Everything you need to know for SAA Exam

These are my notes from studying for the AWS Certified Solutions Architect Associate exam. They cover IAM, networking, compute, load balancing, storage, and the other services the exam tests you on, so you can look up a service and refresh what matters for the exam without re-reading the whole AWS FAQ page for it.

Every exam domain comes back to the same four questions: is it resilient, is it fast, is it secure, and is it cheap.

• Solutions Architect Associate Exam
• Exam Domains
• IAM (Identity Access Management)
  • IAM Authentication Methods.
  • MFA (MultiFactor Authentication)
  • STS (AWS Security Token)
• AWS Global Infrastructure Overview
• VPC (Virtual Private Cloud)
• EC2 (Elastic Compute Cloud)
  • Security Groups.
  • Instance Metadata
  • Instance Userdata
  • Status Checks and Monitoring
  • Public,Private and Elastic IP addresses.
  • Private Subnets and Bastion Hosts
  • NAT Instances and NAT Gateways
  • EC2 Placement Groups
  • Few Notes
• Elastic Load Balancing and Auto Scaling.
  • Elastic Load Balancing
  • Application Load Balancer
  • Network Load Balancer
  • Classic Load Balancer
  • Internet Facing VS Internal
  • Elastic Load Balancing
  • ELB Security Groups
  • ELB Monitoring
  • EC2 Auto Scaling
  • EC2 Autoscaling - Scaling Types
  • EC2 Autoscaling - Termination Policy
• Virtual Private Cloud
  • Amazon VPC Components.
  • Amazon VPC - Routing
  • Amazon VPC - Subnets
  • Amazon VPC - Internet Gateways.
  • Amazon VPC - Security Groups
  • Amazon VPC - Network ACLs
  • Amazon VPC - Connectivity
• Route 53
  • Route 53 Hosted Zones
  • Route 53 Health Checks
  • CNAME vs Alias
  • Route 53 Routing Policies
  • Route 53 Traffic Flow
  • Route 53 Resolver
  • AWS Global Accelerator
• Amazon S3
  • Amazon S3 Buckets
  • Amazon S3 Objects:
  • Amazon S3 Sub-resources
  • Amazon S3 Storage Classes
  • Amazon S3 Multipart upload
  • Amazon S3 Copy
  • Amazon S3 Transfer Acceleration
  • Amazon S3 Encryption
  • Amazon S3 Performance
• Amazon CloudFront
  • Amazon CloudFront Origins
  • Amazon CloudFront Distributions
  • Amazon CloudFront Charges
• Amazon EBS (Elastic Block Store)

Solutions Architect Associate Exam

• Multiple choice and multiple response questions.
• 130 minutes to complete the exam.
• 65 questions, costing $150.
• Requires a score of 720 to pass.

Exam Domains

The exam consists of the following domains:

• Design Resilient Architectures
  • Design a multi-tier architecture solution.
  • Design highly available and/or fault-tolerant architectures.
  • Design decoupling mechanisms using AWS services.
  • Choose appropriate resilient storage.
• Design High-Performing Architectures
  • Identify elastic and scalable compute solutions for the workload.
  • Select a high-performance, scalable storage solution for a workload.
  • Select high-performance networking solutions for a workload.
  • Choose high-performance database solutions for the workload.
• Design Secure Applications and Architectures
  • Design secure access to AWS resources.
  • Design secure application tiers.
  • Select appropriate data security options.
• Design Cost-Optimized Architectures
  • Identify cost-effective storage solutions.
  • Identify cost-effective compute and database services.
  • Design cost-optimized network architectures.

IAM (Identity Access Management)

• It’s a service that provides users, groups, and IAM policies.

• IAM USER: An entity that represents a person or a service. You associate an IAM Policy directly with the user, and that policy defines what the user is allowed to do within the AWS environment. A user can also be assigned the following:

  • An access key-pair that allows programmatic access to the AWS API, CLI, SDK, and other development tools.
  • A password for access to the management console.
  • By default, users can’t do anything within their accounts.
  • Account credentials are usually the email address used to create the account and a password.
  • The root account has full admin privileges; think of it as sudo.
  • Best practice is to avoid using root credentials. Instead, create an IAM user and assign it admin privileges.
  • Never share root credentials.
  • Make sure you enable MFA.
  • IAM users can also be created to represent applications; these are known as service accounts.
  • You can have up to 5000 users per AWS account.
  • Each user account has a friendly name and an ARN (Amazon Resource Name), which uniquely identifies the user across AWS.
  • Always create individual IAM accounts for users (don’t share them).
  • A password policy can be defined for users, enforcing stronger passwords across all users.

• IAM GROUP: A collection of users with policies attached to them, such as a group for developers or sys-admins.

  • It’s not an identity and can’t be identified as a principal in an IAM policy.
  • Use groups to assign permissions to users.
  • Always assign the least privilege needed when assigning permissions.

• IAM ROLES: Think of a role as access assigned to AWS services, such as a role that gives DynamoDB read-only access.

  • Roles are created and then assumed by trusted entities, and they define a set of permissions for making AWS requests.
  • With roles, you can delegate permissions to resources for users and services without using permanent credentials.
  • AWS users or services can assume a role to obtain temporary security credentials, which can then be used to make aws API calls.

• IAM Policies: Documents that define permissions and can be applied to users, groups, and roles.

  • Policy documents are written in json.
  • All permissions are implicitly denied by default.
  • The most restrictive policy is applied.
  • The IAM policy simulator is a tool that helps you understand, test, and validate the effects of access control policies.

IAM Authentication Methods.

• key-pair access keys, used for programmatic access, especially the CLI (you can’t add MFA to this).
  • A combination of access key ID and secret access key.
  • Used to make programmatic calls to AWS through the API, for example with boto. Also used to access AWS through the CLI.
  • You can create, modify, view, or rotate access keys.
  • When created, IAM returns the access key ID and secret access key.
  • The secret access key is returned only at creation time; if it’s lost, a new key must be created.
  • Make sure access keys and secret access keys are stored securely.
  • Users can be given access to change their own keys through an IAM policy (not from the console).
  • You can disable a user’s access key, which prevents it from being used for API calls.
• A simple username and password to access the management console.
  • The password the user uses to sign in to the aws web console.
• Some AWS services use a signing certificate.
  • SSL/TLS certificates that can be used to authenticate with some AWS services.
  • AWS recommends using ACM (AWS Certificate Manager) to provision, manage, and deploy your server certificates.
  • You can also use IAM when you need to support HTTPS connections in a region not supported by ACM.

MFA (MultiFactor Authentication)

• A physical or soft token that lets you access AWS.
  • A soft token can be Google Authenticator.
  • A hard token can be a YubiKey.
  • AWS also provides soft tokens and physical access keys for MFA.
  • Two factors of authentication make access much more secure.

STS (AWS Security Token)

• STS is a web service that lets you request temporary, limited-privilege credentials for IAM users or for users you authenticate (federated users).
• By default, AWS STS is a global service, and all AWS STS requests go to a single endpoint at https://sts.amazonaws.com.
• All regions are enabled by default for STS, but this can be disabled.
• The region in which temporary credentials are requested must be enabled.

AWS Global Infrastructure Overview

• Region: A geographical area with 2 or more AZs, isolated from other AWS regions. There are 23 regions around the world at the moment.
• Availability Zone: One or more data centers that are physically separate and isolated from other AZs.
• Edge Location: A location with cached content that can be delivered at low latency to users. Mostly used by CloudFront for delivering content such as static files or video.
• Regional Edge Cache: Also part of the CloudFront network. These are larger caches that sit between AWS services and edge locations.
• Global Network: A highly available, low-latency private global network interconnecting every data center, AZ, and AWS region.

VPC (Virtual Private Cloud)

• An isolated section of AWS where you can launch your own resources.
• Within a VPC you can create your own networks with your own IP ranges.
• A VPC sits within a region: you create the VPC in that region, then create subnets within it that sit inside AZs. Subnets can be public or private, and you launch resources within those subnets. You can have 5 VPCs per region by default.
• A VPC router is used to communicate between subnets and availability zones. It has a route table you can configure and an IP address range; every VPC has a CIDR (Classless Inter-Domain Routing) block.
• You define the IP range for your VPC.
• You can attach an internet gateway to your VPC to send requests to the outside internet; for that you need the igw-id and an IP-ADDR as the destination.
• Internet gateways let you make requests to the public internet, which requires adding an entry to the route table.
• Each VPC has its own CIDR block.

EC2 (Elastic Compute Cloud)

• An elastic service that lets you launch compute resources on the AWS cloud. In AWS terms these are called EC2 instances, but you can think of them as virtual machines.
• Each instance has an operating system, storage, and a virtual hard drive.
• When launching instances you can choose from the AWS Marketplace and Community AMIs.
• You can connect to EC2 instances using ssh.

Security Groups.

• Firewalls applied at the instance level.
• They monitor traffic going in and out of EC2 instances.
• You can have multiple instances in a security group, and multiple security groups applied to an instance.
• Security groups are stateful.
• For example, a security group with port 22 access applied to EC2 instances lets you connect over secure shell.

Instance Metadata

Instance metadata is data about your instance that can be used to configure or manage the running instance. It’s divided into categories and gives you information about your instance, such as hostname, ami-id, and so on.

You can run this command inside your ec2 instance’s command line to get the metadata:

curl http://169.254.169.254/latest/meta-data/

Instance Userdata

This is information you can pass into an instance when it boots up.

Think of it as a bash script containing all the commands you need to run when booting up the ec2 instance. This can use your regular Ubuntu apt commands, for example:

#!bin/bashsudo apt-get upgradesudo apt install xyz

You can paste this into userdata, located in advanced details, when launching an instance.

You can also query the userdata with the following command:

curl http://169.254.169.254/latest/meta-data/

Status Checks and Monitoring

You can set up CloudWatch alarms on ec2 instances to monitor them effectively, and you can also install the stress tool to run stress tests on the instances.

Public,Private and Elastic IP addresses.

• Public IP Address:
  • Lost when the instance is stopped.
  • Used in public subnets.
  • No charge.
  • Associated with a private IP address on the instance.
  • Can’t be moved between instances.
• Private IP Address:
  • Retained when the instance is stopped.
  • Used in public and private subnets.
• Elastic IP Address:
  • Static public IP address.
  • You’re charged if it’s not in use.
  • Associated with a private IP address on the instance.
  • Note: an Elastic Fabric Adapter is a network device you can attach to reduce latency and increase throughput for distributed HPC (High Performance Computing).

Private Subnets and Bastion Hosts

• Public subnets are easily accessible through the public internet.
• A private subnet’s route table doesn’t have the igw route, and it’s not configured to give public IP addresses to instances launched into it.
• There’s no way to directly manage such an instance over the internet.
• A bastion host is a public instance you use to jump to a private instance; it’s also known as a jump host, and through it you can ssh into your private instance.
• We use agent forwarding, and use the bastion host to connect to the private subnet instance.

NAT Instances and NAT Gateways

• NAT Instance: Network Address Translation (NAT) is the process of taking a private IP address and translating it to a public IP address so it can connect to the public internet.
  • It’s managed by you.
  • The only way to scale it is manually: using a bigger, more powerful instance with more resources and enhanced networking with additional bandwidth.
  • There’s no high availability; it has to be done manually.
  • Needs a security group assigned.
  • Can be used as a bastion host.
  • You can use an Elastic IP address or a public address with a NAT instance.
  • Can implement port forwarding manually.
• NAT Gateway: A better version of the NAT instance.
  • Managed by AWS.
  • Elastically scales up to 45 GBps.
  • Provides automatic high availability within an AZ, and can be placed in multiple AZs.
  • No security groups.
  • Can’t be accessed through ssh.
  • Choose the Elastic IP address to associate with the NAT gateway at creation.
  • Doesn’t support port forwarding.
• A private subnet’s route table contains a nat-gateway-id instead of an igw-id, and anything not defined within the ip cidr block of that route table is handled by the nat-gateway-id.

EC2 Placement Groups

• Cluster: packs instances close together inside an Availability Zone. This strategy lets workloads achieve the low-latency network performance needed for the tightly coupled node-to-node communication typical of HPC applications.

  • WHAT: Instances are placed into a low-latency group within a single AZ.
  • WHEN: You need low network latency or high network throughput.
  • Pros: Get the most out of enhanced networking instances.
  • Cons: Finite capacity; launch everything you might need upfront.

• Partition: spreads your instances across logical partitions, so that groups of instances in one partition don’t share underlying hardware with groups in other partitions. Typically used by large distributed and replicated workloads such as Hadoop, Cassandra, and Kafka.

  • WHAT: Instances are grouped into logical segments called partitions that use distinct hardware.
  • WHEN: You need control and visibility into instance placement.
  • Pros: Reduces the likelihood of correlated failures for large workloads.
  • Cons: Partition placement groups aren’t supported for dedicated hosts.

• Spread: strictly places a small group of instances across distinct underlying hardware to reduce correlated failures.

  • WHAT: Instances are spread across underlying hardware.
  • WHEN: You want to reduce the risk of simultaneous instance failure if underlying hardware fails.
  • Pros: Can span multiple AZs.
  • Cons: Maximum of 7 instances running per group, per AZ.

Few Notes

• Amazon EC2:
  • A compute cloud: a web service that provides resizable compute capacity in the cloud.
  • With EC2 you have full control of the operating system layer.
  • You use a key-pair to securely connect to EC2 instances over ssh.
  • A keypair consists of a public key that AWS stores and a private key you store on your local machine.
  • user-data is a script you provide when starting an instance.
  • meta-data is the data about your instance that you can use to configure it.
• EC2 Pricing Models:
  • On Demand:
    • No upfront fee.
    • Charged per hour or second.
    • No commitment.
    • Ideal for short-term needs or unpredictable workloads.
  • Reserved:
    • Options: no upfront, partial upfront, or all upfront.
    • Charged by hour or second.
    • 1-year or 3-year commitment.
    • Ideal for steady-state workloads and predictable usage.
  • Spot:
    • No upfront fee.
    • Charged by hour or second.
    • No commitment.
    • Ideal for cost-sensitive, compute-sensitive use cases that can withstand interruption (batch processing).
  • Dedicated Hosts:
    • Good for enterprise customers looking for isolated environments.
• Amazon EC2 AMIs:
  • An Amazon Machine Image provides the information required to launch an instance.
  • An AMI includes the following:
    • A template for the instance’s root volume (OS, system, an application server, and applications).
    • Launch permissions that control which AWS accounts can use the AMI to launch instances.
    • A block device mapping that specifies which volumes to attach to the instance when it’s launched (which EBS volumes to attach).
  • Volumes attached to instances are either EBS or instance store.
    • Amazon EBS provides persistent storage. EBS snapshots, which reside on Amazon S3, are used to create the volume.
    • Instance store volumes are ephemeral (non-persistent); data is lost when the instance shuts down.
  • AMIs are regional. You can only launch an AMI from the region where it’s stored, but you can copy AMIs to other regions using the console, CLI, or API.
• Elastic Network Interface (ENI):
  • A logical networking component in a VPC that represents a virtual network card.
  • Can include attributes such as IP addresses, security groups, MAC addresses, a source/destination check flag, and a description.
  • You can create and configure network interfaces in your account and attach them to your instances in a VPC.
  • eth0 is the primary network interface and can’t be moved or detached.
  • An ENI is bound to an availability zone, and you can specify which subnet/AZ you want it loaded in.
• Elastic Fabric Adapter (EFA):
  • An AWS Elastic Network Adapter (ENA) with added capabilities.
  • Lets customers run applications that need high levels of internode communication at scale on AWS.
  • With EFA, High Performance Computing (HPC) applications using the Message Passing Interface (MPI), and Machine Learning (ML) applications using NVIDIA Collective Communications Library (NCCL), can scale up to thousands of CPUs or GPUs.
• ENI vs ENA vs EFA:
  • When to use ENI: The basic adapter type, for when you don’t have high-performance requirements. Works with all instance types.
  • When to use ENA: Good for use cases that need higher bandwidth and lower inter-instance latency. Supported for limited instance types (HVM only).

Elastic Load Balancing and Auto Scaling.

Elastic Load Balancing

Load balancing refers to efficiently distributing incoming network traffic across a group of backend servers.

Application Load Balancer

• Operates at the request level.
• Routes based on the content of the request (Layer 7).
• Supports path-based routing, host-based routing, query-string-parameter-based routing, and source-IP-address-based routing.
• Supports IP addresses, Lambda functions, and containers as targets.
• HTTPS, HTTP.

Network Load Balancer

• Operates at the connection level.
• Routes connections based on IP protocol data (Layer 4).
• Offers ultra-high performance, low latency, and TLS offloading at scale.
• Can have a static IP / Elastic IP.
• Supports UDP and static IP addresses as targets.

Classic Load Balancer

• Old generation; not recommended for new applications.
• Performs routing at Layer 4 and Layer 7.
• Use for existing applications running on an EC2-Classic instance.

Internet Facing VS Internal

• Internet Facing:
  • ELB nodes have public IPs.
  • Routes traffic to the private IP addresses of the EC2 instances.
  • Needs one public subnet in each AZ where the ELB is defined.
  • ELB DNS name format: <name>-<id-number>.<region>.elb.amazonaws.com
• Internal only ELB:
  • ELB nodes have private IPs.
  • Routes traffic to the private IPs of the EC2 instances.
  • ELB DNS name format: internal-<name>-<id-number>.<region>.elb.amazonaws.com

Elastic Load Balancing

• EC2 instances and containers can be registered against an ELB.
• ELB nodes use IP addresses within your subnets; use at least a /27 subnet and make sure at least 8 IP addresses are available in it so the ELB can scale.
• An ELB forwards traffic to eth0 (the primary IP address).
• An ELB listener is the process that checks for connection requests:
  • Listeners for CLB provide options for TCP and HTTP/HTTPS.
  • Listeners for ALB only provide options for HTTPS and HTTP.
  • Listeners for NLB only provide TCP as an option.

ELB Security Groups

• Security groups control the ports and protocols that can reach the front-end listener.
• You must assign a security group for the ports and protocols on the front-end listener.

ELB Monitoring

• CloudWatch every 1 minute.
• The ELB service sends information when requests are active.
• Access Logs:
  • Disabled by default.
  • Include information about the client (not included in the CloudWatch metrics).
  • Can identify requester IP, request type, and so on.
  • Can optionally be stored and retained in S3.

EC2 Auto Scaling

• You can attach one or more classic ELBs to your existing Auto Scaling groups.
• You can attach one or more target groups to your ASG to include instances behind an ALB.
• The ELBs must be in the same region.
• The launch configuration is the template used to create new EC2 instances; it includes parameters such as instance family, instance type, AMI, keypair, and security groups.

EC2 Autoscaling - Scaling Types

• Can also scale based on AWS SQS.
• Uses a custom metric sent to Amazon CloudWatch that measures the number of messages in the queue per EC2 instance in the Auto Scaling group.
• Then uses a target tracking policy that configures your ASG to scale based on the custom metric and a set target value. CloudWatch alarms invoke the scaling policy.
• Use a custom backlog per instance metric to track not just the number of messages in the queue but the number available for retrieval.

EC2 Autoscaling - Termination Policy

• Termination policies control which instances are terminated first when a scale-in event occurs.
• There’s a default termination policy, and options for configuring your own custom termination policies.
• The default termination policy is designed to help instances span AZs evenly for high availability.
• The default policy is kept generic and flexible to cover a range of scenarios.

Virtual Private Cloud

• A Virtual Private Cloud (VPC) is logically isolated from other VPCs on AWS.
• VPCs are region-specific.
• A default VPC is created in each region with a subnet in each AZ.
• You can define dedicated tenancy for a VPC to ensure instances launch on dedicated hardware.
• The default VPC has all public subnets.
• Public Subnets:
  • Auto Assign public IPv4 address set to Yes.
  • The subnet route table has an attached internet gateway.
• Instances in the default VPC always have both a public and a private IP address.
• AZ names are mapped to different zones for different users.

Amazon VPC Components.

• VPC: A logically isolated virtual network in the AWS cloud. You define the VPC’s IP address space from ranges you select.
• Subnet: A segment of a VPC’s IP address range where you can place groups of isolated resources (maps to a single AZ).
• Internet Gateway: The Amazon VPC side of a connection to the public internet.
• NAT Gateway: A highly available, managed Network Address Translation (NAT) service for resources in a private subnet to access the internet.
• Hardware VPN Connection: A hardware-based VPN connection between your AWS VPC and your data center, home network, or colocation facility.
• Virtual Private Gateway: The VPC side of a VPN connection.
• Customer Gateway: Our side of a VPN connection.
• Router: Routers interconnect subnets and direct traffic between internet gateways, virtual private gateways, NAT gateways, and subnets.
• Peering Connection: Lets you route traffic via private IP addresses between two peered VPCs.
• VPC Endpoints: Enable private connectivity to services hosted in AWS from within a VPC, without using an internet gateway, VPN, NAT device, or firewall proxy.
• Egress-only Internet Gateway: A stateful gateway that provides egress-only access for IPv6 traffic from the VPC to the internet.

Amazon VPC - Routing

• The VPC router performs routing between AZs within a region.
• The VPC router connects different AZs together and connects the VPC to the internet gateway.
• Each subnet has a route table the router uses to forward traffic within the VPC.
• Route tables also have entries for external destinations.

Amazon VPC - Subnets

• Types of subnets:
  • If a subnet’s traffic is routed to an internet gateway, the subnet is a public subnet.
  • If a subnet doesn’t have a route to the internet gateway, the subnet is a private subnet.
  • The VPC is created with a master address range (CIDR block, anywhere from 16 to 28 bits), and subnet ranges are created within that range.
  • New subnets are always associated with the default route table.
  • Once a VPC is created you can’t change its CIDR block.
  • You can’t create additional CIDR blocks that overlap with existing CIDR blocks.
  • You can’t create additional CIDR blocks in a different RFC 1918 range.
  • Subnets with overlapping IP address ranges can’t be created.
  • The first 4 and last 1 IP address in a subnet are reserved.
  • Subnets are created within AZs.
  • Subnets map 1:1 to AZs and can’t span AZs.

Amazon VPC - Internet Gateways.

• An internet gateway serves two purposes:
  • To provide a target in your VPC route tables for internet-routable traffic.
  • To perform network address translation (NAT) for instances assigned public IPv4 addresses.
• Internet gateways must be created, then attached to a VPC, added to a route table, and associated with the relevant subnets.
• No availability risk or bandwidth constraints.
• You can’t have multiple internet gateways in a VPC.
• An egress-only internet gateway provides outbound internet access for IPv6-addressed instances.

Amazon VPC - Security Groups

• A security group acts like a firewall at the instance (network interface) level.
• You can only assign permit rules in a security group; you can’t assign deny rules.
• All rules are evaluated until a permit is found, or until the implicit deny.
• Can control ingress and egress traffic.
• Security groups are stateful.
• By default, custom security groups don’t have inbound allow rules (all inbound traffic is denied by default).
• By default, the default security group does have inbound allow rules (allowing traffic from within the group).
• All outbound traffic is allowed by default in both custom and default security groups.
• You can’t delete the security group created by default within a VPC.
• You can use a security group’s name as the source or destination in other security groups.
• You can use a security group’s name as a source in its own inbound rules.
• Security group membership can be changed while instances are running.
• Changes take effect immediately.
• You can’t block specific IP addresses using security groups; use NACLs instead.

Amazon VPC - Network ACLs

• Network ACLs function at the subnet level.
• With NACLs you can have permit and deny rules.
• Network ACLs contain a numbered list of rules evaluated in order from the lowest number until the explicit deny.
• Network ACLs have separate inbound and outbound rules, and each rule can allow or deny traffic.
• Network ACLs are stateless, so responses are subject to the rules for the direction of traffic.
• NACLs only apply to traffic that’s ingress or egress to the subnet, not to traffic within the subnet.
• A VPC automatically comes with a default network ACL that allows all inbound/outbound traffic.
• A custom NACL denies all traffic, both inbound and outbound, by default.
• All subnets must be associated with a network ACL.
• You can create custom network ACLs. By default each custom network ACL denies all inbound and outbound traffic until you add rules.
• You can associate a network ACL with multiple subnets; however, a subnet can only be associated with one network ACL at a time.
• Network ACLs don’t filter traffic between instances in the same subnet.
• NACLs are the preferred option for blocking specific IPs or ranges.
• Security groups can’t be used to block specific ranges of IPs.
• The NACL is the first line of defense; the security group is the second.
• Changes to a NACL take effect immediately.

Amazon VPC - Connectivity

There are several methods of connecting to a VPC, including:

• AWS Managed VPN
  • What: An AWS-managed IPSec VPN connection over your existing internet.
  • When: A quick and usually simple way to establish a secure tunneled connection to a VPC; a redundant link for Direct Connect or other VPC VPN.
  • Pros: Supports static routes or BGP peering and routing.
  • Cons: Dependent on your internet connection.
  • How: Create a virtual private gateway on AWS and a customer gateway on-premises.
• AWS Direct Connect
  • What: A dedicated network connection over private lines straight into the AWS backbone.
  • When: You need a large network link into AWS, with lots of resources and services provided on AWS to your corporate users.
  • Pros: More predictable network performance; potential bandwidth cost reduction; up to 10 GBps provisioned connections; supports BGP peering and routing.
  • Cons: May require additional telecom and hosting provider relationships and/or network circuits; costly; takes time to provision.
  • How: Work with your existing data networking provider; create virtual interfaces (VIFs) to connect to VPCs (private VIFs) or other AWS services like S3 or Glacier (public VIFs).
• AWS Direct Connect plus a VPN
  • What: An IPSec VPN connection over private lines (Direct Connect).
  • When: You need the added security of encrypted tunnels over Direct Connect.
  • Pros: More secure (in theory) than Direct Connect alone.
  • Cons: More complexity introduced by the VPN layer.
• AWS VPN CloudHub
  • What: Connects locations in a hub-and-spoke manner using AWS’s VPC.
  • When: Linking remote offices for backup or primary WAN access to AWS resources.
  • Pros: Reuses existing internet connections; supports BGP routes to direct traffic.
  • Cons: Dependent on the internet connection; no inherent redundancy.
  • How: Assign multiple customer gateways to a virtual private gateway, each with its own BGP ASN and unique IP ranges.
• Software VPN
  • What: You provide your own VPN endpoint and software.
  • When: You must manage both ends of the VPN connection for compliance reasons, or you want to use a VPN option not supported by AWS.
  • Pros: Ultimate flexibility and manageability.
  • Cons: You must design for any needed redundancy across the whole chain.
  • How: Install VPN software via a marketplace appliance or on an EC2 instance.
• Transit VPC
  • What: A common strategy for connecting geographically dispersed VPCs and locations to create a global network transit center.
  • When: Locations and VPC-deployed assets across multiple regions need to communicate with one another.
  • Pros: Ultimate flexibility and manageability, plus an AWS-managed VPN hub-and-spoke between VPCs.
  • Cons: You must design for any needed redundancy across the whole chain.
  • How: Providers like Cisco, Juniper Networks, and Riverbed have offerings that work with their equipment and AWS VPC.
• VPC Peering:
  • What: AWS-provided network connectivity between two VPCs.
  • When: Multiple VPCs need to communicate or access each other’s resources.
  • Pros: Uses the AWS backbone without traversing the internet.
  • Cons: Transitive peering isn’t supported.
  • How: A VPC peering request is made; the accepter accepts the request (either within or across accounts).
• AWS Private Link:
  • What: AWS-provided network connectivity between VPCs, and/or AWS services, using interface endpoints.
  • When: Keep private subnets truly private by using the AWS backbone to reach other AWS or Marketplace services rather than the public internet.
  • Pros: Redundant; uses the AWS backbone.
  • How: Create an endpoint for the required AWS or Marketplace service in all required subnets; access it via the provided DNS hostname.
• VPC Endpoints:

Route 53

According to Wikipedia, Amazon Route 53 is a scalable and highly available Domain Name System. It launched in December 2010 and has been part of AWS since then. Route 53 lets you register a domain name for your service, and it offers the following functions:

• Domain name registry.
• DNS resolution.
• Health checks of resources.

Route 53 is located alongside all edge locations, and when you register a domain with it, it becomes the authoritative DNS server for that domain and creates a public hosted zone.

Route 53 also lets you transfer domains to it, as long as it supports the TLD (Top Level Domain), and you can even transfer to another registrar by contacting AWS support.

You can also transfer a domain to another account in AWS. This doesn’t migrate the hosted zone by default (it’s optional), and it’s also possible to have the domain registered in one AWS account and the hosted zone in another.

Route 53 also lets you set up private DNS, which gives you authoritative DNS within your VPCs without exposing DNS records to the public internet.

Lastly, you can use the AWS Management Console or the API to register new domain names with Route 53.

Route 53 Hosted Zones

• A hosted zone is a collection of records for a specified domain.
• A hosted zone is analogous to a traditional DNS zone file; it represents a collection of records that can be managed together.
• There are two types of zones:
  • Public Hosted Zone: determines how traffic is routed on the internet.
  • Private Hosted Zone for VPC: determines how traffic is routed within a VPC (not accessible outside of it).
• For private hosted zones you must set the following VPC settings to true:
  • enableDnsHostname
  • enableDnsSupport You also need to create a DHCP options set.

Route 53 Health Checks

• Health checks ensure instance health by connecting to it.
• Health checks can be pointed at:
  • Endpoints (IP addresses or domain names)
  • Status of other health checks
  • Status of a CloudWatch alarm

Route 53 supports most DNS record types; the Alias record is specific to Route 53 and points to the DNS name of the service.

CNAME vs Alias

Route 53 Routing Policies

• Simple
  • An A record is mapped to one or more IP addresses.
  • Uses round robin.
  • Doesn’t support health checks.
• Failover:
  • Fails over to a secondary IP address.
  • Associated with a health check.
  • Used for active-passive.
  • Can be used with an ELB.
• Geolocation:
  • Caters to different users in different countries and languages.
  • Contains users within a specific geography and offers them a customized version of the workload based on their specific needs.
  • Can be used to localize content and present some or all of your website in the language of the user.
  • Can also protect distribution rights.
  • Can be used to spread load evenly between regions.
  • If you have multiple records for overlapping regions, Route 53 routes to the smallest geographic region.
• Geoproximity:
  • Used to route traffic based on the location of resources, and optionally shift traffic from resources in one location to resources in another.
• Latency Based Routing:
  • AWS maintains a database of latency from different parts of the world.
  • Focused on improving performance by routing to the region with the lowest latency.
• Multi-value answer:
  • Responds to DNS queries with up to 8 healthy records selected at random.
• Weighted:
  • Similar to simple, but you can specify a weight per IP address.
    • You create records with the same name and type, and assign each record a relative weight.

Route 53 Traffic Flow

• Route 53 traffic flow provides global traffic management services.
• Traffic flow policies let you create routing configurations for resources using routing types such as failover and geolocation.
• Create policies that route traffic based on specific constraints, including latency, endpoint health, load, geo-proximity, and geography.
• Scenarios:
  • A backup page in Amazon S3 for a website.
  • Building routing policies that consider an end user’s geographic location, proximity to an AWS region, and the health of each of your endpoints.

Route 53 Resolver

• A set of features that enable bidirectional querying between on-premises infrastructure and AWS over private connections.
• Used to enable DNS resolution for hybrid clouds.
• Route 53 Resolver Endpoints:
  • Inbound query capability is provided by Route 53 Resolver Endpoints, letting DNS queries that originate on-premises resolve AWS-hosted domains.
  • Connectivity needs to be established between your on-premises DNS infrastructure and AWS through Direct Connect or a VPN.
  • Endpoints are configured by assigning an IP address in each subnet where you want to provide a resolver.
• Conditional Forwarding Rules:
  • Outbound DNS queries are enabled through Conditional Forwarding Rules.
  • Domains hosted within your on-premises DNS infrastructure can be configured as forwarding rules in Route 53 Resolver.
  • Rules trigger when a query is made to one of those domains, and Route 53 attempts to forward DNS requests to the DNS servers configured with the rules.
  • Like inbound queries, this requires a private connection over DX or VPN.

AWS Global Accelerator

• AWS Global Accelerator is a service that improves the availability and performance of applications with local or global users.
• It provides static IP addresses that act as a fixed entry point to application endpoints in a single or multiple AWS regions, such as ALB, NLB, or EC2 instances.
• Uses the AWS global network to optimize the path from users to applications, improving the performance of TCP and UDP traffic.
• AWS Global Accelerator continually monitors the health of application endpoints, and redirects traffic to healthy endpoints in less than 1 minute of detecting an unhealthy one.
• Uses redundant (two) static anycast IP addresses in different network zones (A & B).
• The redundant pair are globally advertised.
• Uses AWS edge locations: addresses are announced from multiple edge locations at the same time.
• Addresses are associated with regional AWS resources or endpoints.
• AWS Global Accelerator IP addresses serve as the frontend interface of the applications.
• Intelligent traffic distribution: routes connections to the closest point of presence for the application.

Amazon S3

Amazon Simple Storage Service is an object storage service built to store and retrieve any amount of data from anywhere on the internet.

• Amazon S3 is a distributed architecture: objects are redundantly stored on multiple devices across multiple facilities (AZs) in an Amazon S3 region.
• Amazon S3 is a simple key-based object store.
• Amazon S3 provides a simple, standards-based REST web services interface designed to work with any internet development toolkit.
• Files can be from 0TB to 5TB.
• The largest object that can be uploaded in a single PUT is 5 gigabytes.
• For objects larger than 100 MB, use the Multipart Upload capability.
• Event notifications for specific actions can send alerts or trigger actions.
• Notifications can be sent to:
  • SNS topics
  • SQS queues
  • Lambda functions
  • Need to configure SNS/SQS/Lambda before S3.
  • No extra charges from S3, but you pay for SNS, SQS, and Lambda.
• Provides read-after-write consistency for PUTS on new objects.
• Provides eventual consistency for overwrite PUTS and DELETES (takes time to propagate).
• S3 is made up of the following:
  • Key (name)
  • Value (data)
  • Version ID
  • Metadata
  • Access Control Lists

• You can use S3 for the following:
  • Backup and Storage: providing data backup and storage services for others.
  • Application Hosting: providing services that deploy, install, and manage web applications.
  • Media Hosting: building a redundant, scalable, and highly available infrastructure that hosts video, photo, or music uploads and downloads.
  • Software Delivery: hosting software applications that customers can download.
  • Static Website: hosting static sites such as HTML pages or a blog.

Amazon S3 Buckets

• Files are stored in the bucket:
  • A bucket can be viewed as a container for objects.
  • A bucket is a flat container of objects.
  • It doesn’t provide a hierarchy of objects.
  • You can use an object key name (prefix) to mimic folders.
• 100 buckets per account by default.
• You can store unlimited objects in your buckets.
• You can create folders in your buckets.
• You can’t create nested buckets.
• An S3 bucket is region-specific.

Amazon S3 Objects:

• Each object is stored and retrieved by a unique key (ID or name).
• An object in S3 is uniquely identified and addressed through:
  • Service endpoint.
  • Bucket name.
  • Object key.
  • Optionally, an object version.
• Objects stored in a bucket never leave the region where they’re stored, unless you move them to another region or enable cross-region replication.
• You can define permissions on objects when uploading, and at any time afterward, using the AWS Management Console.

Amazon S3 Sub-resources

• Sub-resources (configuration containers) associated with buckets include:
  • Lifecycle: define an object’s lifecycle.
  • Website: configuration for hosting static sites.
  • Versioning: retain multiple versions of objects as they’re changed.
  • Access Control Lists (ACLs): control permissions on the bucket.
  • Bucket Policies: control access to the bucket.
  • CORS (Cross Origin Resource Sharing).
  • Logging.

Amazon S3 Storage Classes

• Storage classes include:
  • S3 Standard (durable, immediately available, frequent access)
  • S3 Intelligent-Tiering (automatically moves data to the most cost-effective tier)
  • S3 Standard-IA (durable, immediately available, infrequent access)
  • S3 One Zone-IA (lower cost for infrequently accessed data, with less resilience)
  • S3 Glacier (archived data, longer retrieval times)
  • S3 Glacier Deep Archive (lowest-cost storage class for long-term retention).

Amazon S3 Multipart upload

• Multipart upload uploads objects in parts, independently, in parallel, and in any order.
• Performed using the S3 Multipart Upload API.
• Recommended for objects larger than 100MB.
• Can be used for objects from 5MB up to 5TB.
• Must be used for objects larger than 5GB.

Amazon S3 Copy

• You can create a copy of objects up to 5GB in size in a single atomic operation.
• For files larger than 5GB you must use the multipart upload API.
• Can be performed using the AWS SDKs or REST API.
• The copy operation can be used to:
  • Generate additional copies of objects.
  • Rename objects.
  • Change the copy’s storage class or encryption-at-rest status.
  • Move objects across AWS locations/regions.
  • Change object metadata.

Amazon S3 Transfer Acceleration

• Amazon S3 Transfer Acceleration enables fast, easy, and secure transfers of files over long distances between your client and your S3 bucket.
• S3 Transfer Acceleration uses Amazon CloudFront’s globally distributed AWS edge locations.
• Used to accelerate object uploads to S3 over long distances (latency).
• Transfer acceleration is as secure as a direct upload to S3.
• You’re charged only if there was a benefit to the transfer time.
• Needs to be enabled on the S3 bucket.
• Can’t be disabled, only suspended.

Amazon S3 Encryption

Amazon S3 Performance

• Measure performance.
• Scale storage connections horizontally.
• Use byte-range fetches.
• Retry requests for latency-sensitive applications.
• Combine Amazon S3 (storage) and Amazon EC2 (compute) in the same AWS region.
• Use Amazon S3 Transfer Acceleration to minimize latency caused by distance.

Amazon CloudFront

CloudFront is a web service that distributes content with low latency and high data transfer speeds. It’s usually used for dynamic, static, streaming, and interactive content. For instance, Netflix might use this service to deliver its content globally.

• CloudFront is a global service:
  • Ingress to upload objects.
  • Egress to distribute the content.
• You can use a zone apex DNS name on CloudFront.
• CloudFront supports wildcard CNAME.
• Supports SSL certificates, dedicated IP, custom SSL, and SNI custom SSL (cheaper).
• You can restrict access to content using the following methods:
  • Restrict access to content using signed cookies or signed URLs.
  • Restrict access to objects in your S3 bucket.
• A special type of user called an Origin Access Identity (OAI) can be used to restrict access to content in an Amazon S3 bucket.
• By using an OAI you can restrict users so they can’t access the content directly through the S3 URL; they must connect via CloudFront.

Amazon CloudFront edge locations and regional edge caches:

• An edge location is where the content is cached.
• Requests are automatically routed to the nearest edge location.
• Edge locations aren’t tied to Availability Zones or regions.
• Regional edge caches sit between origin web servers and global edge locations and have a larger cache.
• Regional edge caches have a larger cache width than any individual edge location, so your objects remain in cache longer at these locations.
• Regional edge caches aim to get content closer to users.

Amazon CloudFront Origins

• An origin is where the files that the CDN distributes come from.
• Origins can be an S3 bucket, an EC2 instance, an ELB, or Route 53; they can also be external.
• A custom origin server is an HTTP server, which can be an EC2 instance or an on-premises/non-AWS web server.
• Amazon EC2 instances are considered custom origins.
• Static sites on Amazon S3 are also considered custom origins.

Amazon CloudFront Distributions

• There are two types of distribution.
• Web:
  • Static and dynamic content, including .html, .js, or .css.
  • Distributes files over HTTPS or HTTP.
  • Add, update, or delete objects and data from submitted forms.
  • Use live streaming to stream an event in real time.
• RMTP:
  • Distribute streaming media files using Adobe Flash Media Server’s RTMP protocol.
  • Lets an end user begin playing a media file before it’s finished downloading from a CloudFront edge location.
  • Files must be stored in an S3 bucket.

Amazon CloudFront Charges

• You pay for:
  • Data transfer out to the internet.
  • Data transfer out to origin.
  • Number of HTTP/HTTPS requests.
  • Invalidation requests.
  • Dedicated IP custom SSL.
  • Field-level encryption requests.
• You don’t pay for:
  • Data transfer between AWS regions and CloudFront.
  • Regional edge cache.
  • AWS ACM SSL/TLS certificates.
  • Shared CloudFront certificates.

Amazon EBS (Elastic Block Store)

• EBS volumes are network-attached storage that can be attached to EC2 instances.
• EBS volume data persists independently of the life of the instance.
• EBS volumes don’t need to be attached to an instance.
• You can attach multiple EBS volumes to an instance.
• You can’t attach an EBS volume to multiple instances (use EFS instead).
• EBS volume data is replicated across multiple servers in an AZ.
• EBS volumes must be in the same AZ as the instances they’re attached to.
• Root EBS volumes are deleted on termination by default.
• Extra non-boot volumes aren’t deleted on termination by default.
• The behavior can be changed by altering the DeleteOnTermination attribute.

Note: These notes cover almost everything, but if you want to add more, fork the repo and open a PR. I’d be happy to add your changes.

• REPO LINK
• Main Blog