Publish AWS Cost and Usage Reports Description: Generate detailed reports about your AWS costs and usage. Details: Publish reports that provide insights into your spending and resource usage, which can be shared with stakeholders or used for deeper analysis. Summary: Pay Bills: Direct payment options for your AWS usage. Monitor & Analyze: Track and compare spending, and forecast future costs. Breakdown & Track: View spending by service and track Free Tier usage. Tools: Use Cost Explorer and set budgets to manage costs. Savings & Reports: Purchase Savings Plans for discounts and generate detailed cost reports. Consolidated Billing with AWS Organizations Consolidated billing helps you manage multiple AWS accounts under one central billing account, making it easier to track and pay for all AWS services. Here’s a breakdown: 1. Overview of Consolidated Billing Single Bill: You receive one monthly bill for all accounts in your organization. Transparency: You can see detailed charges for each individual account on this single bill. Shared Discounts: Bulk discounts, Savings Plans, and Reserved Instances can be shared across all accounts in your organization. 2. Benefits of Consolidated Billing Simplified Management: Track combined costs and get a unified view of all accounts. Cost Savings: Aggregated usage might help you qualify for volume pricing discounts or other savings that a single account alone might not reach. 3. Steps for Using Consolidated Billing Step 1: Setting Up Consolidated Billing Scenario: Your company has three separate AWS accounts for different departments. o Account 1: $19.64 o Account 2: $19.96 o Account 3: $20.06 Action: You create an AWS Organization and add these three accounts. Management: You manage these accounts from a primary account. Step 2: Receiving the Consolidated Bill Billing Process: AWS charges the primary account for all linked accounts. o The primary account also incurs its own charges (e.g., $14.14). Total Bill: The total amount billed is $73.80, combining all accounts' charges. Step 3: Sharing Discounts Across Accounts Volume Pricing Example: o Amazon S3 Data Transfer: Discounts are available for higher data usage. o Data Transferred: ▪ Account 1: 2 TB ▪ Account 2: 5 TB ▪ Account 3: 7 TB o Threshold: To get a lower per-GB price, you need to transfer more than 10 TB. o Result: None of the accounts individually crossed the 10 TB threshold, so none receive the discounted rate. Summary: Consolidated Billing simplifies paying for multiple accounts, offers detailed reporting, and allows sharing of discounts. Management: Set up billing through the primary account, and view combined and itemized charges. Discounts: Benefit from shared volume pricing and discounts based on total usage across accounts. AWS Budgets: Simple and Detailed Explanation AWS Budgets helps you keep track of your spending and usage for AWS services. Here’s a detailed breakdown: 1. Overview of AWS Budgets Purpose: AWS Budgets allows you to plan and manage your AWS costs, service usage, and instance reservations. Updates: The information is updated three times a day for accurate tracking. Alerts: You can set up custom alerts to notify you if your usage or costs exceed (or are expected to exceed) your budgeted amounts. 2. How AWS Budgets Works Example: Budgeting for Amazon EC2 Scenario: You want to limit your Amazon EC2 spending to $200 for the month. Action: Set a custom budget in AWS Budgets to receive an alert when spending reaches $100 (half of your budget). Notification: This alert helps you review and control your usage to avoid exceeding the budget. 3. Reviewing Your Budget Details Current Spending: Incurred Amount: The amount spent so far this month (e.g., $136.90). Forecasted Spending: Forecasted Amount: Estimated total spending for the month based on current usage patterns (e.g., $195.21). Comparisons: Current vs. Budgeted: Shows how your current spending compares to your budgeted amount.  Forecasted vs. Budgeted: Compares your forecasted spending to your budgeted amount. Example of Comparison: Forecasted vs. Budgeted Bar: If the forecasted amount ($56.33) exceeds the budgeted amount ($45.00), the bar shows 125.17%, indicating spending is projected to be over budget. Summary: Track Spending: Monitor and plan your AWS usage and costs. Receive Alerts: Set up alerts for when your usage or costs approach or exceed your budget. Review Details: Check current spending, forecasted spending, and how they compare to your budget. AWS Budgets helps you stay on top of your spending, avoid surprises, and make adjustments as needed. AWS Cost Explorer: Simple and Detailed Explanation AWS Cost Explorer helps you understand and manage your AWS spending over time. Here’s a clear breakdown: 1. What AWS Cost Explorer Does Purpose: Lets you visualize and ma