Please enable JavaScript.

Coggle requires JavaScript to display documents.

AWS Solutions Architect (Databases (RedShift - OLAP (Online Analytical…

- - - - Application
        
        Used 9/10 compared to others
        
        Must be deployed in at least 2 subnets
        
        Intelligent routing
        
        Stick sessions: can be enabled, but the traffic will be sent to at the target group level
      - Network
        
        High performance
      - Classic
        
        Becoming obsolete
        
        Requires to be in two AZ
        
        Simple routing
        
        IPv4 of end user: X-Forwarded-For
        
        Sticky sessions:
        Routes each request independently to the registered EC2 instance with the smallest load
        Binds a user to a specific EC2 instance. Ensures all requests are sent to the same instnace.
      - 504 error means the gateway has timed out
      - Monitoired by ELB reported as:
        InService or OutofService
      - Health checks check the instance health by talking to it
      - Own DNS name, never given the IP address
      - Cross zone load balancing
        
        Enables to load balance across multiple AZs
      - Path Patterns
        
        Allows you to direct traffic to difference EC2 instances based on the URL contained in the request
      - Connection draining
        
        Auto scaling will wait for outstanding requests before terminating instances.
    - - Persistent
      - Can be detached and reattached
      - Can be stopped; data will persist
      - Store data long term
      - Data encrypted at rest
      - Max size 16TiB
    - - Not persistent (ephemeral)
      - Volumes cannot be detached and reattached
      - Only exist for life of instance
      - Volumes cannot be stopped, doing so will wipe the data
      - Shouldn't be used for long-term data
    - - curl http://169.254.169.254/latest/meta-data/
        wget http://169.254.169.254/latest/meta-data/
        Instance META DATA
    - - Placement groups
        
        Spread placement group
        
        Group of instances that are placed on different hardware
        
        Recommended for applications that have a small number of critical instances that should be kept separate
        
        Clustered placement group
        
        Recommended for applications that need low network latency, high network throughput or both
        
        Group of instances within a single AZ
        
        Name must be unique in AWS account
        
        Only certain types can be launched in a placement group (Compute Optimised, GPU, Memory Optimised, Storage Optimised)
        
        AWS recommend homogeneous instances within placement groups
        
        Can't merge placement groups
        
        Can't move an existing instance into a placement group.
        Can create an AMI from your existing instance, then launch a new instance from the AMI into a placement group
      - Elastic IPs
      - Security groups
        
        Stateful firewall - wrapped around instance
    - - Launch configuration
      - Can use SNS notifications
      - Step
        
        Select scaling metrics and threshold values for CloudWatch alarms. Based on a set of scaling adjustment
      - Simple
        
        Based on single scaling adjustment
      - Target tracking
        
        Increase or decrease the current capacity with a target value
  - - - Ensures tasks are constantly running and reschedules tasks when a task fail
      - Can ensure tasks are registered against an ELB
    - - Can your own schedulers that meet business needs
      - Leverage third-party schedulers, such as blow
    - - IAM Roles
      - Security groups operate at the instance level, not the task or container level
- - - - Web distribution - Typically used for websites
      - RTMP - Used for media streaming
      - Name given to CDN which consists of a collection of Edge locations
    - - One primary, second origin. CloudFront automatically switches when the primary origin returns specific HTTP status failure responses
  - - - Stateless
      - Default network ACL
        Default allows all outbount and inbound traffic
      - Customer ACLs
        Denies inbound and outbound traffic
      - Each subnet must be associated with a network ACL
      - Evaluated in order by lowest number
      - Operate at the subnet level
    - - Disable source/destination checks
      - Must be in public subnet
      - Route out via private subnet to the NAT instance
      - Throughput dependent on instance size
      - HA using autoscaling groups, script to automate failover
      - Behind security group
    - - Preferred by the enterprise
      - Scales auto to 10Gbps
      - No need to patch
      - Not associated with security groups
      - Auto assigned IP
      - Remember to update route tables
      - More secure than NAT instance
    - - Stateful
      - Operate at the instance level
    - - Random ports
    - - Tracks network traffic.
        Stored in CloudWatch
      - 3 levels
        VPC
        Subnet
        Network Interface level
      - Cannot enable for VPCs not in your account (peering)
      - Cannot tag a flow log
      - Cannot change config once created
      - Not all traffic is monitored (DHCP, reserved IPs etc)
    - - NAT is used to provide internet traffic to EC2
      - Bastion i.e. Jump box
    - - Gateway
        
        S3
        
        DymnoDB
      - Source: IAM policy to restrict actions of VPC
      - Dest: IAM policy at S£ to make accessible form VPC endpoint only
    - - Connection between 2 VPCs route traffic between Private IPs
      - Own VPCs or in another AWS account in a single region
      - Uses existing infrastructure
      - No single point of failure
      - Transitive peering NOT supported
      - Overlapping CIDR blocks will not work
      - Inter-region peering encrypts with no single point of failure or and bandwidth bottleneck
      - Traffic using inter-region peering always stays on the global AWS backbone
    - - Uses Internet
      - Customer gateway & Virtual Private gateway
      - Two IPSec tunnels
      - Route table out via VGW
      - Can turn on propagated
- - - - Website endpoint
    - - S3 Standard
      - S3 - IA (Infrequently accessed)
      - S3 One Zone - IA
      - S3 - Intelligent Tiering
        
        Machine learning
      - S3 Glacier
      - S3 Glacier Deep Archive
    - - Requires versioning enabled
      - Replication entire bucket / prefix or tags
      - Destination region
      - Doesn't replicate existing objects, only new ones
      - Delete marker not replicated
        or individual versions
    - - ACL
      - Torrent
    - - Enables applications to retrieve only a subset of data from an object
    - - At Rest
        
        Client-side
        
        client-side master key
        
        KMS-managed customer master key
        
        Server-side
        
        S3-Managed Keys (SSE-S3)
        
        AES 256
        
        KMS-managed keys (SSE-KMS)
        
        Customer-provided keys (SSE-C)
      - In Transit
        
        SSL / TLS
    - - Utilises the CloudFront Edge Network
      - Use a distinct URL to upload directly to an edge location which then gets transferred to S3
        *.s3-accelerate.amazonaws.com
      - 20GB file size, same as CloudFront
  - - - Stored volumes - Entries dataset is stored and is asynchronously backed up to S3
      - Cached volume - Entire dataset is stored on S3 and the most frequently accessed data is cached on site
    - - Used for backup and uses popular backup applications like NetBackup, Backup Exec Veeam etc
    - - Objects stored in S3 buckets
- - - - 2 copies contained in each AZ
        Min 3 AZ, 6 copies of data
      - Can handle loss of up to two copies of data without affecting DB write availability
        3 copies without affecting read availability
      - 2 types of replicas available
        Aurora replicas (currently 15)
        MySQL Read Replicas
      - Sing instance Failover - Creates a new DB in the same AZ. If unable to do so will place in different AZ
      - Failover is automatically handled
      - Replica failover, uses this instead of creating new DB
        
        Flips the CNAME record
      - Start with 10GB, scales in 10GB increments to 64TB (Storage autoscaling)
      - Compute resources can scale up to 32vCPUs & 244GB of memory
      - Backups
        
        Automated backups are always enabled.
        
        Do not impact DB perofrmance
        
        Can take snapshots
        
        Can share snapshots with other AWS accounts
      - Replicas
        
        Aurora replicas
        
        MySQL replicas
        
        Automated failover only available with Aurora replicas
    - - Scaling not DR!
      - Read-only copy of DB
        
        Uses asynchronous replication
      - Read replicas primarily for very read-heavy DB workloads
      - Available for:
        MySQL Server
        PostgreSQL
        MariaDB
        Aurora
      - Must have automatic backups turned on in order to deploy a read replica
      - Can have up to 5 read replica-copies of any DB
      - Can have read replicas of read replicas (watch out for latency)
      - Each read replicas will have its own DNS end point
      - Can have read replicas that have Multi-AZ
      - Can create read replicas of multi AZ source databases
      - Read replicas can be promoted to be their own DB. This breaks the replication
      - Can have read replica in a second region
      - Can be in any region
    - - Max size 16TB
    - - Allows to have an exact copy of your DB in another AZ
      - AWS handles the replication, new data is written to the standby DB
      - DB instance failure, RDS will automatically failover to the standby
        
        AWS updates the IP of the endpoint automatically
      - For DR only
      - Available for:
        SQL Server
        Oracle
        MySQL Server
        PostgreSQL
        MariaDB
      - Can force a failover from one AZ to another by rebooting the RDS instance
    - - Automated
        
        Retention period - 1 and 35 days
        
        Full daily snapshot
        
        Stores transaction logs throughout the day
        
        Restores > Choose the most recent daily backup, and then applies the relevant transaction log to that day
        
        Point in time recovery down to a second, within the retention period
        
        Enabled by default
        
        Backup stored in S3
        
        Free storage equal to the size of DB. DB size 50GB, free 50GB of storage
        
        Taken within a define window
        
        During the window storage I/O may be suspended while data is being backed up and may experience elevated latency
      - Database snapshots
        
        Manually
        
        Stored even after you delete the original RDS instance, unlike automated backups
      - The restored version of the DB will be a new RDS instance with a new DNS endpoint
    - - Supported for:
        MySQL
        Oracle
        SQL server
        PostgreSQL
        MariaDB
        Aurora
      - Uses AWS KMS
      - Underlying storage is encrypted, as are its automated backups, read replicas & snapshots
      - Disabled by default
  - - - Across all copies of data is usually reached within a second. Repeating a read after a short time should return the updated data (Best read performance)
    - - Read returns a result that reflects all writes that received a successful response prior to the read
    - - In-memory cache that delivers up to 10x performance improvement
      - Does all the heavy lifting required to add in-memory acceleration into DynamoDB tables
      - Real time bidding, social gaming & trading applicaitons
  - - - Leader Node
        
        Managers client connections & receives queries
      - Compute node - up to 128
        
        Store data and perform queries & computations
    - - Petabyte of data
    - - Columnar data stores can be compressed much more than row-based data stores because similar data is stored sequentially on disk
    - - Automatically distributes data & query load across all nodes. Redhsift makes it easy to add nodes to data warehouse & enables you to maintain fast query performance as the data grows
    - - Enabled by default with a 1 day retention period
      - Maximum retention period is 35 days
      - Redshift always attempts to maintain at least three copies of your data (the original & replica on the compute nodes and a backup in Amazon S3)
      - Can also asynchronously replicate your snapshots to S3 in another region for disaster recovery
    - - Compute Node Hours
      - Billed 1 unit per node per hour, so a 3-node data warehouse cluster running persistency for an entire month would incur 2,160 instance hours
      - Not charged for leader node hours, only compute nodes will incur charges
      - Data transfer (only within a VPC, not outside it)
    - - Encrypted in transit using SSL
      - Encrypted at rest using AES-256 encryption
      - By default RedShift takes care of key management
        
        Can manage your own keys through HSM
        
        AWS Key Management Service
    - - Currently only available in 1 AZ
      - Can restore snapshots to new AZs in the event of an outage
  - - - Existing tools will work with Memcache
      - Simple & easy to deploy
      - Can scale horizontally
    - - Popular open-source in-memory key-value store
      - Multi-AZ
      - Backup & Restore
- - - - Workflow starter
        
        Application that can initiate a workflow.
        Could be your e-commerce website when placing an order or a mobile app
      - Deciders
        
        Control the flow of activities in a workflow execution
      - Activity workers
        
        Carry out the activity tasks
- - - - 24 > 7 days retention
      - Shard
        
        Data consumers
        
        DynamoDB, S3, EMR & Redshift
        
        5 transactions per second read
        Data read max 2MB per second
        1000 records by second for writes max 1MB per sec
    - - S3
        
        Redshift
      - Elasticsearch Cluster
      - Analyse on the fly
        
        Lambda
    - - S3
      - Redshift
      - Elastisearch Cluster
    - - Redshift for business intelligence
      - Elastic Map Reduce for big data processing
  - - - S3
- - - - Web server
      - Lambda
      - Application
  - - - Limit of 20 linked accounts
      - 1 bill per AWS account
      - Volume pricing discount
      - Track charges and allocate costs
      - Unused reserved instances for EC2 are applied across the group
      - CloudTrail is on a per account and per region bases
        Can be aggregated in to a single bucket in the paying account
- - - - Limited & Temporary access to AWS resources
      - Federation (AD)
        Uses Security Assertion Markup Language (SAML)
        Uses AD does not need IAM account
        SSO AWS console access
      - Federation with mobile apps
        Uses Facebook/Amazon/Google OpenID
      - Cross Account access
        Lets users from one AWS account access resources in another
      - Identity broker - allows you to take an identity from point A and join it (federate it) to point B
        
        Develop an identity broker to communicate with LDAP and AWS STS
        
        Communicates with LDAP and then AWS STS
        
        Application then gets temporary access to AWS resources
      - Identity Store - Services like AD, facebook, Google etc
      - Identities - a user of a service like Facebook etc
  - - - Layer 3 & 4 - protects against SYN/UDP floods, reflection attacks & others to support HA
  - - - These conditions include IP, HTTP headers, HTTP body, URI strings, SQL injection & cross-site scripting
- - - - Create a service map
      - Identify errors and bugs
      - Analysis and visualization apps