Please enable JavaScript.

Coggle requires JavaScript to display documents.

Ultimate AWS Certified Cloud Practitioner CLF-C02 - Coggle Diagram

- - - - Retention rules
  - - - Infrastructure
      - Replication
    - - Setting up backup procedures
      - Setting up data encryption
      - Responsibility of data on drives
      - Understand risk of EC2 instance store
  - - - Built on Windows File Server
      - Supports SMB protocol & Windows NTFS
      - Integrated with Microsoft Active Directory
    - - for High Performance Computing (HPC)
      - Lustre (Linux + cluster)
- - - - Can handle greater loads by adapting
      - Vertical
        
        Exemplo: passar de t2.micro para t2.large
        
        Very common for non distributed systems, such as a database
        
        There's a limit to how much (hardware limit)
        
        Increase the size of the instance (up/down)
      - Horizontal (= elasticity)
        
        Implies distributed systems
        
        Very common for web applications
        
        Easy to scale with EC2
        
        Increase the number of instances (in/out)
        
        Auto Scaling Group e Load Balancer
    - - Running app in at least 2 AZs
      - ASG e LB multi AZ
  - - - Spread load across multiple instances
      - Expose single point of access (DNS) to app
      - Seamlessly handle failures
      - Health check of instances
      - SSL termination
      - High availability across zones
    - - Managed load balancer
      - Tipos
        
        Application Load Balancer
        
        HTTP / /HTTPS / gRPC (Llayer 7)
        
        HTTP routing features
        
        Static DNS (URL)
        
        Network Load Balancer
        
        TCP / UDP (Layer 4)
        
        High performance
        
        Static IP through Elastic IP
        
        Gateway Load Balancer
        
        Route traffic to firewalls that you manage on EC2 instances
        
        Intrusion detection
        
        GENEVE Protocol on IP Packets (Layer 3)
        
        Classic Load Balancer (retired in 2023) - layer 4 e 7
  - - - Scale in/out
      - Ensure min/max nubers of machines running
      - Register new instances to LB
      - Replace unhealthy instances
    - - Maximum size
      - Actual size / desired capacity
      - Minimum size
  - - - Target tracking scaling (ex: average CPU at 40%)
      - scheduled scaling (ex: increase on Fridays)
      - Simple / step scaling (ex: add when CloudWatch alarm is triggered)
- - - - Use cases
        
        Backup an storage
        
        Disaster Recovery
        
        Archive
        
        ...
    - - Object (files) in buckets (directories)
      - Globally unique name
      - Defined at the region level
      - Naming convention
        
        No uppercase, no underscore
        
        3-63 characters long
        
        Not an IP
        
        Must start with lowercase letter or number
    - - Objects
        
        Key is the full path
        
        s3://my-bucket/my_file.txt (key=my_file.txt)
        
        s3://my-bucket/my_folder/another_folder/my_file.txt (key=my_folder/another_folder/my_file.txt)
        
        No concept of directories within buckets
        
        Maximum size: 5TB (5000GB)
        
        Metadata (key / value pairs)
        
        Tags
        
        Version ID
  - - - IAM Policies
    - - Bucket Policies
      - Object Access Control List (ACL)
      - Bucket Access Control List (ACL)
    - - Extra layer to prevent company data leaks
      - Can be set at the account level
  - - - Amazon S3 Glacier Instant Retrieval
      - Amazon S3 One Zone-Infrequent Access
      - Amazon S3 Glacier Flexible Retrieval
      - Amazon S3 Standard-Infrequent Access (IA)
      - Amazon S3 Glacier Deep Archive
      - Amazon S3 Intelligent Tiering
        
        Moves objects automatically between accesstiers based on usage
        
        Infrequent Access Tier (automatic): obj. not accessed for 30 days
        
        Frequent Access Tier (automatic): default
        
        Archive Instant Access Tier (automatic): obj. not accessed for 90 days
        
        Archive Access Tier (optional): configurable from 90 days to 700+ days
        
        Deep Archive Access Tier (optional): configurable from 180 days to 700+ days
      - Amazon S3 Standard - General Purpose
    - - 99.999999999%
      - Same for all storage classes
    - - Depends on storage class
      - S3 standard has 99.99% availability (53 min/year)
  - - - Server-Side Encryption
        
        Is always on
      - Client-Side Encryption
  - - - Infrastructure (global security, durability, availability, sustain concurrent loss of data in two facilities)
      - Configuration and vulnerability analysis
      - Compliance validation
    - - S3 versioning
      - S3 bucket policies
      - S3 replication setup
      - Logging and monitoring
      - S3 storage class
      - Data encryption at rest and in transit
  - - - Highly-secure, portable devices to collect and process data at the edge, and migrate data into and out of AWS
      - Data migration
        
        Snowcone
        
        Snowball Edge
        
        Snowmobile
      - Edge computing
        
        Snowcone
        
        Snowball Edge
    - - Limited / no internet
      - Limited / no computing power
    - - Para usar no lugar da CLI (que é muito difícil / complicada)
      - Software to manage Snow Family Device
  - - - On-premise
        
        Volume
        
        Tape
        
        File
      - Cloud
        
        Amazon EBS
        
        S3
        
        Glacier
      - Allow on-premises to seamlessly use the AWS Cloud
- - - - Scale the read workload of DB
      - Can create up to 15 read replicas
      - Data is only written to the main DB
    - - Failover in case of AZ outage (high availability)
      - Data is only read/written to the main database
      - Can only have 1 other AZ as failover
    - - Aplicações lêem do banco próximo (read replicas)
      - Aplicações escrevem no banco principal
      - Tem custo de replicação entre regiões
  - - - DynamoDB is a key/value database
    - - Fully managed in-memory cache for DynamoDB (only)
      - 10x performance improvement
      - Secure, highly scalable * highly available
    - - Fully Managed Highly available with replication across 3 AZ
      - NoSQL database - not a relational database
      - Scales to massive workloads, distributed “serverless” database
      - Millions of requests per seconds, trillions of row, 100s of TB of storage
      - Fast and consistent in performance
      - Single-digit millisecond latency — low latency retrieval
      - Integrated with IAM for security, authorization and administration
      - Low cost and auto scaling capabilities
      - Standard & Infrequent Access (IA) Table Class
  - - - Postgres
      - MySQL
      - MariaDB
      - Oracle
      - Microsoft SQL Server
      - IBM DB2
      - Aurora (AWS Proprietary Database)
    - - Automated provisioning, OS patching
      - Continuous backups and restore to specific timestamp
      - Monitoring dashboards
      - Read replicas for improved read performance
      - Multi AZ setup for DR (Disaster Recovery)
      - Maintenance windows for upgrades
      - Scaling capacility (vertical and horizontal)
      - Storagebacked by EBS
      - BUT you can't SSH into your instances
    - - Proprietary technology from AWS
      - PostgreSQL and MySQL supported as Aurora DB
      - Aurora is "AWS cloud optimized"
      - Aurora storage automatically grows up to 128 TB (10GB increments)
      - Costs more than RDS, but is more efficient
      - Not in the free tier
    - - Automated instantiation and auto-scaling
      - PostgreSQL and MySQL
      - No capacity planning needed
      - Least management overhead
  - - - Redshift is based on PostgreSQL, but it's not used for OLTP
      - It's OLAP — online analytical processing (analytics and data warehousing)
      - Load data once every hour, not every second
      - 10x better performance than other data warehouses, scale to PBs of data
      - Columnar storage of data (instead of row based)
      - Massively Parallel Query Execution (MPP), highly available
      - Pay as you go based on the instances provisioned
      - Has a SQL interface for performing the queries
      - BI tools such as AWS Quicksight or Tableau integrate with it
    - - Automatically provisions and scales data warehouse underlying capacity
      - Run analytics workloads without managing data warehouse infrastructure
      - Pay only for what you use (save costs)
      - Use cases: Reporting, dashboarding applications, real-time analytics...
  - - - Flexibility: easy to evolve data model
      - Scalability: designed to scale-out by using distributed clsuters
      - High-performance: optimized for a specific data model
      - Highly functional: types optimized for the data model
      - Examples: key-value, document, graph, in-memory, search databases
    - - Data can be nested
      - Fields can change over time
      - Support for new types:arrays, etc...
    - - AWS offers use to manage different databases
      - Benefits
        
        Quick Provisioning, High Availability, Vertical and Horizontal Scaling
        
        Automated Backup & Restore, Operations, Upgrades
        
        Operating System Patching is handled by AWS
        
        Monitoring, alerting
  - - - Business analytics
      - Building visualizations
      - Perform ad-hoc analysis
      - Get business insights using data
  - - - Join public blockchain networks
      - Or create your own scalable private network
  - - - Can be used by Athena, Redshift, EMR
  - - - Homogeneous migrations: ex Oracle to Oracle
      - Heterogeneous migrations: ex Microsoft SQL Server to Aurora
- - - - Apps run the same, regardless of where they're run
      - Software development platform to deploy apps
      - Scale containers up and down very quickly (seconds)
      - Apps are packaged in containerrs that can be run on any OS
    - - Docker Repositories
      - Public: Docker Hub
      - Private: Amazon ECR (Elastic Container Registry)
  - - - Elastic Container Service
      - Launch Docker containers on AWS
      - You must provision & maintain the infrastructure (the EC2 instances)
      - AWS takes care of starting / stopping containers
      - Has integrations with the Application Load Balancer
    - - Launch Docker containers on AWS
      - You do not provision the infrastructure (no EC2 instances to manage)
      - Serverless offering
      - AWS just runs containers for you based on the CPU / RAM you need
    - - Store your Docker images so they can be run by ECS or Fargate
      - Private Docker Registry on AWS
      - Elastic Container Registry
  - - - Serverless is a new paradigm in which the developers don't have to manage servers anymore...
      - They just deploy code
      - They just deploy... functions !
      - Initially... Serverless == FaaS (Function as a Service)
      - Serverless was pioneered by AWS Lambda but now also includes anything that's managed: databases, messaging, storage, etc.
      - Serverless does not mean there are no servers... it means you just don't manage / provision / see them
    - - S3
      - DynamoDB
      - Fargate
      - Lambda
  - - - Amazon EC2
        
        Virtual Servers in the Cloud
        
        Limited by RAM and CPU
        
        Continuously running
        
        Scaling means intervention to add / remove servers
      - Amazon Lambda
        
        Virtual functions — no servers to manage!
        
        Limited by time - short executions
        
        Run on-demand
        
        Scaling is automated!
    - - Easy Pricing:
        
        Pay per request and compute time
        
        Free tier of 1,000,000 AWS Lambda requests and 400,000 GBs of compute time
      - Integrated with the whole AWS suite of services
      - Event-Driven: functions get invoked by AWS when needed
      - Integrated with many programming languages
      - Easy monitoring through AWS CloudWatch
      - Easy to get more resources per functions (up to 10GB of RAM!)
      - Increasing RAM will also improve CPU and network!
  - - - Fully managed batch processing at any scale
      - Efficiently run 100,000s of computing batch jobs on AWS
      - A "batch" job is a job with a start and an end (opposed to continuous)
      - Batch will dynamically launch EC2 instances or Spot Instances
      - AWS Batch provisions the right amount of compute / memory
      - You submit or schedule batch jobs and AWS Batch does the rest!
      - Batch jobs are defined as Docker images and run on ECS
      - Helpful for cost optimizations and focusing less on the infrastructure
    - - Lambda
        
        Time limit
        
        Limited runtimes
        
        Limited temporary disk space
        
        Serverless
      - Batch
        
        No time limit
        
        Any runtime as long as it's packaged as a Docker image
        
        Rely on EBS / instance store for disk space
        
        Relies on EC2 (can be managed by AWS)
  - - - Simple web applications (has templates for LAMP, Nginx, MEAN, Node js...)
      - Websites (templates for WordPress, Magento, Plesk, Joomla)
      - Dev /Test environment
- - - - JS/TS
      - Python
      - Java
      - .Net
    - - Great for Lambda functions
      - Great for Docker containers in ECS/EKS
  - - - It uses all the components we've seen before: EC2, ASG, ELB, RDS, etc...
      - Beanstalk = Platform as a Service (PaaS)
      - Developer centric view of deploying an application on AWS
    - - Managed service
        
        Instance configuration / OS is handled by Beanstalk
        
        Deployment strategy is configurable but performed by Elastic Beanstalk
        
        Capacity provisioning
        
        Load balancing & auto-scaling
        
        Application health-monitoring & responsiveness
      - Just the application code is the responsibility of the developer
      - Three architecture models:
        
        Single Instance deployment: good for dev
        
        LB + ASG: great for production or pre-production web applications
        
        ASG only: great for non-web apps in production (workers, etc..)
      - Support for many platforms
        
        Go, Java, .Net, Node, PHP, Python, Ruby...
        
        Single container / multi-container / preconfigured docker
      - Health Monitoring
  - - - Infrastructure as code
      - Cost
      - Productivity
      - Don't reinvent the wheel
      - Support (almost) all AWS resources
  - - - Patching automation for enhanced compliance
      - Run commands across an entire fleet of servers
      - Store parameter configuration with the SSM Parameter Store
- - - - AAAA IPv6
      - CNAME: hostname to hostname
      - A record (IPv4)
      - Alias (ex: ELB, CloudFront, S3, rds, etc...)
    - - Simple routing policy (sem health check)
      - Weighted routing policy
      - Latency routing policy
      - Failover routing policy
  - - - Content Delivey Netowrk (CDN)
      - Improves read performance, content is cached at the edge
      - 216 points of presence globally (edge locations)
      - DDoS protection, integration with Shield, AWS Web Application Firewall
    - - S3 bucket
      - Custom origin (HTTP)
        
        EC2
        
        S3 webstire
        
        ALB
        
        Any HTTP backend you want
    - - CloudFront
        
        Global Edge network
        
        Files are cached for a TTL (maybe a day)
        
        Great for static content that must be available everywhere
      - S3 Cross Region Replication
        
        Must be set up for each region
        
        Files updated in near real-time
        
        Great for dynamic content that needs low-latency in few regions
- - - - Synchronous communications (application to application)
      - Asynchronous / Event based (application to queue to application)
    - - SNS (pub/sub model)
      - Kinesis (real-time data streaming model)
      - SQS (queue model)
  - - - Oldest AWS offering (over 10 years old)
      - Fully managed service (~serverless), use to decouple applications
      - Scales from 1 message per second to 10,000s per second
      - Default retention of messages: 4 days, maximum of 14 days
      - No limit to how many messages can be in the queue
      - Messages are deleted after they're read by consumers
      - Low latency (<10 ms on publish and receive)
      - Consumers share the work to read messages & scale horizontally
    - - Messages are processed in order by the consumer
  - - - Kinesis Data Streams: low latency streaming to ingest data at scale from hundreds of thousands of sources
      - Kinesis Data Firehose: load streams into S3, Redshift, ElasticSearch, etc...
      - Kinesis Data Analytics: perform real-time analytics on streams using SQL
      - Kinesis Video Streams: monitor real-time video streams for analytics or ML
- - - - EC2: CPU, status checks, network
      - EBS: disk read/writes
      - S3: BucketSizeBytes, NumberOfObjects, AllRequests
      - Billing: Total Estimated Charge (only in us-east-1)
      - Service Limits: how much you've been using a service API
      - Custom metrics: push your own metrics
    - - Metric is a variable to monitor (CPU utilization, netowrking...)
      - Metrics have timestamps
      - CloudWatch provides metrics for every service in AWS
    - - Alarms are used to trigger notifications for any metric
      - Various options (sampling, %, max, min, etc...)
      - Can choose the period on which to evaluate an alarm
      - Example: create a billing alarm on the CloudWatch Billing metric
      - Alarm States: OK. INSUFFICIENT_DATA, ALARM
      - Alarms actions...
        
        Auto Scaling: increase or decrease EC2 instances “desired” count
        
        EC2 Actions: stop, terminate, reboot or recover an EC2 instance
        
        SNS notifications: send a notification into an SNS topic
  - - - Enables real-time monitoring of logs
      - Adjustable CloudWatch Logs retention
      - CloudWatch Logs can collect log from:
        
        Elastic Beanstalk: collection of logs from application
        
        ECS: collection from containers
        
        AWS Lambda: collection from function logs
        
        CloudTrail based on fitter
        
        CloudWatch log agents: on EC2 machines or on-premises servers
        
        Route53: Log DNS queries
    - - By default, no logs from your EC2 instance will go to CloudWatch
      - You need to run a CloudWatch agent on EC2 to push the log files you want
      - Make sure IAM permissions are correct
      - The CloudWatch log agent can be setup on-premises too
  - - - Console
      - SDK
      - CLI
      - AWS Services
  - - - Log formats differ across applications and log analysis is hard.
      - Debugging: one big monolith “easy”, distributed services “hard”
      - No common views of your entire architecture
    - - Troubleshooting performance (bottlenecks)
      - Understand dependencies in a microservice architecture
      - Pinpoint service issues
      - Review request behavior
      - Find errors and exceptions
      - Are we meeting time SLA?
      - Where I am throttled?
      - Identify users that are impacted
  - - - Helps understand the runtime behavior of your application
      - Example: identify if your application is consuming excessive CPU capacity on a logging routine
      - Support applications running on AWS or on-premise
      - Minimal overhead on application
      - Features:
        
        Identify and remove code inefficiencies
        
        Improve application performance (e.g, reduce CPU utilization)
        
        Decrease compute costs
        
        Provides heap summary (identify which objects using up memory)
        
        Anomaly Detection
    - - Identify critical issues, security wulnerabilities, and hard-to-find bugs
      - Example: common cpdir&g best practices, resource leaks, security detection, input validation
      - Uses Machine Learning and automated reasoning
      - Hard-learned lessons across millions of code reviews on 1000s of open-source and Amazon repositories
      - Supports Java and Python
      - Integrates with GitHub, Bitbucket, and AWS CodeCommit
  - - - Shows all regions, all services health
      - Shows historical information for each day
      - Has an RSS feed you can subscribe to
      - Previously called AWS Service Health Dashboard
    - - Previously called AWS Personal Health Dashboard (PHD)
      - AWS Account Health Dashboard provides alerts and remediation guidance when AWS is experiencing events that may impact you.
      - While the Service Health Dashboard displays the general status of AWS services, Account Health Dashboard glvewou a personalized view into the performance and availability of the AWS services underlying your AWS resources.
      - The dashboard displays relevant and timely information to help you manage events in progress and provides proactive notification to help you plan for scheduled activities.
      - Can aggregate data from an entire AWS Organization
- - - - VPC, Subnets, Internet Gateways & NAT Gateways
      - Security Groups, Network ACL (NACL),VPC Flow Logs
      - VPC Peering,VPC Endpoints
      - Site to Site VPN & Direct Connect
      - Transit Gateway
  - - - Public IPv4, changes when EC2 is started
      - Private IPv4, fixed for EC2 even is you start/stop them
    - - Fixed public IPv4 address
      - Has cost if not attached or EC2 instance is stopped
    - - Every IP address s public
      - 3.4 x 10^38 addresses
  - - - Public subnet
      - Private subnet
      - Subnets (tied to AZ)
      - Route tables
      - VPC - Virtual Private Cloud
    - - Internet Gateways
      - Public subnets have a route to the internet gateway
      - NAT Gateways (AWS-managed) & NAT Instances (self-managed) allow your instances in your private subnets to access the internet while reamining private
  - - - Subnet level
      - ALLOW and DENY rules
      - IP addresses
    - - EC2 level
      - Only ALLOW rules
      - IP addresses and other security groups
  - - - Capture information about IP traffic
      - Helps to monitor & troubleshoot connectivity issues
    - - Connect two VPCs
      - Must no have overlapping CIDR
  - - - S3
      - DynamoDB
    - - For all thre rest
  - - - Encrypted
      - Goes over public internet
      - Customer Gateway (on-prem) e Virtual Private Gatway (AWS)
    - - Physical connection between on-premises and AWS
      - Goes over a private netowrk
      - Takes at least a month to establish
- - - - Customer responsibility - Security in the Cloud
      - Shared controls
        
        Patch management
        
        Configuration management
        
        Awareness & Training
      - AWS responsibility - Security of the Cloud
  - - - AWS Shield Advanced
        
        Optional, R$3k/month
        
        Protects against more sophisticated attacks
      - AWS WAF
        
        Protects from common web exploits (layer 7)
        
        Deploy on ALB, API Gateway, ClooudFront
        
        Can define a Web ACL
        
        IP, headers, body
        
        Geo-match
        
        Rate-limit
      - AWS Shield Standard
        
        Free, activated for every AWS customer
        
        Protection from SYN/UDP floods, reflection attacks, other layer3/4 attacks
      - CloudFront and Route 53
      - AWS Auto Scaling
  - - - EC2, NAT gateways, ELB
      - RDS
      - CloudFront
      - Aurora
      - API gateways
      - Lambda e Lambda Edge
      - Lightsail
      - Elastic Beanstalk
    - - DNS zone walking
      - DDoS, flooding
  - - - Encryption Opt-in
        
        Redshift
        
        S3
        
        RDS
        
        EBS
        
        EFS
      - Encryption automatically enabled
        
        CloudTrail logs
        
        S3 Glacier
        
        Storage Gateway
    - - Dedicated hardware (hardware security module)
      - You manage your encryption keys
      - HSM is tamper resistant
    - - Customer Managed Key
      - AWS Managed Key
      - AWS Owned Key
      - CloudHSM Key
  - - - ELB
      - CloudFront
      - API Gateway
  - - - CloudTrail
      - VPC Flow Logs
      - DNS Logs
  - - - Port scanning
      - DoS or DDoS
      - Intrusion attempts
      - Spam
      - Hosting objectionable or copyrighted content
      - Distributing malware
  - - - Change account settings
      - View certain tax invoices
      - Close your AWS account
      - Restore IAM user permissions
      - Change or cancel your AWS Support Plan
      - ...
  - - - IAM roles
      - KMS keys
      - S3
      - Lambda functions and layers
      - SQS queues
      - Secrets Manager Secrets
- - - - Automatic Speech Recognition (ASR) to convert speech to text
      - Recognizes the intent of text, callers
    - - Cloud-based virtual contact center
      - Receive calls, create contact workflows
- - - - Consoliated billing
      - Pricing benefits from aggregated usage
      - Pooling of reserved EC2 instances
    - - Department
      - Cost center
      - Dev / test / prod
      - ...
    - - Applied at the OU or Account level
      - Does not apply to the Master Account
      - Whitelist or blacklist IAM actions
      - Applied to all the Users and Roles of the Account, including Root
  - - - Reserved instances
      - Saving plans
      - Volume pricing
  - - - Automate ongoing policy management
      - Detect policy violations
      - Monitor compliance
      - Automate the set up of the environment
  - - - VPC subnets
      - Transit gateways
      - Route 53
      - Aurora
      - EC2 Dedicated hosts
  - - - Save when you reserve
      - Pay less by using more
      - Pay as you go
      - Pay less as AWS grows
    - - Free services
        
        IAM
        
        VPC
        
        Consolidated billing
      - Free but pay what is created
        
        Elastic Beanstalk
        
        CloudFormation
        
        Auto Scaling Group
      - Free tier
        
        EC2 t2.micro for a year
        
        S3, EBS, ELB, AWS Data Transfer
    - - Spot instances: bid for unused capacity (may lose it)
      - Dedicated host: 1 or 3 years commitment
      - Reserved instances: 1 or 3 years commitment
      - Saving plans
      - On-demand instances
    - - Use private IP
      - Use same AZ
  - - - Cost allocation tags
      - Cost and usage reports
      - Cost explorer
      - Billing dashboard
    - - Billing alarms
      - Budgets
    - - Pricing calculator
  - - - Free tier dashboard
      - High level overview
    - - Tag Editor
  - - - Create budget and send alarms
      - 4 types of budgets: Usage, Cost, Reservation, Savings Plans
  - - - Performance
      - Security
      - Fault tolerance
      - Cost optimization
      - Service limits
      - Operational excellence
    - - Full set of checks
      - AWS Support API
  - - - Business hours email access to Cloud Support Associates
    - - Trusted Advisor (full set of checks) + API
      - 24x7 phone, email and chat access to Cloud Support Engineers
    - - AWS Trusted Advisor (only 7 checks)
      - AWS Personal Health Dashboard
      - Customer Service & Communities
    - - Technical Account Managers (TAM)
      - Concierge Support Team (for billing and account best practices)
      - Infrastructure Event Management, Well-Architected & Operations Reviews
    - - Designated Technical Account Manager (TAM)
- - - - Found on any Windows Server with AD Domain Services
      - Database of objects: user accounts, computers, printers, file shares, security groups
      - Centralized security management, create account, assign permissions
    - - AWS Managed Microsoft AD
        
        Create AD in AWS
        
        Establish "trust" connections with on-prem AD
      - AD Connector
        
        Proxy to redirect to on-prem AD
      - Simple AD
        
        AD-compatible managed directory on AWS
  - - - Built-in identity store in IAM Identity Center
      - 3rd party: AD, OneLogin, Okta...
    - - AWS accounts in AWS Organizations
      - Business cloud applications (e.g., Salesforce, Box, Microsoft 365...)
      - SAML2.0-enabled applications
      - EC2 Windows Instances
- - - - Full version of the app in cloud, but at minimum size
      - Increase the size when needed (DR)
    - - Most expensive
      - Full version of the app, at full size in cloud
    - - Run core functions of the app in the cloud (e.g. the database)
      - Ready to scale, but minimal setup
    - - Cheapest
      - Backup da app na cloud
  - - - Agentless Discovery (AWS Agentless Discovery Connector)
      - Agent-based Discovery (AWS Application Discovery Agent)
      - Plan migration projects by gathering information about on-prem data centers
    - - Lift-and-shift (rehost) solution
- - - - Test systems at production scale
      - Automate to make architectural experimentation easier
      - Stop guessing your capacity needs
      - Allow for evolutionary architectures
        
        Design based on changing requirements
      - Drive architecture using data
      - Improve through game days
        
        Simulate applications for flash sales days
    - - Disposable Resources: servers should be disposable & easily configured
      - Automation: serverless, IaaS, auto scaling...
      - Scalability: vertical & horizontal
      - Loose coupling
        
        Monolith
        
        Break it down into smaller, loosely coupled components
        
        A change or a failure in one component should not cascade to other components
      - Services, not servers
        
        Don't use just EC2
        
        Use managed services, databases, serverless, etc
    - - Security
      - Reliability
      - Operational excellence
      - Performance efficiency
      - Cost optimization
      - Sustainability
  - - - People
      - Governance
      - Business
      - Platform
      - Security
      - Operations
    - - Technology
      - Process
      - Organization
      - Product
    - - Align
      - Launch
      - Envision
      - Scale
  - - - AWS Forums
      - AWS Whitepapers & Guides
      - AWS Blogs
      - AWS Partner Solutions
      - AWS Solutions
  - - - Quickly find professional help for your AWS projects
      - Like a freelance platform
    - - Community forum
      - AWS-managed Q&A service
      - Part of the AWS Free Tier