\n\tRegion – 12\n<\/p>\n
\n\tAvailability Zone – 33\n<\/p>\n
\n\tEdge Locations – 56\n<\/p>\n
\n\tPlacement Group: keeping multiple instances together in a single AZ, where you want to get low latency, high throughput, 10 gbps network\n<\/p>\n
\n\tASG\n<\/p>\n
\n\tELB\n<\/p>\n
\n\tRoute53
\n\t ELB don not have pre-defined IPv4 addresses, you resolve to them using a DNS name.
\n\t Difference between Alias Record and a CNAME.
\n\t The DNS port is on Port 53 and Route53 is a DNS service
\n\t Route53 Routing Policies:
\n\t Simple -> Single Webserver scenarios.
\n\t Weighted -> Lets you split traffic based on different weights assigned
\n\t Latency -> Allows you to route your traffic based on the lowest network latency for your end user(i.e which region will give them the fastest response time).
\n\t Failover -> Failover routing policies are used when you want to create an active\/passive set ip.
\n\t GeoLocation -> GeoLocation lets you chosse where your traffic will be sent based on the geographic location of your users(local language supported instances).\n<\/p>\n
\n\tEc2
\n\t Pricing Models for Ec2:
\n\t On Demand
\n\t Reserved
\n\t Spot -> if you terminate, you need pay for usage. If aws terminated – its free
\n\t Dedicated
\n\t Instance types:
\n\t Dr MC GIFT PX
\n\t File Service, Memory Optimised, General Pupose appln service, Compute Optimized, (G)Graphics intensive, (I)High Speed Storage, (F)Field Programmable Gate Array, (T)Low cost general purpose, (P)Graphics& Genreal purpose, (X)xtreme Memory Optimised
\n\t EBS :Elastic BLock Service
\n\t SSD – general purpose – GP2, upto 10000 IOPS
\n\t SSD – provisioned IOPS – 101 – more than 10000
\n\t HDD – Throughput optimised, – ST1 frequently accessed workloads -not used for root volumes, used for just attching
\n\t HDD, Cold – SC1 , less frequenced accessed data.-not used for root volumes, used for just attching
\n\t HDD – Magnetic, Standard – cheap & infreq accessed storage.\n<\/p>\n
\n\t You can not mount 1 EBS in to multiple Ec2 instances, instead use EFS.
\n\t Volumes vs Snapshots
\n\t Volumes exsits on EBS
\n\t Snapshot exsits on S3\n<\/p>\n
\n\tMonitoring:
\n\t Standard Monitoring : 5 min
\n\t Detail Monitoring : 1 min
\n\t CloudWatch is performance monitoring
\n\t CloudTrail is for Auditing
\n\t Dashboards, Alarms, Events & Logs
\n\tRoles:
\n\t Roles are more secured than access key and secret access key. Roles can be assinged to Ec2 instance after creating it, butonly throguh command line.
\n\t Roles are universal, no region.
\n\tInstance metadata: curl http:\/\/169.254.169.254\/latest\/metadata\/
\n\tEFS (Elastic File System)
\n\tLambda: Serverless, AWS lambda is a compute service where you can upload your code and create a lambda function\n<\/p>\n
\n\t
\n\tS3\n<\/p>\n
\n\tIAM\n<\/p>\n
\n\tAMI\n<\/p>\n
\n\tDatabase
\n\t RDS – OLTP (Online Txn Processing)
\n\t SQL,Oracle,MySqlServer,PostgresSQL,Aurora,MariaDB
\n\t NonRelation Database:
\n\t DynamoDB (DocumentBased)
\n\t Collection = table,Document = row,Key Value Pairs = fields
\n\t ElasticCache is a web service that makes it east to deploy, operate, and scale an in-memory cache in the cloud. Elastic cache supports two open-source in-memory caching engines.
\n\t – Memcached
\n\t – Redis
\n\t DMS(Database Migration Service) : Allow you to migrate your production database to AWS.
\n\t Backups: Automated Backups and Database Snapshots
\n\t Multi-AZ RDS is for disastr recovery only not for improving performance. For performance improvements, use read replicas.
\n\t Read Replica :for performance improvement\/scaling.Read replicas allow you to have a only copy of your production db. This is achieved by using asynchronous replication from the primary RDS instance to the read replica.
\n\t – Must have automatic backups truned on in order to deploy a read replica.
\n\t – You can have up to 5 read replicas copies of any databases.
\n\t – You can have read replicas of read replicas.
\n\t – Each read replica will have its own dns endpoint.
\n\t – You cannot have read replicas that have multi-AZ.
\n\t DynamoDB:
\n\t -Supports both document and key-value data models
\n\t -Stored on SSD storage
\n\t -Stored across 3 geographically distince data centers
\n\t -Eventually consistent reads(default) = 1sec
\n\t -Strongly Consistent reads < 1sec
\n\tRedShift – OLAP (Online Analytical Processing)
\n\t -Single Node
\n\t – Multi Node cfg
\n\t .Leader node (1 leader node)
\n\t .Compute node (up to 128 nodes)
\n\tAurora :
\n\t -Amzon SQL engine. 2 copies of your data is contained in each avaliability zone, with minimum of 3 AZ. 6 copies of your data.
\n\t -Transparently handles loss up to two copies of data with out affecting database write avaliability and up to 3 copies with out affecting read avaliability
\n\t -Self healing.
\n\t -2 replicas. 1. Aurara Replicas(15 replicas ) 2. mySQL Replical(5 replicas)\n<\/p>\n
\n\tVPC Virtual Private Cloud
\n\t – VPC as a logical datacenter in AWS, consists of IGW's( Virtual Private Gateways), route tables, Network Access Control Lists, Subnets, Security Groups.
\n\t – 1 Subnet = 1 Avaliability Zone
\n\t – Security groups are stateful
\n\t – Netwrok Access Control Lists are stateless
\n\t – No Transitive peering (if VPC A <-> VPC B, VPC B <-> VPC C, but you cannot between VPC A <->VPC C)
\n\t What you can do with a VPC ?
\n\t – Launch instances in to a subnet of your choosing
\n\t – Assign custom IP address ranges in each subnet
\n\t – Cfg route tables between subnets
\n\t – Create internet gateway and attach it to our VPC
\n\t – Much better secusrity control over your AWS resources.
\n\t – Instane security groups
\n\t – Subnet netwrok access control lists(ACLS)\n<\/p>\n
\n\tPoints to Remember:
\n\t – When you create a custom VPC, by default,it creats security groups, Route Tables, Netwrok ACL's. It doesn't create Subnets, Gateways
\n\t – One Internet Gateway(IGW) to one VPC
\n\t – ICMP SG is for ping
\n\t NAT instances (2016)
\n\t – NAT instance is an EC2 instance provides access to IGW.
\n\t – When creating a NAT instance, Disable Source\/Destination Check on the Instance
\n\t – NAT insatnce must be in a public subnet.
\n\t – There must be a route out of the private subnet to the NAT insatnce, in order for this to work
\n\t – Nat Instances are behind security groups
\n\t NAT Gateways
\n\t – Scale automatically up to 10Gbps
\n\t – Automatically assigned a public ip address
\n\t – You need to update your route tables.
\n\t – No need to disable Source\/Destination checks\n<\/p>\n
\n\t Network Access Control Lists Vs Security Groups (NACLs Vs SG)
\n\t SG – Operates at the instance level (1st layer of defence)
\n\t – Supports allow rules only
\n\t – is stateful, return traffic is automagically allowed regardless of any rules
\n\t – evaluate all rules before deciding wether to allow traffic
\n\t – Applies to an instance only if someone specifies the security group when launching the instance or associates the security group with the instance later on
\n\t
\n\t Network ACL – Operates at subnet level(2nd layer of defence)
\n\t – Operates at the Subnet level
\n\t – Supports allow rules and deny rules
\n\t – Is stateless – return traffic must be explicitly allowed by rules
\n\t – process rules in number order when deciding wether to allow traffic
\n\t – Automatically applies to all instances in the subnet its associated with (backup layer of defence, so you don't have to rely on someone specifying the security group)
\n\t – Custom Netwrok ACL, inbound and outbound restricted
\n\t – Default Netwrok ACL, inbound and outbound allowed
\n\t – One subnet = One AZ = 1 Netwrok ACL
\n\t – NACL works only when Ephimeal outbound&inbound rules defined with range 1024-65535
\n\t I – Rules evaluated in order. Lower rule number take effect in case conflict(rule 99 get priorty than 100)\n<\/p>\n
\n\t *Network ACL's
\n\t 1. Your VPC automatically comes a default network ACL andby default it allows all the outbound and inbound traffic.
\n\t 2. You can create a custom network ACL. By default, each custom network ACL denies all inbound and outbound traffic until you add rules.
\n\t 3. Each subnet in your VPC must be associated with a network ACL. If you don't explicitly associate a subnet with a network ACL, the subnet is automatically assoicated with the default network ACL.
\n\t 4. You can associate a network ACL with multiple subnets; however, a subnet can be assoicated with only one network ACL at a time. When you assoicate a new network ACL with a subnet, the previous association is removed.
\n\t 5. A network ACL has separate inbound and outbound rules, and each rule can either allow or deny traffic.
\n\t 6. Network ACLs are stateless; responses to allowed inbound traffic are subject to the rules for outbound traffic(and vice versa)
\n\t 7.Block IP addresses using network ACL's not security groups.
\n\t
\n\tVPC ELB setup: You will need to select a subnet for each avaliabilty zone where you wish traffic to be routed by your load balancer. If you have instances in only one Availability Zone, please select at least two subnets in different avaliability Zones to provide higher avaliability for your load balancer.\n<\/p>\n
\n\tNAT vs Bastion Servers:
\n\tA NAT is used to provide a internet traffic to EC2 instances in private subnets
\n\tA Bastion is used to securely administer EC2 instances(using SSH or RDP) in private subnets. These are like jump boxes.\n<\/p>\n
\n\tVPC Flow Logs: Flow logs enable you to capture IP traffic flow for the network interfaces in your resources.\n<\/p>\n
\n\tApplication Section:\n<\/p>\n
\n\tSQS – is a web service that gives you access to a message queue that can be used to store messages while waiting for a computer to process them.
\n\tAmazon SQS is a distributed queue system that enables web service applications to quickly and reliably queue messages that one component in the application generates to be consumed by another component.
\n\t1. Messages can contain up to 256 KB of text in any format.
\n\t2. Order is not posibble
\n\t3. Asynchronously pulls the task messages from the queue.
\n\t4. 12 hr Visibilty timeout period.
\n\t5. Does not offer FIFO
\n\t6. Amazon SQS engineered to provide "at least once" delivery of all messages in its queues.
\n\t7. Billed at 64kb chunks.\n<\/p>\n
\n\tSWF (Simple Workflow Service) is a web service that makes it easy to coordinate work across distributed application component.\n<\/p>\n
\n\tSQS vs SWF :
\n\t – SQS has a retention period of 14 days, SWF up to 1 yr(12 months) for workflow executions.
\n\t – SQS offers a message-oriented API where as SWF presents atask-oriented API
\n\t – SWF ensures that a task is assigned only once.\n<\/p>\n
\n\t SWF Actors
\n\t Workflow Starters – An application that can initiate a workflow
\n\t Deciders – Control the flow of activity tasks in a workflow(or fails) a Decider decides to do next
\n\t Activity Workers – carry out the actitivty tasks.\n<\/p>\n
\n\tSNS (Simple notification service) – is a webservice that makes it easy to set up, operate, and send notifications from the cloud. SNS is pushing messaging system. Messages are stored under multiple AZ.
\n\tCreate a SNS topic and assign a subscriber
\n\t – Insatantaneous, push-based delivery(no polling])
\n\t – Felxible message delivery over multiple transport protocols.
\n\t SNS Subscribers – HTTP, HTTPS, Email, Email-JSON, SQS, Application, Lambda\n<\/p>\n
\n\tSQS Vs SNS
\n\t– SNS -push
\n\t– SQL – polls(pull)\n<\/p>\n
\n\tElastic Transcoder : Media Transcoder in the cloud. Convert media files form their original source format in to different formats that will play on smartphones, tablets, pc's etc.\n<\/p>\n
\n\tAPI Gateway
\n\t1. Api Gateway has caching capabilities to increase performance.
\n\t2. Api gateway is low cost and scales automatically
\n\t3. You can throttle API Gateway to prevent attacks
\n\t4. You can log results to CloudWatch
\n\t5. If you are using Javascript\/AJAZ that uses multiple domains with API gateway, ensure that you have enabled CORS on API Gateway.\n<\/p>\n
\n\t
\n\tKinesis
\n\t Streaming data – is data that is generated continuously by thousands of data sources, which typically send in the data records simultaneously, and in small sizes. etc,
\n\t Amazon Kinesis is a platform on AWS to send your streming data too.Kinesis makes it easy to load and analyze streaming data, and also providing the ability for you to build your own custom applications for your business needs.
\n\t Core Kinesis Services:
\n\t 1) Kinesis Streams
\n\t – default stores 24hrs.Increased to 7 days retension. Data stored in shards. Total capacity of the stream is number of shards configured in the stream.
\n\t 2) Kinesis Firehose
\n\t 3) Kinesis Analytics\n<\/p>\n
\n\t#!\/bin\/bash\n<\/p>\n
\n\tYum update -y
\n\tyum install httpd php php-mysql stress -y
\n\tcd \/etc\/httpd\/conf
\n\tcp httpd.conf httpd-bk.conf
\n\tnano httpd.conf
\n\t update in http.conf AllowOVerride all(allow url rewrite)
\n\tcd \/var\/www\/html
\n\tnano healthy.html
\n\t healthy
\n\twget https:\/\/wordpress.org\/latest.tar.gz
\n\ttar -xzf latest.tar.gz
\n\tcp -r wordpress\/* \/var\/www\/html\/
\n\trm -rf wordpress
\n\trm -rf latest.tar.gz
\n\tchmod -R 755 wp-content
\n\tchown -R apache.apache wp-content
\n\tservice httpd start
\n\tchkconfig httpd on\n<\/p>\n
\n\taws s3 ls
\n\taws s3 cp –recursive \/var\/www\/html s3:\/\/wordpresscode16acloudguru
\n\taws s3 ls wordpresscode16acloudguru
\n\taws s3 cp –recursive s3:\/\/wordpresscode16acloudguru \/var\/www\/html
\n\taws s3 sync \/var\/www\/html\/wp-content\/uploads\/ s3:\/\/wordpressmedia16acloudguru –delete –dryrun
\n\taws s3 sync \/var\/www\/html\/wp-content\/uploads\/ s3:\/\/wordpressmedia16acloudguru –delete\n<\/p>\n
\n\twget https:\/\/s3-eu-west-1.amazonaws.com\/acloudguru\/config\/htaccess
\n\tcp htaccess .htaccess\n<\/p>\n
\n\tcd \/etc
\n\tnano crontab
\n\t*\/2**** root aws s3 sync –delete \/var\/www\/html\/wp-content\/uploads\/ s3:\/\/wordpressmedia16acloudguru\/
\n\t*\/2**** root aws s3 sync –delete \/var\/www\/html\/ s3:\/\/wordpresscode16acloudguru\/
\n\t*\/3**** root was sync -delete s3:\/\/wordpresscode16acloudguru\/ \/var\/www\/html\/\n<\/p>\n
\n\tstress –cpu 100\n<\/p>\n
\n\tCloudFormation : Its kind of bootstrap of most of aws services.\n<\/p>\n
\n\t
\n\tAWS 12 regions
\n\t– 1 region -> multiple AZ
\n\t– Access is authorized on a "Least previleged access"
\n\t– IAAS
\n\tAmazon Protects against DDos, Man in the middle attacks(MITM), Ip Spoofing, Port Scanning, Packet Sniffing by other tenants
\n\tTrusted Advisor inspects your AWS environment and makes recommendations when opportunities may exist to save money, improve system performance, or close security gaps\n<\/p>\n
\n\tDifferent instances running on the same physical machine are isolated from each other via the Xen hypervisor. In addition, the AWS firewall resides with in the hypervisor layer, between the physical network inteface and the instance's virtual interface.
\n\tGuest Operating System
\n\tElastic Load Balancing – SSL Termination on the load balancer is supported.
\n\tDirect Connect – ByPass Internet Service providers in your network path.
\n\tStorage Gateway – is a service that connects an on-premises software appliance with cloud-based storage to provide seamless and secure integration between an orgnization on-premises and AWS storage infrastructure.
\n\t1.gateway-cached
\n\t2.gateway-stored volumes (asynchronously backup data from data center to AWS)\n<\/p>\n
\n\tImplement Elasticity
\n\t1. Proactive Cyclic Scaling : periodic scaling that occurs at fixed interval(daily, weekly, monthly, quaterly)
\n\t2. Proactive Event-based Scaling : scale on events like balck friday
\n\t3. Auto-Scaling based on demand\n<\/p>\n
\n\t
\n\tElastic Beanstalk automatically handles the deployment, from capacity provisioning, load balancing, auto scaling to application health monitoring based on the code you upload to it, where as CloudFormation is an automated provisionig engine designed to deploy entire cloud environments vis a JSON script.\n<\/p>\n
\n\t
\n\tGeneral Design Priciples
\n\t– Stop guessing about your capacity needs
\n\t– Test systems at production scale
\n\t– Lower the risk of architecture change
\n\t– Automate to make architectural experimentation easier
\n\t– Allow for evolutionary architectures\n<\/p>\n
\n\tWell-Architected Framework – 4 pillars
\n\t– Security
\n\t– Reliabilty
\n\t– Perforamce Efficiency
\n\t– Cost Optimisation\n<\/p>\n
\n\tSecurity:\n<\/p>\n
\n\t Design Priciples:
\n\t – Apply securities at all layers
\n\t – Enable tracebility
\n\t – Automate responses to security events
\n\t – Focus on securing your system
\n\t – Automate security best practies (centerforinternetsecurity.com)
\n\t AWS Shared Responsibility Model:
\n\t – Customer responsible for OS, network, firewall, encryption, network traffic
\n\t – AWS responsible for Compute, Storage, Database, Networking, Regions, AZ, Edge Locations\n<\/p>\n
\n\t Definition: Secutiry in the cloud consist of 4 areas
\n\t – Data protection
\n\t .encryption\/decryption at rest and transit(using ssl)
\n\t .logging
\n\t .versioning
\n\t .AWS doesn't move data between regions
\n\t – Privilege management
\n\t .IAM
\n\t .ACl (Access Control List)
\n\t .Role based access control
\n\t .Password management(such as password rotation policies)
\n\t .MFA
\n\t – Infrastructure protection
\n\t .RFID, Secutiy guards, CCTV
\n\t .VPC (secutiry groups, subnets, etc)
\n\t – Detective controls
\n\t .AWS cloudTrail
\n\t .AWS CloudWatch
\n\t .AWS Config
\n\t .Amazon Simple Storage Service
\n\t .Glacires\n<\/p>\n
\n\tReliability:
\n\t Design Principles:
\n\t – Test Recovery Procedures
\n\t – Automatically Recover from failures.
\n\t – Scale Horizontally to increase aggregate system avaliabilty
\n\t – Stop guessing capacity
\n\t Definations: 3 Ares
\n\t – Foundation -> IAM VPC
\n\t – Change Management -> CloudTrail
\n\t – Failure Management ->AWS Cloud Formation \n<\/p>\n
\n\tPerformance Efficiency Pillar:
\n\t Design Priciples:
\n\t – Democratize advanced technologies (use new technologies as a service.)
\n\t – Go global in minutes
\n\t – Use server-less architectures
\n\t – Experiment more often
\n\t Defination
\n\t – Compute – AutoScaling
\n\t -> Access Method – block , fileor Object
\n\t -> Patterns of Access – Random or Sequential
\n\t -> Throughput Required
\n\t -> Frequency of Access – Online, Offline or Archival
\n\t -> Frequency of Update – Dynamic, Worm
\n\t -> Avaliability Constraints
\n\t -> Durabiltiy Constraints
\n\t – Storage – EBS, S3, Glacier
\n\t – Database – RDS, DynamoDB, RedShift
\n\t – Space-Time Trade-off – CloudFront, ElasticCache, Direct Connect, RDS Read Replicas etc\n<\/p>\n
\n\tCost Optimization:
\n\t
\n\t Design Principles:
\n\t -Transparently attribute expenditure
\n\t -Use managed services to reduce cost of ownership
\n\t -Trade capital expense for operating expense
\n\t -Benefit from economies of scale.
\n\t -Stop spending money on data center operations
\n\t
\n\t Defination:
\n\t -Matched supply and demand – Autoscaling
\n\t -Cost Effective Resources – Ec2(reserved instances), AWS trusted Advisor
\n\t -Expenditure Awareness – CloudWatch Alarms, SNS
\n\t -Optimizing Over Time – AWS Blog, AWS Trusted Advisor\n<\/p>\n
\n\t
\n\t \n<\/p>\n
\n\t
\n\t <\/p>\n","protected":false},"excerpt":{"rendered":"
InProgress…. Region – 12 Availability Zone – 33 Edge Locations – 56 Placement Group: keeping multiple instances together in a single AZ, where you want to get low latency, high […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"quote","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":true,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","enabled":false},"version":2}},"categories":[18,2],"tags":[],"class_list":["post-410","post","type-post","status-publish","format-quote","hentry","category-aws","category-technology","post_format-post-format-quote"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p70lnf-6C","jetpack-related-posts":[],"_links":{"self":[{"href":"https:\/\/kaizen-koka.com\/index.php?rest_route=\/wp\/v2\/posts\/410","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/kaizen-koka.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kaizen-koka.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kaizen-koka.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/kaizen-koka.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=410"}],"version-history":[{"count":9,"href":"https:\/\/kaizen-koka.com\/index.php?rest_route=\/wp\/v2\/posts\/410\/revisions"}],"predecessor-version":[{"id":423,"href":"https:\/\/kaizen-koka.com\/index.php?rest_route=\/wp\/v2\/posts\/410\/revisions\/423"}],"wp:attachment":[{"href":"https:\/\/kaizen-koka.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=410"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kaizen-koka.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=410"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kaizen-koka.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=410"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}