Please enable JavaScript.

Coggle requires JavaScript to display documents.

AWS Architect Associate (Simple Storage Service-S3 (Tiered Storage (S3…

- - - - Authoritative name server contains SOA record
        which stores CNAME or A name - maps ip to domain name
        
        A record name - Maps Domain to IP
        
        CNAME (Canonical) Record - Map one (mobile) domain name to another(Website). This cannot be used for naked domain names
        or like all below domain mapping to a domain name google.com in CNAME
        google.com
        mail.google.com
        docs.google.com
        and then we use A record to map google.com to a ip address
        
        Alias record - For Naked domain names
        i.e they dont contain subdomain i.e WWW.
        This is also called apex
        Always choose Alias record over CNAME when possible
        
        PTR - reverse i.e from IP get the domain name
        MX - for mail
  - - - Only 1 record with multiple IP addresses( EC or ELB instances)
        Each IP address on new line and added as A record. TTL is time until when you need to be cached
    - - Here we can assign weights to regions and requests would be routed based on weights..Each IP has a weight assigned and is a separate A record
        Ireland EC 2 instance- 50%.
        Ohio EC 2 instance- 30%
        Sydney - 20%
        
        Further you can specify health check when you create
        A records. Here you have to create 3 separate health checks for these 3 instances. I
        
        It will pool an endpoint which is your EC2 instance index.html. If any instance fails an health check it will be removed from routing policy and no longer request will come to that instance
        
        SNS can be set to notify you for failed health check
    - - Request routed based on lowest network latency for the region where end point (EC2 instance or ELB instance) exists
    - - Based on Geolocation of users
        if in US then, US region , if user from Europe
        then EU- East region, etc. This comes handy
        when you want to configure some region level things
        like displaying currency in EURO
    - - Its kind of Simple policy but here you can give
        health check to each record
        so if one fails traffic is diverted to other instance
- - - - Read after write consistent for PUTS- can read latest created data
      - Eeventual consistency for modified PUTS(edit/delete)- data takes some time to read
  - - - S3 Managed keys SSE-S3
      - AWS Key management service,Managed Keys- SSE-KMS
      - Servier side encryption with customer provided keys - SSE-C
- - - - Default route table created earlier has route which will enable 2 subnets to talk to each other
        
        Since 2 subnets by default gets assigned to this route table, if route to IGW is created in route table then both subnets can get exposed to intenet. To avoid this we only associate private subnet to default root table.
        
        Then we Create one more Route table , and
        create route which enables IPv6 (::/0) and IPv4 (0.0.0.0/0) to connect to Internet gateway
        
        then we associate public subnet to this route table so in this way only 1 subnet gets exposed t internet
        
        Create 2 EC2 instances, 1 instance called Webserver and
        associate it to public subnet , WebDMZ security group
        (create one for HTTP) and other call it as DB server and
        tag to private subnet and default security group
        
        To enable Webserver to talk to DB server in private subnet, we create a new Security group, add following inbound rules
        
        Allow Ping (ICMP) , HTTPS, HTTP, TCPIP, SSH, from public subnet ip
        
        Now associate this new security group DBSeGrp to the EC2 instance
        
        Then SSH onto Private EC2 instance in Private subnet using the private key file (create one by copying it from the file created during creation of EC2 instance, from your public EC2 instance , In this way public EC2 can talk to private EC2
        
        NAT Instances
        
        Correct method for intercommunication between public and private EC2 instance is via NAT Instances & Gateways. this will help to download all the software from internet to private subnets..So private subnet talk to outside world without getting exposed
        
        Create EC2 instance in public subnet, name it as NAT instance and disable **the source and destination** check
        
        Now go to route table associated with private subnet and add a route, which will connect to 0.0.0.0/0 via NAT Instance
        
        Now do ssh to private EC2 through public EC2 and then do yum update , this time it will be able to connect to internet
        
        However if there are many subnets needing access to internet then it will create a huge bottleneck as it has limited instance size and we need to increase it then so a better way is through NAT Gateways
        
        NAT Instance are behind security group as its an EC2 instance
        
        NAT Gateways
        
        Alternate method to NAT instances.
        
        Create NAT gateway in public subnet
        
        Assign Elastic IP
        
        Assign it to main route table that is associated with private subnet and add a route which will connect to 0.0.0.0/0 via NAT Gateways
        
        NAT Gateway cannot span across AZ. So in case of multiple AZ, create a NAT gateway for each AZ
        
        It scales automatically. No need to patch, not in a Security group
        
        Network ACL
        
        Associate private subnet to default ACL. Default ACLallows all inbound and outbound traffic
        
        Create new ACL and associate public subnet
        
        Now edit inbound and outbound rules to ALLOW HTTP, HTTP(s), SSH, Network gateway traffic (1024-65535) part of Ephemeral ports with rule # as 100,200,300,400
        
        If you want to DENY , u have to put it explicitly. Use ACLs and not security group to block/deny
        
        Order of Rule # is key, they get executed in chronological order
        
        one Subnet can be associate with only 1 ACL..By default, all subnets are connected to default ACL
        
        Netowrk ACL are stateless i.e having inbound rules do not automatically creates out bound rules and Security group are stateful..
- - - - Cloud formation - Way to script the cloud formation
        
        Quick start is bunch of cloud formation templates created by AWS to create your complex environments.here you need scripting , JSON etc to come up with your application
      - Elastic Beanstalk - You upload /deploy your code /app and Beanstalk take care of everything. like what infra would app need, etc. You need not have any knowledge about AWS cloud here .It automatically handles details on capacity provisioning, loadbalancing, scaling, app health monitoring
        it auto comes to know what app it is PHP, Java, etc and corr infra it needs to provide based on it
      - Summary
        
        Application LB have Domain name, you are never given IP address
        
        Read Classic/ ELB based load balancers. FAQ/ Here you get the IP addresss byX- Forwarder For
        
        NLB are provided with 2 static IP address
        
        Sticky sessions (storing info locally to specifci instance), Cross Zone load balancing , Path Pattern
        
        Cloudformation, Quick start (Cloud form templates) , Elastic Bean Stalk