AWS Services and Architecture

119 flashcards by MentisLibrary

The core AWS services and how they fit together: EC2 and Auto Scaling, S3 and EBS, RDS and DynamoDB, VPC networking, IAM and KMS, Lambda, SQS and SNS, CloudWatch, and ECS, for developers and engineers building on AWS.

What is an AWS Region?
A separate geographic area containing multiple isolated Availability Zones. Most services are regional: resources and data in one Region do not appear in another unless you copy them.
What is an Availability Zone (AZ)?
One or more discrete data centers with independent power, cooling and networking inside a Region, linked to the other AZs by low-latency private fiber.
Edge location
A site in the AWS global edge network, separate from Regions, where CloudFront caches content, Route 53 answers DNS and Global Accelerator terminates traffic close to users.
Shared responsibility model
AWS is responsible for security OF the cloud (facilities, hardware, hypervisor, managed service software); the customer is responsible for security IN the cloud (data, IAM, guest OS patching, network configuration, encryption choices).
ARN
Amazon Resource Name, the unique identifier for any AWS resource, in the form arn:partition:service:region:account-id:resource.
AWS CloudFormation
The native infrastructure-as-code service: you describe resources in a YAML or JSON template and CloudFormation creates, updates and deletes them together as a stack.
AWS Organizations
A service for managing many AWS accounts as one unit: a management account, organizational units (OUs), consolidated billing and service control policies (SCPs).
How do you make a web tier highly available on AWS?
Stateless instances in an Auto Scaling group spread across at least two AZs, behind a load balancer, with session state moved to ElastiCache or DynamoDB.
Three-tier architecture on AWS
Public subnets hold the load balancer; private subnets hold the application instances; isolated private subnets hold the database with no route to the internet.
Static website on AWS
Store the files in an S3 bucket, serve them through CloudFront with an origin access control, terminate TLS with an ACM certificate and point a Route 53 alias record at the distribution.
Decoupling with a queue
Put SQS between a producer and a consumer so bursts are absorbed, failures are retried and the two sides scale independently.
Amazon EC2
Elastic Compute Cloud: resizable virtual servers (instances) you launch from an AMI, choosing an instance type, network placement and storage.
How is an EC2 instance type name read?
Family, generation, optional attribute letters, then size: in m6g.large, m is general purpose, 6 the generation, g Graviton (ARM), large the size.
EC2 instance families by first letter
t burstable, m general purpose, c compute optimized, r memory optimized, x and u very large memory, i and d storage optimized, p and g GPU accelerated.
AMI
Amazon Machine Image: a template containing the root volume snapshot, launch permissions and block device mapping used to launch instances.
EC2 user data
A script or cloud-init directive passed at launch that runs once, as root, on the first boot.
Instance Metadata Service (IMDS)
An HTTP endpoint at 169.254.169.254, reachable only from inside the instance, that reveals its ID, AZ, IAM role credentials, user data and more.
EC2 purchase options
On-Demand (no commitment), Savings Plans and Reserved Instances (1 or 3 year commitment for a discount), Spot (spare capacity at a steep discount, reclaimable), Dedicated Hosts (a physical server, mainly for licensing).
Spot Instances
Spare EC2 capacity sold at a discount of up to 90% that AWS can reclaim with a two-minute interruption notice.
Auto Scaling group (ASG)
A logical group of EC2 instances kept between a minimum and maximum size, replacing unhealthy instances and scaling on policies, launched from a versioned launch template.
Scaling policy types
Target tracking (hold a metric at a value), step scaling (add N instances per alarm breach band), simple scaling, scheduled scaling (by time) and predictive scaling (forecast from history).
Elastic Load Balancing types
Application Load Balancer (layer 7, routes HTTP by path, host or header), Network Load Balancer (layer 4, TCP/UDP/TLS, static IP per AZ, very high throughput), Gateway Load Balancer (layer 3, for virtual appliances).
Target group
The set of registered targets (instances, IP addresses or Lambda functions) that a load balancer listener rule forwards to, with its own health check settings.
AWS Lambda
Run code without provisioning servers: upload a function, choose a memory size, and Lambda runs it in response to events, billing per millisecond of execution.
Amazon S3
Simple Storage Service: durable object storage where objects (up to 5 TB each) live in buckets with globally unique names and are addressed by key, not by directory.
S3 durability and consistency
Designed for 99.999999999% (eleven nines) durability by storing objects across at least three AZs, with strong read-after-write consistency for all operations since December 2020.
S3 storage classes
Standard, Standard-IA and One Zone-IA (infrequent access), Intelligent-Tiering (automatic tiering per object), Glacier Instant Retrieval, Glacier Flexible Retrieval and Glacier Deep Archive (archival).
S3 lifecycle rules
Bucket-level rules that transition objects to another storage class or expire (delete) them after a number of days, optionally filtered by prefix or tag.
S3 Versioning
Keeps every version of an object in the bucket; a delete adds a delete marker rather than removing data.
S3 bucket policy vs IAM policy
A bucket policy is a resource-based policy attached to the bucket that can grant access to other accounts or the public; an IAM policy is attached to a principal and only works for that account's identities.