Muhammad Raza
Hire me
aws

AWS Certification Notes for Cloud Practioner

My study notes for the AWS Cloud Practitioner exam: cloud basics, global infrastructure, EC2, S3, RDS, Lambda, pricing models, billing, and support plans.

Muhammad Raza · 22 min read #aws

These are my study notes for the AWS Cloud Practitioner exam: a reference on the core services, pricing, and security concepts the exam covers.

AWS Cloud Practioner

People mostly use this certification to get a working understanding of AWS services.

Where you can take this exam ?

You can take this exam on Pearson VUE online.

  • Costs $100
  • 90 mins
  • 65 Questions
  • 70% passing score
  • Valid for 3 years.

Exam Guide

The exam mostly comprises:

  • Cloud Concepts 28%.
  • Security 24%
  • Technology 36%
  • Billing & Pricing 12%

There are 65 questions total, mostly multiple choice or multiple response.

What is Cloud Computing

Cloud computing is the practice of using a network of remote servers hosted on the internet to store, manage, and process data, instead of using a local server or personal computer.

Benefits of the cloud computing

  • No upfront costs such as paying for a server. You pay on demand.
  • Economies of scale: you save money because so many people share the same cloud infrastructure.
  • You can scale up or down based on demand.
  • A few clicks and your service is deployed.
  • No more maintenance costs.
  • Go global in a few minutes, since cloud servers run in regions around the world.

Types of Cloud Computing

  • SaaS –> Software as a Service. A complete product run and managed by the service provider (examples: Salesforce, Gmail, Google Docs).
  • PaaS –> Platform as a Service. Focused on deploying applications without managing the underlying infrastructure (examples: Heroku, Netlify).
  • IaaS –> Infrastructure as a Service. The building blocks of IT: compute, storage, and networking (examples: AWS, GCP, Azure).

Cloud Computing Models

  • Cloud (fully hosted on the cloud, such as startups)
  • Hybrid (on-premise and public cloud, such as banks)
  • On-premise (on a private cloud, where sensitive data is stored).

AWS Global Infrastructure

  • There are over a million active customers using aws.
  • There are 69 Availability Zones and 22 Geographic Regions worldwide.
  • Regions –> a physical location with multiple availability zones.
  • Availability Zones (AZ) –> one or more discrete data centers (owned by AWS).
  • Edge Locations –> a data center owned by a trusted partner of aws.

Regions AWS

  • A geographically distinct location with multiple data centers.
  • Each region has at least two AZs.
  • US-EAST (North Virginia) is the largest AWS region, and new services usually become available there first.
  • Not all services are available in all regions.
  • US-EAST-1 is where you see your billing information.

AZs(Availability Zones)

  • Each region has at least two AZs.
  • An AZ is a data center run and owned by AWS.
  • Less than 10ms latency between AZs.

Edge Locations (Get Data Fast or Upload Data Fast)

  • A data center owned by a trusted partner of AWS, with a direct connection to the aws network.
  • These locations serve requests for CloudFront and Route53. Requests to either service route automatically to the nearest edge location.
  • S3 Transfer Acceleration and the API Gateway endpoint also use the AWS Edge Network.
  • This gives you low latency no matter where you’re located.

Gov Cloud

An AWS service that lets customers host sensitive Controlled Unclassified Information or other regulated workloads.

  • Only operated by US Citizens, on US Soil.
  • Must follow several compliance guidelines.
  • GovCloud

EC2 Instances

  • To create an EC2 instance, head over to the AWS Console.
  • Choose EC2 and follow along. Select the Amazon Linux 2 AMI and the t2.micro type, since that’s covered by the free tier.
  • Follow along and make sure to set an IAM role.
  • Make sure you turn on billing alerts.
  • You can use either ssh or sessions manager to get into an ec2 instance.
  • You can also reach sessions-manager through systems manager.
  • sessions-manager opens a simple bash shell you can use to access your ec2 instance.

AMI (Amazon Machine Image)

  • Create an image from the ec2 management console: click actions, then select image.
  • This creates a copy you can use to launch multiple servers.

AutoScaling

  • Ensures multiple instances and servers stay running.
  • Helps you meet demand from web traffic.
  • Configured in the ec2 management console.

Elastic Load Balancer (ELBs)

  • Reroutes traffic, especially useful when updating an application.

S3 Buckets

  • The service is global, but buckets are region-specific.
  • It’s object storage used to store files.

CloudFront (CDN)

  • CloudFront is a Content Delivery Network.
  • It makes it easier for companies to distribute their content.
  • Hook it up to an S3 bucket to deliver your content worldwide.

RDS (Relational Database Service)

  • Used to set up a relational database (examples: SQL, PSQL).
  • Amazon Aurora is the default engine when setting up this service.
  • It supports auto scaling.

AWS Lambda

  • A serverless framework.
  • Lets you run simple functions, similar to cron jobs.

EC2 Pricing Models

EC2 has four different pricing models.

On Demand

  • Low cost and flexible.
  • Charges per hour only.
  • Short term.
  • Good for first-time apps or prototypes.
  • No upfront payment.

Reserved Instances

  • Good for committed applications.
  • Standard savings of 75% (you can’t change the RI attributes).
  • Best for long term.
  • You can schedule the reservation.
  • Comes with a 1 to 3 year commitment with AWS.
  • RIs can be shared between multiple accounts.
  • You can even sell your unused instances.

Spot instances

  • Think of it like a hotel offering discounts to fill empty rooms.
  • AWS uses the same approach to maximize the use of idle servers.
  • There are conditions:
    • Instances can be terminated at any time.
    • If your instance gets terminated, you don’t get charged for a partial hour of usage.
    • If you terminate an instance yourself, you’re charged for any hour it ran.
  • Good for applications that can tolerate low, unpredictable usage.
  • Offers 90% savings.

Dedicated

  • The most expensive EC2 instance type.
  • Built for single-tenant customers; more useful for large enterprises.
  • Offered both on demand and reserved.

Billing and Pricing

AWS Free Services

  • IAM (Identity Access Management) –> used for creating user roles.
  • Auto Scaling
  • CloudFormation
  • Elastic Bean
  • Opswork
  • Amplify
  • AppSync
  • CodeStar
  • AWS Cost Explorer

NOTE: services in bold are free, but they can provision AWS services that cost money.

AWS Support Plan

  • $0/month - Basic (support only by email).
  • $20/month - Developer (tech support via email, reply within 24hrs)
    • No third-party support.
    • General guidance only.
  • $100/month - Business (tech support via chat/phone, 24/7)
    • Supports third-party issues.
    • Less than 1hr response time when a production system is down (business downtime).
  • $15000/month - Enterprise (tech support via chat/phone, 24/7)
    • Personal concierge.
    • TAM (Technical Account Manager).
    • Response time less than 15min (business downtime).

AWS MarketPlace

  • A place with thousands of software listings from independent software vendors.
  • Products are free to use, or can have a charge that’s added to your AWS bill.

AWS Trusted Advisor Check

  • Advises customers on security, saving money, performance, service limits, and fault tolerance.
  • Free tier includes 7 Trusted Advisor checks.
  • Enterprise and Business tiers get all Trusted Advisor checks.

Consolidated Billing

  • One master account for all member accounts.
  • Cost Explorer tool for visualizing usage.
  • Also offers volume discounts (the more you use, the cheaper it gets).

AWS Cost Explorer

  • Lets you visualize usage across multiple accounts.

AWS Budgets

  • The first two budgets are free.
  • Lets you set up alerts when you exceed your limits.
  • You can set three types of alerts: Budget, Usage, and instance reservation.
  • Alerts support EC2, RDS, RedShift, and Elastic Cache.
  • Manage budgets from the AWS Budget Dashboard or the Budgets API.
  • Get notified through email or ChatBot.

TCO Calculator

The Total Cost of Ownership calculator shows how much you can save by shifting to aws.

  • A tool for building reports for execs, showing potential savings.
  • For approximation purposes only.

AWS Landing Zone

  • Meant for enterprises.
  • Automatically provisions and configures new accounts via a Service Catalog template.
  • Uses SSO.

AWS Resource Groups & Tagging

  • Tags are words or phrases that act as metadata for organizing AWS resources.
  • Resource groups are collections of resources that share one or more tags.
  • A resource group can display, for a group of resources:
    • Metrics
    • Alarms
    • Configuration settings.

AWS QuickStart

Prebuilt templates offered by AWS or AWS partners that help you deploy popular stacks on AWS, reducing manual effort.

It’s divided into three parts:

  • A reference architecture for deployment.
  • AWS CloudFormation templates that automate and configure the deployment.
  • A guide explaining the architecture and implementation in detail.

AWS Cost and Usage Report

Generates a detailed report of your AWS costs. You get a spreadsheet highlighting the costs.

  • Reports are stored in S3.
  • You can use ATHENA to turn this into a queryable database.
  • QuickSight for analysis.

AWS Networking

  • Region -> the geographic location of the network.
  • VPC -> an isolated space in aws where you can launch aws resources.
  • AZ -> the data center hosting the aws resources.
  • Security Groups -> acts as a firewall at the instance level.
  • Internet Gateway -> enables access to the internet.
  • NACLs -> acts as a firewall at the subnet level.
  • Route Tables -> determine where network traffic from your subnets is directed.
  • Subnets -> a logical partition of an IP network into multiple, smaller network segments.

AWS Database Services

  • DynamoDB -> NoSQL key/value database (example: Cassandra). Really fast for read and write access.
  • DocumentDB -> NoSQL document database compatible with MongoDB.
  • RDS -> Relational Database Service supporting multiple engines: MySQL, Postgres, MariaDB (most popular DB).
  • AuroraDB -> MySQL (5x faster) and PSQL (3x faster) fully managed database. Runs 6 copies of the database, and costs more.
  • Aurora Serverless -> only runs when needed.
  • Neptune -> graph database.
  • RedShift -> columnar database, petabyte-scale warehouse.
  • Elastic Cache -> Redis or Memcached database.

AWS Provisioning Services

  • Elastic BeanStalk -> think of it as Heroku. A service for deploying and scaling web applications and services written in Java, python, c++, and more (perfect for deploying web apps).
  • OpsWork -> configuration management service that provides managed instances of CHEF and Puppet (it has layers, like tier 2 or tier 3).
  • CloudFormation -> IaaS, Infrastructure as Code, in JSON or YAML.
  • AWS QuickStart -> ready-made templates that launch and configure your AWS compute, network, and other services.
  • AWS MarketPlaces -> a place to buy or sell software or services for AWS Cloud.

AWS Compute Services

  • EC2 -> Elastic Compute Cloud, a highly configurable server.
  • ECS -> Elastic Container Service, “Docker as a Service”, highly scalable, high performance, and good for microservices.
  • Fargate -> you don’t choose the ec2 instance like you would in ECS. You define the service and AWS runs it (like Lambda, since you don’t pay for EC2).
  • EKS -> Kubernetes as a service, making it easy to deploy, manage, and scale.
  • Lambda Serverless -> upload code as a function and AWS runs it for you.
  • Elastic BeanStalk -> upload the code and it does the rest. Good for developers who just want to upload their apps.
  • AWS Batch -> for batch processing, where you can schedule Batch jobs.

AWS Storage Services

  • S3 -> a simple storage service, object store (upload files).
  • S3 Glacier -> low-cost storage, good for archiving data for long-term backup.
  • Storage Gateway -> a hybrid solution from on-premise to cloud for storage.
  • EBS (Elastic Block Storage) -> a hard drive in the cloud you attach to an ec2 instance, such as SSDs, HDDs.
  • EFS (Elastic File Storage) -> file storage mountable to multiple EC2 instances at the same time.
  • Snowball -> a way of moving data from on-premise to aws.
    • Snowball Edge -> 100 TB (a better version with additional features).
    • SnowMobile -> lets you move petabytes of data (a data center on wheels).

AWS Business Centric Services

  • Amazon Connect -> a cloud-based call center service you can set up in a few minutes; you can save calls in S3 for further analysis, and even route calls based on defined rules.
  • WorkSpaces -> secured, managed virtual desktops.
  • WorkDocs -> AWS’s version of SharePoint, where you collaborate and share documents.
  • Chime -> think of it as Skype for business calls and meetings.
  • WorkMail -> managed aws email service, like Microsoft Outlook Exchange, using the IMAP protocol.
  • PinPoint -> for marketing campaigns, targeting emails and SMS notifications.
  • SES (Simple Email Service) -> a cloud-based email sending service for emails and notifications (good for web apps that send email notifications, with an HTML format email option).
  • QuickSight -> think of it as QlikSense or Tableau; it lets you visualize data.

AWS Enterprise Integration

  • Direct Connect -> a dedicated gigabit connection from on-premise to aws.
  • VPN
    • Site to Site -> connecting an on-premise network to aws.
    • Client VPN -> connecting a client to the AWS network.
  • Storage Gateway -> a hybrid storage service that lets on-premise applications use AWS cloud storage.
    • Good for backup.
    • Archiving.
    • Disaster recovery.
    • Migration.
    • Data processing.
  • AD (Active Directory) -> an AWS directory service for Microsoft Active Directory, also known as AWS Managed Microsoft AD; lets your workloads and AWS-related resources use managed AD in the aws cloud.

AWS Logging Services

  • CloudTrail -> a logging service that logs all api calls (SDK, CLIs) between AWS services.

    • Who created the service.
    • Who spun up the EC2 instance.
    • Who launched a SageMaker notebook.
    • Detects developer misconfigurations.
    • Detects malicious activity.
    • Automates responses.

  • CloudWatch -> a collection of multiple services; more like a storage solution for all your logs.

    • Stores all types of logs.
    • CloudWatch Metrics -> timeseries data from logs.
    • CloudWatch Events -> triggers an event based on a condition (such as taking a snapshot of the server).
    • CloudWatch Alarms -> triggers notifications based on metrics.
    • CloudWatch Dashboard -> creates visualizations based on metrics.

Most Common AWS Initials

  • IAM:Identity Access Management.
  • S3: Simple Storage
  • SWF: Simple Workflow Service.
  • SNS: Simple Notification System.
  • SQS: Simple Queue Service.
  • SES: Simple Email Service.
  • SSM: Simple Systems Manager.
  • RDS: Relations DataBase Service.
  • VPC: Virtual Private Cloud.
  • VPN: Virtual Private Network.
  • CFN: Cloud Formation
  • WAF: Web Application Firewall.
  • MQ: Amazon ActiveMQ.
  • ASG: AutoScaling Groups.
  • TAM: Technical Account Manager.
  • ELB: Elastic Load Balancer.
  • ALB: Application Load Balancer.
  • NLB: Network Load Balancer.
  • EC2: Elastic Cloud Compute .
  • ECS: Elastic Container Service.
  • ECR: Elastic Container Repository.
  • EBS: Elastic Block Storage.
  • ELF: Elastic File Storage.
  • EMR: Elastic MapReduce.
  • EB: Elastic Beanstalk.
  • ES: Elastic Search.
  • EKS: Elastic Kubernetes Service.
  • MKS: Managed Kafka Service.
  • IoT: Internet of Things.
  • RI: Reserved Instances.

AWS Security

In the Shared Responsibility Model, the customer is responsible for the security of the cloud, such as securing the data and using the right configuration. Anything the customer can’t touch or access is secured by AWS, such as hardware, operation of managed services, and the global infrastructure.

Things Customer should take care of

  • IAM
  • Customer data
  • OS, network, and firewall configs.
  • Maintaining encryption protocols.

Things AWS takes care of

  • Software
  • Hardware
  • Services that aws provides.

AWS Compliance Programs

A set of internal policies and procedures a company follows to comply with rules and regulations, or to uphold its reputation.

Two most popular ones:

  • HIPAA

  • PCI (payment card data; you can read more about it online)

  • Read more here

AWS Artifact

A no-cost, self-service portal for on-demand access to AWS compliance reports.

AWS Inspector

AWS Inspector runs security benchmarks against specific EC2 instances. The most popular one is run by CIS (Center for Internet Security), which has 699 benchmarks. It can even inspect the network to check whether any ports are open and running.

AWS WAF (Web Application Firewall)

It protects your web application against the most common exploits. You can write your own rules that allow traffic based on the contents of HTTP requests, or use a ruleset from an AWS trusted security partner. You can attach it to either CloudFront or an Application Load Balancer (ALB).

Most common attacks include:

  • Injection
  • Broken Authentication
  • Sensitive Data Exposure
  • XML External Entities XXE
  • Broken Access Control
  • Security Misconfigurations
  • XSS Cross Site Scripting
  • Insecure Deserialization
  • Using Components with known Vulnerabilities
  • Insufficient logging and Monitoring

AWS Shield

A managed DDoS (Distributed Denial of Service) protection service that safeguards applications running on AWS.

All AWS customers benefit from the automatic protections of AWS Shield Standard at no charge.

When you route your traffic through ROUTE53 or CloudFront, you’re using AWS Shield.

Protects you against Layer3, Layer4, and Layer7 attacks:

  • 7 Application
  • 4 Transport
  • 3 Network

There’s also a paid tier known as Shield Advanced, which costs $3000/Year (upfront or commitment). It gives you extra protection with 24/7 support, and it’s available on:

  • Amazon Route 53
  • Amazon CloudFront
  • ELB
  • AWS Global Accelerator
  • Elastic IP (Amazon Elastic Compute Cloud, Network, and Load Balancer).

AWS Penetration Testing

An authorized service that lets you simulate a cyberattack on a computer system, to evaluate the system’s security.

Permitted Services

  • EC2 instances, NAT Gateways, and ELB.
  • RDS
  • CloudFront
  • Aurora
  • API Gateways
  • AWS Lambda and Lambda@Edge functions.
  • LightSail resources.

Prohibited Services

  • DNS zone walking via Amazon Route 53 Hosted Zones.
  • DoS (Denial of Service), DDoS, simulated DoS, simulated DDoS.
  • Port flooding.
  • Protocol flooding.
  • Request flooding.

Amazon Guard Duty Service

IDS: Intrusion Detection System

IPS: Intrusion Prevention System

A device or software that monitors a network or systems for malicious activity or policy violations.

Guard Duty is a threat detection service that continuously monitors for malicious and suspicious activity and unauthorized behavior. It uses machine learning to analyze the following AWS logs:

  • CloudTrail logs.
  • VPC Flow Logs.
  • DNS logs.

It alerts you to its findings, which you can use to automate an incident response via CloudWatch Events or third-party software.

KMS (Key Management System)

A managed service that makes it easy to create or control the encryption keys used to encrypt your data.

  • KMS is a multi-tenant HSM (Hardware Security Module).
  • Many AWS services integrate with KMS, so you can encrypt your data with a simple checkbox.
  • KMS uses envelope encryption.

Envelope Encryption

When you encrypt your data, the data is protected, but you still have to protect your encryption key. Encrypting your data key with a master key adds an extra layer of security. Read more about envelope encryption with AWS KMS

Amazon Macie

Macie is a fully managed service that continuously monitors S3 data access activity for anomalies and generates detailed alerts when it detects a risk of unauthorized access or inadvertent data leaks.

It uses machine learning to analyze CloudTrail logs.

It provides the following alerts:

  • Anonymized Access.
  • Config Compliance
  • Credential loss
  • Data Compliance
  • File Hosting
  • Identity Enumeration
  • Information Loss
  • Location Anomaly
  • Open Permisson
  • Privilege Escalation
  • Ransomware
  • Service Disruption
  • Suspiscious Activity

Security Groups VS NACLs(Network Access Control Lists)

Security GroupsNetwork Access Control Lists (NACLs)
Acts as a firewall at the instance level.Acts as a firewall at the subnet level
Implicitly denies all traffic. You create Allow rules (For Example allow an EC2 Instance to access port 22)You create allow and deny rules

AWS VPN(Virtual Private Network)

Lets you create a secure, private tunnel from your network or device to the AWS global network.

AWS Site-to-Site VPN: securely connects an on-premise network or branch office site to a VPC. AWS Client VPN: securely connects users to AWS or on-premise networks.

Same Name But Different Services (Don’t Get Confused)

  • CloudFormation: IaaS (Infrastructure as a Service) used to set up template scripting (YAML, JSON).
  • CloudTrail: logs all api calls between aws-services (who to blame).
  • CloudFront: CDN (Content Delivery Network), used to distribute content such as videos and static assets.
  • CloudWatch: a collection of multiple services.
  • CloudSearch: search engine for your site (ecommerce).

AWS Connect Services

  • Direct Connect: a dedicated fiber-optic connection from a data center to AWS. Say an enterprise wants a direct connection from its on-premise data center to AWS: they’d use this service. If you want an extra layer of security, you’d add a vpn connection on top.

  • Amazon Connect: call center service.

  • Media Connect: a newer version of Elastic Transcoder that converts videos to different formats.

Say you have 1000 videos and need to transcode them into different formats: this is a useful service for that. You can even add watermarks and insert an intro before every video.

Elastic Transcoder VS AWS Elemental MediaConvert

Elastic Transcoder OldWayAWS Elemental MediaConvert NewWay
Transcodes videos to
streaming formats		Transcodes videos to
streaming formats
Overlay images
Insert Video Clips
Extract captions data
Better and Robust UI

SNS vs SQS

Both connect apps via messages.

SNS

  • Uses the PubSub (publisher/subscriber) model.
  • Sends notifications to subscribers via protocols such as HTTP, Email, SQS, and SMS.
  • Generally used for sending plaintext emails triggered by other aws services. Billing alerts are a good example.
  • Can retry sending on failure for HTTPS.
  • Good for webhooks, internal emails, and triggering Lambda functions.

SQS (Examples RabbitMQ) - (think of it as message broker service)

Queue up messages, guaranteed delivery.

  • Places messages into a queue; applications pull from the queue using the AWS SDK.
  • Can retain a message for up to 14 days.
  • Can send messages in sequential order or in parallel.
  • Can ensure only one message is sent.
  • Can ensure messages are delivered at least once.
  • Good for delayed tasks and queueing up emails.

You can read more in this Stack Overflow answer on SNS vs SQS

NLB vs ALB vs CLB

ApplicationNetworkClassic
Layer 7 RequestsLayer 4 IP protocol data
Layer 4 and Layer 7
HTTPS and HTTP trafficTCP and TLS traffic where extreme
performance is required (Example: Netflix)
Intended for applications
that were built within the

EC2 Classic network
Routing Rules,more usability

from one load balancer
Capable of handling millions of requests
per second while maintaining ultra-low-latencies
Doesn't use Target Groups
Can attach WAF(WebApp Firewall)Optimized for sudden and volatile traffic patterns
while using a single static IP address per AZ

Can attach ACM (Amazon Certification Manager) SSL Manager.

That’s everything you need to know for the AWS Cloud Practitioner exam. I hope you found it helpful.

If you think I missed anything, or spelled something wrong, feel free to fork this repo and open a PR.

I’m always available on twitter and by email.