You're sending disks to Amazon and they deploy it to S3 or sth similar (or reverse - they will write sth to the disk)

you're uploading a code and beanstalk automatically creates an environment for it

You're installing inspector agent on your virtual machine and it reports you audit results

This is where you get your documentation (e.g. ISO compliance certificate) in AWS console

Turns your infrastructure into code. In normal architecture you have switches, firewalls, services and so on and in cloud you have a document describing all those components. Responsible for it is Cloud Formation. You can deploy whole production environment using Cloud Formation templates.

Audtiting your AWS activity. If something is changed (e.g. new service added/removed) the Cloud Trail is responsible for logging this information. Can be stored in S3 bucket

Monitors your configuration and warns you if specific configuration can broke your environment that you set

You can specify which services are authorised among your enterprise and which don't

Gives you recommendations, e.g. how to do cost optimization, performance optimization or security fixes in your environment.

Allows to design mobile features, e.g data storage, way of authentication. It has its own mobile console

Simplify sign in and sign up - aloows to do it over 3rd parties (Social Identity Providers), e.g. Google. You have to give Google credenttials which are stored in Cognito and then you can log in over Cognito in other services (which allows for it)

it's like google analytics for mobile apps. Helps you understand user's behaviour.

For storing work documents in a secure way. Similar to S3 with some additional security features.

Give data sets and then it can be used in future. E.g. for people profiling.

the origin actually may be your non AWS server - CloudFront will still work

when you PUT a new object to edge location then the edge location it will update your bucket

using "Path Pattern" you can set the regular expression what should be cached, e.g. *.pdf

You can delete the distribution by firstly disabling it and then deleting

gives you also the compute capabilities. For example, the airplane engineer takes the snowball edge's box on the board and it's mounted as a disk. During the flight data about engines is collected and then send to Amzaon data centre. In the result you have in your cloud not only the data, but also the Lambda function.

before snowball there was an import export service where users were sending their own disks, but it was hard to manage for AWS

you have to download the manifest file and provide the access code from your AWS console to run the Snowball

you may use pre-signed URLs in the following scenario. You have a website with photos (stored on s3) and you don't want to share directly the photos but rather you want people to visit your website and see the pictures there (e.g. because of displaying ads to people). With normal s3 storage other websites can directly link to photos without reaching your website. If you use pre-signed urls then it is impossible to directly refer to photo. People can only see it on your website.

from multiple EBS volumes you can create a RAID (the EBSes can be of different types), e.g. from 4 different volumes create one striped partition D://

You can do this using one of the following method: freeze filesystem, unmount the RAID array, shut down associated EC2 instance

Require to configure health checks - LB passes traffic only to instances which pass the healthcheck

CloudWatch Events, e.g. a rule to update DNS when event is triggered

Cloud watch is for monitoring (performance), while CloudTrail is for auditing (what people are doing on your resources)

It's a logical grouping of instances within a single Availability Zone. It is recommended for applications that need very low latency and very high network throughput (10Gb/s), e.g. clusters.

Placement Group cannot span across multiple Availability Zones.

only certain instances can be launched in a Placement Group.

However you can create an AMI from existing instance and then launch a new instance from AMI into a Placement Group

It elastically grow (can scale up to petabytes) and shrinks when you add/remove files

EC2 instances have to be in the same security groups as the elastic file system

To mount it simply run the proper command on each instance.

it's a compute service. You upload a code and Lambda takes care of provisioning and managing the servers to run your code.

You have to grant permissions to role assigned to your function, e.g. Simple Microservice permissions (without permissions it will not work)

CNAME records map 1 domain name to another, e.g. http://m.example.com to http://mobile.example.com

Alias is similar to CNAME but it allows for mapping the naked domains e.g. http://example.com, while CNAME not. ELB doesn't resolve to IP address (always to domain name) so Alias here are very helpful

Amazon charges you for CNAME record, but not for Alias requests

allows you to route traffic based on the lowest network latency

based on the geographic location (continents, countries or only in US states)

it's helpful when you want for example present one version of a website for all Europeans, and the other version for all Africans

By default you can have registered 50 domains, however if you need more you can have after contacting Amazon support

E.g. you want to count net income of EMEA and US region, then you need to have sum of :sold products from EMEA and US, unit cost of each product, sales price of each product etc.

e.g. Oracle licensing is very expensive so you can convert your Oracle db to free MySQL

It takes a daily db snapshot and stores transaction logs through all day. This allows you to recover a db to any point in time within retention period (it can be from 1 to 35 days)

backups are taken in a defined time window and during a backup you may experience latency

The backup is stored on automatically created S3 bucket. If your RDS db is 10 GB big then there is created for free S3 10 GB bucket

Unlike automated backups they are stored EVEN AFTER deleting RDS instance

Restored instance is always a NEW RDS instance with a new endpoint

It allows you to to have exact copy of production db in different Availability Zone. Both dbs are automatically synchronised so if one fails then another one comes live.

if there's a planned mainenance window then RDS will automatically switch and then come live again without administrator's action

Multi-AZ is only for Disaster Recovery not for improving performance (for this you need Read Replicas)

you have multiple dbs which are synchronised with each other improving performance (e.g. each instance of a web server is connected with an RDS instance)

The other possible purpose is to take a replica of your production for dev purposes

Read replicas of read replicas are possible but may cause latency problems , because of asynchronous algorithm of synchronization

Read Replicas CANNOT have Multi-AZ, HOWEVER you can have read replicas of Multi-AZ source dbs

You can have read replica in a 2nd region however ONLY for MySQL and MariaDB

to scale RDS (increase the size) you have to manually restore a snapshot with bigger size or to add a read replica. DynamoDB has a scale "push button" and the process of scaling is automatic

Allows automatic scaling up process without any down time (in opposite to RDS)

Automatically spreads across 3 geographically different data centres (user cannot specify which specific AZs should be used)

Advanced Compression - Columnar Data Can be compressed more effectively than row based data (it stores same type of data)

Massively Parallel Processing - automatically distributes data across all nodes

by default Redshift takes care of key management (but you can change it to AWS KMS or manage keys through HSM)

2 copies of your data in each AZ, with minimum of 3 AZs = 6 copies of your data

self-healing - automatically scans disks for errors and repairs them

the maximum provisioned IOPS capacity on an Oracle and MySQL RDS instance (using provisioned IOPS) is 30,000 IOPS

the maximum size RDS volume you can have by default using Amazon RDS Provisioned IOPS storage with MySQL and Oracle database engines is 6 TB

There's NO transmitive peering - VPCs can communicate only with directly connected VPCs

first 4 IPs and the last from the subnet (5 in all) cannot be used

by default each newly created subnet is asociated with the main route table

by default newly created subnets has no auto-assign public IP - you have to turn it on manually if you want to access resources in this subnet from public

Security groups dont't span across VPCs (if you created a security group in VPC1 it will not be visible in ~VPC2)

created by default (allows all in and out traffic). But if you create your own one it has a rule DENY everything.

Remember to specify a 'Custom TCP' outbound rule with a port range (it is required for ephemeral ports - the ports open on client side, e.g. on client side you're using 1050 as ephemeral port and 80 as a destination port)

you can block addresses using ACLs (NOT via Security Groups)

Rare choice, only if you need static IP and ultra high performance

You can stream captured logs e.g. to Lambda and react for the traffic

Flow logs between VPCs are ONLY possible if both VPCs are under ONE account

After creating a flow log you cannot change its configuration, e.g. you cannot assign a new IAM role

Not all traffic is monitored. Exceptions are: Amazon DNS traffic (however if you have your own DNS server then it is logged), traffic from Windows instance for an Amazon Windows license activation, traffic to and from 169.254.169.254, DHCP traffic, traffic to reserved IP for the default VPC router

accessing any AWS Service through VPC endpoint within one region is done using private IPs

they're used for accessing other AWS services behind the gateway (like to the different department, but in the same enterprise network)

NAT gateway is not associated with security groups (while NAT instances are)

By default you can have 5 VPCs in one region and 200 subnets per VPC

if you want to serve images from CloudFront rather than from S3 via Apache on EC2, you have to change a setting in httpd.conf to AllowOverwrite All

Proactive Cyclic Scaling - periodic scaling after fixed time interval (e.g. daily)

Proactive Event-based Scaling - scale when an event occurs (release of your product)

Amazon currently doesn't support increasing storage on SQL Server Db instance

Resource groups - allows to group resources using tags assigned to them

you can connect VPCs owned by different accounts however only in the same region

Using STS you can log in to AWS with your AD account/OpenID providers without IAM credentials.

Federation - combining list of users in 1 domain (e.g. IAM users) with list of users from 2 domain (e.g. AD)

Identity Broker - a service to take an identity from point A and join it (federate it) to point B

public subnet has at least one route that uses an internet gateway in it's route table.

EC2 instance in a public subnet is only publicly accessible if it has a public ip address or is behind an elastic load balancer.

when using multiple availability zones, you cannot use the secondary database as an independent read node

Once a VPC is set to Dedicated hosting, it is not possible to change the VPC or the instances to Default hosting. You must re-create the VPC.

DynamoDB allows for the storage of large text and binary objects, but there is a limit of 400 KB.