Please enable JavaScript.

Coggle requires JavaScript to display documents.

(AWS Cloud) - Coggle Diagram

- - - - Global infrastructure = Regions -> Availability Zones (AZs) -> edge locations / points of presence
      - Choose a Region by: latency, compliance/data residency, price, service availability
      - IAM = identities & permissions (global)
        
        Users / Groups / Roles / Policies; policies use JSON elements such as Effect, Action, Resource
        
        Role = temporary permissions for workloads; attach roles to EC2/Lambda instead of hard-coding long-term keys
        
        Policy types: AWS managed / customer managed / inline; apply least privilege
      - STS = temporary security credentials (for example AssumeRole)
        
        Cross-account access and role chaining
      - AWS access = Management Console | CLI | SDKs | CloudShell
        
        SDK credential providers can use role credentials; use retries with exponential backoff for throttling
    - - Families by workload (general, compute, memory, GPU)
      - Pricing: on-demand | spot (cheap, interruptible) | reserved/savings plan
      - User data = bootstrapping script at launch
      - Instance role = IAM permissions for the application on the instance
      - Security group = stateful virtual firewall; allow required application ports
      - AMI = image used to launch instances; Instance Store = ephemeral local disk
    - - Event-driven; 15 min max; memory sets CPU; /tmp scratch
      - Triggers: API Gateway, S3, SQS, SNS, EventBridge, DynamoDB Streams
      - Limits: 15 min max; /tmp scratch; memory setting affects CPU
      - Versions & aliases = stable pointers (prod/dev)
      - Concurrency: reserved (cap) vs provisioned (reduces cold-start impact)
      - Event source mapping = Lambda polls SQS/Kinesis Data Streams/DynamoDB Streams
      - Asynchronous failures can use destinations and DLQ
    - - Launch on Fargate (serverless) or EC2
      - Task definition = container image + CPU/memory + environment/config
      - Task role = application permissions; Execution role = pull images / write logs
    - - Use when you want the k8s ecosystem / portability
    - - Launch template + scaling policy (e.g. target tracking on CPU or request metrics)
      - Pairs with ELB health checks; replaces unhealthy instances
    - - Authenticate with get-login-password; image scanning can be enabled
    - - Deployment policies: all-at-once, rolling, rolling with additional batch, immutable, blue/green
      - .ebextensions = configuration files; environments can represent dev/test/prod
    - - API Gateway = managed front door for APIs
        
        API types: REST | HTTP | WebSocket
        
        Stages, throttling, and caching (REST); usage plans + API keys where supported
        
        Authorizers: IAM | Amazon Cognito | Lambda
        
        Mapping templates (VTL) can transform requests/responses
      - SAM = AWS Serverless Application Model on CloudFormation
        
        Transform: AWS::Serverless
        
        sam local for local testing
        
        sam deploy for deployment
      - CDK = define AWS infrastructure in programming languages -> CloudFormation
        
        Constructs
        
        cdk synth / cdk deploy
      - Step Functions = workflow orchestration using state machines
        
        Standard = long-running/durable workflows
        
        Express = high-volume, shorter workflows
      - AppSync = managed GraphQL API service
  - - - Least privilege
      - Use roles for AWS workloads instead of hard-coded access keys
      - Managed and inline policies
      - Policy evaluation is based on applicable identity/resource/session controls
    - - User Pools = user sign-in and token issuance including JWTs
      - Identity Pools = exchange authenticated/federated identities for temporary AWS credentials
      - Hosted UI
      - Federation options such as social identity providers and SAML/OIDC
    - - Envelope encryption
      - Symmetric vs asymmetric KMS keys
      - Key policies + IAM policies control use
      - Envelope encryption = data key encrypts data; KMS key encrypts the data key
    - - SCPs set permission guardrails for accounts/OUs
      - SCPs do not grant permissions by themselves
    - - Configuration history
      - Compliance rules
      - Resource relationships
    - - SecureString uses KMS
      - Standard vs Advanced parameters
      - Hierarchy paths for organization
    - - Useful for credentials/API secrets
      - Integrates with supported services such as RDS
    - - WAF evaluates web requests against rules
      - Shield provides DDoS protection at AWS edge/network layers
    - - At rest = often KMS-backed
      - In transit = TLS
  - - - AWS CodeCommit returned to General Availability and reopened to new customers on November 25, 2025
      - GitHub/GitLab remain common alternatives
      - IAM-integrated managed Git service for repositories
    - - buildspec.yml defines build phases such as install, pre_build, build, post_build
      - Build artifacts
      - Environment variables and secrets can come from Parameter Store / Secrets Manager
    - - In-place / blue-green
      - appspec.yml defines files and lifecycle hooks
      - Deployment strategies/configurations can include traffic shifting such as canary / linear / all-at-once where supported
    - - Typical flow: Source -> Build -> Test/Approval -> Deploy
      - Artifacts can be stored in S3
      - Stages/actions can start from source changes
      - Manual approval actions are supported
    - - Templates
      - Stacks
      - Change sets
      - Template -> Stack
      - Resources
      - Parameters
      - Outputs
      - Mappings
      - Change sets preview proposed updates
      - Drift detection finds differences from the template
      - Intrinsic functions include Ref, Fn::GetAtt / !GetAtt, Fn::Sub / !Sub
    - - npm
      - PyPI
      - Maven
  - - - Public vs private subnets
      - Security Groups (stateful) vs Network ACLs/NACLs (stateless)
      - VPC endpoints = private connectivity to supported AWS services such as S3 and DynamoDB without traversing the public internet
      - Lambda functions can attach to a VPC when they need private access to resources such as RDS or ElastiCache
    - - ALB = HTTP/L7 routing
      - NLB = TCP/L4, low latency
      - ALB = HTTP/HTTPS (Layer 7), path & host routing; routes to target groups
      - NLB = TCP/UDP/TLS (Layer 4), high performance/low latency; static IP support
      - Sticky sessions
      - X-Forwarded-For can carry the original client IP through proxies/load balancers
    - - Policies: simple, weighted, latency-based, failover, geolocation
      - Alias records can point supported AWS resources including at the zone apex
    - - Signed URLs
      - Signed cookies for private content
      - OAC = secure S3 origin access so the bucket can remain private
      - Cache behaviors by path
      - Invalidations purge cached objects
    - - Network-layer acceleration/failover
      - Does not cache content like CloudFront
  - - - Standard vs FIFO
      - Standard = at-least-once delivery and best-effort ordering; design consumers to be idempotent
      - FIFO = ordered processing with exactly-once processing semantics when configured correctly
      - Message groups enable FIFO parallelism
      - Visibility timeout
      - DLQ for messages that repeatedly fail processing
      - Long polling
      - Max SQS message size = 256 KB
    - - Message filtering
      - FIFO topics
      - Subscribers can include Lambda, SQS, HTTP/S, email, and SMS depending on topic/protocol support
      - SNS + SQS fan-out = classic decoupling pattern
    - - Shards
      - Ordered per key / partition-key ordering scope
      - Replay
      - Shards provide throughput in provisioned mode
      - On-demand mode manages capacity automatically
      - Retention = 24 hours by default; configurable up to 365 days
    - - Near real-time delivery
      - No shard management for the delivery stream
    - - Schedule / cron
      - SaaS + custom events
      - EventBridge Schemas can catalog event structure
    - - Use when application compatibility with traditional broker protocols/APIs is important
      - Examples: JMS / AMQP
    - - SQS = queue
      - SNS = pub/sub
      - Kinesis Data Streams = real-time stream + replay
      - Amazon MQ = broker compatibility
  - - - Data lake, backups, static site; up to 5 TB/object
      - Classes: Standard -> IA -> Glacier (cost vs retrieval)
      - Bucket versioning; static website hosting
      - Presigned URL = temporary upload/download access URL generated by an authorized signer
      - S3 Event Notifications -> Lambda / SQS / SNS; EventBridge can also react to S3 events
      - CORS = allow approved browser cross-origin requests
    - - Persistent; snapshots -> S3
    - - Windows File Server
      - Lustre (HPC)
      - NetApp ONTAP
      - OpenZFS
    - - Retrieval minutes to hours; lowest cost tier
    - - SSE-S3 (S3-managed keys) | SSE-KMS (KMS keys) | SSE-C (customer-provided keys)
      - Bucket policies and IAM policies can both control access; use S3 Block Public Access as a guardrail against unintended public access
      - Presigned URLs grant time-limited access according to the permissions of the signer and request
  - - - Multi-AZ = failover
      - Read replicas = scale read traffic asynchronously
      - IAM database authentication is available for supported engines
      - Encryption at rest can use KMS
    - - ~5x MySQL / 3x Postgres throughput; auto-scaling storage
      - Writer and reader endpoints
      - Aurora Serverless can automatically adjust capacity for variable/spiky workloads
    - - Single-digit ms
      - On-demand or provisioned
      - Partition key + optional sort key
      - GSI vs LSI
      - Streams
      - TTL
      - DAX
    - - Caching, sessions, leaderboards
      - Redis = persistence, replication, sorted sets (depending on engine/mode)
      - Memcached = simple, multi-threaded cache without persistence
      - Patterns: lazy loading, write-through, session storage
  - - - Pay per data scanned
    - - See Integration & Messaging
  - - - Custom metrics can be published with PutMetricData
      - Alarms can notify SNS
      - Alarms can drive Auto Scaling actions
      - Lambda execution logs can go to CloudWatch Logs
    - - Logs Insights provides query / analysis of log data
    - - Formerly CloudWatch Events
    - - Who did what, when
      - Management events vs data events
      - Use CloudTrail for API activity / audit trails
    - - Service map
      - Latency
      - Annotations are indexed
      - Metadata is not indexed