Please enable JavaScript.

Coggle requires JavaScript to display documents.

AWS CP, Services, Customer Service, Best practices, Security, Types of…

- - - - S3 Intelligent Tierung
        
        is designed to optimize bosts by automatically moving data to the most cost-effective access tier, without performance impact or operational overhead
        
        works by storing objects in two access tiers
        
        one tier that is optimized for frequent access
        
        a lower-cost tier that is optimized for infrequent access
        
        costs a small monthly monitoring and automation fee per object
        
        S3 monitors access patterns of the objects in S3-Intelligent Tiering, and moves the ones that have not been accessed for 30 consecutive days to the infrequent access tier
        
        If an object in the infrequent access tier is accessed, it is automatically moved back to the frequent access tier
        
        There are no retrieval fees when using S3 intelligent-tiering storage class, and no additional tiering fees when objects are moved between access tiers
        
        it is the ideal storage class for long-lived data with access patterns that are unknown or unpredictable.
      - S3 Standard
        
        offers high durability, availability, and performance object storage for frequently accessed data
      - S3 Standard-Infrequent Access
        
        S3 Standard-IA
        
        is for data that is accessed less frequently, but requires rapid access when needed
      - S3 Glacier
        
        low-cost storage class for data that is rarely accessed; such as archived data
  - - - is a MySQL and PostgreSQL-compatible relational database built for the cloud
      - combines the performance and availability of traditional enterprise databases with the simplicity and cost-effectiveness of open source databases
      - delivers up to five times the throughput of standard MySQL and up to three times the throughput of standard PostgreSQL
      - is designed to be compatible with MySQL and with PostgreSQL, so that existing applications and tools can run without requiring modification
      - is available through Amazon Relational Database Service (RDS), freeing you from time-consuming administrative tasks such as provisioning, patching, backup, recovery, failure detection, and repair
      - is a MySQL and PostgreSQL-compatible relational database NOT a key-value database
  - - - are used for non-structured data that are typically stored in JSON-like, key-value documents
  - - - is a petabyte-scale data transport solution that uses devices designed to be secure to transfer large amounts of data into and out of the AWS Cloud
      - addresses common challenges with large-scale data transfers including high network costs, long transfer times, and security concerns
      - to migrate analytics data, genomics data, video libraries, image repositories, backups, and to archive part of data center shutdowns, tape replacement or application migration projects
      - Transferring data with Snowball is simple, fast, more secure, and can be as little as one-fifth the cost of transferring data via high-speed Internet
    - - is the exabyte-scale data migration service that allows you to move very large datasets from on-premises to AWS
      - An Exabyte-scale data transfer service that allows you to move extremely large amounts of data to AWS
    - - helps you migrate databases to AWS easily and securely
      - source database remains fully operational during the migration, minimizing downtime to applications that rely on the database
      - can migrate your data to and from most widely used commercial and open-source databases
      - supports homogeneous migrations such as Oracle to Oracle, as well as heterogeneous migrations between different database platforms, such as Oracle to Amazon Aurora or Microsoft SQL Server to MySQL
      - also allows you to stream data to Amazon Redshift from any of the supported sources including Amazon Aurora, PostgreSQL, MySQL, MariaDB, Oracle, SAP ASE, and SQL Server, enabling consolidation and easy analysis of data in the petabyte-scale data warehouse
      - can also be used for continuous data replication with high availability
- - - - AWS Management Console
      - AWS SDKs
      - command line tools
      - other AWS services
      - event history simplifies security analysis, resource change tracking and troubleshooting
  - - - Examples of built-in rules include checking for remote root login being enabled, or vulnerable software versions installed
      - These rules are regularly updated by AWS security researchers
      - To help get started quickly, Amazon Inspector includes a knowledge base of hundreds of rules mapped to common security best practices and vulnerability definitions
  - - - a collection of IAM users - within the same AWS account - that are managed as a unit
      - let customers specify permissions for multiple users, which can make it easier to manage the permissions for those users
    - - Specific individuals, can receive personal logins
    - - Low level permission to resources (Allow or Deny)
    - - Collection of policies (DB Read, DB Write)
    - - Least privilege
      - be careful when editing policies
  - - - Subdivision of the VPC
      - A subnet is a range of IP addresses in your VPC.
    - - means to allow subnet to allow access to public internet
      - means to allow public internet to acces a resource
    - - Access Control Lists
      - specify rules for controlling access
    - - can use the Amazon Virtual Private Cloud console to launch AWS resources, such as Amazon EC2 instances
      - You can use it to specify an IP address range for the VPC, add subnets, associate security groups, and configure route tables
- - - - Core security checks
        
        Security groups - specific parts unrestricted
        
        checks security groups for rules that allow unrestricted access to specific ports
        
        unrestricted access increases opportunities for malicious activity
        
        hacking
        
        denial-of-service attacks
        
        loss of data
        
        Amazon S3 Bucket Permissions
        
        Checks buckets in Amazon S3 that have open access permission
        
        Bucket permissions that grant List access to everyone can result in higher than expected charges oif objects in the bucket are listed by unintended users at a high frequency
        
        Bucket permissions that grant Upload/Delete access to everyone create potential security vulnerabilities by allowing anyone to add, modify, or remove items in a bucket
        
        examines explicit bucket permissions and associated bucket policies that might override the bucket permissions
        
        MFA on Root Account
        
        Checks the root account and warns if NFA is not enabled
        
        multi-factor authentication
        
        for increased security, AWS recommends that you protect your account by using MFA
        
        requires a user to enter a unique authentication code from their MFA hardware or virtual device when interacting with the AWS console and associated websites
- - - - build REST endpoints and back them with any infrastructure that you choose (EC2, ECS fleet, Lambda, ...)
      - has a permissioning system
      - throttling (rate of requests)
    - - simple notification service
      - broadcast a message to an SNS topic
      - consumers subscribe their queue to SNS topic => get informed and can process it at their own rate
      - great pubsub solution
      - is a fully managed pub/sub messaging service
      - enables you to decouple microservices, distributed systems, and serverless applications
      - Using Amazon SNS topics, your publisher systems can fan out messages to a large number of subscriber endpoints for parallel processing, including AWS Lambda functions, and HTTP/S webhooks. Additionally, SNS can be used to fan out notifications to end users using mobile push, SMS, and email.
    - - simple queue service
      - is the subscriber in the SNS topic
      - is used to ensure that messages between software components are not lost if one or more components fai
      - is a fully managed message queuing service that enables you to send, store, and receive messages between software components at any volume, without losing messages or requiring other services to be available
      - lets you decouple application components so that they run independently, increasing the overall fault tolerance of the system
      - Multiple copies of every message are stored redundantly across multiple availability zones so that they are available whenever needed
    - - is a flexible, affordable, and highly-scalable email messaging platform for businesses and developers
  - - - Metrics
        
        assess metrics that are being emitted
        
        how are services doing
        
        faults
        
        latency
        
        spikes
        
        error rates
        
        low traffic times
        
        there is a UI with graphs
      - Alarms
        
        can be set up
        
        can email, page, text you when threshold is reached
        
        high-availability
      - Dashboards
        
        can be constructed
        
        how is service doing?
        
        graph that tell what is going on
- - - - is not a MySQL database service
  - - - put data to a stream
      - handle all out-of-order events
      - handle time window queries
    - - put events to a stream
      - batch stream into big (e.g. 5 MB) batches with a big list of data inside of it so it can be processed at once
    - - enables you to securely stream video from connected devices (IoT devices) to AWS for analytics, machine learning (ML), playback, and other processing. Kinesis Video Streams automatically provisions and elastically scales all the infrastructure needed to ingest streaming video data from millions of devices. It durably stores, encrypts, and indexes video data in your streams, and allows you to access your data through easy-to-use APIs.
  - - - takes care of these tasks so you can focus on analysis
- - - - Accelerate static website content delivery.
        
        CloudFront can speed up the delivery of your static content (for example, images, style sheets, JavaScript, and so on) to viewers across the globe. By using CloudFront, you can take advantage of the AWS backbone network and CloudFront edge servers to give your viewers a fast, safe, and reliable experience when they visit your website.
      - Live & on-demand video streaming
        
        The Amazon CloudFront CDN offers multiple options for streaming your media – both pre-recorded files and live events – at sustained, high throughput required for 4K delivery to global viewers.
      - Security
        
        CloudFront integrates seamlessly with AWS Shield for Layer 3/4 DDoS mitigation and AWS WAF for Layer 7 protection.
      - Customizable content delivery with Lambda@Edge
        
        Lambda@Edge is a feature of Amazon CloudFront that lets you run code closer to users of your application, which improves performance and reduces latency.
- - - - achieve high-availability
      - distribute traffic over a fleet of many EC2 machines
      - is a service that distributes the incoming application traffic to multiple targets that you define
      - distributes incoming application traffic across multiple targets, such as Amazon EC2 instances, containers, IP addresses, and Lambda functions
      - do not scale resources
    - - scale EC2 machine up or down in response to demand
      - maintain elasticity
      - keep costs down
      - is the feature that automates the process of adding/removing server capacity (based on demand)
      - allows you to reduce your costs by automatically turning off resources that aren’t in use
      - ensures that your application runs effectively by provisioning more server capacity if required
    - - helps plan for suture EC2 usage
      - shows historical EC2 instance usage
      - designed to make it easier for you to track and better manage your EC2 usage and spending
    - - On-demand
        
        Per-second billing
        
        no startup or termination fees associated with Amazon EC2
        
        you pay for compute capacity by the hour or the second depending on which instances you run
        
        you only pay for the compute capacity you consume, and once you stop using them, there are no additional costs or termination fees
        
        pay-as-you-go
        
        you pay for compute capacity by the hour or second (minimum of 60 seconds) with no long-term commitments
        
        can increase or decrease your compute capacity depending on the demands of your application and only pay for what you use
        
        frees you from the costs and complexities of planning, purchasing, and maintaining hardware and transforms what are commonly large fixed costs into much smaller variable costs
        
        remove the need to buy “safety net” capacity to handle periodic traffic spikes
        
        example application: run a questionnaire application for only one day (without interruption)
      - Reserved Instance (RI)
        
        types
        
        Standard
        
        can be modifed (but not exchanged)
        
        most significant discount (up to 72% off On-Demand)
        
        best suited for steady-state usage
        
        Convertible
        
        There are no limits to how many times you perform an exchange, as long as the new Convertible Reserved Instance is of an equal or higher value than the original Convertible Reserved Instances that you are exchanging
        
        exchange the purchased reserved instance for another reserved instance with higher computing power if they need to
        
        you can exchange one or more Reserved Instances for another Reserved Instance with a different configuration, including instance family, operating system, and tenancy
        
        are recommended to customers that can commit to using EC2 over a 1 or 3-year term to reduce their total computing costs
        
        even if the project will last for more than a year, the cost-benefit for acquiring RIs is not as great as the cost-benefit from using Spot instances
        
        the shortest reservation length is one year
      - Spot instances
        
        provide a discount (up to 90%) off the On-Demand price
        
        price is determined by long-term trends in supply and demand for EC2 spaare capacity
        
        If price exceeds the maximum price you specified for a given instance or if capacity is no longer available, your instance will automatically be interrupted
        
        are cost-effective choice if you can be flexible about when your applications run and if you don't mind if your applications get interrupted.
        
        well suited for: data analysis, batch jobs, background processing, and optional tasks
        
        For the application: Consistent uptime is not an issue, and continuous processing is not required
      - Dedicated instances
        
        used when you need your instances to be physically isolated at the host hardware level from instances that belong to other AWS accounts
        
        more expensive than Spot instances
    - - is a physical server with EC2 instance capacity fully dedicated to your use
      - Dedicated Hosts can save you money by enabling you to leverage your existing server-bound software license investments (e.g., Windows Server, Windows SQL Server, and SUSE Linux Enterprise Server) within EC2, subject to your license terms
      - give you more flexibility, visibility, and control over the placement of instances on dedicated hardware. This makes it easier to ensure you deploy your instances in a way that meets your compliance and regulatory requirements.
- - - - provides technical expertise for the full range of AWS services and obtains a detailed understanding of your use case and technology architecture
      - work with AWS Solution Architects to help you launch new projects and give best practices recommendations throughout the implementation life cycle
      - is the primary point of contact for ongoing support needs, and you have a direct telephone line to your TAM
    - - is a structured program available to Enterprise Support customers
      - helps you plan for large-scale events such as product or application launches, infrastructure migrations, and marketing events
      - you get strategic planning assistance before your event, as well as real-time support during these moments that matter most for your business
      - is a short-term engagement with AWS Support
      - partners with your technical and project resources to gain a deep understanding of your use case and provide architectural and scaling guidance for an event
      - Common use-case examples for AWS Event Management include advertising launches, new product launches, and infrastructure migrations to AWS
      - provides the company with architectural and scaling guidance
    - - helps enterprise customers plan migration projects by gathering information about their on-premises data centers
  - - - by paying additional fee, respectively subscribing to a package
- - - - You are receiving unwanted emails from an AWS-owned IP address, or AWS resources are being used to spam websites or forums.
    - - Your logs show that one or more AWS-owned IP addresses are sending packets to multiple ports on your server, and you believe this is an attempt to discover unsecured ports.
    - - Your logs show that one or more AWS-owned IP addresses are being used to flood ports on your resources with packets, and you believe this is an attempt to overwhelm or crash your server or software running on your server.
    - - Your logs show that one or more AWS-owned IP addresses are being used to attempt to log in to your resources.
    - - You have evidence that AWS resources are being used to host or distribute illegal content or distribute copyrighted content without the consent of the copyright holder.
    - - You have evidence that AWS resources are being used to distribute software that was knowingly created to compromise or cause harm to computers or machines on which it is installed.
- - - - ELB
      - Amazon Route 53
    - - Auto scaling
      - Amazon EC2 auto-recovery feature
      - AWS OpsWorks
      - AWS Elastic Beanstalk
- - - - managed services such as Amazon Elastic MapReduce (Amazon EMR) and DynamoDB, AWS is responsible for performing all the operations needed to keep the service running
- - - - You can do so using both private, high speed networking and public internet connections to provide an additional layer of business continuity, or to provide low latency access across the globe.
  - - - Availability Zones offer AWS customers an easier and more effective way to design and operate applications and databases, making them more highly available, fault tolerant, and scalable than traditional single datacenter infrastructures or multi-datacenter infrastructures