Please enable JavaScript.

Coggle requires JavaScript to display documents.

AWS Cloud Components - Coggle Diagram

- - - - EC2 = resizable virtual servers
      - Dependencies
        
        User data = boot script (runs once at launch)
        
        Instance role = creds for your app on the box
        
        Security group = allow app ports (stateful)
        
        AMI = image to launch from
        
        Instance Store = ephemeral disk
      - Pricing: on-demand | spot (cheap, interruptible) | reserved/savings plan
    - - Fargate = serverless compute for containers (no nodes to manage)
      - AWS manages underlying capacity, not the user
      - Pay for requested task resources
  - - - Lambda = run code serverless, pay per ms
      - Triggers: API Gateway, S3, SQS, SNS, EventBridge, DynamoDB Streams
      - Versions & aliases = stable pointers (prod/dev)
      - Event source mapping = Lambda polls SQS/Kinesis Data Streams/DynamoDB Streams
      - Limits: 15 min max; /tmp scratch; memory setting affects CPU
    - - Workflow
        
        Standard = long-running/durable workflows
        
        Express = high-volume, shorter workflows
      - Step Functions = workflow orchestration using state machines
      - Performs work, often by calling Lambda or another AWS service
  - - - ECS = AWS-native container orchestrator
      - Task definition = container image + CPU/memory + environment/config
      - Task role = application permissions; Execution role = pull images / write logs
      - Launch on Fargate (serverless) or EC2
    - - Use when you want the k8s ecosystem / portability
      - EKS = managed Kubernetes
    - - Batch = run batch / HPC jobs at scale (queues + compute envs)
      - Concepts
        
        Job: Actual job to perfom
        
        Job queue: Pending submitted jobs
        
        Compute Environment: EC2/Fargate
    - - Deployment policies: all-at-once, rolling, rolling with additional batch, immutable, blue/green
      - .ebextensions = config files; environments dev/prod
      - Elastic Beanstalk = deploy applications while AWS provisions/manages the underlying environment (PaaS)
- - - - Bucket versioning; static website hosting
      - Data lake, backups, static site; up to 5 TB/object
    - - S3 Glacier / S3 Deep Archive = cheap cold archive
    - - SSE-S3 (S3-managed keys) | SSE-KMS (KMS keys) | SSE-C (customer-provided keys)
      - Bucket policies and IAM policies can both control access; use S3 Block Public Access as a guardrail against unintended public access
      - Presigned URLs grant time-limited access according to the permissions of the signer and request
      - CORS = allow approved browser cross-origin requests
- - - - Cloudwatch = Monitor CPU, memory, errors, latency, requests...
      - EC2 CPUUtilization, Lambda Errors, Lambda Duration, RDS DatabaseConnections, ALB RequestCount
      - CloudWatch Alarms: Did something cross a threshold?
    - - CloudWatch Logs = store and analyze log messages.
      - Log Group: Collection of logs
        Log Stream: sequence of logs from a source/context
      - CloudWatch Logs Insights: Search and analyze logs
- - - - Security Groups (stateful) vs Network ACLs/NACLs (stateless)
      - VPC endpoints = private connectivity to supported AWS services such as S3 and DynamoDB without traversing the public internet
      - Lambda functions can be attached to a VPC when they need private access to resources such as RDS or ElastiCache
      - VPC = isolated private network (the foundation) that includes Public/Private subnets
      - Subnets = Private/Public container where resources(EC2, LB...) live
    - - AWS Direct Connect = private dedicated line to AWS (bypass internet)
      - On-premises Network → Direct Connect → AWS echosyst
  - - - Launch template + scaling policy (e.g. target tracking on CPU or request metrics)
      - Pairs with ELB health checks; replaces unhealthy instances
      - ASG (Auto Scaling Group) = auto scale EC2 instances in/out
  - - - Alias records can point supported AWS resources including at the zone apex
      - Route 53 = DNS + routing policies + health checks
      - Policies: simple, weighted, latency-based, failover, geolocation
    - - Signed URLs, Signed cookies for private content
      - OAC = secure S3 origin access so the bucket can remain private
      - Cache behaviors by path, Invalidations purge cached objects
      - CloudFront = global CDN edge cache
    - - Network-layer acceleration/failover
      - Does not cache content like CloudFront
      - AWS Global Accelerator = static anycast IPs -> optimal AWS Region endpoint based on health and network performance
  - - - API types: REST | HTTP | WebSocket
      - Stages, throttling, and caching (REST); usage plans + API keys where supported
      - Authorizers: IAM | Amazon Cognito | Lambda
      - Mapping templates (VTL) can transform requests/responses
      - API Gateway = managed front door for APIs
    - - AppSync = managed GraphQL API service
      - Suitable for Data-driven applications
      - AppSync connects to data sources (DynamoDB, Lambda, OpenSearch ..)
- - - - Standard (Maximum throughput / at-least-once)
      - FIFO (ordered, exactly-once)
    - - Short polling: Continuously request for messages
      - Long polling: Request once, and wait for a message
  - - - Retention 1-365 days; multiple consumers replay
      - Shards = throughput; ordered per partition key (window)
      - Kinesis Data Streams = real-time streaming
    - - Near real-time; no shard management
      - Kinesis Data Firehose = load streams to S3/Redshift/OpenSearch
- - - - Identity Pools = Temporary AWS credential for AWS resource access
      - User Pools = User directory + authentication + JWTs
  - - - Customer managed key (Owned by user)
      - AWS managed key (Owned by AWS for AWS svc)
      - AWS owned key (automatically by default)
- - - - CloudFormation = AWS-native IaC (templates, stacks, change sets)
      - Declarative = Just express the need without giving step-by-step info
      - Template
        
        YAML/JSON
        
        AWS SAM
        
        SAM is mainly for serverless (YAML/JSON)
        
        SAM CLI: sam build | sam local | sam deploy
        
        SAM = AWS Serverless Application Model.
        
        CDK
        
        CDK = AWS Cloud Development Kit
        
        Used for General AWS infrastructure (Python, Java, Go, Typescript, Javascript, C#)
        
        CDK gives you abstractions and reusable constructs.
    - - Terraform = multi-cloud IaC (HashiCorp), common with AWS
      - use HashiCorp Configuration Language (HCL)
      - Terraform code = Actual infrastructure configs
        Terraform plan = what need to be changed
        Terraform apply = apply the changes